Privacy policy
Last updated: 19 September 2026
Courtesy translation — the French version prevails.
1. Data controller
Fabrice Jolivet EI (sole trader), trading as Plotrek — 37 rue Blanqui, 33110 Le Bouscat, France. SIRET: 941 912 255 00010. Email: hello@plotrek.com.
2. Data we process
- Orders: first and last name, email, shipping address, the content of the order (route, poster texts, format, paper). Card payments are handled by Stripe: we never see or store card details. The email typed on the checkout details page is saved as soon as it is entered, for a single reminder the next day if the order is not completed.
- Poster sent by email: your email and the poster you composed, to send it to you — and, only if you tick the box, a reminder and our offers (dated consent, kept on record).
- GPS routes you provide (GPX import or Strava connection): used only to make and show your poster. For Strava, see section 7.
- Newsletter: your email, if you sign up (e.g. for the welcome discount).
- Messages: contact form, chat and race requests (name, email, message).
- Reviews and photos you send for publication (name or initials, text, photo, email to send the reward code).
- Internal audience measurement, without cookies: pages viewed, campaign parameters (UTM), country and city derived from the IP address (the address itself is not stored), linked by an identifier kept in your browser for the current tab only (sessionStorage, deleted when the tab is closed).
- Google Analytics and Meta cookies: only if you accept them (section 8).
- Technical logs kept by our hosts (IP address, browser).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Making and delivering your order, customer service | Contract (art. 6.1.b) |
| Invoices and accounting | Legal obligation (art. 6.1.c) |
| Answering your messages and race requests | Pre-contractual steps / legitimate interest (art. 6.1.b and f) |
| Newsletter and discount code | Consent (art. 6.1.a) — unsubscribe at any time |
| Publishing your review or photo | Consent (art. 6.1.a) |
| Internal audience measurement without cookies | Legitimate interest (art. 6.1.f) |
| Google Analytics audience measurement and Meta ad measurement | Consent (art. 6.1.a) — cookie banner |
| Site security and abuse prevention | Legitimate interest (art. 6.1.f) |
4. Recipients and processors
Your data is accessed only by Fabrice Jolivet and by the following service providers, each for its own task:
- Vercel Inc. (USA) — website hosting;
- Hostinger International Ltd. (Cyprus, EU) — poster rendering server;
- Supabase Inc. — database (orders, messages, reviews);
- Cloudflare, Inc. (USA) — file storage (R2);
- Stripe Payments Europe Ltd. (Ireland) — payment;
- Resend Inc. (USA) — transactional emails;
- Telegram — internal notifications to the workshop (new order, chat message, race request);
- Strava, Inc. (USA) — only if you connect your Strava account;
- Google Ireland Ltd. (Google Tag Manager, Google Analytics) and Meta Platforms Ireland Ltd. (pixel) — only if you accept cookies.
Google Customer Reviews. After a paid order, the confirmation page may show a box from Google Ireland Ltd. offering to send you a short satisfaction survey about your purchase. The box is loaded from Google's servers and receives the order number, your email address, the delivery country and the estimated delivery date. Google only emails you if you accept, after that date; your answers feed the shop rating shown by Google. Google may place or read cookies when the box is shown, and processes this data under its privacy policy.
When data is processed outside the European Union, the transfer relies on the EU–US Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses.
5. Retention
- Orders and their route: 5 years; accounting documents: 10 years.
- Newsletter: until you unsubscribe, or 3 years without any interaction.
- Messages and race requests: 3 years after the last contact.
- Published reviews and photos: until you ask us to remove them.
- Internal audience measurement: 13 months.
- Google Analytics and Meta cookies: 13 months at most; your cookie choice: 6 months.
- Technical logs: 90 days.
6. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw your consent at any time, and the right to give instructions on what happens to your data after your death. Write to hello@plotrek.com; we answer within one month. You can also lodge a complaint with the CNIL (cnil.fr).
7. Strava data
The Strava connection asks for read-only access (read, activity:read). The access token lives in an encrypted cookie for 6 hours and is only stored with your order if you order. You can disconnect at any time from your account (this revokes our access at Strava) or from strava.com/settings/apps. To anonymise the Strava data attached to a past order, write to hello@plotrek.com. Details on our Strava page.
8. Cookies
- Necessary (no consent required): session, cart, Strava connection.
- Internal audience measurement: no cookie (see section 2).
- Subject to your consent: Google Analytics (audience measurement) and the Meta pixel (measuring our ads). They are only loaded if you click « Accept » on the banner. Declining does not limit anything on the site.
Your choice is kept for 6 months. You can change it at any time with the « Cookies » button at the bottom of every page.
9. Security
Encrypted connections (TLS), restricted access to data, backups. In the event of a data breach likely to create a high risk, we notify the CNIL and the people concerned within the time limits set by the GDPR.
10. Changes
This policy may change; the date at the top of the page shows the latest version.