Who controls your data
The data controller for talking-portfolio.com and Talking Portfolio orders is:
Sonja Laser, Entrepreneur individuel (EI)
Trading name: Talking Portfolio
SIRET: 411 500 275 00044
59 rue de Ponthieu, Bureau 326
75008 Paris, France
Email: hey@talking-portfolio.com
There is no appointed Data Protection Officer because the current scale and type of processing do not require one. Privacy requests still go to the email address above.
What we collect
When you browse
The web host may process technical logs such as IP address, date and time, requested page, browser or device information, referring page, and security events. This is normal server housekeeping, not a dossier about your personality.
When you contact us
We process your name, email address, message, attachments, and the history needed to answer you.
When you order
We process the details supplied through Bumpsale and Stripe, which may include your name, email address, billing country or address, order identifier, the referral link used (if any), amount, currency, transaction status, receipt, and limited payment details such as card type and last four digits. We do not receive or store your full card number or security code.
During Intake and delivery
We process the purchase email and receipt or order ID used to match your order, your answers, project links, text, images, files, portfolio and social links, persona material, permissions, AI-representation consent, revision feedback, communications, and delivery status.
Please do not send special-category or highly sensitive personal data unless it is genuinely necessary and we have agreed a safe, lawful way to handle it first.
For monthly Rent
We process Stripe customer and subscription identifiers, billing dates, payment status, invoices, cancellation requests, portfolio address, usage totals needed to apply fair-use limits, and support history.
Why we use it
| Purpose | Typical data | Legal basis |
|---|---|---|
| Answer questions and prepare an order | Contact details, message, requested service | Steps requested before a contract |
| Take payment and confirm the order | Identity, email, order and transaction data | Performance of the contract |
| Build, revise, deliver, host, and support the portfolio | Intake, content, permissions, service records | Performance of the contract |
| Invoice, account, and meet tax duties | Identity, billing, payment and invoice data | Legal obligation |
| Secure the site, prevent abuse, and defend legal claims | Logs, transaction status, communications | Legitimate interests in security, fraud prevention, and legal defence |
| Send a future newsletter | Email and consent record | Consent, collected separately |
Required checkout and Intake fields are needed to enter or perform the contract. Without them, we may not be able to accept the order, match payment to a buyer, or build the portfolio. Optional fields are marked as such.
There is no automated decision-making that produces legal or similarly significant effects about you.
International transfers
Some suppliers, including Bumpsale and parts of Stripe's global organisation, may process data outside the European Economic Area. Different privacy laws may apply there.
Where EU data-protection law requires a transfer safeguard, the relevant supplier and Talking Portfolio rely on an applicable adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism, together with appropriate security measures. You may ask for information about the safeguards relevant to your data by emailing hey@talking-portfolio.com.
How long we keep it
| Data | Normal retention |
|---|---|
| Unsuccessful enquiries and prospective-customer correspondence | Up to 3 years after the last meaningful contact |
| Order, contract, delivery, complaint, and customer correspondence | For the customer relationship, then up to 5 years where needed to establish or defend legal claims |
| Invoices and accounting records | 10 years from the end of the relevant accounting period, as required by French law |
| Intake assets and working files | For the active service and 30-day offboarding period; residual backups are deleted or overwritten within 90 days unless law or a dispute requires longer |
| Security and access logs | Up to 12 months, unless an incident requires longer retention |
| Newsletter consent, if introduced | Until consent is withdrawn; inactive prospect details are removed after 3 years unless consent is renewed |
Some data may be held longer where required by tax, accounting, court, fraud-prevention, or other legal duties. When a retention period ends, data is deleted, anonymised, or placed in a restricted legal archive.
Your data rights
Depending on the processing and applicable law, you may have the right to:
- access personal data held about you;
- correct inaccurate or incomplete data;
- ask for deletion;
- restrict certain processing;
- object to processing based on legitimate interests or direct marketing;
- receive certain data in a portable format;
- withdraw consent at any time, without affecting earlier lawful processing; and
- complain to a data-protection authority.
Send a request to hey@talking-portfolio.com. We may ask for enough information to verify your identity and find the relevant records. We normally respond within one month, subject to lawful extensions for complex requests.
You can complain to the French supervisory authority, the Commission Nationale de l'Informatique et des Libertés (CNIL), or to the competent authority where you live or work.
Some rights are not absolute. For example, invoice data cannot be deleted while French law requires it to be kept.
Security
Talking Portfolio uses proportionate technical and organisational measures such as access controls, reputable payment processing, encrypted connections, updates, backups, tenant separation, service limits, and restricted access to customer material.
No internet service is risk-free. If a personal-data breach is likely to create a risk to people, it will be assessed, documented, and reported to the CNIL and affected people where the law requires.
Children
Talking Portfolio is a professional creative service and is not directed to people under 18. Please do not place an order or send Intake material if you are under 18. If we learn that a child's data was collected improperly, we will delete it where the law permits.
Policy changes
This policy will be updated when the landing page, Intake flow, newsletter, portfolio infrastructure, or suppliers materially change. The date at the top will change too.
Material changes affecting active customers will be communicated by email or a clear site notice where appropriate. A new purpose that requires consent will not be smuggled in through a rewritten paragraph.