Privacy policy
Information about the processing of personal data, its purposes, retention and the exercise of your rights.
Definitions
“Website” means the website to which this policy relates.
“Personal Data” means any information relating to an identified or identifiable natural person within the meaning of Article 4(1) of the GDPR.
“Processing” means any operation or set of operations performed on Personal Data within the meaning of Article 4(2) of the GDPR, such as collection, consultation, storage or deletion.
“Controller” means the person identified in the section concerning the Controller, who determines the purposes and means of the Processing described in this policy.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Controller
Emilie Schol, at 19 Rue Job, 31000 Toulouse, France, is the Controller for the Processing described in this policy. The Controller decides why and how your Personal Data are used.
To ask a question, request more information or exercise your rights, write to emilie@cosmetic-labs.com. To protect your data, where there is reasonable doubt about your identity, the Controller may request only the information strictly necessary to verify it.
Data processed, purposes and legal bases
Categories of data processed: Identity, contact, usage, account and contributions. Collection and use are limited, for each purpose, to adequate, relevant and necessary data.
For each Processing activity, the entries below explain why data are used, which categories are involved, the legal basis, the recipients or categories of recipients, and how long the data are kept:
Responding to pre-contractual inquiries
- Data:
- Identity and contact details, request content
- Legal basis:
- pre-contractual steps
- Recipients:
- Authorised staff and necessary hosting providers
- Retention:
- for the time needed to resolve the request, then deletion subject to legal obligations
Account management
- Data:
- Identity, contact details and account data
- Legal basis:
- contract
- Recipients:
- Authorised staff and necessary hosting providers
- Retention:
- while the account is active, then deletion on closure request subject to legal obligations
Hosting user contributions
- Data:
- Contributions and author identifier
- Legal basis:
- contract
- Recipients:
- Authorised staff and necessary hosting providers, visitors according to contribution visibility
- Retention:
- for the publication period requested by the user, then deletion subject to legal obligations
Electronic marketing
- Data:
- Contact details and consent choices
- Legal basis:
- consent
- Recipients:
- Authorised staff and necessary hosting providers
- Retention:
- until consent is withdrawn
Optional visit and country statistics
- Data:
- Page visits, referrer, IP or derived visit identifier, browser/device and country
- Legal basis:
- consent
- Recipients:
- Site operator and GeoJS for IP-country lookup
- Retention:
- First-party country cookie three days; statistics deletion configured at 90 days and depends on scheduler; GeoJS retention not verified
Optional embedded video delivery
- Data:
- IP address, player request and telemetry information
- Legal basis:
- consent
- Recipients:
- YouTube / Google
- Retention:
- Provider-controlled retention not verified; withdrawing stops future player requests, not prior disclosures
Optional interactive map delivery
- Data:
- IP address and tile, font and sprite request information
- Legal basis:
- consent
- Recipients:
- OpenFreeMap
- Retention:
- Provider-controlled retention not verified; withdrawing stops future map requests, not prior disclosures
Each Processing activity relies on its own legal basis. The Controller does not reuse your data for a purpose incompatible with the purpose communicated to you. Before any further Processing for another purpose, the Controller informs you of that purpose and provides the required additional information. It checks that the Processing has a valid legal basis and, where that assessment is required, that it is compatible with the original purpose.
Where providing certain data is a condition for entering into or performing a contract, or fulfils a legal obligation, the Controller indicates at the relevant collection point that providing those data is mandatory and explains the consequences of not providing them.
Processing based on consent
Where Processing relies on your consent, it is sought through a separate, understandable and sufficiently precise request to enable you to understand the purpose and scope of your choice. The Controller obtains your decision through a freely given affirmative action and does not infer it from silence, inactivity or a pre-ticked box.
You can withdraw your consent at any time, as easily as you gave it, using the facility offered for the Processing concerned or by contacting the Controller. Withdrawal ends future Processing based on that consent. It does not affect the lawfulness of operations carried out before withdrawal. The Controller does not retrospectively substitute another legal basis for the withdrawn consent. Only separate operations that had another valid legal basis from the outset, brought to your attention, may continue, including those necessary to comply with a retention obligation.
Retention, security and your data protection rights
Retention periods
The Controller retains your data for the periods indicated for each Processing activity or, where a precise period cannot be set in advance, according to the retention criteria specified for the Processing concerned. Any retention for legal or evidential purposes is limited to the data and periods necessary to fulfil the relevant obligation or establish, exercise or defend legal claims. At the end of the useful period in the active database, the Controller deletes the data, irreversibly anonymises them or, where an obligation or an evidential interest justifies it, places them in intermediate archives with restricted access.
Data security
Security measures declared by the Controller: The website uses HTTPS to protect data in transit. Account and administration access is authenticated, and WordPress permissions restrict privileged operations to authorised users. Public profiles and contributions remain visible to their intended audience. No system can guarantee absolute security. This description does not certify the security, backup arrangements or processing locations of external providers.
Your rights
Under the conditions laid down by the regulations and subject to applicable exceptions, you may exercise the following rights:
- obtain confirmation as to whether or not Personal Data concerning you are being processed, access your data, obtain a copy and receive the associated information
- have inaccurate data rectified or incomplete data completed
- request the erasure of your data, particularly where they are no longer necessary, without prejudice to retention obligations or the defence of legal claims
- obtain restriction of Processing in the cases provided for by the GDPR
- where automated Processing is based on your consent or on a contract, receive the data concerning you that you have provided in a structured, commonly used and machine-readable format, and have them transmitted directly to another controller where technically feasible, without adversely affecting the rights and freedoms of others
- object, on grounds relating to your particular situation, to Processing based on legitimate interests or a task carried out in the public interest, including related profiling
- object at any time and without having to give a reason to the use of your data for direct marketing, including profiling related to that marketing
- withdraw consent at any time, without affecting the lawfulness of Processing carried out before its withdrawal
- set instructions concerning the retention, erasure and disclosure of your data after your death.
Exercising your rights and lodging a complaint
You can exercise these rights by writing to emilie@cosmetic-labs.com and specifying the subject of your request.
Response times
The Controller acts on your request without undue delay and no later than one month after receipt. This period may be extended by two months where justified by the complexity or number of requests. You will then be informed of the extension and the reasons for it within the initial one-month period. You may exercise your rights free of charge. The Controller may charge a reasonable fee reflecting administrative costs or refuse to act on that ground only where it demonstrates that a request is manifestly unfounded or excessive. If it does not act on your request, it gives you the reasons within one month and informs you of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
If you consider that the Processing of your Personal Data infringes the applicable regulations, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority, without having to contact the Controller first: https://www.cnil.fr/fr/plaintes.
Managing trackers
Only trackers whose sole purpose is to enable or facilitate electronic communication or which are strictly necessary for a service expressly requested may be used without consent, subject to the applicable conditions, including for certain audience measurement operations described in this policy, and appropriate information being provided. Any other tracker is disabled by default and can only be activated after your prior agreement.
The choice management module allows you to accept or refuse the proposed purposes with equal ease, make a detailed choice and subsequently change your decision. No consent is inferred from simply viewing the Website. Where several devices or environments are concerned, the scope of the choice is explained to you before it is recorded.
Refusing or withdrawing consent ends future operations that depend on it. It does not affect operations lawfully carried out before withdrawal and does not prevent the use of trackers that are strictly necessary for the requested service.
Cookie and tracker inventory
The trackers concerned, their purposes, their issuers or recipients and their durations are listed below:
| Service | Purpose | Description | Provider | Retention |
|---|---|---|---|---|
| Interactive maps (OpenFreeMap) | preferences | Optional MapLibre maps retrieve basemap tiles, fonts and sprites from OpenFreeMap. The provider receives connection information such as your IP address. Page results remain available without the map. | OpenFreeMap | Provider-controlled connection processing. No provider retention period has been verified. Withdrawal stops the map, not previously transmitted data. |
| Voxel visit statistics | analytics | Measures page visits, referrers, devices and visitor country. Configured country providers receive your IP address when country lookup is needed. | Voxel / geojs.io | Country cookie: 3 days. Statistics deletion configured after: 90 days. Actual deletion depends on the site scheduler. |
| YouTube videos | marketing | Optional embedded videos connect to YouTube/Google, including player resources and telemetry before playback. Privacy-enhanced mode does not prevent these connections. | YouTube / Google | Provider-controlled. Withdrawal stops this player, but cannot erase data already sent to YouTube/Google. |
Unless an exemption applies to operations solely enabling electronic communication or strictly necessary for a service expressly requested, including certain audience measurement operations under the conditions stated in this policy, trackers are stored or read only after freely given, specific, informed and unambiguous consent. The Controller allows you to refuse as easily as you can accept. Making no choice, closing the information facility or simply continuing to browse does not constitute consent.
You can change or withdraw your preferences at any time using the tracker management facility provided on the Website. Withdrawal does not affect the lawfulness of operations carried out before it, but prohibits subsequent reading or storage for the refused purposes. The lifetime of each tracker and the retention period for your choice are limited to what is necessary for the stated purpose.
Where your choice is offered or recognised across several devices, the Controller informs you before you decide. Acceptance and refusal have symmetrical effects and can be revised under equivalent conditions.
Electronic direct marketing
The Controller bases the sending of direct marketing communications by email, SMS or similar electronic means on the regime applicable to the situation of the recipient and the nature of the message.
- Individuals and prospects: prior consent is required where no statutory exception applies. The Controller obtains this consent through a freely given, specific, informed and unambiguous affirmative action, in particular through a dedicated box that is not pre-ticked.
- Existing customers: marketing may be sent without fresh consent where it concerns similar products or services provided by the same sender, the contact details were collected directly during a sale or provision of a service, and a simple and free opportunity to object was offered at collection and then in each message.
- Professional contacts: marketing may rely on legitimate interests where it relates directly to the profession or duties performed and the person has been informed and can object easily.
Each communication clearly identifies the sender, unambiguously presents the commercial nature of the message and includes an easily accessible, effective and free unsubscribe method, apart from the normal cost of transmission. Any objection to marketing is taken into account without undue delay and without the person having to justify the request. Information strictly necessary to manage this objection may be retained to prevent further solicitation incompatible with the choice made.
Data relating to user accounts
The data necessary to create, secure and manage an account are those declared in the Processing register. Depending on the features actually offered, they may include registration information, identifiers and profile or usage data. This list does not authorise any additional collection. For each Processing activity actually carried out, the register presented in this policy specifies the applicable purposes, legal basis, categories of data, recipients and retention period.
The Controller distinguishes mandatory fields from optional information. Providing indispensable data is a condition for creating, securing or performing the requested features. Profile data are made public or accessible to other members only to the extent announced when they are entered and according to the visibility settings provided. The Controller favours the most protective settings where required by the circumstances or the regulations.
After the account is closed, data that are no longer necessary are deleted or anonymised. Only information whose retention remains justified by a legal obligation or the need to establish, exercise or defend legal claims, including in cases of fraud, may be placed in intermediate archives, subject to the periods or criteria specified in the register. Access is then restricted and the data are no longer used for the routine provision of the service.
Deleting an account does not necessarily lead to the immediate erasure of content made public where its continued availability has a valid basis. The treatment of contributions, any anonymisation and the applicable periods are specified in the section on user contributions.
Contributions, visibility and moderation
Processing related to contributions: visibility of published content, retention and moderation.
Contributions and the author identifier are disclosed to the audience for which they are published. Public contributions may be consulted, copied or indexed by third parties, including search engines. Authors should not publish personal data they do not wish to make available to that audience or disclose third-party data without a lawful basis. Contributions are kept for their publication period, then deleted on removal, subject to legal retention obligations. Reports, moderation decisions and related exchanges are accessible only to persons handling them and are kept for the time necessary to assess the report, handle challenges and meet legal obligations.
Depending on the features offered and the settings chosen, contributions, display names, profile images or other associated elements may be visible to other members or accessible to the public. Before publication, the Controller informs you of this visibility and the means available to change it. You must publish data concerning third parties only if you have an appropriate basis and, where required, their authorisation.
Displaying, organising, searching or indexing content, service security, abuse prevention and moderation involve only the Processing actually described above, for the purposes and on the legal bases specified in the register. Data used in a report or moderation measure are limited to what is necessary to investigate the case, inform the persons concerned, handle a challenge and comply with legal obligations. Access is restricted to authorised persons.
After content is deleted or an account is closed, data are erased or anonymised at the end of the applicable period. Any temporary retention with restricted access, including for handling a report or dispute, remains subject to a valid legal basis and the periods or criteria specified for the Processing concerned. Where contributions are retained, the Controller removes or pseudonymises their link to the account as soon as that link is no longer necessary, subject to the rights of third parties and applicable obligations.
Enhanced vigilance applies to the contributions and profiles of minors. The Controller limits their visibility by default where justified by the risks and does not use their data for targeted advertising in cases prohibited by the regulations.
Rights request form
Use this form to ask a question or exercise your Personal Data rights: https://cosmetic-labs.com/platform/contact. You may specify the right concerned and information that helps identify the data or service involved. The Controller does not ask you to provide data unrelated to handling your request.
Recipients, processors and security
The recipients or categories of recipients are indicated for each Processing activity in the section on purposes. Access to data is limited, on a need-to-know basis, to persons authorised by Emilie Schol and to service providers acting on its behalf where this access is necessary to perform their duties.
The Controller requires its processors to act on documented instructions, respect confidentiality and provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures. A contract governs their obligations, assistance with the exercise of rights, security, the use of other processors and the handling of data when the service ends. Their status as processors does not authorise them to reuse the data for their own purposes. Any separate Processing as a controller must have its own legal basis and be covered by the required information.
These measures are reviewed to preserve, taking into account the nature of the data and the risks, their confidentiality, integrity and availability, and the resilience of systems. The Controller adapts this review to changing risks. Protecting your devices and authentication methods does not relieve the Controller of its own security obligations.
In the event of a Personal Data breach, the incident is documented and its consequences are assessed. Where the breach is likely to result in a risk to the rights and freedoms of individuals, the Controller notifies the competent supervisory authority without undue delay and, where possible, within seventy-two hours of becoming aware of it, giving reasons for any delay. Where it is likely to result in a high risk, the data subjects are also informed without undue delay, unless one of the exceptions provided for by the GDPR applies.
Effective date and changes to this policy
Effective date: October 25, 2026.
This policy may be updated to reflect changes in Processing activities, the services offered or the applicable legal framework. The current version is permanently accessible on the Website. Changes affecting the purposes, the conditions of data use or the rights of individuals are brought to their attention in the manner and within the time limits required. Publishing a new version does not constitute consent to Processing or a waiver of any right.
If data are to be used for a new purpose incompatible with the purpose initially announced, data subjects receive the required information beforehand and, where necessary, their consent is obtained.
