1. Data controller
The personal data controller is:
Céline GIACHERO
Sole trader
Email: contact [at] prepashow.com
2. Data collected
Prepashow collects the following data:
- Account data: email, first name, last name, password (hashed), organisation, preferred language, phone (optional)
- Payment data: handled by Stripe (Prepashow stores neither card number nor CVV). Stripe customer/subscription/invoice IDs are kept for billing.
- Business data: information about shows (name, structure), directories (dancers, costumes, sets), uploaded files (MP3s, photos, logos)
- Technical data: IP address, login dates, error logs (kept for diagnostics)
Third-party data (dancers, collaborators). When you enter information about your dancers or collaborators in Prepashow (first name, last name, photo, etc.), you are the data controller for this data and Prepashow acts as a data processor in the GDPR sense. You agree to inform the data subjects that their data is entered on the platform and to obtain, where applicable, their consent (in particular for photos of minors: parental authorization).
3. Legal bases and purposes
The processing of your data is based on the following legal grounds:
- Performance of the contract: providing the service, account management, billing, user support
- Legitimate interest: service security (rate limiting, anti-fraud logs), product improvement (aggregated analyses)
- Compliance with legal obligations: keeping billing data for 10 years (French Commercial Code)
Concretely, your data is used to:
- Provide the service (access, show management, PDF exports, ZIP)
- Manage the contractual relationship (billing, support)
- Send notifications necessary for the service (email verification, password reset, invitations, renewal reminders)
- Improve the service (aggregated and anonymized analyses)
No data is used for commercial prospecting or shared with third parties.
4. Retention period
- Active account: as long as the account is active
- Deleted account: immediate deletion from the production database and uploaded files. Data may, however, persist in our encrypted backups for a residual period of 30 days before being permanently overwritten.
- Billing data: kept 10 years after the last transaction (legal obligation, French Commercial Code)
- Technical logs: 12 months maximum
- Tokens (password reset, email verification, invitations): automatically purged on expiration
5. Subcontractors and transfers outside the EU
Data is stored and processed by the following subcontractors:
- OVH SAS (France): hosting (application server, database, uploaded files). Data stored exclusively within the European Union.
- Stripe Payments Europe Ltd (Ireland): payments and billing. Stripe may transfer some data to the United States (Stripe Inc.); these transfers are governed by the Standard Contractual Clauses of the European Commission, ensuring an adequate level of protection compliant with GDPR.
- Brevo (formerly Sendinblue) (France): sending of transactional emails (verification, reset, invitations, reminders).
6. Your rights
In accordance with GDPR and the French Data Protection Act, you have the following rights:
- Access: consult the data concerning you
- Rectification: have inaccurate data corrected
- Erasure: request deletion of your data (except for legal obligations)
- Portability: retrieve your data in a usable format
- Objection / Restriction: object to or restrict certain processing
To exercise these rights, write to contact [at] prepashow.com. We will respond within one month.
You also have the right to lodge a complaint with the CNIL (French data protection authority).
7. Cookies
Prepashow uses a single technical cookie: the session cookie that keeps you logged in. No advertising cookies and no third-party tracking are used.
8. Security
Your data is protected by:
- Mandatory HTTPS connection
- Hashed passwords (bcrypt / argon2 algorithm)
- Daily database backups
- Hosting in France (OVH)
9. Contact
For any question regarding your personal data: contact [at] prepashow.com