Privacy Policy
Last updated: 14 June 2026
This policy explains how personal data is handled on robincartier.com, including contact enquiries, De:Coded newsletter subscription and feedback, optional analytics, content recommendation measurement, and future paid digital-product flows. Fields marked “to complete” must be completed before any checkout, large-scale paid offer, or broader commercial launch.
Data controller
- Controller: Robin Cartier / commercial entity to complete.
- Business registration: SIRET/SIREN to complete if applicable.
- Postal address: to complete before commercial launch.
- Contact: hello@robincartier.com
Processing inventory
| Activity | Data processed | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Site operation and security | Server logs, IP address, browser data, security events, consent choices. | Run the website, protect forms, prevent abuse, remember privacy choices. | Legitimate interest, legal obligation where applicable, and strictly necessary service operation. | Host/security log retention to complete. Consent choices are stored for up to 180 days. |
| Contact enquiries | Name, email address, message, form metadata, Cloudflare Turnstile validation data. | Reply to enquiries and manage pre-contractual or professional requests. | Legitimate interest and pre-contractual steps at your request. | Normally up to 24 months after the last exchange unless a legal obligation requires longer. |
| De:Coded newsletter subscription | Email address, first name, opt-in timestamp, consent version, source, UTM parameters, double opt-in status, analytics and personalisation consent choice. | Send the requested De:Coded newsletter, confirm subscription, maintain a consent record, and understand which acquisition sources work when consent allows it. | Consent for the newsletter. Separate consent for analytics and personalisation. | Until unsubscribe, then suppression details retained as needed to respect opt-out and evidence consent history. |
| Newsletter unsubscribe and suppression | Email address submitted on the unsubscribe form, hashed email in the consent ledger, unsubscribe timestamp, source, UTM parameters, optional reason, suppression status. | Record and honour unsubscribe requests, keep the CRM current, prevent future newsletter sends, and sync downstream email providers. | Legal obligation and legitimate interest in maintaining suppression records; consent withdrawal where applicable. | Suppression records are retained as long as needed to avoid re-contact and demonstrate compliance. |
| Newsletter feedback and CSAT | Issue ID, rating, optional verbatim, topic/module, experiment arm, acquisition source, consent segment, optional subscriber hash when analytics consent allows it. | Improve De:Coded quality and identify useful or low-value content. | Consent or explicit action when you submit feedback. Passive analytics are not used for personalisation or optimisation unless analytics/personalisation consent is recorded. | Feedback retention to complete; aggregate learnings may be kept without directly identifying subscribers. |
| Analytics and journey measurement | Page title, page URL, source/medium, device/browser data, engagement events, GA4 identifiers. | Understand whether content, SEO/GEO work, newsletter journeys, and user journeys improve authority and lead generation. | Consent. | GA4 retention setting to complete; recommended baseline is 14 months unless business needs require less. |
| Content recommender telemetry | Source page title/category/URL, recommended item title/category/URL, experiment name, test/control population, impressions, clicks, fallback/error events. | Improve relevance, measure incremental value, and learn whether recommendations help users discover useful content or LinkedIn. | Consent. | Aggregate performance records to complete. No recommender telemetry runs before analytics consent. |
| Paid products or services, if launched | Identity, billing details, payment reference, invoice data, support history. | Sell, deliver, invoice, support, and comply with accounting obligations. | Contract and legal obligation. | Accounting and invoice data retained for statutory periods; details to complete before launch. |
Processors and recipients
Personal data may be processed by the website host and WordPress stack, self-hosted n8n automation, Google Workspace/Sheets for the consent and operational ledgers, Mailchimp as the newsletter email provider, Google Site Kit/Google Analytics only after analytics consent, Cloudflare Turnstile for form protection, and email hosting used to answer enquiries. If you click external links such as LinkedIn, GitHub, or YouTube, those services process your visit under their own policies.
Mailchimp is used to send the newsletter and manage provider-side delivery, bounces, complaints, profile updates, and unsubscribe state. Robin Cartier keeps a first-party consent ledger so consent and suppression history remains auditable and portable if newsletter vendors change.
International transfers
Some providers may process data outside the European Economic Area. Where this happens, the site should rely on appropriate legal safeguards such as adequacy decisions, standard contractual clauses, or provider-specific transfer mechanisms. Provider-level details must be completed as contracts are confirmed.
Cookies and optional tracking
Strict opt-in applies. Non-essential analytics, marketing tags, recommender tracking, feedback beacons, and experiment storage stay off unless you choose to allow them. You can change your choice at any time through the “Cookie settings” link in the footer. See the Cookie Policy.
Newsletter delivery may still require essential operational events such as unsubscribe, bounce, complaint, and suppression handling. Optional newsletter analytics or personalisation signals are used for optimisation only when you have consented to analytics and personalisation.
Your rights
Under GDPR, you may request access, rectification, erasure, restriction, portability, and objection where applicable. You may withdraw consent at any time for consent-based processing. You can unsubscribe from De:Coded at /de-coded/unsubscribe/. To exercise other rights, contact hello@robincartier.com. You may also lodge a complaint with the French data protection authority, the CNIL.
Contact forms
Contact forms do not use a generic marketing consent checkbox. Messages are handled to answer your enquiry. Newsletter subscription uses a separate unchecked opt-in and double opt-in.
Children
This website is intended for professional and general-audience use and is not directed at children.
Updates
This policy may be updated when providers, features, newsletter flows, or commercial offers change. Major changes should trigger a new consent version where tracking purposes change.