RGPD

Personal data

Courtesy translation. This English text is provided for convenience only. The French version of this page is the binding one; in case of any discrepancy, the French text prevails.

Preamble

This privacy policy describes how sho-slave.xxx processes its visitors' personal data, in strict compliance with Regulation (EU) 2016/679 (the "GDPR") and French Act no. 78-17 of 6 January 1978 as amended (the "Data Protection Act").

sho-slave.xxx is a personal and artistic site, non-commercial in nature, dedicated to documenting an adult practice (BDSM, bondage, latex, chastity). It offers no sale of goods or services and carries out no transaction or payment. Data collection on it is reduced to the strict minimum.

Warning. This site is strictly reserved for persons of full age (18 and over). By accessing it, you state that you are of full age under the law applicable to you.

Our guiding principle is minimisation: we collect only what is indispensable, for a specific purpose, for a limited period, and we never use your data for any other end.

1. Data controller

The controller of personal data is the publisher of sho-slave.xxx.

  • Controller: ShoSlave (pseudonym — non-professional publisher)
  • Address: disclosed on legitimate request from the authorities; the publisher's full identity is held by the host (Art. 6-III-2 LCEN)
  • Contact (single channel): [email protected]

For any question about this policy or about exercising your rights, this e-mail address is the single point of contact.

2. Data collected

The site works without any public user account and collects only the data strictly necessary for it to function:

  • Newsletter sign-up: your e-mail address, together with the date and technical proof of your consent (double opt-in).
  • Contact form: the information you choose to send us (e-mail address and the content of your message). We ask you not to send any sensitive or superfluous data.
  • Technical audience-measurement data: aggregate and anonymous statistics, with no cookie and no personal identifier (see section 4).

No other category of data is collected. In particular, the site collects no sensitive data within the meaning of Article 9 of the GDPR through its forms.

3. Purposes and legal basis

Each processing operation rests on a specific legal basis:

Processing Purpose Legal basis (GDPR)
Newsletter Sending you the site news and publications you subscribed to Consent (Art. 6(1)(a)), obtained by double opt-in
Contact form Receiving and replying to your message Legitimate interest (Art. 6(1)(f)) in replying to an approach you initiated
Anonymous audience measurement Understanding overall traffic to the site Cookieless and anonymous measurement, not an identifying processing operation (Art. 6(1)(f), legitimate interest, with no individual tracking)

You are never required to provide your data: newsletter sign-up and use of the contact form are entirely optional.

4. Cookieless audience measurement

Traffic to the site is measured using eTrack, a solution self-hosted within the European Union.

  • No cookie is set on your device for this purpose.
  • The statistics produced are aggregate and anonymous: they do not allow you to be identified or tracked from one site to another.
  • No individual profile is built.

In accordance with the applicable guidelines, this strictly anonymous, cookieless audience measurement does not require your prior consent and therefore displays no consent banner.

5. No profiling, no resale, no advertising

We expressly undertake that your data will be subject to none of the following:

  • profiling or automated decision-making producing effects concerning you;
  • sale, rental, exchange or transfer to third parties, on any basis whatsoever;
  • targeted advertising, advertising trackers or data brokerage;
  • use for any purpose other than those described in this policy.

As the site is non-commercial, there is no commercial interest in using your data beyond the stated purposes.

6. Recipients of the data

Your data is intended for the site's publisher alone. It is disclosed to no third party, with the exception of technical processors strictly necessary for the site to function (hosting, e-mail delivery, newsletter sending service), acting on the controller's instructions and bound by confidentiality and GDPR-compliance commitments (Art. 28).

These providers are located in the European Union. The delivery and protection network sitting in front of the site (Cloudflare, CDN/proxy) processes technical connection data for security and performance purposes only.

  • Host: OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France — https://www.ovhcloud.com
  • E-mail delivery: Amazon Web Services — Amazon SES, eu-west-3 region (Paris, France).
  • Newsletter: Notifuse, a self-hosted solution within the European Union — holds the e-mail address and language of confirmed subscribers, and is used to send campaigns.
  • Electronic signature of session contracts: DocuSeal, a self-hosted instance within the European Union.

Your data may in addition be disclosed to an administrative or judicial authority where the law so requires.

7. Retention periods

Your data is kept for the period strictly necessary for the purposes pursued:

  • Newsletter e-mail address: until you withdraw your consent (unsubscribe), after which it is deleted or kept solely on a suppression list so that you are no longer contacted.
  • Contact form messages: for as long as it takes to handle your request, then for a period not exceeding 12 months for follow-up purposes, before deletion.
  • Audience statistics: kept in anonymous and aggregate form only.

At the end of these periods, the data is deleted or irreversibly anonymised.

8. Security

We implement appropriate technical and organisational measures to protect your data against any unauthorised access, alteration, disclosure or destruction:

  • encryption in transit (HTTPS/TLS protocol);
  • restricted access to the data, limited to the publisher and protected by authentication;
  • hosting within the European Union and use of GDPR-compliant providers;
  • collection limited to the strict minimum, which correspondingly reduces exposure.

As no system is infallible, we cannot guarantee absolute security, but we endeavour to maintain it according to the state of the art.

9. Transfers outside the European Union

No transfer of your personal data is made outside the European Union. Hosting and technical processors are located in the EU. Should that situation change, it would be covered by the appropriate safeguards provided for by the GDPR (Chapter V) and this policy would be updated.

10. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data at any time:

  • right of access: to obtain confirmation that your data is being processed and to receive a copy of it;
  • right to rectification: to have inaccurate or incomplete data corrected;
  • right to erasure (the "right to be forgotten"): to request the deletion of your data;
  • right to object: to object to processing based on legitimate interest;
  • right to restriction of processing;
  • right to portability: to receive your data in a structured, machine-readable format;
  • right to withdraw your consent at any time for the newsletter, without calling into question the lawfulness of the processing carried out before that withdrawal (an unsubscribe link appears in every mailing).

How to exercise them: send your request to [email protected]. We may ask you to prove your identity in the event of reasonable doubt. You will receive a reply within one month, extendable by two months where the request is complex.

11. Complaint to the CNIL

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL):

  • CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
  • www.cnil.fr

If you are resident in another EU Member State, you may also lodge a complaint with your own national supervisory authority.

12. Changes to this policy

This privacy policy may be updated to take account of legal, technical or editorial developments. The applicable version is the one published on this page.

Last updated: 20 August 2026