1. Data controller

The data controller for personal data collected via bevesper.com is:

EDXAD LLC
Delaware File Number 3503122
8 The Green, Suite B, Dover, DE 19901, USA
Contact: contact@bevesper.com

EDXAD LLC operates the commercial brand BeVesper. This document explains what personal data we collect, for what purpose, how we use it, with whom we share it, and what your rights are.

2. Applicable legal framework

This policy complies with:

• Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR") for persons residing in the European Union;
• The French "Informatique et Libertés" law of January 6, 1978 as amended, for persons residing in France;
• Personal data protection rules applicable in other states of residence of the persons concerned.

3. Data collected

We collect only the data strictly necessary for the execution of our services.

Category of data	Source	Purpose
Email address	Order form	Sending the payment link, correspondence related to the order
Username	Order form	Display on the personalized page
Provided photo	Upload by the Client	Display on the personalized page, cropping adjustment
WhatsApp / Telegram / phone number	Order form	Redirection of visitors from the page to the contact channel
Opening message	Order form	Pre-filling the message sent by visitors
Campaign parameters	Order form	Service configuration (plan, duration, traffic type, promotional code)
Technical data	Site navigation	Security, fraud prevention, anonymized statistics

We do not collect any sensitive data within the meaning of Article 9 GDPR (health data, biometric identification data, political opinions, religious beliefs, sexual orientation, etc.), except insofar as such information could be inferred from the context of the service, in which case its processing is based on your express consent materialized by the validation of the order.

4. Legal basis for processing

Each processing operation is based on one of the legal grounds provided for in Article 6 GDPR:

• Contract performance (Art. 6.1.b) — for all data strictly necessary for the provision of the ordered service;
• Consent (Art. 6.1.a) — for the use of the photo, username, and contact information on the personalized page, as well as for any optional processing;
• Legal obligations (Art. 6.1.c) — for data retention for accounting and tax purposes;
• Legitimate interest (Art. 6.1.f) — for site security, fraud prevention, and anonymized audience measurement.

5. Retention periods

We retain your data for the following periods:

• Active order data — throughout the duration of the campaign;
• Photo and page parameters — deleted within 7 days after the end of the campaign, or immediately upon your request;
• Email and order history — 3 years after the last order, for commercial follow-up purposes and recognition of returning clients;
• Accounting and tax data — 10 years from the closing of the relevant fiscal year, in accordance with applicable legal obligations;
• Technical logs — 12 months maximum, for security purposes.

6. Data recipients

Your data is accessible only to authorized personnel of EDXAD LLC and to its subprocessors strictly necessary for the execution of the service:

Subprocessor	Role	Location
Cloudflare, Inc.	Hosting of the site and personalized pages, attack protection	United States
Formspree, Inc.	Order form processing	United States
Wise Payments Ltd.	Payment processing	United Kingdom, European Union
Third-party advertising networks	Traffic delivery to the personalized page	European Union, United States

Each of these subprocessors is subject to its own data protection obligations. We do not authorize any processing of your data beyond the purposes described above.

We do not sell your personal data.

7. International transfers

Some subprocessors are located outside the European Union, notably in the United States. Transfers to these providers are governed by the mechanisms provided for by the GDPR, notably:

• Standard contractual clauses adopted by the European Commission;
• Adherence to the Data Privacy Framework (DPF) where applicable;
• Additional contractual safeguards based on identified risks.

8. Data security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of communications via TLS (HTTPS);
• Access control to data;
• Anonymization or pseudonymization where possible;
• Logging of access to sensitive data;
• Regular backups.

No system being perfectly secure, we cannot guarantee absolute security. We will inform you as soon as possible in case of a data breach affecting your personal information.

9. Your rights

In accordance with the GDPR and applicable laws, you have the following rights:

• Right of access — obtain confirmation that your data is being processed and receive a copy;
• Right to rectification — correct inaccurate or incomplete data;
• Right to erasure — request the deletion of your data (within the limits of legal retention obligations);
• Right to restriction of processing — request the temporary suspension of processing;
• Right to data portability — receive your data in a structured, machine-readable format;
• Right to object — object to processing based on legitimate interest;
• Right to withdraw consent — withdraw your consent at any time when processing is based on it;
• Right to define post-mortem directives concerning the fate of your data after your death.

These rights are exercised free of charge, by email to: contact@bevesper.com

We will respond to your request within a maximum period of one month, possibly extended by two months in case of complexity. We may ask you for proof of identity if reasonable doubt remains as to the identity of the requester.

10. Complaint to a supervisory authority

If you consider that the processing of your data does not comply with the applicable regulations, you have the right to file a complaint with the competent supervisory authority of your country of residence.

In France, this authority is the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr

11. Cookies and similar technologies

The bevesper.com site uses a minimal number of technical cookies strictly necessary for its operation (for example: session management, language preference memorization). These cookies do not require prior consent within the meaning of the GDPR and the ePrivacy Directive.

We do not use advertising cookies, third-party tracking cookies, or behavioral tracking systems on bevesper.com.

Personalized pages published for Clients contain audience measurement mechanisms for the purpose of verifying traffic delivery. These mechanisms are anonymized and do not allow individual identification of visitors.

12. Minors

Our services are strictly reserved for adults. We do not knowingly collect personal data concerning minors. If we discover that a minor has provided personal data, we immediately proceed with its deletion and cancel any associated order.

13. Modifications to this Policy

We reserve the right to modify this Privacy Policy to reflect legislative, technical, or operational developments. The date of the last update appears at the top of the document. We encourage you to review this page regularly.

14. Contact

Any question relating to this Privacy Policy can be sent to:

EDXAD LLC — BeVesper
contact@bevesper.com