Personal Data

pErsOnAl dAtA

IntrOduCtioN

This section is dedicated to our Personal Data Protection Policy. It explains where the information processed when you visit our site and make purchases comes from, how it is used, and what your rights are, as required by the data protection laws in force in the countries in which we operate, in particular the European General Data Protection Regulation (Regulation 2016/679, known as the "GDPR"), which came into force on 25 May 2018, and the French Data Protection Act.

This Policy is therefore important for you, who wish to have a positive and trusting experience of our Services, and for Us, who wish to answer your questions about your use of our site accurately and completely, and to take your wishes into account.

Last updated: October 2026

1 - Personal data collected

JRSA directly or indirectly collects the following categories of data: - Your identity and contact details (in particular username, password, last name, first name, e-mail address, usual residential address, delivery address, telephone number) that you may provide to JRSA via the "My account" and "Contact" sections or when you make an online purchase. If you choose to provide them, your title and date of birth, which are optional; - Information about your orders: works and books purchased, amounts, order history, exchanges with our customer service; - Payment information: your payment data is processed directly by our secure payment providers (in particular Verifone Paybox and PayPal). JRSA never has access to your credit card number; - If you subscribe to our newsletter: your e-mail address, your language and, where applicable, whether you open our e-mails and click on their links;

- Technical information related to your browsing on our site, such as your IP address, device and browser type, pages viewed and where your visit came from. Information collected through analytics or advertising cookies is only collected with your consent (see our cookie policy).

2 - What is the data used for?

This data allows JRSA to: - Manage your customer account and process your order (payment, delivery, after-sales service). Legal basis: performance of the sales contract; - Prevent online payment fraud. Legal basis: JRSA's legitimate interest in securing transactions; - Issue invoices and comply with its accounting and tax obligations. Legal basis: legal obligation; - Handle your requests, manage complaints and answer your questions. Legal basis: JRSA's legitimate interest in responding to you, or pre-contractual measures taken at your request; - Send you its newsletter (lithograph releases, books, news) if you have subscribed without being a customer. Legal basis: your consent, which you can withdraw at any time; - If you are a customer, send you information by e-mail about products similar or complementary to those you have purchased from Atelier JR, the content of which may be tailored to your previous purchases. Legal basis: JRSA's legitimate interest. You can object to this free of charge, when placing your order and at any time, using the unsubscribe link included in every e-mail; - Measure the site's audience and improve its services (Google Analytics). Legal basis: your consent; - Measure the effectiveness of its communication on Facebook and Instagram (Meta Pixel). Legal basis: your consent.

When providing personal data, users undertake to give JRSA complete, accurate and up-to-date information that does not harm the interests or rights of third parties. JRSA does not make any decision producing legal effects concerning you based solely on automated processing.

3 - Consent and mandatory information

Some processing is based on your consent: subscribing to the newsletter if you are not a customer, and the use of analytics and advertising cookies. Your consent is requested beforehand, and you can withdraw it at any time. Other processing is based on the legal bases set out in article 2.

Whether the information you provide to JRSA is optional or mandatory is indicated when it is collected, mandatory fields being marked with an asterisk. Without this information, JRSA cannot process your order or request.

4 - Identity of the data controller

JRSA is responsible for the collection and processing of personal data carried out on the Site. Its full contact details are available in our legal terms. For any question about your personal data, you can write to: hello@jr-art.net.

5 - Recipient(s) of personal data

Data collected on the Site is intended for the JRSA departments authorised to process it. JRSA never sells or rents your personal data, and only shares it with third parties when: - JRSA needs to share this information, strictly to the extent necessary, with service providers in order to provide the service you request or to operate its website: its website development and maintenance provider, its hosting provider, its payment providers (in particular Verifone Paybox and PayPal), its carriers (Fedex and Colissimo), its newsletter provider (Mailchimp, The Rocket Science Group LLC / Intuit Inc.) and its accountant; - You have accepted the corresponding cookies: Google Ireland Limited (Google Analytics) for audience measurement, and Meta Platforms Ireland Limited (Meta Pixel) to measure our communication on Facebook and Instagram. For the collection and transmission of this data to Meta, JRSA and Meta act as joint controllers; - JRSA is required by a judicial or other administrative authority to disclose the information;

- JRSA may transmit your payment information to an external provider with an online fraud detection tool in order to authenticate a payment.

6 - Data transfers abroad

Some of our service providers, in particular Mailchimp, Google and Meta, may process your data in the United States. These transfers are governed by the EU-U.S. Data Privacy Framework, under which these companies are certified, and/or by the standard contractual clauses adopted by the European Commission, which guarantee an adequate level of protection. You can obtain information about these safeguards by writing to hello@jr-art.net.

7 - Data retention period

Your data is only kept for as long as necessary for the purposes described above, or for the retention period required by law: - If you are a customer: for the entire duration of the business relationship, then 3 years from your last purchase to keep you informed of our releases; - Invoices and accounting documents: 10 years, in accordance with the French Commercial Code; - If you are a prospect (that is, if you have not made any purchase from JRSA but are interested in JRSA's news): 3 years from your last contact with JRSA (for example, your last click in one of our e-mails), or until you unsubscribe; - Your contact requests: the time needed to answer them, then 3 years; - Cookies and browsing data: according to the periods set out in our cookie policy.

You can request the deletion of your personal data at any time (see article 8). JRSA will however keep the data it is legally required to retain, such as invoices.

8 - User rights

Each user has: - a right of access to and information on how their personal data is processed, namely the purposes of the processing, the categories of data processed, the categories of recipients and the retention period of their data; - the right to obtain a copy of the information we hold about them. Users can retrieve the data provided on our site at any time: from your "My account" area, click on "Export my data" to automatically download a copy of your personal data as a PDF or CSV file; - a right to rectify, complete and update their personal data; - the right to object to its processing, in particular for direct marketing purposes, at any time, free of charge and without having to give a reason; - the right to request the restriction of its processing; - the right to data portability; - a right to the erasure of their personal data;

- the right to give instructions regarding what happens to their data after their death.

Where the processing of the user's data is based on consent, this consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal: using the unsubscribe link included in every e-mail, or the "Cookie settings" link at the bottom of every page of the site.

To exercise these rights, users can contact JRSA by e-mail at the following address: hello@jr-art.net. JRSA will respond within one month, and may request proof of identity in the event of reasonable doubt.

For any question or difficulty, we invite you to contact us first: we are committed to answering you as quickly as possible. If, after contacting us, you believe your rights have not been respected, you can lodge a complaint with a supervisory authority, the CNIL in France (www.cnil.fr).

9 - Personal data protection

JRSA has put in place technical and organisational measures to protect the personal information provided by users against loss and unauthorised access and use. Access to this data is limited to the people who need it.

All stages of credit card payment between you and Atelier JR via Verifone Paybox are fully encrypted and protected (the protocol used is SSL combined with bank payment technology). This means that order information and credit card numbers are never transmitted unencrypted over the Internet. In practice: o Credit card numbers are never printed on any paper, invoice, receipt or other listing, o Atelier JR has no knowledge of card numbers, o Verifone Paybox does not keep card numbers after transmitting the payment transaction.

Good to know: you are in secure mode when paying online if a padlock appears in your browser's address bar and the address begins with "https://" (the "s" indicating that the connection is protected).

As no system is completely infallible, we also invite you to choose a strong password for your account and never to share it.