Privacy policy
Privacy Policy
In force as of 23/07/2026
This policy describes how the publisher of the site www.youinthespot.com (hereinafter the "Site") collects and processes the personal data of its users and customers, in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the French Data Protection Act ("Informatique et Libertés").
1. Data controller
The data controller is the publisher of the Site:
- Renaud COLLET, sole trader — SIRET 483 682 399 00033
- Address: 28 rue Béranger, 93310 Le Pré-Saint-Gervais, France
- Contact: contact@youinthespot.com
2. Data collected and purposes
The Site collects only the data necessary for its operation:
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail address | Processing the order, sending the download link and the invoice | Performance of the contract |
| Billing information (where applicable) | Issuing a compliant invoice | Legal obligation |
| Order data (photos purchased, amount, date) | Sales tracking, accounting, after-sales service | Performance of the contract / legal obligation |
| Payment data (bank card) | Payment processing — collected directly by Stripe, never by the Site | Performance of the contract |
| Technical data (server logs: IP address, timestamp) | Security, fraud prevention, proper functioning | Legitimate interest |
| Aggregated audience statistics | Traffic measurement without cookie or individual identification (Umami) | Legitimate interest |
| Request to remove a photo (e-mail, reason) | Handling of requests relating to image rights / GDPR | Legal obligation / legitimate interest |
The Site uses no facial recognition and processes no biometric data.
3. Photographs of identifiable individuals
The Site sells sports photographs taken in public places, in which individuals may be recognisable; these images constitute personal data.
- Legal basis: the publisher's legitimate interest (photography and sales activity), balanced against the rights and freedoms of the individuals concerned. Until a purchase is made, the images are displayed only in low resolution and watermarked; the original file is never publicly accessible.
- No facial recognition or indexing by face is carried out: individuals are neither searched for nor automatically identified.
- Right to object and to removal: any person appearing in a photograph may request its removal at any time and without having to give a reason, by writing to contact@youinthespot.com. The photograph is then withdrawn from sale and deleted as soon as possible.
This image right is exercised independently of the other rights described in section 8.
4. Audience measurement and cookies
The Site uses Umami, a privacy-friendly audience measurement solution, without cookie and without collecting any data that could identify a person. Umami does not retain IP addresses and does not track visitors across sites. As such, this measurement is exempt from consent (CNIL recommendation).
The Site only places cookies or local storage strictly necessary for its operation (remembering the chosen language and the contents of the cart). These items do not require prior consent.
5. Recipients and processors
Your data is never resold or transferred to third parties for commercial purposes. It is shared only with the processors strictly necessary for the service:
- Stripe Payments Europe, Ltd. — secure processing of card payments.
- Cloudflare R2 — storage of images and order files (EU jurisdiction).
- Resend — sending of transactional e-mails (confirmation, download link, invoice), from the European Union region.
- IONOS SARL — hosting of the server and the database (France, EU).
- Umami Cloud — aggregated traffic statistics without individual identification (data stored in the European Union region).
Each processor is governed by a data processing agreement (DPA) and provides guarantees compliant with the GDPR.
6. Data location and transfers
The data is hosted and processed within the European Union. In the event of recourse to a provider likely to transfer data outside the EU, such transfer is governed by appropriate safeguards (standard contractual clauses of the European Commission).
7. Retention period
- Order data and invoices: retained for 10 years under accounting and tax obligations (Art. L.123-22 of the Commercial Code).
- Download link: active for 30 days after purchase, then deactivated.
- Technical logs: retained for a maximum of 12 months.
- Removal requests: retained for as long as necessary to process them and to provide proof thereof.
- Audience statistics: aggregated, with no personal data retained; kept for 6 months by Umami.
8. Your rights
In accordance with the GDPR, you have the following rights over your data: right of access, rectification, erasure, restriction, objection and portability. You may exercise them at any time by writing to: contact@youinthespot.com.
The right to erasure is exercised subject to the data that the publisher is legally required to retain (in particular invoices, for the legal period).
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL (French Data Protection Authority): https://www.cnil.fr.
9. Security
The publisher implements appropriate technical and organisational measures to protect your data: private storage buckets, access to original files only via signed links with short expiry after verified payment, encryption of payments by Stripe, and compartmentalisation of access.
10. Contact
For any questions relating to this policy or to your personal data: contact@youinthespot.com.