Privacy Policy

At Lullae, you entrust us with what matters most to you: the faces of your family. We take that trust very seriously. This policy explains, in full transparency, what data we process, why, for how long, and what your rights are, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (“loi Informatique et Libertés”).

1. Data controller

The controller of your data is:

• Hugo Denis, sole trader (entrepreneur individuel, EI) (Lullae brand)
• 195 rue de Saint-Priest, 34090 Montpellier, France
• SIRET: 106 845 514 00012
• Contact: [email protected]
• No data protection officer (DPO) has been appointed: as this is not mandatory for our activity, you can contact us directly at [email protected] with any question about your data.

2. Data we collect

• Identification and contact data: surname, first name, email address, phone number;
• Delivery and billing data: postal address, billing address;
• Order data: purchase history, options chosen, amounts;
• Payment data: processed exclusively by our payment provider; we do not keep your full bank details;
• Uploaded photographs and content: images, first names, dates and information provided to personalise your artwork (see the dedicated section below);
• Technical and browsing data: IP address, device type, pages viewed, via cookies (see our cookie policy).

3. Purposes and legal bases

• Processing and fulfilling your orders (production, manufacturing, delivery, after-sales service), legal basis: performance of the contract.
• Managing customer relations and answering your requests, legal basis: performance of the contract and legitimate interest.
• Meeting our legal obligations (invoicing, accounting), legal basis: legal obligation.
• Measuring our audience and running targeted advertising (in particular via the Meta/Facebook pixel and the Conversions API), to improve the Site and our campaigns, legal basis: consent (non-essential cookies).
• Sending you marketing communications (newsletter, waiting lists), legal basis: consent.

4. Your family photos: specially protected processing

Your photographs are at the heart of what we do and receive special care:

• they are strictly private and used only to produce, manufacture and deliver the artwork you ordered;
• they are never reused for advertising, communication, examples or model training without your express, prior and specific consent;
• they can be deleted at any time on simple request to [email protected];
• photo uploads that do not lead to an order are automatically purged after about 30 days, so that we do not keep images we no longer need.

When your photographs show a person who has died, they are handled with particular respect and are never used outside your order.

5. Retention periods

• Photographs that led to an order: kept for as long as needed to produce the artwork, then archived on a limited basis for after-sales service for 1 year after delivery, and deleted at your request at any time.
• Uploads that did not lead to an order: deleted automatically within about 30 days.
• Account and contact data: for the duration of the business relationship, then 3 years after the last contact.
• Accounting documents and invoices: 10 years, in line with legal obligations.
• Marketing data (consent): until consent is withdrawn, and at the latest 3 years after your last contact with us.

6. Recipients and processors

Your data is passed only to the recipients needed to provide the service, within the limits of their tasks. We use processors bound by confidentiality and security commitments:

• Website hosting: OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France;
• E-commerce platform and payment pages: Shopify International Ltd, Ireland (Shopify Payments);
• Delivery and security (CDN): Cloudflare, Inc. (United States);
• Image processing and rendering (AI / retouching): Google (Gemini models) and Replicate, Inc., only for the time needed to generate your preview or your artwork;
• Printing and manufacturing: Gelato ASA (Norway) and its network of partner printers, which receive the print file, your name and the delivery address, and nothing else. Production takes place in the network’s workshop closest to you;
• Carriers and logistics: the carrier responsible for delivering your parcel;
• Emailing (newsletter, order emails): Brevo (Sendinblue SA, France);
• Advertising and measurement (social networks): Meta Platforms Ireland Ltd (Facebook, Instagram), via the Meta pixel and the Conversions API, for measurement and ad targeting, only after your consent;
• Audience measurement and ease of use: Microsoft Corporation (Microsoft Clarity), heatmaps and anonymised session recordings to improve the Site, only after your consent.

Third-party audience measurement and advertising tools (in particular the Meta/Facebook pixel, the Conversions API and Microsoft Clarity) are activated only after your consent, never before. You can withdraw it at any time (see our cookie policy).

Some of our processors (Cloudflare, Replicate, Google, Gelato, Meta, Microsoft) may process data outside the European Union, in particular in the United States. In that case, appropriate safeguards (the European Commission’s standard contractual clauses or an adequacy decision, such as the EU–US Data Privacy Framework) govern these transfers to ensure a level of protection consistent with the GDPR.

7. Security

We implement appropriate technical and organisational measures (encrypted exchanges, access control, secure uploads) to protect your data against unauthorised access, loss, alteration or disclosure.

8. Your rights

Under the GDPR, you have the following rights over your data at any time:

• Right of access, to know what data we hold;
• Right to rectification, to correct inaccurate or incomplete data;
• Right to erasure, to ask for your data to be deleted, including your photographs;
• Right to data portability, to receive your data in a structured format;
• Right to object, to object to processing based on legitimate interest or to marketing;
• Right to restriction of processing;
• Right to withdraw your consent at any time, without affecting the lawfulness of earlier processing;
• Right to set instructions on what happens to your data after your death.

To exercise these rights, email us at [email protected]. You may be asked for proof of identity. We undertake to reply within the legal time limit of one month.

9. Complaints to the CNIL

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

10. Cookies

The cookies and trackers used on the Site, how long they last and how to manage them are detailed in our cookie policy.