Privacy policy
Last updated: 15 June 2026
This policy describes how stage21.fr processes personal data, in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and French data protection law.
1. Data controller
The data controller is STAGE 21 (SAS), 10 rue des Danys, 06110 Le Cannet, France, whose details appear in the legal notice. Contact for any data question: contact@stage21.fr.
2. Processing, legal bases and retention
| Processing | Legal basis | Retention |
|---|---|---|
| Order and customer relationship management | Performance of the contract (art. 6.1.b) | Duration of the relationship + legal obligations |
| Invoicing and accounting | Legal obligation (art. 6.1.c) | 10 years |
| Newsletter | Consent (art. 6.1.a), double opt-in | Until withdrawal / inactivity (~3 years) |
| Audience measurement cookies | Consent (art. 6.1.a) | 13 months (cookie) / 25 months (results) |
| Child health data (Bordeaux, art. 9) | Contract + parental consent on sensitive data | Deletion 30 days after the camp |
| Image rights consent | Consent (art. 6.1.a), separate | Until withdrawal |
3. Recipients and sub-processors
Data is processed by the organiser and by sub-processors bound by a data processing agreement (DPA):
- Supabase: database and authentication (EU region hosting, Ireland).
- Vercel: website hosting (USA).
- Stripe: payment processing (USA / EU).
- Resend: sending transactional e-mails and the newsletter (USA).
4. Transfers outside the European Union
Some sub-processors (Vercel, Stripe, Resend) are established in the United States. Transfers are framed by appropriate mechanisms (European Commission standard contractual clauses and/or the Data Privacy Framework). Supabase hosts data in the EU region.
5. Minors’ health data (Bordeaux camp)
Health data collected to supervise a minor (allergies, individual care plan, emergency contact) is sensitive data within the meaning of Article 9 GDPR. Accordingly:
- it is collected with the legal guardian’s consent;
- it is stored in a dedicated table, encrypted at rest, isolated from order data, and accessible only to authorised supervising staff;
- it is never sent to the payment provider or to e-mailing tools;
- it is deleted within 30 days of the end of the camp at the latest.
6. Cookies
The site favours cookieless, identifier-free audience measurement. Only cookies strictly necessary for operation (session, payment security) are set without consent. Any audience measurement cookie subject to consent is only set after your agreement, collected via the consent banner (refusing is as easy as accepting, with no pre-ticked boxes). You can change your choice at any time: .
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time and to set instructions regarding your data after your death. To exercise them, write to contact@stage21.fr.
- Erasure / anonymisation: the customer’s identity is anonymised, while keeping the invoices that the law requires to be retained for 10 years.
- Minor’s health data: effectively deleted at term or upon early request.
- Portability: export of your order and account data on request.
You may also lodge a complaint with the French data protection authority (CNIL: www.cnil.fr).
8. Security
The organiser implements appropriate technical and organisational measures (encryption of sensitive data, access control, logging) to protect data against unauthorised access.