Privacy Policy
Draft version: the proposed retention period and the items marked “To be completed” must be approved by the publisher.
Controller and contact
The portfolio is published under the name Sofian Javich Hadgé. For any questions about personal data or to exercise your rights, contact s.javich.hadge@gmail.com.
To be completed: the data controller’s legal identity, capacity and contact details, if different from the information above.
Data and purposes
The form asks for your name, email address and message, which are required to handle your enquiry, and an optional subject. This information is used to respond to enquiries about works, exhibitions and collaborations. Without the required fields, the form cannot process your enquiry. Please avoid including unnecessary sensitive information.
The hosting provider receives the technical information needed for connections, including the IP address and request characteristics. The form’s spam protection uses a honeypot field, a signed timestamped token and a temporary count of attempts per IP address. The site’s code does not store messages in a database or write them to its application logs; providers’ logs are governed by their own settings.
Legal basis
Responses to general enquiries are based on the legitimate interest in maintaining professional correspondence requested by visitors. Where an enquiry concerns a prospective purchase or service, processing is based on pre-contractual steps taken at your request. Security measures are based on the legitimate interest in protecting the site against abuse.
The form does not subscribe you to a newsletter. No marketing consent checkbox is required for this correspondence. To be completed: document and approve this assessment of legal bases in light of actual practices.
Recipients and delivery service
Enquiries are intended for Sofian Javich Hadgé at s.javich.hadge@gmail.com. The form is validated by a server function hosted by Netlify, then forwarded to Netlify Forms. Enquiries are recorded in the publisher’s Netlify account, and a notification is configured to be sent to the publisher’s Gmail inbox. The visitor’s address is used as the reply-to address; Netlify sends the notification. Resend is not used for this site.
If an error occurs, the fields remain on the page so you can try again; this does not save them after the tab is closed or reloaded.
To be completed: verify who is authorised to access messages and the Netlify and Google data processing agreements applicable to the accounts used.
Retention periods
Proposed period, subject to approval and implementation: retain ordinary enquiries while they are being handled, then for no more than twelve months after the last exchange, unless a justified need requires otherwise. Documents relating to a contractual relationship or a legal obligation will have separate retention periods to be specified.
The spam counter is limited to a one-minute window per instance; expired entries are removed on a subsequent request or when the instance stops. The form token expires after two hours. These periods do not describe the retention of the hosting provider’s logs.
To be completed: retention periods and settings for Netlify Forms submissions, Netlify logs and the Gmail inbox; deletion procedures and any mandatory archiving.
Location and transfers
Netlify provides hosting through its infrastructure and service providers. The regions and safeguards that actually apply to this account must be specified; no claim is made that data is stored exclusively in Europe.
To be completed: confirm the actual processing and transfers by Netlify and Google, as well as the applicable contractual safeguards, before approving this policy.
Your rights
Under the conditions set out in the GDPR, you may request access to your data, its rectification or erasure, or restriction of processing. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Data portability applies where its legal conditions are met.
Send your request to s.javich.hadge@gmail.com. Only information necessary to assess your request may be sought. You may also lodge a complaint with the CNIL.
Cookies and external links
The audited version of the portfolio contains no Google Analytics, remotely loaded Google Fonts, advertising, or embedded videos, maps or Instagram posts. No non-essential cookies or trackers were identified in the functionality examined. No consent banner has therefore been added. Technical hosting logs are not cookies.
Instagram and the SumUp shop are simple links. Their services are not loaded within the portfolio; their own policies apply when you visit them. This information will need to be reviewed if tracking services or embedded content are added.