Personal data
Written to be read by a person rather than to satisfy an auditor. If anything here is unclear, ask us — an email to a human is a legitimate way to exercise your rights and we will not send you to a form.
1. Who is responsible
TRENDS SEASON SARL, 34 Boulevard Chasseigne, 86000 Poitiers, France, is the data controller for the processing described here. Contact us at support@trendsseason.site or +33 7 63 04 90 75. We have not appointed a data protection officer; we are not required to.
2. What we collect, and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone, delivery address, organisation | To print, deliver and invoice your order, and to contact you about it | Performance of a contract | 10 years (accounting obligation) |
| Uploaded artwork | To review, prepare and print it | Performance of a contract | 90 days after the order completes |
| Order history and consent records | To honour your guarantees and to evidence the declarations you gave | Legal obligation and legitimate interest | 10 years |
| Contact and quote-request messages | To answer you | Your request, prior to a contract | 3 years from the last contact |
| Cookie preference | To remember your answer | Legal obligation | 6 months |
We do not build profiles, we do not run automated decision-making, and we do not buy or enrich contact data from anyone.
3. Artwork gets special handling
A file uploaded for printing is not an ordinary attachment. A club photo pressed across a batch of jerseys contains the personal data — and in France the image rights — of everyone in it. So uploaded artwork is treated as sensitive material by default:
- A private store. The bucket has no public read policy. Files are only ever served through a short-lived signed link.
- Random file names. Your original file name is recorded for your reference but is never used as the storage key, so nothing is guessable.
- Metadata removed on arrival. Exif, XMP, IPTC and text blocks are stripped server-side before the file is written to disk — GPS coordinates, camera serial numbers, embedded thumbnails and author names do not survive. The studio tells you exactly what was removed from your file.
- Never written to your browser's storage. Your cart holds a reference and the measured figures, never the image itself.
- Automatic deletion after 90 days, a window kept only so that a reprint is possible without asking you to send the file again. Ask us and we will delete it sooner.
- Never used for anything else. Not for marketing, not for a portfolio, not for case studies, and not for training any machine-learning model. If we ever wanted to show your work, we would ask you separately, and the default answer stays no until you say otherwise.
4. Who else sees it
Only the processors we need to run the shop, each under a written agreement and instructed to act only on our behalf:
- Hosting: Vercel Inc. (site and application hosting).
- Database and file storage: our managed Postgres and object storage provider, hosted in the European Union.
- Payment: a PCI-DSS compliant payment provider. They receive what they need to take the payment; we never receive your full card number.
- Delivery: the carrier, which receives the delivery address and nothing more.
We do not sell personal data and we do not share it for anyone else's marketing. Where a processor is located outside the European Economic Area, the transfer relies on the European Commission's standard contractual clauses.
5. Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to you in a portable format. You may object to processing based on our legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what was done before.
Write to support@trendsseason.site with “personal data” in the subject line, or by post to TRENDS SEASON SARL, 34 Boulevard Chasseigne, 86000 Poitiers, France. We answer within one month. We may ask for proof of identity if the request is not obviously from you, and for nothing more than that.
Complaining to the regulator
If you are not satisfied with how we have handled your data you have the right to lodge a complaint with the French supervisory authority, the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. You can also complain to the authority in your own EU country. You do not have to raise it with us first, though we would like the chance.
6. Security
Traffic is encrypted in transit. Files are held in a private store with no public read access. Access to order data is limited to the people who need it to fulfil orders. If a breach ever occurs that is likely to put your rights at risk, we will tell you and the CNIL within the statutory deadlines, and we will tell you what actually happened rather than a sanitised version of it.
7. Cookies
Covered separately at cookies. In short: no advertising, no audience measurement, and the cart uses session storage because the shop cannot work without it.
8. Children
This shop is intended for adults. We do not knowingly collect data from children. If artwork you send contains identifiable children, please make sure a parent or guardian has agreed before you send it.