Privacy Policy

Last updated: 3 September 2026

This privacy policy explains, clearly and transparently, how your personal data is collected and processed when you use the website rnbrush-painting.com, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Definitions

  • Website: the website available at https://rnbrush-painting.com.
  • RNBrush Painting: Mr Nicolas Favier, sole trader (entreprise individuelle), SIREN 929 936 250, publisher and operator of the Website.
  • User: any person who visits or uses the Website.
  • Customer: any User who has placed an order on the Website.
  • Personal data: any information relating to an identified or identifiable natural person.

2. Who is the data controller?

The controller of the data collected on the Website is:

Mr Nicolas Favier (RNBrush Painting)
Sole trader – SIREN 929 936 250
831 Route de Briancon, 05240 La Salle-les-Alpes, France
Email: contact@rnbrush-painting.com

Given the size of the business, no Data Protection Officer (DPO) has been appointed. Any request relating to your data may be sent directly to the email address above.

3. Who is concerned?

The processing described below concerns: visitors to the Website, people who use the contact form, and Customers who place an order.

The Website is not intended for children under 15 and does not knowingly collect their data.

4. What data is collected?

Only the data strictly necessary for the purposes described below is collected. The Website does not collect any special category data (origin, opinions, health, etc.).

4.1 Contact form

Name, email address, subject of the enquiry and content of the message. Mandatory fields are indicated in the form.

4.2 Orders

First and last name, email address, billing and delivery address, telephone number where applicable, and the details of the order (products, amount, date).

No banking data (card number, security code) is collected, processed or stored by RNBrush Painting. Payment takes place entirely on the secure infrastructure of the payment provider (see section 7).

4.3 Browsing and audience measurement

For every visitor, for audience measurement: browser and device type, pages viewed, date and time of the visit, referring website and any campaign parameters. Your IP address is used to derive a technical identifier by hashing on our provider’s servers and is then discarded: it is not stored with the visit data.

Only if you consent, for detailed analysis: your interactions with the pages (clicks, scrolling, form entries excluding sensitive fields) and a recording of how your visit unfolded, tied to an identifier stored on your device that allows you to be recognised from one visit to the next.

5. What are the purposes of the processing?

  • Responding to enquiries sent through the contact form.
  • Processing, shipping and tracking orders, managing invoicing, after-sales service, returns and any disputes.
  • Complying with the legal, accounting and tax obligations of RNBrush Painting.
  • Measuring the Website’s audience and understanding how it is used, in order to improve its content and usability.
  • Ensuring the security of the Website and preventing fraudulent or abusive use.

Your data is never sold, rented or transferred to third parties for commercial purposes.

6. What are the legal bases for this processing?

  • Contact form: your consent, given by voluntarily sending the message (Article 6.1.a GDPR).
  • Orders and delivery: performance of the sales contract to which you are a party (Article 6.1.b GDPR).
  • Retention of accounting records: compliance with legal obligations (Article 6.1.c GDPR).
  • Audience measurement and Website security: the legitimate interest of RNBrush Painting in knowing how its Website is used and in keeping it running properly (Article 6.1.f GDPR), subject to your right to object as described in section 10. This measurement stores nothing on your device and therefore falls under the consent exemption for audience measurement.
  • Detailed browsing analysis and marketing: your consent, collected through the cookie banner and revocable at any time (Article 6.1.a GDPR). Without it, neither visit recording nor the Meta pixel is activated.

7. Who is your data shared with?

Your data is processed by Mr Nicolas Favier. It may be shared with the following technical providers, and only to the extent necessary for their task:

  • Website hosting: Hostinger International Ltd (Cyprus), which hosts the Website and its database.
  • Online payment: PayPal (Europe) S.a r.l. et Cie, S.C.A. (Luxembourg). Payment is made on PayPal’s interface; RNBrush Painting has no access to any banking data and only receives confirmation of the payment.
  • Audience measurement and browsing analysis: PostHog, whose instance used by the Website is hosted in the European Union (Frankfurt, Germany). PostHog acts as a processor and does not use this data for its own purposes.
  • Social network advertising: Meta Platforms Ireland Limited, for the Meta pixel used to measure the effectiveness of our Facebook and Instagram ads. This pixel is only activated after your consent.
  • Embedded videos: Google Ireland Limited, for the YouTube videos embedded on certain pages (see section 9).
  • Delivery: the carrier responsible for delivering your order, which receives only the information needed for delivery.

Some of these providers may transfer data outside the European Union, in particular to the United States, under the safeguards provided for by the GDPR (standard contractual clauses or adequacy decision). Your data may also be disclosed to administrative or judicial authorities upon lawful request.

8. How long is your data kept?

  • Contact form messages: 3 years from the last exchange.
  • Order data: for the duration of the business relationship, then 3 years for follow-up and evidence purposes.
  • Invoices and accounting records: 10 years, in accordance with Article L.123-22 of the French Commercial Code.
  • Audience measurement data: 12 months from the visit. Audience measurement stores no identifier on your device; the technical identifier derived server-side changes every day and cannot be used to follow you beyond it.
  • Identifiers stored after consent (detailed analysis, Meta pixel): 13 months maximum, in line with the French data protection authority’s recommendations. Visit recordings are kept for 30 days.
  • Server technical logs: 12 months maximum.

At the end of these periods, the data is deleted or irreversibly anonymised.

9. Cookies and trackers

A cookie is a small file placed on your device when you browse the Website. The Website uses the following categories:

  • Strictly necessary cookies: operation of the cart and checkout, storing the display language, form security. They are essential to the Website and cannot be disabled.
  • Cookie-free audience measurement (PostHog): it counts visits and identifies referring websites without placing a cookie or writing anything into your browser’s storage. Visitors are distinguished by a technical identifier computed by hashing on PostHog’s servers, which changes every day and is never reused across websites. The data is hosted in the European Union. No targeted advertising, no profiling and no resale of data takes place. Because it is strictly limited to measuring this Website’s audience and stores no tracker, this collection is not subject to your prior consent; you may nevertheless object to it (see below).
  • Detailed analysis (PostHog) – subject to your consent: if you accept, PostHog stores an identifier on your device, records your interactions with the pages and how your visit unfolded, and recognises you from one visit to the next. Off by default.
  • Meta pixel (Facebook, Instagram) – subject to your consent: it measures the effectiveness of our ads and lets Meta match a visit to an advert that was seen. Off by default.
  • Third-party cookies from embedded videos: pages containing a YouTube video or playlist may lead to cookies being placed by Google. These cookies are governed by Google’s privacy policy, available at https://policies.google.com/privacy.

How to refuse non-essential cookies? A banner appears on your first visit: detailed analysis and the Meta pixel are off by default and are only switched on if you accept them. You can change your mind at any time using the “Cookies” link in the footer or the floating button at the bottom of the screen. You can also configure your browser to block or delete cookies, or use a tracker-blocking extension. Blocking strictly necessary cookies may prevent the ordering process from working.

How to object to cookie-free audience measurement? Since it stores nothing on your device, it is not covered by the banner. Write to us at contact@rnbrush-painting.com to ask for your data to be excluded, or use a tracker-blocking extension, which also prevents this measurement.

10. What are your rights?

Under the GDPR, you have the following rights over your data:

  • Right of access and to obtain a copy of your data.
  • Right to rectification of inaccurate or incomplete data.
  • Right to erasure, subject to data we are legally required to keep.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest, in particular audience measurement.
  • Right to withdraw your consent at any time, where processing is based on it.
  • Right to set instructions regarding the fate of your data after your death.

To exercise these rights, write to contact@rnbrush-painting.com or by post to the address given in section 2. You will receive a reply within one month of your request being received. Proof of identity may be requested in the event of reasonable doubt as to the identity of the requester.

If, after contacting us, you believe that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at https://www.cnil.fr/fr/plaintes. You may also contact the supervisory authority of your country of residence.

11. Data security

The Website is served over HTTPS and exchanges are encrypted. Access to the Website’s administration is protected by personal credentials and restricted to the data controller alone. The Website and its database are backed up regularly. Payments are handled exclusively by a specialised provider, with no banking data passing through our own systems.

12. Links to third-party websites

The Website may contain links to external sites, in particular YouTube, Patreon or social networks. RNBrush Painting has no control over these sites and accepts no liability for their personal data practices. We invite you to read their own privacy policies.

13. Changes to this policy

This policy may be amended at any time to reflect changes to the Website or to the applicable regulations. The date of the last update appears at the top of this page. We invite you to consult it regularly.

Scroll to Top