Privacy Policy
Privacy Policy
Preamble
The purpose of this Privacy Policy is to inform users of the Attimo platform (hereinafter “the Platform”) of the conditions under which their personal data is collected and processed.
Attimo is committed to respecting the privacy of its users and to processing their personal data in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Data Protection Act No. 78-17 of 6 January 1978, as amended.
GDPR standards applied to all users
Regardless of the user's country of residence, Attimo applies European GDPR standards as the highest benchmark for personal data protection. Users located outside the European Union benefit from these standards by contractual extension, in addition to any mandatory rights granted by their local jurisdiction (such as the CCPA in California, PIPEDA in Canada, or the Privacy Act in Australia).
Article 1 — Data controller
The controller of the data collected within the framework of the Attimo Platform is:
- Name: Frédéric Gras — trading name: Attimo
- Legal status: Sole trader (Entrepreneur individuel under French law)
- Address: 38 avenue de Tournaisis, 78990 Élancourt, France
- SIRET (French business registration number): 453 606 253 00020
- General / GDPR email: [email protected]
- Technical support email: [email protected]
- Phone: +33 6 51 39 30 80
For any question relating to this policy or the exercise of GDPR rights, you may contact Attimo at [email protected].
Article 2 — Attimo's dual role under the GDPR
2.1 Attimo as data controller
Attimo acts as data controller for the following data:
- Data of photographers subscribed to the Platform (registration, billing, service usage).
- Data of visitors to the attimo-gallery.com website (contact form, newsletter, statistics).
- Data of persons submitting a request to Attimo's technical support.
2.2 Attimo as data processor
Attimo acts as data processor within the meaning of Article 28 of the GDPR for data collected through the photographic galleries of subscribed photographers. In that case, the data controller is the photographer, who determines the purposes and means of the processing.
The relationship between Attimo and each photographer is formalised through a Data Processing Agreement (DPA) appended to the Terms of Use and Sale. The full table of retention periods applied on that basis is set out in Article 3.4 of that agreement.
Article 3 — Data collected and purposes
3.1 Data of subscribed photographers
Upon registration and use of the Platform, Attimo collects and processes the following data:
| Category of data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identity and contact details (surname, first name, email, phone, address) | Account creation, contract management | Performance of contract | Contract duration + 3 years |
| Business data (registration number, VAT number, company name) | Billing, tax compliance | Legal obligation | 10 years (accounting obligation) |
| Login data (credentials, hashed password) | Authentication, security | Performance of contract | Contract duration |
| Login history and authentication logs | Security, detection of unauthorised access | Legitimate interest | 6 months |
| Billing data (payment method, history) | Billing, accounting | Legal obligation | 10 years |
| Technical usage logs | Service improvement, security | Legitimate interest | 6 months |
| Evidence of acceptance of legal documents | Contractual traceability | Legal obligation | 5 years after the end of the contract |
| Support data (tickets, email exchanges) | User assistance | Performance of contract | Contract duration + 1 year |
3.2 Data of Attimo website visitors
| Category of data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Contact form (name, email, message) | Response to enquiries | Consent | 2 years after the last exchange |
| Newsletter subscription (email) | Sending information | Consent | Until unsubscription |
| Correspondence sent to technical support | Handling of the request | Legitimate interest | Duration of handling + 1 year |
| Browsing data (cookies) | Statistics, site operation | Consent / Legitimate interest | See Cookie Policy |
3.3 Data of gallery end clients
For end clients accessing photographers' galleries, Attimo processes the following data on behalf of the photographer, acting as processor:
| Category of data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identity and contact details (name, email, phone, delivery address) | Order processing | Performance of contract | Determined by the photographer |
| Order data (items, payment) | Purchase history, billing | Legal obligation | 10 years (accounting obligation) |
| Electronic signature on the order form (Studio module) | Evidence of commitment | Legitimate interest | 10 years, attached to the order |
| Gallery login data (access code) | Securing access | Performance of contract | Gallery lifespan |
| Favourites and selections | Gallery and session features | Performance of contract | Gallery or session lifespan |
| Gallery access logs (IP address, user agent, any email address) | Viewing statistics, security | Legitimate interest | Irreversible anonymisation at 6 months, deletion at 24 months |
| Vintage photographs entrusted to the Restoration module | Automated repair processing | Performance of contract | 30 days after validation by the photographer |
3.4 Data processed within the referral programme
Within the framework of the referral programme defined in Article 14 of the Terms of Use and Sale, Attimo processes specific data intended for the management of referrals and the prevention of fraud.
| Category of data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Personal referral code, referral statistics (number of referees, badges acquired) | Programme operation, allocation of benefits | Performance of contract | Contract duration |
| Email address of the Referee upon registration using the Referrer's code | Creation of the referrer-referee link, eligibility verification | Performance of contract | Contract duration + 3 years |
| IP address, browser user agent, technical identifiers upon registration via a referral code | Fraud prevention (self-referral, fictitious accounts, programme abuse) | Legitimate interest (Art. 6.1.f GDPR) | 3 years from collection |
| Business registration number of the Referee | Anti-fraud verification by cross-checking against registration numbers already recorded | Legitimate interest (Art. 6.1.f GDPR) | 3 years from collection |
| Logs of detected fraud (type, severity level, administrative resolution) | Audit, traceability, defence in the event of a dispute | Legitimate interest (Art. 6.1.f GDPR) | 3 years from resolution |
| Programme ban data (reason, date, administrator issuing the decision) | Preventing the re-creation of an account by a person banned for fraud | Legitimate interest (Art. 6.1.f GDPR) | Contract duration + 5 years |
Balancing of interests — Attimo considers that the processing of the above data, based on its legitimate interest, does not unduly infringe the rights and freedoms of the data subjects. The data collected is strictly necessary to prevent fraud liable to cause financial harm to Attimo, its retention period is proportionate, and data subjects may at any time exercise their GDPR rights, including their right to object under Article 21 of the GDPR.
Article 4 — Data recipients
4.1 Internal recipients
The data collected is accessible exclusively to Frédéric Gras (Attimo) and, where applicable, to technical service providers bound by a contractual confidentiality obligation.
4.2 Sub-processors
Attimo uses technical sub-processors to operate the Platform. Each is bound by strict data protection obligations. The list of sub-processors is as follows:
| Sub-processor | Service provided | Data location |
|---|---|---|
| OVH SAS | Hosting of the website and application, media file storage, backups | France (Gravelines, Roubaix) |
| Cognix Systems | Managed server hosting: system administration, monitoring, maintenance, backups. Holds administrator access to the production infrastructure. | France |
| Amazon Web Services | Facial recognition, Sport module (Rekognition) | Ireland (eu-west-1) — processed exclusively within the EU |
| Nero AG | Automated image restoration and upscaling processing, Restoration module | Germany (Karlsruhe) — own data centre |
| Stripe | Payment processing and collection on behalf of third parties | Ireland (EU) and United States (DPF framework) |
| PayPal | Payment processing | Luxembourg (EU) |
| Mollie | Payment processing | Netherlands (EU) |
| SystemPay (Lyra Network) | Payment processing | France |
| Attimo mail server | Sending of transactional emails from Attimo's server | France (Gravelines) |
| Brevo (if enabled by the photographer) | Large-scale email delivery | France / EU |
| SMS Envoi | Sending of transactional SMS messages | France |
| Mondial Relay (if enabled by the photographer) | Order shipping and delivery tracking | France |
| Koy Lab (if enabled by the photographer) | Professional printing of albums and photographic prints | Portugal |
4.3 Transfers outside the European Union
Personal data processed by Attimo is hosted and processed exclusively within the European Union. No data transfer to third countries is carried out, with the exception of the following service, covered by appropriate safeguards:
- Stripe: transfers governed by the Data Privacy Framework (DPF) between the European Union and the United States.
No biometric or otherwise sensitive data is transferred outside the EU.
4.4 Legal recipients
Attimo may be required to disclose personal data to the competent administrative or judicial authorities in the event of a legal request or in order to comply with a regulatory obligation.
Article 5 — Data security
Attimo implements appropriate technical and organisational measures to ensure the security of the data processed, including:
- Password hashing using the bcrypt algorithm.
- Secure HTTPS/TLS connections across the entire Platform.
- Data isolation between photographers (multi-tenant architecture).
- Temporary signed URLs for accessing photographs stored on OVH, the storage container not being public.
- Two-factor authentication available for photographers' accounts.
- Limitation of login attempts and rate limiting on sensitive routes.
- Encryption in the database of credentials for third-party services.
- Regular automated backups, distributed across several separate infrastructures.
- Logging of access and sensitive actions, with automatic purging or anonymisation at the announced intervals.
- Regular updating of software components (Laravel, PHP, dependencies) and of the operating system.
- Pre-production environment strictly separated from the production environment.
- Continuous application monitoring and alerting in the event of anomalies.
- Hosting exclusively on infrastructure located in France and the European Union.
- Access to data restricted to authorised persons only.
Article 6 — Rights of data subjects
In accordance with the GDPR, every data subject has the following rights regarding their personal data:
6.1 Right of access (Article 15 GDPR)
You have the right to obtain confirmation as to whether or not your data is being processed, and to receive a copy of it.
6.2 Right to rectification (Article 16 GDPR)
You have the right to have inaccurate or incomplete data concerning you rectified.
6.3 Right to erasure (Article 17 GDPR)
You have the right to request the erasure of your data in the cases provided for by the GDPR, in particular where the data is no longer necessary, where you withdraw your consent, or where the processing is unlawful.
6.4 Right to restriction of processing (Article 18 GDPR)
You have the right to request the restriction of the processing of your data in certain cases (contesting accuracy, objecting to processing, etc.).
6.5 Right to data portability (Article 20 GDPR)
You have the right to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
6.6 Right to object (Article 21 GDPR)
You have the right to object to the processing of your data based on legitimate interest, as well as to processing for direct marketing purposes.
6.7 Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before that withdrawal.
6.8 Post-mortem directives
You have the right to lay down directives concerning the fate of your data after your death. Those directives may be general or specific and are sent to Attimo by email.
6.9 Exercising your rights
To exercise one of these rights, send your request to [email protected], together with a copy of a valid identity document.
Attimo undertakes to respond to your request within one month of receipt. That period may be extended by two months in the event of a complex request or a large volume, with notice given to the user.
6.10 Complaint to the supervisory authority
If, after contacting us, you believe that your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL — Commission Nationale de l'Informatique et des Libertés):
- Website: https://www.cnil.fr
- Address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
- Phone: +33 1 53 73 22 22
Users residing outside France may also contact the supervisory authority of their own country.
Article 7 — Cookies and trackers
The Attimo Platform uses cookies and similar technologies to ensure its proper functioning, to remember user preferences and to carry out anonymised audience measurement.
For full information on the cookies used and how to manage your preferences, please consult the Cookie Policy available on the Platform.
Article 8 — Minors
8.1 Direct registration on the Platform
The Attimo Platform is intended for adult professional photographers. Subscribing to an Attimo plan requires being of legal age within the meaning of applicable legislation (18 years old in France).
8.2 Protection of minors' data
In accordance with Article 8 of the GDPR and the French Data Protection Act, the processing of the personal data of a minor under the age of 15 requires the authorisation of the holders of parental authority. Attimo does not knowingly collect the personal data of minors under 15 without such authorisation.
8.3 Processing of minors' data in galleries (School and Nursery modules)
Within the School and Nursery modules, data relating to minors (including those under 15) may be processed on behalf of photographers. Such processing is systematically subject to the prior authorisation of the holders of parental authority, in accordance with the “Minors' Data” Addendum to the DPA, regardless of the age of the child concerned.
8.4 Reporting
If you find that a minor has provided us with personal data in a manner that does not comply with this policy, please contact us at [email protected] so that we may carry out the necessary checks and delete the data where applicable.
Article 9 — Automated decision-making and algorithmic processing
The Attimo Platform does not implement any wholly automated decision-making producing legal effects on the persons concerned within the meaning of Article 22 of the GDPR.
The Sport module uses artificial intelligence technologies (facial recognition and bib number reading) to make it easier to find photographs within large volumes of images. Such processing does not constitute automated decision-making within the meaning of Article 22, and its result can always be contested by the user.
The Restoration module implements automated generative processing applied to vintage photographs. That processing operates on an image and not on a person: it produces no decision, no assessment and no profiling. Every result is submitted to the photographer for human validation before delivery.
The referral programme's fraud detection system produces alerts that are systematically reviewed by a human administrator before any measure is taken (retroactive cancellation, ban). No decision producing legal effects within the meaning of Article 22 of the GDPR is taken in a wholly automated manner.
Article 10 — Amendments to this policy
Attimo reserves the right to amend this Privacy Policy at any time, in particular to comply with legislative or regulatory developments.
Any substantial amendment will be notified to users by email or by a notice on the Platform, with reasonable notice allowing each user to take note of it.
The date of the last update is indicated at the top of this document. It is advisable to consult this page regularly.
Article 11 — Contact
For any question relating to this Privacy Policy or to the exercise of your rights, you may contact Attimo:
- By email (general and GDPR): [email protected]
- By email (technical support): [email protected]
- By post: Frédéric Gras — Attimo, 38 avenue de Tournaisis, 78990 Élancourt, France
- By phone: +33 6 51 39 30 80