Privacy Policy

Last updated: 19 October 2026

This policy explains what personal data is collected on katia-belam.com, why, how long it is kept, and how to exercise your rights. It complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés). It supplements the legal notice and the cookie policy.

1. Who is responsible for your data?

Data controller: Katia Belam, publisher of the site.

Technical management and contact for your data: Louis Simeon, sole trader, who builds and runs the site on behalf of Katia Belam. He acts as a data processor under the GDPR and handles requests about your data.

2. What data is collected, and why?

Contact form

  • Data: your name, email address, message, and any information you choose to provide in the form.
  • Purpose: to answer your request (information, booking, collaboration proposal).
  • Legal basis: steps taken at your request before entering into a contract or, for other messages, legitimate interest in replying.
  • Retention: for as long as needed to handle your request, then up to 12 months after the last exchange.
  • Your message is sent by email through OVH’s mail server.

Newsletter

  • Data: your email address and, if you provide it, your name.
  • Purpose: to send you news about Katia Belam (releases, performances, projects).
  • Legal basis: your consent, given when you sign up.
  • Retention: until you unsubscribe, and no later than 3 years after your last interaction with the newsletter.
  • Your data is sent to Brevo, our mailing tool, only when you submit the sign-up form. Every newsletter includes a link to unsubscribe at any time.

Audience measurement

  • Data: pages viewed, visit duration, device and browser type, approximate location. Your IP address is not stored by Google Analytics.
  • Purpose: to understand how the site is used in order to improve it.
  • Legal basis: your consent, collected through the cookie banner.
  • Retention: cookies last up to 13 months, and statistics are kept for 14 months.
  • Tool: Google Analytics. No measurement takes place if you decline.

Form protection against bots

  • Data: IP address and technical information about your browser.
  • Purpose: to tell human visitors from bots and block spam.
  • Legal basis: legitimate interest in protecting the site.
  • Retention: one-off processing, with no long-term storage by the site.
  • Tool: Cloudflare Turnstile.

Site security

  • Data: IP address, requested pages, connection date and time.
  • Purpose: to detect and block malicious behaviour (attacks, intrusion attempts, abusive bots).
  • Legal basis: legitimate interest in keeping the site secure.
  • Tools and retention:
    • CrowdSec: IP addresses showing malicious behaviour may be shared with CrowdSec’s community network, to protect other sites.
    • OVH hosting logs: kept for up to 12 months.

Share buttons

  • Data: IP address and technical information about your browser, sent when the buttons load.
  • Purpose: to let you share a page on social networks.
  • Legal basis: legitimate interest in making content easy to share.
  • Tool: AddToAny. Once you click on a social network, that network’s terms apply.

Security badge

  • Data: IP address, sent when the badge is displayed.
  • Purpose: to display the badge of the site’s security certificate.
  • Legal basis: legitimate interest.
  • Tool: Certum.

Embedded content

YouTube videos and Spotify players on the site load only after you agree in the cookie banner. Once loaded, these services may set their own cookies, under their own privacy policies.

3. Who has access to your data?

Your data is never sold or rented. It is accessible only to Katia Belam, to Louis Simeon for technical management, and to the following providers, each for its own service:

  • OVH (France): site hosting and sending the site’s emails
  • Brevo (France): sending the newsletter
  • Google (Ireland / United States): audience measurement and YouTube videos
  • Spotify (Sweden): embedded audio players
  • Cloudflare (United States): form protection
  • CrowdSec (France): site security
  • AddToAny (United States): share buttons
  • Certum (Poland): security badge

4. Transfers outside the European Union

OVH, Brevo, CrowdSec, Spotify and Certum process data within the European Union. Google, Cloudflare and AddToAny may transfer some data to the United States. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s standard contractual clauses.

5. Cookies

The site uses:

  • technical cookies needed for it to work (language choice, remembering your cookie preferences);
  • with your consent only, audience measurement cookies and third-party content (YouTube videos, Spotify players).

You can change your choices at any time from the cookie settings link at the bottom of every page. Details are in the cookie policy.

6. Your rights

You have the following rights over your data:

  • access: find out what data is held about you;
  • rectification: correct inaccurate data;
  • erasure: ask for your data to be deleted;
  • restriction: temporarily freeze the use of your data;
  • objection: object to processing based on legitimate interest;
  • portability: receive your data in a reusable format;
  • withdrawal of consent: at any time, without affecting processing already carried out;
  • instructions after death: decide what happens to your data after you die.

To exercise these rights, write to louis.simeon@posteo.com. You will receive a reply within one month. Proof of identity will only be requested if there is reasonable doubt about your identity.

If you believe your rights have not been respected, you can file a complaint with the French data protection authority, the CNIL: www.cnil.fr.

7. Minors

The site is not specifically aimed at minors. A minor may only sign up for the newsletter with parental consent if they are below the age of digital consent in their country: 15 in France, and 16 by default under the GDPR. If data has been collected without this consent, it will be deleted as soon as we become aware of it.

8. Security

The site is fully encrypted (HTTPS). It is protected by a web application firewall and an attack detection system, and its forms are protected against automated submissions. Access to the site’s administration is restricted to authorized people.

9. Automated decisions

No decision with legal effects on you is made by fully automated means, and no profiling is carried out.

10. Changes

This policy may be updated, for example when a new service is added. The date of the last update is shown at the top of the page.

Scroll to Top