● REC
← Back to archive
Legal

Privacy Policy

Last updated: July 10, 2026

Article 1 - Data controller

This Privacy Policy explains how personal data is collected and processed when you use the website gda6.art (the “Website”), operated by the independent art project Ghost Data Archive · GDA6 (the “Seller”), in accordance with the General Data Protection Regulation (GDPR) and applicable French data protection law.

Contact: contact@gda6.com. Full legal entity details are available upon request and are shown on every invoice.

Article 2 - Data we collect

We collect only the data necessary to process your order and operate the Website:

  • Identification & contact: name, email address, shipping address, and phone number if you provide it.
  • Order data: the Products ordered, amounts, and order history.
  • Payment data: processed directly by our payment provider (Stripe). We never receive or store your full card details.
  • Technical & usage data: IP address, device and browser information, and data collected through cookies (see our Cookie Policy).
  • Communications: the content of any message you send us.

Article 3 - Why we collect it (purposes & legal bases)

  • To process, produce, ship and track your order and provide customer service - performance of the contract.
  • To take payment and prevent fraud - contract / legitimate interest / legal obligation.
  • To meet our accounting and tax obligations - legal obligation.
  • To send you marketing emails, only if you have opted in - your consent.
  • To keep the Website secure and to measure and improve it - legitimate interest, and your consent for non-essential cookies.

Article 4 - Who we share it with

We share data only with the service providers needed to run the Website and fulfil orders, acting on our instructions as processors:

  • Stripe - payment processing;
  • Our fulfilment partner and carriers - production, packing and shipping;
  • Our hosting provider - hosting of the Website;
  • Our email tool - order and (if applicable) marketing emails.

We never sell your personal data.

Article 5 - International transfers

Where a provider processes data outside the European Union / EEA, we ensure appropriate safeguards are in place (such as the European Commission's Standard Contractual Clauses).

Article 6 - How long we keep it

  • Order and customer data: for the duration of our relationship, then archived to meet legal accounting and tax obligations (up to 10 years for invoices);
  • Marketing data: until you unsubscribe, or after 3 years of inactivity;
  • Cookies: for the durations set out in our Cookie Policy.

Article 7 - Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict and port your data, to object to certain processing, and to withdraw your consent at any time. To exercise these rights, email contact@gda6.com. You also have the right to lodge a complaint with the French supervisory authority, the CNIL.

Article 8 - Security

We take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. Payments are secured by our payment provider.

Article 9 - Changes

We may update this Privacy Policy from time to time. The version in force is the one published on the Website at the date of your visit.

Article 10 - Contact

For any question about this Policy or your personal data, contact us at contact@gda6.com.