Last updated: September 21, 2026
This Privacy Policy describes how Gilles Caron (operated under the entity Par Hasart) collects, uses, protects, and stores the personal data of users visiting the website gillescaron.org, in accordance with the General Data Protection Regulation (GDPR – Regulation EU 2016/679) and applicable French data protection legislation (“Loi Informatique et Libertés”).
1. DATA CONTROLLER
The Data Controller responsible for personal data collected on the website is:
- Entity: Fondation Gilles Caron
- Legal Representatives: Louis Bachelot & Marjolaine Caron
- Headquarters: France
- Contact / DPO: caron.bachelot@gmail.com
2. DATA COLLECTED & PURPOSES
We limit data collection to the strict minimum necessary (data minimization principle):
- Contact & Correspondence Data:
- Data: Name, first name, email address, message content.
- Purpose: Handling inquiries regarding information, press requests, artwork acquisitions, residencies, or reproduction rights.
- Legal Basis: Legitimate interest and/or execution of pre-contractual measures.
- Données de navigation et logs techniques :
- Data: IP address (anonymized), browser type, operating system, timestamps, pages viewed.
- Purpose: Ensuring website security, proper technical performance, and cyberattack prevention.
- Legal Basis: Publisher’s legitimate interest in securing its platform.
- Newsletter / News Subscription (if applicable):
- Data: Email address.
- Purpose: Sending updates regarding exhibitions, publications, or artistic news from Fondation Gilles Caron.
- Legal Basis: Explicit prior consent (double opt-in).
3. DATA RETENTION PERIODS
- Contact Requests / Correspondence: Kept for the duration necessary to handle your request, then archived for a maximum period of 3 years following the last contact.
- Browsing Data / Logs: Kept for a maximum period of 12 months.
- Newsletter Subscription Data: Kept until you unsubscribe (an unsubscribe link is included in every email).
4. SHARING AND SUB-PROCESSING OF DATA
Your personal data is never sold, rented, or transferred to third parties for commercial or marketing purposes.
Data may be securely transmitted to our technical service providers acting as sub-processors:
- Web Hosting: Kinsta Inc. – host compliant with the GDPR, providing standard contractual clauses guaranteeing data security.
- Email Services: Google Workspace (Google Ireland Limited) for managing business correspondence.
5. DATA TRANSFERS OUTSIDE THE EUROPEAN UNION
Website hosting is provided via Kinsta Inc.. Kinsta complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF”) as set forth by the U.S. Department of Commerce. Kinsta has certified to the U.S. Department of Commerce that we adhere to the applicable DPF Principles with regard to the processing of personal data received from the EU, UK (and Gibraltar), and Switzerland.
6. SECURITY AND CONTENT PROTECTION
Technical and organizational security measures are implemented to prevent unauthorized access, modification, disclosure, or destruction of your personal data.
In accordance with our Legal Notice, we also deploy automated opt-out measures against unauthorized bulk scraping and data harvesting (Text and Data Mining) for AI training purposes.
7. COOKIES AND TRACKERS
This website prioritizes a streamlined user experience. Any cookies used by WordPress are strictly necessary for the technical operation of the site (session management, smooth rendering of HD galleries, security).
No third-party cookies for advertising or profiling purposes are set without your prior consent. You can configure your browser at any time to block cookies, although this may affect certain website features.
8. YOUR RIGHTS (GDPR & CNIL COMPLIANCE)
In accordance with Articles 15 to 22 of the GDPR, you hold the following rights regarding your personal data:
- Right of Access: Obtain confirmation and a copy of your data.
- Right to Rectification: Correct inaccurate or incomplete data.
- Right to Erasure (“Right to be Forgotten”): Obtain the deletion of your personal data.
- Right to Restriction of Processing: Request a temporary freeze on the use of your data.
- Right to Object: Object at any time to the processing of your data on legitimate grounds.
- Right to Data Portability: Receive your data in a structured, machine-readable format.