Privacy Policy

01 Who We Are

This Privacy Policy applies to https://visualsbyvs.com/, operated by Visuals by VS ("we", "us", "our"), a videography business based in 77270, France.

We take your privacy seriously. This policy explains what personal data we collect when you visit our website, create an account, submit an enquiry, or receive communications from us — and how we handle it in compliance with the EU GDPR 2016/679 and French data protection law enforced by the CNIL.

02 Data We Collect

Account & Login Data

• Email address — primary login identifier and transactional communications
• Phone number — used for SMS one-time passcode (OTP) login, and with your explicit consent, marketing SMS
• Hashed password (where applicable)
• Account creation date and last login timestamp

Enquiry & Contact Data

• Name, email address, phone number, event date, and message submitted via contact forms

Push Notification Data

• Push subscription token (generated by your browser, managed by OneSignal)
• Device type, browser, and operating system
• Notification delivery and interaction events

Client Gallery & Delivery Data

• Email and/or phone used to verify access to your private client gallery
• Viewing activity on delivered films and photos

Technical & Usage Data

• IP address (anonymised after session ends where possible)
• Browser type, version, and operating system
• Pages visited, referring URL, and session duration
• Cookie identifiers (see Section 10)

03 How We Use Your Data

04 Legal Basis (GDPR Art. 6)

• Art. 6(1)(a) — Consent: Push notifications, marketing emails, and marketing SMS. You may withdraw consent at any time.
• Art. 6(1)(b) — Contract: Delivering your gallery, responding to booking enquiries, and managing your account.
• Art. 6(1)(c) — Legal obligation: Retention of invoices and financial records (Art. L.123-22 Code de commerce — 10 years).
• Art. 6(1)(f) — Legitimate interests: Website security, fraud prevention, and service improvement.

05 Third-Party Services

Each processor below is bound by a GDPR-compliant DPA or Standard Contractual Clauses (SCCs) where data leaves the EU:

✓ = data remains within the EU. SCCs = Standard Contractual Clauses, Commission Decision 2021/914.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

06 Push Notifications — OneSignal

We use OneSignal, Inc. to send browser and mobile push notifications about your client gallery, new films, and promotions. Push notifications are only sent with your explicit opt-in consent.

What OneSignal collects on subscription

• A unique push token generated by your browser or device
• Device type, browser name and version, operating system
• IP address at time of subscription
• Notification delivery and interaction events (delivered / opened / dismissed)

How to withdraw & opt out

• Chrome: Settings → Privacy & Security → Site Settings → Notifications → find visualsbyvs.com → Block
• Firefox: Preferences → Privacy & Security → Permissions → Notifications → Settings
• Safari: Preferences → Websites → Notifications → remove this site
• Via email: visualbyvs@gmail.com

OneSignal privacy policy: onesignal.com/privacy_policy. Transfers to the USA are covered by SCCs and the EU–US Data Privacy Framework.

07 SMS & Email Communications

Transactional messages

We send transactional SMS and emails necessary to operate our service — OTP login codes, booking confirmations, and gallery delivery notifications. These are sent on the basis of contract performance and do not require separate marketing consent.

Marketing messages

Promotional SMS and email communications are only sent with your explicit prior consent, collected at account registration or via a dedicated opt-in form. Each marketing message includes a clear opt-out:

• Email: Unsubscribe link in every marketing email footer
• SMS: Reply STOP to any marketing SMS to unsubscribe immediately

OTP authentication via SMS

When you log in with your phone number, a one-time passcode (OTP) is sent via SMS to verify your identity. This code expires after a short period and is never stored in plaintext. Your phone number is not shared with third parties beyond the SMS delivery provider.

08 Data Retention

After the applicable period, data is securely deleted or irreversibly anonymised.

09 Your Rights

Under GDPR, you have the following rights. We respond to all verified requests within 30 days:

• Art. 15 — Access: Request a copy of all personal data we hold about you.
• Art. 16 — Rectification: Ask us to correct inaccurate or incomplete data.
• Art. 17 — Erasure: Request deletion of your data, subject to legal retention obligations.
• Art. 18 — Restriction: Ask us to pause processing while a dispute is resolved.
• Art. 20 — Portability: Receive your data in a machine-readable format (JSON/CSV).
• Art. 21 — Object: Object to processing based on legitimate interests or for direct marketing.
• Art. 7(3) — Withdraw consent: Withdraw consent for push, marketing emails, or marketing SMS at any time.

Right to complain — CNIL

You may lodge a complaint with France's data protection authority:

• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Phone: +33 1 53 73 22 22

10 Cookies

Strictly necessary cookies cannot be disabled — they are essential for login to work. You can manage all others via your browser's cookie settings.

11 International Transfers

Our website is hosted by Hostinger UAB in the EU (Lithuania). Your data stays within the EU for primary hosting and database storage.

Certain services (OneSignal, Google, Stripe, Cloudflare) transfer data to the USA or other countries outside the EEA. These transfers are protected by:

• EU Standard Contractual Clauses (SCCs) — Commission Decision 2021/914
• EU–US Data Privacy Framework (DPF) — where the processor is certified
• Adequacy decision — where applicable

You may request a copy of relevant safeguards by contacting us.

12 Children's Privacy

Our website is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has submitted data, please contact visualbyvs@gmail.com and we will delete it promptly.

13 Changes to This Policy

We may update this policy to reflect changes in our services or legal requirements. For material changes we will update the date at the top of this page, post a notice on our homepage, and where required by law notify you by email or in-app notification.

14 Contact & Data Controller

For any questions about this policy or to exercise your rights: