Privacy policy
Last updated September 28, 2026
This policy explains what personal data the Human Origin Label handles, why, and what rights you have. We collect as little as possible.
Who is responsible
The data controller is the publisher of this website (see the legal notice). For any question or request: contact@lochness-paris.com.
What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Pilot applications: your name, email address, discipline and the links you send us by email | To answer you and organize the review call | Steps taken at your request (GDPR art. 6.1.b) | 12 months after our last exchange if no badge is issued |
| Reviewed creators: name, website, disciplines, work covered, review date and method, a short description of the evidence shown, and the date you accepted the Creator Charter | To publish your verification page and serve your badge | Your consent (art. 6.1.a), which you can withdraw at any time | As long as your badge is active. If revoked, up to 24 months, so the public can see the badge is no longer valid |
| Review recordings you choose to send instead of a video call: screen recordings of your files | To review your creative process | Your consent (art. 6.1.a) | Deleted within 7 days of our decision |
| Badge display records: the domain and page address of websites where a badge image loads, as sent by the visitor’s browser | To detect badges copied without authorization or still displayed after revocation | Our legitimate interest in preventing misuse of the label (art. 6.1.f) | 24 months after the badge was last seen on that page |
What we do not collect
- We do not keep copies of your files. On a video call nothing is sent. If you send a screen recording, we delete it within 7 days of our decision and only keep a note of what we saw.
- We do not store the IP address or any other data about people who visit a page displaying a badge.
- There is no advertising or tracking cookie on this website.
Cookies
Public pages set no cookies. Visit statistics are measured with GoatCounter, which works without cookies and does not track individual visitors across sites. The private administration area uses a single session cookie, strictly necessary to keep the administrator logged in, which does not require consent.
Who else handles the data
- Our hosting provider, OVH SAS, which stores the website and, like any host, keeps technical server logs (including IP addresses) under its own policy.
- Our email provider, for the messages you send us.
- The app you choose to send a recording (Signal, WhatsApp, Threema, Telegram secret chat, Proton Drive or SwissTransfer), under that service’s own privacy policy. Signal, WhatsApp, Threema and Telegram secret chats are end-to-end encrypted.
- GoatCounter, a privacy-friendly analytics service, which receives anonymous page-view data (page, referring site, browser type, screen size, country) to count visits. It sets no cookies and does not build visitor profiles.
- Google Fonts: our pages load fonts from Google’s servers, which receive your IP address in the process. See Google’s privacy policy.
We do not sell or share your data with anyone else. Verification pages are public by design: anyone can read them.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, or to withdraw your consent. Reviewed creators can ask us at any time to remove their verification page; their badge will then stop working. Write to contact@lochness-paris.com; we reply within one month.
If you believe your rights are not respected, you can file a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of the EU country where you live.
Changes
We may update this policy as the program evolves. The date at the top shows the latest version.