6. Privacy Policy: Personal Data Protection (GDPR & LGPD)

6.1 Cross-Border Compliance Commitment

Posto 5 Agency is committed to ensuring that the collection and processing of your data, carried out via the website https://posto5agency.com, comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) and Brazilian Law No. 13,709/2018 (LGPD).

6.2 Data Controller

The entity responsible for the processing of personal data is Posto 5, represented by its co-founders, Manuel Besse and Pénélope Fiorindi. DPO (Data Protection Officer)

Contact: agency@posto5.com

6.3 Nature of Collected Data

Within the framework of its prestige activities (Audits, Fine Art Sales, Reportage), Posto 5 collects the following categories of data:

Identification Data: First name, last name, title, and professional position (for Haute Couture/Press clients).

Contact Data: Mailing address (billing/delivery), email address, and phone number.

Transactional Data: Order history for prints and payment terms (excluding bank details, which are processed by PCI-DSS certified providers).

Technical Data: IP address, connection logs, and browsing data (via cookies).

6.4 Purposes and Legal Basis for Processing

The processing of your data is necessary for:

Performance of Contract (Art. 6.1.b GDPR): Managing print orders, organizing reportage assignments, and tracking exhibition leases.

Legitimate Interest (Art. 6.1.f GDPR): Responding to requests for quotes, targeted business development (Luxury/Art sectors), and website security.

Consent (Art. 6.1.a GDPR): Sending the agency’s newsletter (photographer updates, gallery openings).

Legal Obligations: Retention of invoices and accounting documents.

6.5 International Transfers and Confidentiality

Collected data is strictly intended for internal use by Posto 5. Within our bi-national organization, data is processed exclusively by the Posto 5 team between our Paris and Rio de Janeiro offices, in accordance with uniform security standards that meet European requirements. No data is transferred to commercial third parties. Our technical partners (high-security hosting, art logistics) are rigorously selected for their compliance with data protection standards and their level of confidentiality.

6.6 Data Retention Period

Client Data: Retained for the duration of the contractual relationship, plus the statutory limitation periods (5 years in France).

Prospect Data: Deleted after 3 years of no interaction from the prospect.

Accounting Documents: Retained for 10 years (French legal requirement).

6.7 Your Rights (Access, Rectification, Erasure)

In accordance with European (GDPR) and Brazilian (LGPD) legislation, you have the following rights:

Right of Access and Portability: To obtain a copy of your data in a structured format.

Right to Rectification and Update: To correct any inaccurate information.

Right to Erasure ("Right to be Forgotten"): To request the deletion of your personal data.

Right to Object or Restrict Processing: To limit the use of your information.

Right to Provide Post-Mortem Instructions: To arrange for the disposition of your data after your passing.

To exercise these rights: You may contact our legal department at: agency@posto5.com. A response will be provided within a maximum of 30 days.

Right to Lodge a Complaint: If, after contacting us, you believe your rights are not being respected, you may file a complaint with the competent supervisory authority:

In France: The CNIL (Commission Nationale de l'Informatique et des Libertés) at www.cnil.fr.

In Brazil: The ANPD (Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.

6.8 Cookie Management, Data Security, and Trackers

The website https://posto5agency.com uses cookies to improve the user experience and analyze traffic.

Technical Cookies (Necessary): Essential for site functionality (session, security). These cannot be deactivated.

Audience Measurement Cookies: Used to understand navigation and optimize the site’s EEAT (Experience, Expertise, Authoritativeness, and Trustworthiness).

Social Media Cookies: Activated only if you interact with sharing modules. Consent Management: A cookie banner allows you to accept, decline, or customize your choices upon arrival. You can change your preferences at any time via the "Cookie Management" link at the bottom of the page.

Posto 5 implements high-level technical and organizational security measures (SSL encryption, restricted access, firewalls) to protect data against intrusion, loss, or alteration, particularly regarding information related to confidential projects.