Data controller
Philippe LUU, publisher of the website, is the controller for the processing activities described below.
Data collected
The site offers no form, input field or submission endpoint. The publisher does not collect any data directly through a site interface. However, in line with the Breyer case-law (CJEU, 19 October 2016, C-582/14) qualifying IP addresses as personal data, the hosting provider Vercel automatically collects, on each HTTP request, the following items: visitor IP address, browser user-agent, timestamp, requested URL, HTTP response code. These server logs are necessary for the technical operation of the site, its security (abuse detection, attack prevention) and hosting billing. They are retained by Vercel for approximately thirty (30) days under its current policy (see vercel.com/legal/privacy-policy). The Contact section simply displays a dedicated ProtonMail address. Any outreach is initiated by the visitor from their own mail client, off-site. The site does not use tracking cookies, analytics tools, browser fingerprinting or advertising pixels. A single technical cookie (NEXT_LOCALE) is set by the framework to persist the fr/en language choice. This cookie is strictly necessary for the service requested by the user and therefore benefits from the consent exemption laid down in Article 82 of the French Data Protection Act and Article 5(3) of Directive 2002/58/EC (ePrivacy).
Purpose and legal basis
Purposes: (1) making the site and its educational content available, (2) allowing the visitor to identify a professional contact channel, (3) ensuring the security and technical integrity of the service. Legal bases under Article 6 GDPR: • Hosting server logs: legitimate interest of the publisher (Article 6.1.f), namely securing the proper operation and integrity of the site. • Language preference cookie (NEXT_LOCALE): technical necessity under Article 82 of the French Data Protection Act. • Processing of incoming emails: legitimate interest (Article 6.1.f) in responding to professional outreach initiated by the visitor.
Recipients
The displayed address belongs to a dedicated portfolio ProtonMail inbox (portfolio_philippe34@protonmail.com). No mail delivery provider, no SMTP relay, no third-party service is involved. Messages sent by the visitor transit through their own email provider towards ProtonMail.
Transfer outside the European Union
The site is hosted by Vercel Inc., a company established in the United States. The server logs mentioned above are therefore processed on US territory. This transfer is framed by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 finding the adequacy of the protection afforded by the EU-US Data Privacy Framework (DPF), to which Vercel Inc. has self-certified (verifiable at dataprivacyframework.gov). The Geist typefaces are self-hosted by Next.js after build, so no client-side call is made to any third-party infrastructure. ProtonMail, recipient of messages initiated by the visitor, is operated by Proton AG, a company established in Switzerland, a country recognized as adequate by Commission Decision 2000/518/EC of 26 July 2000.
Retention period
Messages sent to the publisher are retained in the ProtonMail inbox for a maximum of twelve (12) months from receipt, then deleted.
Security
Email transit initiated by the visitor depends on their own provider. ProtonMail encrypts messages at rest server-side and applies TLS on supported SMTP exchanges. The site applies standard HTTP security headers (CSP, HSTS, X-Frame-Options, etc.).
Your GDPR rights
Pursuant to Articles 15 to 22 of Regulation (EU) 2016/679, you have the following rights: access, rectification, erasure, restriction of processing, objection, portability. You also have the right to issue directives regarding the fate of your data after death (Article 85 of French Law No. 78-17 of 6 January 1978 as amended). You may exercise these rights by writing to portfolio_philippe34@protonmail.com. The publisher commits to respond within the one-month deadline laid down in Article 12.3 GDPR. You are also entitled to lodge a complaint with the French data protection authority (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, telephone +33 (0)1 53 73 22 22, website www.cnil.fr.