Legal
Privacy policy
Last updated: 28 September 2026
This policy explains what happens to personal data collected through flavieberleand.com. It is written under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés of 6 January 1978, as amended).
1. Who is responsible
The data controller is Flavie Berleand (House of Her), 2 allée des Bernaches, 17440 Aytré, France. SIRET 801 385 543 00039.
For any question about this policy or about your data: [email protected]
There is no obligation to appoint a Data Protection Officer for a practice of this size, and none has been appointed. Requests go to the address above and are handled by Flavie Berleand personally.
2. What is collected, why, and on what basis
| What is collected | Why | Legal basis | Kept for |
|---|---|---|---|
| Contact form: first name, last name, email, phone, your message | To read and answer your message, and to continue the conversation if it leads to work together | Steps taken at your request prior to entering into a contract (Art. 6.1.b) | 3 years from our last contact |
| Newsletter: email, first name | To send the newsletter you asked for | Your consent (Art. 6.1.a) | Until you unsubscribe, then 3 years as proof of consent |
| Booking a call: name, email, phone, chosen time, anything you write in the booking form | To hold the call and prepare it | Steps taken at your request prior to a contract (Art. 6.1.b) | 3 years from our last contact |
| Payments: name, email, billing address, amount, and the payment reference returned by the payment provider. Card numbers are handled by the provider and never reach House of Her | To take payment for a service you bought, issue the invoice and handle any refund or chargeback | Performance of a contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) | 10 years, with the accounting records |
| Client relationship: everything exchanged during an engagement, plus billing details | To deliver the work, invoice it, and meet accounting obligations | Performance of a contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) | Accounting records: 10 years, as required by French commercial law |
| Technical logs: IP address, browser, pages viewed, kept by the hosting platform | Security of the site and diagnosis of incidents | Legitimate interest in keeping the site available and secure (Art. 6.1.f) | 12 months maximum |
Fields marked as required on a form are the ones needed to answer you. The rest is optional, and leaving them empty changes nothing about the answer you get.
No profiling, no automated decision-making, no sale of data. Personal data collected here is never sold, rented or exchanged.
3. Who else sees the data
Data is shared only with the service providers needed to run the practice, each acting as a processor under a written agreement:
| Provider | What it handles | Where |
|---|---|---|
| HighLevel Inc. (GoHighLevel / LeadConnector) | Hosting of the site, contact and newsletter forms, booking calendar, CRM and email sending | United States |
| Substack Inc. | The newsletter archive and any subscription made on Substack | United States |
| Stripe Payments Europe, Ltd. | Card payments made through the site, and the fraud checks that come with them | Ireland, with transfers to Stripe, Inc. in the United States |
| Google (Workspace) | Professional email and document storage | European Union and United States |
Transfers outside the European Union are covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, by the EU–U.S. Data Privacy Framework.
Data may also be disclosed where the law requires it, following a request from a court or a competent authority.
4. Cookies
This site does not run any audience measurement, advertising pixel or behavioural tracker.
The only cookies placed are the ones strictly necessary for the site and its forms to work: session identification, load balancing, and the anti-spam protection of the forms. Under Article 82 of the French Data Protection Act these are exempt from consent, which is why no cookie banner is shown.
You can still block or delete cookies in your browser settings. Blocking the strictly necessary ones will prevent the forms from being submitted.
If audience measurement or advertising is added later, this policy will be updated and a consent banner will appear before any such cookie is placed.
5. Your rights
Under the GDPR you have the right to:
- access the data held about you, and obtain a copy of it;
- rectify anything inaccurate or incomplete;
- erase your data, where one of the grounds in Article 17 applies;
- restrict the processing while a dispute about accuracy or lawfulness is resolved;
- portability: receive the data you provided in a structured, machine-readable format;
- object to processing based on legitimate interest, on grounds relating to your situation;
- withdraw your consent at any time where processing rests on consent, without affecting what was done before;
- give instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).
To exercise any of these: [email protected]. You will get an answer within one month. Proof of identity may be requested where there is reasonable doubt about who is asking.
Every newsletter carries an unsubscribe link that works in one click, with no explanation required.
If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. cnil.fr
6. Security
Data is held on the platforms listed above, which encrypt data in transit (HTTPS) and at rest. Access to accounts is protected by strong, unique passwords and two-factor authentication where the provider offers it. Access is limited to Flavie Berleand and to any collaborator who needs it for a specific engagement.
No transmission over the internet can be guaranteed absolutely secure. In the event of a personal data breach likely to result in a high risk to your rights, you will be informed and the CNIL notified within the time limits set by Article 33 of the GDPR.
7. Children
This site is aimed at professionals and is not intended for people under 15. No data is knowingly collected from them.
8. Changes to this policy
This policy may change when the practice or its service providers change. The date at the top of the page tells you which version you are reading. Any material change affecting existing subscribers will be announced by email before it takes effect.