Personal Data Protection Policy

1. Data controller

The publisher of Olfastory, identified in the legal notice, is responsible for the processing described below. The publisher can be reached at contact@olfastory.com.

No data protection officer has been appointed: the site is published on a non-professional basis and does not fall under any of the cases of mandatory appointment set out in Article 37 of the General Data Protection Regulation.

2. Processing carried out

Contact form

Data: name, email address, subject and content of the message. Purpose: responding to the request. Legal basis: legitimate interest. Retention: twelve months from the last exchange.

Form security

Data: IP address and browser user agent. Purpose: preventing abusive submissions and limiting submission rate. Legal basis: legitimate interest. Retention: three months.

Votes and ratings

Data: a random identifier stored in a cookie, with no identity data whatsoever. Purpose: preventing multiple votes on the same page. Legal basis: legitimate interest. Retention: duration of the cookie; the vote itself is retained without any identifier that could be linked to a person.

Member account

Data: email address, password stored as a hash, chosen display name, date and version of the terms accepted. Purpose: creating and using the account and linking votes already cast. Legal basis: performance of the requested service. Retention: until the account is deleted. Account creation requires email confirmation: until the link is activated, the account remains inactive.

Audience measurement

Data: Google Analytics 4 measurement identifiers; for Microsoft Clarity, measurement identifiers and an anonymous recording of the browsing session — pages viewed, clicks, scrolling, pointer movements, device and browser type. The content of input fields is masked at the source and is never transmitted. Purpose: measuring site traffic and understanding navigation difficulties. Legal basis: consent. Retention: according to the GA4 stream configuration; for Clarity, according to the retention period set by Microsoft.

Cookie-free audience measurement

Data: the page viewed, the category of origin (search engine, internal link, direct access, other site), a device class (mobile, tablet or computer) and, where applicable, the action taken on the page (click to a merchant, link to a perfume page, search with no result). No cookie is set or read for this purpose, no identifier is created, and neither the IP address nor the browser is recorded. Purpose: measuring site traffic, solely on the publisher’s behalf, as aggregated statistics. Legal basis: legitimate interest; this measurement falls under the consent exemption for audience measurement (Article 82 of the French Data Protection Act). Objection: the “Decline” button in the banner, or the “Manage my consent” button in the footer, stops it. Retention: fourteen days for the raw log; only aggregated statistics are kept beyond that.

Advertising films played on YouTube

Some perfume pages show the advertising film published by the house on its YouTube channel. Before any click, nothing is loaded from YouTube: the preview image is served by Olfastory. The play button loads the YouTube player in privacy-enhanced mode (youtube-nocookie.com); from that moment, Google Ireland Limited may read or set trackers and receives the IP address, under its own responsibility (Google privacy policy: https://policies.google.com/privacy). Legal basis: consent, given by clicking the play button, beneath which a notice is shown. Withdrawal: simply do not play the films; trackers already set can be deleted in the browser settings.

Olfastory accounts on social networks

Olfastory publishes its own content, perfume presentations drawn from the site’s pages, on its Instagram, Facebook, Threads and TikTok accounts using a private application, “Olfastory Social”, which is not open to any other user.

This application only accesses Olfastory’s accounts. It uses their identifier, their display name, the access tokens issued by each network and the statistics of the posts, in order to publish and measure Olfastory’s content, to the exclusion of any other purpose. This data is stored on Olfastory’s server (OVH, France) and is neither sold nor transferred. When access is revoked, the access tokens and the collected statistics are erased from this server no later than the next daily check, and from backup copies when their retention period ends, thirty days at most.

The application collects no data from site visitors or from other users of these networks. Access can be revoked at any time from the security settings of the relevant account. For any questions: contact@olfastory.com.

YouTube

Olfastory publishes its own videos on its YouTube channel (@olfastory) using YouTube API Services. This tool accesses no data from YouTube users: it does not read, collect, retain or share any information about them. The only authorization granted is that of the Olfastory channel itself, to upload videos to it and view its statistics.

Watching Olfastory’s videos on YouTube is subject to Google’s privacy policy: https://policies.google.com/privacy. The authorization granted to the tool can be withdrawn at any time from the Google account permissions page (https://myaccount.google.com/permissions); the corresponding access token is then erased from this server no later than the next daily check, and from backup copies when their retention period ends, thirty days at most. Since no YouTube user data is retained, there is none to erase.

No newsletter is offered and no data is collected for this purpose.

3. Cookies and audience measurement

Two categories of cookies are used. The first are necessary for the site to function — session, remembering consent choice, voting identifier — and do not require consent. The second relate to audience measurement — Google Analytics 4, as well as Microsoft Clarity, which sets measurement cookies, notably _clck and _clsk — and are only set after consent.

Consent Mode v2 is configured in “basic” mode: no signal is sent to Google or to Microsoft until consent has been given. The choice can be changed at any time via the “Manage my consent” button located in the footer.

Olfastory also measures its traffic with an anonymous, cookie-free count hosted on its own servers (see “Cookie-free audience measurement” above). Choosing “Decline” stops it too.

The advertising films on perfume pages set no tracker until they are played (see “Advertising films played on YouTube” above). The share buttons are plain links: no social network script is loaded on the site.

4. Recipients and processors

• Hosting of the site and database: OVH SAS, France.
• Sending of account confirmation and notification emails: OVH SAS, France.
• Audience measurement: Google Ireland Limited, where consent has been given. Microsoft Ireland Operations Limited, also where consent has been given, which acts for Microsoft Clarity as an independent data controller and not as a processor. Transfers outside the European Union are possible under these two arrangements; they are governed by the European Commission’s standard contractual clauses.
• Affiliate links: clicking such a link leaves Olfastory; the processing carried out by the destination site and, where applicable, the affiliate platform then applies. No personal data is transmitted to them by Olfastory.

No data is sold, rented or transferred.

5. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to set guidelines regarding the fate of your data after your death. Where processing is based on consent, it can be withdrawn at any time.

These rights may be exercised at contact@olfastory.com; a response will be provided within one month. A complaint may also be lodged with the Commission nationale de l’informatique et des libertés — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

6. Security

Exchanges with the site are encrypted (HTTPS). Access to the administration area is restricted and account passwords are stored as hashes. The database undergoes regular backups. These measures are those of a site published on a non-professional basis and do not claim to match the standard of an enterprise-grade system.

7. Updates

This policy may be amended to reflect changes to the site or to the regulations.