Contents
1.Data controller
The publisher of the Loch Ness services (see the legal notice), reachable at contact@lochness-paris.com. This policy covers:
- the bracelet builder (/pwa/en/, /pwa/fr/, /pwa/es/), including when it is embedded on a partner shop's website (link, iframe or floating button);
- the creations gallery (/creations/);
- Stone of the Day (/pwa/pierre-du-jour/);
- the partner programme for shops (/pwa/partenaire/ and the client area /pwa/espace-client/).
We never sell or rent your data, and we run no advertising.
2.Designing a bracelet and publishing a creation
- Data: the design (list of beads, size, score) is published without any name or contact details on a gallery page. To prevent abuse, the server keeps an encrypted fingerprint (hash) of your IP address, never the address itself.
- Purpose: displaying the creations gallery and protecting the service.
- Legal basis: legitimate interest (proper operation and security).
- Retention: fingerprint deleted within 24 hours; the creation page stays online as long as the gallery exists (it contains no personal data).
3.Order requests
- Data: name, email, phone (optional), message (optional), design and indicative price, page of origin, date.
- Purpose: replying to your request and confirming size, price and delivery before anything is made. No payment is taken on the site.
- Legal basis: steps taken at your request before entering into a contract.
- Retention: 12 months after our last exchange; if a sale takes place, accounting records are kept for the period required by law.
- Recipients: the publisher only. The request is sent by email through the Web3Forms service.
Builder embedded on a partner shop's website: your requests then go to that shop, which is responsible for them and replies directly. If the shop has not set up its own inbox, we receive the request and forward it to the shop, with no other use.
4.Email requested in the builder
- Data: email, number of designs created.
- Purpose: sending you Loch Ness inspiration and news.
- Legal basis: your consent (checkbox), which you can withdraw at any time by simple email.
- Retention: until you withdraw your consent, and at most 3 years after our last exchange.
5.Stone of the Day: sign-up
- Data: email, first name (optional), language, moods viewed, sign-up and visit dates, wording of the consent accepted. An encrypted fingerprint of the IP address is used to prevent abuse.
- Purpose: giving access to your daily stone selection and sending you Loch Ness inspiration.
- Legal basis: your consent (checkbox), which you can withdraw at any time by email.
- Retention: until you withdraw your consent, and at most 3 years after your last visit; IP fingerprint deleted within 24 hours.
- Recipients: the publisher. Data is stored with the host in a folder that cannot be reached from the web; a notification is sent to the publisher through Web3Forms.
6.Partner programme (shops)
- Partnership request: shop name, contact name, email, phone (optional), website, logo URL, city or country, business type, message.
- Shop account: email, password (stored only in irreversibly encrypted form), builder settings (name, logo, colours, menu, prices, order inbox key), technical log of emails sent (last 50).
- Purpose: reviewing the request, creating and managing the account, sending invitation and password-reset emails.
- Legal basis: pre-contractual steps, then performance of the partnership.
- Retention: declined requests deleted after 12 months; account kept for the duration of the partnership and deleted on request or when it ends.
- Recipients: the publisher. Emails are sent from contact@lochness-paris.com through the host's mail server.
7.Audience measurement
GoatCounter counts page views and a few actions (bracelet designed, mood chosen, sign-up, share) without cookies, without identifying visitors and without storing IP addresses. Legal basis: legitimate interest (improving the services).
8.Storage in your browser
Some preferences stay only on your device (browser local storage) and are never sent to the server: sounds on or off (sfx), score window hidden (lithoScoreHidden), email already given (wccrEmailCaptured), Stone of the Day favorites, collection and sign-up (pdj2_fav, pdj2_owned, pdj2_member), the journey and badges of "My path" (isr_j, isr_js, isr_jd_*: pages and stones viewed, calculations done, messages already shown), calculator entries for the length of the visit (lp_fields) and, only if you choose "Remember on this device", your birth day and month and your numbers (isr_me). Everything can be erased in one click from the "My path" page. The installed app also caches pages and photos you have viewed so it works offline. You can clear everything from your browser settings.
9.Cookies
No advertising or tracking cookies. Only essential technical session cookies are set on the pages that need them: partner form (lnpartner), client area (lnclient) and administration (lnadmin). They are deleted when you close your browser or log out.
10.Third-party services
- OVH (hosting, France).
- Web3Forms: relays form submissions by email.
- Google Fonts (Google) and cdnjs (Cloudflare): load fonts and icons; these services receive your IP address when loading them.
- GoatCounter: cookie-free audience measurement.
- Share buttons (Pinterest, Facebook, X, WhatsApp): plain links, nothing is sent until you click.
Some of these providers may process data outside the European Union; such transfers are then covered by the safeguards provided by the GDPR (standard contractual clauses or an adequacy decision).
11.Security
Data stored in a private server folder that cannot be reached from the web; encrypted passwords; administration and client area protected by password with limited login attempts; encrypted connections (HTTPS).
12.Your rights
You can request access to, correction, erasure, restriction or portability of your data, object to processing based on legitimate interest and withdraw your consent at any time by writing to contact@lochness-paris.com. We reply within one month.
You can also complain to the Lithuanian data protection authority (VDAI, vdai.lrv.lt) or to the authority of your country of residence.
13.Changes
This policy may change as the services evolve; the update date is shown at the top of the page. See also the legal notice and the terms of use.