Privacy

Contact form. Your name, email address and message.

Merch enquiry form. Your name, email address, the size and quantity you asked about, and any message you add.

Your IP address. When you submit a form, your IP address is held in the server's memory for up to one hour and used only to count submissions and block spam. It is never stored on disk, never linked to your message, and disappears on its own.

Form submissions are used for one thing: to read your message and reply to it. Nothing is sold, rented, or used for advertising, and you will not be added to a mailing list.

Under the GDPR, the legal basis is your request to be contacted (Article 6(1)(b), steps taken at your request before any agreement) and, for the spam limiting above, legitimate interest in keeping the site usable (Article 6(1)(f)).

Resend delivers the form as an email. Google hosts the inbox it arrives in, and Vercel hosts the site itself and keeps short-lived server request logs. These providers process the data on Cécile Gardens's behalf and may store it outside the EU, including in the United States.

Nobody else receives your details. Links out to Spotify, Instagram, Facebook, YouTube and TikTok are ordinary links — once you follow one, that platform's own privacy policy applies.

There are none. This site sets no cookies, runs no analytics, and embeds no tracking pixels or advertising scripts. Fonts, images, audio and video are served from this domain rather than fetched from a third party, so simply reading the site does not report you to anyone.

Enquiry emails stay in the inbox for as long as they are useful for answering you and keeping track of bookings, and are deleted after that. Ask and yours will be deleted sooner.

You can ask for a copy of what is held about you, ask for it to be corrected or deleted, or object to it being used. Email cecile.gardens@gmail.com and it will be handled within one month. There is no charge.

If you are in the EU or the UK and think your data has been mishandled, you can complain to your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens. In Australia, that is the Office of the Australian Information Commissioner.

This site is not aimed at children, and the forms are not intended for anyone under 16.

If how this site handles your information changes, this page changes with it and the date at the top is updated.