Privacy Policy

Last updated: April 2, 2026

1. Data Controller

Raphaël Vavasseur Art
Website: https://raphaelvavasseur.com
Contact: raphaelvavasseurcontact@gmail.com

2. Data We Collect

We collect information you provide when placing an order (name, email, shipping address) and browsing data (cookies, pages visited).

3. How We Use Your Data

• Processing and fulfilling orders
• Sending order confirmations and shipping updates
• Improving our website
• Sending newsletters (with your consent only)

4. Data Sharing

We do not sell your personal data. We share data only with service providers necessary to operate our business (PayPal, shipping carriers, email providers).

5. Cookies

We use cookies for website functionality, analytics (Google Analytics 4), and shopping cart management.

6. Your Rights (GDPR)

Under GDPR, you have the right to access, correct, delete or export your personal data. Contact: raphaelvavasseurcontact@gmail.com

7. Data Retention

Order data is retained for 10 years as required by French law. Newsletter data is kept until unsubscription.

8. Contact

For any privacy questions: raphaelvavasseurcontact@gmail.com

9. B2B Outreach Communications

The following section applies specifically to business contacts who receive licensing-related emails from Studio Raphaël Vavasseur.

9.1 Source of contact data

We collect publicly available business contact information (emails published on company websites, public business directories such as Pappers (FR), Companies House (UK), Bundesanzeiger (DE), Sirene/Insee (FR), Europages, Google Search public results, and the public pages of company websites) for the sole purpose of B2B art licensing outreach. We do not use scraped data from platforms whose Terms of Service prohibit it (LinkedIn, Alibaba, etc.).

9.2 Categories of data processed

• Business name
• Business sector / vertical
• Business email address (publicly available)
• Business postal address (when public)
• Business website URL
• Public business identifiers (registration numbers, etc.)

We never process special-category data (Art. 9 GDPR).

9.3 Legal basis (GDPR Art. 6(1)(f) — Legitimate interest)

We rely on legitimate interest to send one-to-one B2B licensing proposals to companies actively operating in sectors relevant to art licensing (puzzles, publishing, calendars, drinkware, apparel, wall art, stationery, packaging). A balancing test (LIA — Legitimate Interest Assessment) has been performed and is available upon written request.

9.4 Recipients

Data is processed internally by Studio Raphaël Vavasseur (Raphaël Vavasseur and Radina V., License Manager). Data is stored on Google Workspace infrastructure (Google LLC, USA — covered by EU-US Data Privacy Framework).

9.5 International transfers

When you are located outside the EEA, your data may be processed in your jurisdiction under the applicable local law. When you are located inside the EEA, data transfers to the USA rely on the EU-US DPF adequacy decision (July 2023).

9.6 Retention period

• Active prospect data: 3 years from last interaction
• Suppression list: indefinite (SHA-256 hashed only — the original email address is no longer retained)
• Audit logs (compliance evidence): 3 years

9.7 Your rights

Under GDPR / UK GDPR / LGPD / PIPL / applicable laws, you have the right to: access your personal data, request rectification, request erasure (“right to be forgotten”), restrict or object to processing, data portability, withdraw consent (where applicable), lodge a complaint with your supervisory authority (CNIL in France, ICO in the UK, etc.).

9.8 How to exercise your rights

Reply to any email we send you, or email raphaelvavasseurcontact@gmail.com. For formal written requests requiring our postal address, please first contact us by email — the postal address of the data controller will be provided in our reply.

We respond within 30 days (GDPR) or 45 days (LGPD).

9.9 Unsubscribe

Reply with the word UNSUBSCRIBE to any email. Your address is hashed (SHA-256) and added to a permanent suppression list within 24 hours. The original email address is then deleted from our active database.

9.10 Data Controller

Raphaël Vavasseur (sole trader, registered in France).
Contact: raphaelvavasseurcontact@gmail.com

No Data Protection Officer (DPO) is appointed (below GDPR Art. 37 thresholds).

9.11 Updates

This B2B Outreach section was last updated on April 27, 2026.