Privacy and cookies

On this page, "I" means Simon Cavrenne, videographer: I run this site under the name Cav Production and I read the messages you send me.

Publisher of the site and controller of your data:

What I receive. The contact form sends me your name, email address and message, plus the other fields you fill in (for example your organisation, phone number, type of project, date and place). It adds the language and the page of the site you write from, and the date.

Why. To reply to you and, if we work together, to prepare your project. You also receive an acknowledgement by email.

Protection against abuse. To keep robots out, the form uses a hidden field, a minimum delay before sending and Vercel's BotID check. The check starts when you begin using a form, and then analyses your browser to tell a person from a program. The site also limits the number of messages: 5 per hour, per email address and per connection. To apply that limit, it may keep with your message, for 24 hours at most, a fingerprint of your IP address computed with a secret key. The IP address itself is never stored.

Legal basis. The steps you ask for before a possible contract (Article 6(1)(b) GDPR). For the acknowledgement, keeping messages and protection against abuse: my legitimate interest in following up the requests I receive and protecting the site (Article 6(1)(f)).

Who has access. Me and the site's administrators, and the technical providers that process your message on my behalf: Convex (the site's database, in Ireland), Resend (sending emails, from Ireland, with no open or click tracking) and Vercel (running the site, in the United States (Washington, D.C.)). The notification arrives in my mailbox [OVHcloud, France: to be confirmed].

How long. 2 years after receipt in the site's database, then deleted automatically. Resend's sending log is kept for 30 days. In my mailbox: [period to be confirmed by Simon]. You can ask me to delete your message sooner.

Why. To know which pages and videos interest you, where visitors come from and whether the contact details are easy to find, so I can improve the site.

Tool. PostHog, on its servers in the European Union (Frankfurt). Data goes through an address on this site (/relais). PostHog is set up not to keep IP addresses.

What is measured. Pages viewed and their language; the site or link you came from, including a link's tracking parameters ("utm"); device type, browser and operating system; clicks towards the services (from the home page and the menu), on contact buttons and on the video play button; starting and sending the contact form, never what you write in it. I only see totals, I don't try to identify you and I don't link these statistics to your messages. Visits by the site's administrators aren't counted.

Without your consent (before you choose, or if you reject). Nothing is stored on your device. To tell apart visits on the same day, PostHog computes a fingerprint on its servers from your IP address and browser, with a key that changes every day and isn't kept: you aren't recognised from one day to the next. Legal basis: my legitimate interest in knowing how my site is visited (Article 6(1)(f) GDPR). You can object at any time: "Manage cookies", then "Don't count my visits".

With your consent ("Accept" button). PostHog stores a random identifier in your browser that links your visits together, for 6 months at most: a cookie, plus details of the current visit kept until you close the tab. Legal basis: your consent (Article 6(1)(a) GDPR and Article 10/2 of the Belgian Act of 30 July 2018). You can withdraw it at any time, as easily as you gave it, with "Manage cookies": the identifier is then deleted from your browser straight away. Withdrawing doesn't affect what was measured before.

Browser signals. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, nothing is measured, unless you explicitly accept statistics with "Manage cookies".

How long. Statistics are deleted at the latest 2 years after they are collected.

My films are hosted on YouTube, a Google service. Until you click the play button, your browser doesn't contact YouTube: the preview image comes from this site. When you click, the player loads in "privacy-enhanced mode" (youtube-nocookie.com). Google then receives your IP address and technical information about your browser, and may store information on your device. What Google does with this data is its own responsibility: see Google's privacy policy.

The site is hosted by Vercel. As with any website, each visit sends technical data to the host (IP address, browser, page requested, date and time) to display pages, protect them and fix errors. Pages are served by Vercel's global network, as close to you as possible; server-side processing, such as sending the form, takes place in the United States (Washington, D.C.). The short ambient videos at the top of pages are served by Vercel Blob (storage in Frankfurt). The site's content and messages are kept by Convex, in Ireland. Fonts are hosted on the site: Google's servers aren't contacted to display text. The language comes from the page address (/nl, /en): there is no language cookie.

Legal basis: my legitimate interest in providing a safe, working site (Article 6(1)(f)). Retention: that of Vercel's technical logs [period to be checked].

This part only concerns people who have access to the admin area, or who ask for it. The site keeps the administrators' email addresses, their passwords in an unreadable (hashed) form and their login sessions (Convex Auth). An access request sent from the login page (name, email, message) is emailed to the administrators (Resend), then accepted or refused. Legal basis: my legitimate interest in managing and securing the site's administration (Article 6(1)(f)). Retention: accounts, as long as access is open; access requests, 1 year after the decision (or after they were sent if no decision is made), then deleted automatically.

Some items are essential: they remember your choices or make what you ask for work, and serve no other purpose. The others are only set with your consent. There are no advertising cookies and no language cookie.

When it loads, the analytics tool checks that your browser's storage works: it writes a test value and deletes it immediately. Nothing is kept.

• Form messages (site database): 2 years after receipt, then deleted automatically.
• IP address fingerprint (protection against abuse): 24 hours at most.
• Email sending log (Resend): 30 days.
• Messages in my mailbox: [period to be confirmed by Simon].
• Statistics (PostHog): 2 years at most.
• Your cookie choice: 6 months.
• Statistics identifier (after consent): 6 months at most, deleted as soon as you withdraw your consent.
• Host's technical logs: [period to be checked].
• Admin accounts: as long as access is open.
• Admin access requests: 1 year after the decision.

I don't sell or rent your data, show ads or make automated decisions about you. Only these technical providers have access to it, on the publisher's behalf:

• Vercel Inc. (United States): hosting, BotID protection, ambient videos;
• Convex, Inc. (United States): the site's database, hosted in Ireland;
• Resend (United States): sending emails, from Ireland;
• PostHog (United States): statistics, hosted in Frankfurt;
• my mailbox [OVHcloud, France: to be confirmed].

When you play a video, Google (YouTube) also receives data, under its own responsibility.

Transfers outside the European Union. Even when data is hosted in the European Union, these US companies or their own subprocessors may access it from the United States, for example for technical support. The site's server-side processing takes place in the United States. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for certified companies (Vercel, Resend, PostHog, Google), and on the European Commission's standard contractual clauses in their contracts (Convex, PostHog).

At any time, you can: access your data and get a copy; have it corrected; have it deleted; restrict its use; receive it in a common format to pass it on to someone else; object to its use based on legitimate interest, in particular to cookieless measurement; withdraw your consent, without affecting what was done before.

To do so, write to me at contact@cavproduction.com. I reply within one month, extendable by two months if the request is complex (I'll let you know). It's free. If I have reasonable doubts about your identity, I may ask you to confirm it.

Statistics don't allow me to identify you, so I can't find your data in them from your name or email address. "Manage cookies" lets you decide what is measured.

If you believe your data isn't handled properly, you can lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels · +32 2 274 48 00 · contact@apd-gba.be · www.dataprotectionauthority.be. If possible, write to me first: I'll sort it out.

I update this page when the site changes (new tool, new use of your data). The version number and date are at the top of the page, and previous versions are kept. If a change concerns the cookies that need your consent, I'll ask you again.