Courtesy translation. This English version is provided for convenience only; the French version is the sole legally binding text.
Legal informationPrivacy & cookies
Last updated: 12 September 2026. This policy explains what data is collected on the winter way. site, why, and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
Data controller
The data controller is winter way. (Lou Winter), whose full contact details appear in the legal notice. Dedicated contact for personal data:
Data you provide to us
Data is collected only when you provide it voluntarily, in two cases:
a) The quotation-request form, in order to prepare a suitable proposal:
- Name, email address, telephone number and town/city
- Your answers to the qualification questionnaire (type of project, rooms concerned, situation, objectives, timeframe and indicative budget)
- The content of the message describing your project
- Where applicable, the photos you choose to attach to illustrate the space concerned
b) Newsletter sign-up: your email address only, collected with your explicit consent (tick box) and revocable at any time via one-click unsubscribe.
Audience measurement — cookie-free and anonymous
To understand site traffic (pages viewed, number of visitors), winter way. uses an internal audience-measurement system, with no cookies and no external service. No data enabling you to be identified is retained:
- Your IP address is never stored: for the duration of a single visit it is used only to compute an anonymous identifier that changes every day and cannot be traced back to you.
- No tracking from one day to the next, no profiling, no advertising.
- The data never leaves the site’s server and is not passed on to any third party.
As this measurement is strictly anonymous, it does not require a cookie-consent banner (in accordance with the CNIL’s recommendations on privacy-friendly statistics).
Purposes
The form data is used exclusively to respond to your quotation or information request, and to manage the business relationship if an assignment goes ahead. The audience statistics are used solely to improve the site.
Legal basis, purpose by purpose
Each processing operation rests on its own legal basis:
| Processing | Purpose | Legal basis | Retention |
|---|---|---|---|
| Quotation request form | Prepare and send a proposal | Pre-contractual steps taken at your request (GDPR art. 6(1)(b)) | 3 years after the last contact |
| Photographs attached to a request | Assess the space and price the work | Pre-contractual steps taken at your request (art. 6(1)(b)) | Deleted 12 months after the request if no assignment follows |
| Follow-up of a booked assignment | Perform the contract, invoice | Performance of the contract (art. 6(1)(b)) and accounting obligations (art. 6(1)(c)) | Statutory accounting and tax periods (10 years) |
| Newsletter | Send you the updates you signed up for | Your consent (art. 6(1)(a)), withdrawable at any time | Until you unsubscribe, then 3 years as proof of consent |
| Anonymous audience measurement | Understand how the site is used | Legitimate interest (art. 6(1)(f)) — anonymous, no cross-referencing | 25 months maximum |
| Server technical logs | Security, abuse detection, fault diagnosis | Legitimate interest (art. 6(1)(f)) | 30 days, then automatic deletion |
| Where your visit came from | Know which channel introduced you to winter way. | Legitimate interest (art. 6(1)(f)) — see the dedicated section below | With the quotation request it is attached to |
Form fields marked as required are those without which a proposal cannot be prepared: leaving them empty prevents the request from being sent, with no other consequence. All other fields are optional.
Where your visit came from
When you arrive on the site from a search engine, a social network or an advertising link, that information is held for the duration of your visit in your browser’s memory (sessionStorage), then attached to your request if you complete the quotation form. It lets winter way. know which channels genuinely make her work known.
Three points, because this is the only processing on the site that writes anything into your browser besides the opt-out cookie:
- the information disappears as soon as you close the tab; it allows no tracking from one visit to another, nor across sites;
- it reaches winter way. only if you send a quotation request — without that, it is never collected;
- once attached to a named request it is no longer anonymous: it is then covered by the same rights as the rest of your request, and kept for the same period.
You can object to it by declining audience measurement (button further down): declining also switches off the recording of where your visit came from.
Server technical logs
Like any web server, the one hosting this site automatically records, for each request, the IP address, the date, the page requested and the browser used. These logs are used solely for security and technical diagnosis; they are neither used commercially nor cross-referenced with quotation requests. They are deleted automatically after 30 days.
Data recipients
The data submitted via the quotation form and the newsletter email address is stored directly on the site’s server (sovereign hosting, with no third-party tool such as Google Forms) and can be consulted only by winter way. within its secure administration area. Photos attached to a request are never published or publicly accessible. No data is sold, rented or transferred to third parties for commercial purposes.
Hosting and transfers outside the European Union
The website and its database are hosted on a dedicated machine located in France, at OVH SAS (2 rue Kellermann, 59100 Roubaix). No sub-processor is involved in the site itself: no audience analytics service, no external form, no social media button. Your form answers and any photos you attach are stored directly on that server, in France, and do not leave it.
Email, however, follows a different path, and we would rather say so plainly. Messages are sent from the winter-way-organizing.com domain, hosted by OVH in France. But the address at which winter way. receives messages and new-enquiry notifications is currently a Google (Gmail) mailbox: the name, contact details and message you send are therefore processed by Google, whose servers may be located outside the European Union, under the safeguards provided for by the GDPR (EU–US adequacy decision of 10 July 2023).
In short: what you type on the site stays in France; what is notified by email goes through Google. If you would rather avoid that route, you can reach us by telephone — the number is in the legal notice.
No profiling, no automated decision-making
No processing carried out on this site involves profiling, scoring, or any decision producing legal effects or significantly affecting you taken by automated means, within the meaning of article 22 GDPR. Quotation requests are read and handled by a person.
Retention period
Requests not followed by an assignment are kept for guidance for 3 years from the last contact; data relating to a completed service follows the statutory accounting and tax retention periods. The audience statistics, being anonymous, do not constitute personal data.
Your rights
In accordance with the GDPR, you have the right to access, rectify, erase and restrict the processing of your data, to object to it, and to data portability. You may also give instructions as to what happens to your data after your death.
Where a processing operation rests on your consent — the newsletter, open-rate measurement, authorisation to use photographs — you may withdraw that consent at any time, as easily as you gave it. Withdrawal does not affect what was done beforehand, and has no bearing on the commercial relationship.
These rights are exercised by writing to . You will receive a reply within one month, extendable by two months for complex requests — you will be told if that happens. Proof of identity is requested only where there is reasonable doubt as to who you are.
winter way. has not appointed a data protection officer: none of the situations making that appointment mandatory (GDPR art. 37) applies — it is not a public body, carries out no large-scale systematic monitoring, and processes no special categories of data at scale. Requests are handled directly by Lou Winter.
If, having contacted us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — or at www.cnil.fr.
Cookies
Objecting to audience measurement
Although this measurement is anonymous and cookie-free, you can object to it at any time. Your refusal is then kept for one year in an opt-out cookie — it contains no identifier, and its mere presence is enough to stop any of your visits being counted from this browser.
Decline audience measurement Restore measurement
Email open-rate measurement
The newsletter may contain an invisible image that reveals whether a message was opened. This is enabled only in two cases: either purely for list hygiene (identifying inactive addresses in order to space out or stop sending — in which case only the date of the last opened email is kept, to the day, replacing the previous one), or to establish an open rate, and then only for people who explicitly ticked the corresponding box when signing up. You can withdraw this consent at any time by replying to one of our emails.
The site sets no cookie, except for the opt-out cookie described above should you choose to enable it: no audience measurement, no advertising, no third-party service. The quotation-request form and the newsletter sign-up are now built into and processed directly on the site’s server — no external module (such as Google Forms) is loaded, and so no third-party cookie is set as a result.
Security
winter way. implements appropriate technical and organisational measures to protect the information submitted: end-to-end encrypted connection (HTTPS with HSTS), hosting on a dedicated and isolated machine, restricted and logged access to the administration area, daily encrypted backups, and regular security updates. Photographs attached to requests are never publicly accessible: they are stored outside the web area and served only to an authenticated person.
In the event of a data breach likely to result in a risk to your rights and freedoms, winter way. notifies the CNIL within 72 hours and informs you directly, without undue delay, where the risk is high (GDPR art. 33 and 34).
Contact
For any question regarding this policy or to exercise your rights: