Privacy policy

Ludovic Zammit is responsible for the personal information collected on this site, and is the person in charge of its protection under Québec's Law 25. This site follows Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the federal PIPEDA, and the GDPR for visitors from the European Union.

Name

Ludovic Zammit

Email

zamsignled@gmail.com

Nothing is collected until you send a request. After that, the site stores what you give it and what it needs to make and deliver the sign:

• your name, email, phone if you give it, and your notes;
• the sign text, the uploaded SVG logo if any, and a picture of the sign as you designed it;
• your language choice, the delivery choice and, for shipping, the shipping address;
• the name and note you enter when accepting the quote, with the date and time you accepted the terms;
• the Stripe checkout session and payment identifiers (never card data, which stays with Stripe);
• the log of emails the site sent you (date and kind of message).

The site has no customer accounts and never asks for a password.

This information is used to build and price your sign, to send you the quote and status emails, to collect the deposit and the balance, and to deliver. The legal basis is the performance of the contract you are asking for. The server's technical logs (IP address, time, page) serve the security of the site; their basis is Ludovic Zammit's legitimate interest in protecting it.

• Stripe Payments Canada, Ltd., for payment: your email and the amount are passed to it when you open the payment page.
• Google (Gmail), the studio's email service, which carries the messages sent to you.
• Akamai Connected Cloud (Linode), which hosts the site in Toronto, Canada.

Nobody else. Your information is not sold and not shared for advertising.

This site uses no analytics, no advertising and no third-party scripts. Fonts are served from this site. The only outside connection while you design is to this same server.

Three cookies exist, all needed for the site to work:

• lang: the language you chose, kept for 1 year. It is only set when you click FR or EN.
• sd_admin and sd_wa: the workshop administrator's session and passkey challenge. They are only ever set on the workshop's own computer, never on yours.

There is no consent banner because there is nothing to consent to: strictly necessary cookies and a preference you set yourself do not require one.

A finished or cancelled request is anonymised 1095 days (about 3 years) after it closes: name, email, phone, notes, address, acceptance name, mail log, logo and picture are erased. The sign's measurements stay, unlinked from you, for the workshop's statistics. The delay matches how long accounting records must be kept. A request that goes no further is closed as cancelled and follows the same rule.

Server backups are kept for 14 days, in Canada, then overwritten.

You can ask to see your information, to correct it, to have it deleted, or withdraw your consent. If you live in the European Union you also have the right to restrict processing, to portability, and to object to processing based on legitimate interest.

To do so, write to zamsignled@gmail.com. The confirmation page of your request also has a “Request deletion of my data” link that prepares the email with your request number. A deletion asked for while an order is in progress may wait until it is delivered, and the accounting records the law requires are kept for as long as it requires.

If you think your information is being mishandled, you can turn to:

• the Commission d'accès à l'information du Québec;
• the Office of the Privacy Commissioner of Canada;
• the CNIL for residents of France, or the authority of your EU country.

Your information is stored in Canada, which the European Commission recognises as providing adequate protection for organisations covered by PIPEDA. Stripe and Google process part of the data in the United States, under their standard contractual clauses and applicable certifications.

The site is served over HTTPS. The workshop signs in with a passkey and the login form limits attempts. The pages that track your request open for anyone holding their link: share it only with the people concerned. They show the minimum (masked email, town and postal code only).

This policy may change when the site changes. The date at the top shows the current version. Significant changes will be pointed out on this page.