Skip to content

Personal Data Protection Policy

1. Data Controller

The publisher of Olfastory, identified in the legal notice, is responsible for the processing described below. The publisher can be reached at olfastory@gmail.com.

No data protection officer has been appointed: the site is published on a non-professional basis and does not fall under any of the cases of mandatory appointment set out in Article 37 of the General Data Protection Regulation.

2. Processing activities

Contact form

Data: name, email address, subject and content of the message. Purpose: to respond to the request. Legal basis: legitimate interest. Retention: twelve months from the last exchange.

Form security

Data: IP address and browser user agent. Purpose: to prevent abusive submissions and limit the sending rate. Legal basis: legitimate interest. Retention: three months.

Votes and ratings

Data: a random identifier stored in a cookie, without any identity data. Purpose: to prevent multiple votes on the same page. Legal basis: legitimate interest. Retention: duration of the cookie; the vote itself is kept without an identifier that can be linked to a person.

Member account

Data: email address, password stored as a hash, chosen display name, date and version of the terms accepted. Purpose: to create and use the account and to link previously cast votes. Legal basis: performance of the requested service. Retention: until the account is deleted. Account creation requires email confirmation: until the link is activated, the account remains inactive.

Audience measurement

Data: Google Analytics 4 measurement identifiers; for Microsoft Clarity, measurement identifiers and an anonymized recording of the browsing journey — pages viewed, clicks, scrolling, pointer movements, device and browser type. The content of input fields is masked at the source and is never transmitted. Purpose: to measure site traffic and understand navigation difficulties. Legal basis: consent. Retention: according to the GA4 stream configuration; for Clarity, according to the retention period set by Microsoft.

No newsletter is offered and no data is collected for this purpose.

3. Cookies and audience measurement

Two categories of cookies are used. The first are necessary for the site to function — session, storage of the consent choice, voting identifier — and do not require consent. The second relate to audience measurement — Google Analytics 4, as well as Microsoft Clarity, which sets measurement cookies, notably _clck and _clsk — and are only set after consent is given.

Consent Mode v2 is configured in “basic” mode: no signal is transmitted to Google or Microsoft until consent has been given. The choice can be changed at any time via the “Manage my consent” button located in the footer.

4. Recipients and processors

  • Hosting of the site and database: OVH SAS, France.
  • Sending of account confirmation and notification emails: OVH SAS, France.
  • Audience measurement: Google Ireland Limited, subject to consent. Microsoft Ireland Operations Limited, also subject to consent, which acts for Microsoft Clarity as an independent data controller and not as a processor. Transfers outside the European Union are possible under both arrangements; they are governed by the European Commission's standard contractual clauses.
  • Affiliate links: when clicking such a link, the user leaves Olfastory; the processing carried out by the destination site and, where applicable, the affiliate platform then becomes applicable. No personal data is transmitted to them by Olfastory.

No data is sold, rented, or transferred.

5. Your rights

Users have the rights of access, rectification, erasure, restriction, objection, and portability, as well as the right to set guidelines regarding the fate of their data after death. Where processing is based on consent, it may be withdrawn at any time.

These rights may be exercised at olfastory@gmail.com; a response will be provided within one month. A complaint may also be lodged with the Commission nationale de l'informatique et des libertés — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

6. Security

Exchanges with the site are encrypted (HTTPS). Access to the administration area is restricted and account passwords are stored as hashes. The database is backed up regularly. These measures are those of a site published on a non-professional basis and do not claim to match the level of a corporate system.

7. Updates

This policy may be amended to reflect changes to the site or to applicable regulations.