Your GDPR Rights
1. Your GDPR rights
In accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act, you have the following rights regarding your personal data at any time: • Right of access (art. 15) — obtain a copy of all personal data we hold about you. • Right to rectification (art. 16) — correct any inaccurate or incomplete data. • Right to erasure / 'right to be forgotten' (art. 17) — request deletion of your data, subject to our legal retention obligations. • Right to restriction of processing (art. 18) — temporarily freeze a processing you contest. • Right to data portability (art. 20) — receive your data in a structured, commonly used, machine-readable format (JSON). • Right to object (art. 21) — object to processing based on legitimate interest or to profiling. • Right to withdraw consent (art. 7-3) — at any time, for processing based on consent. • Right not to be subject to automated decision-making (art. 22) — including profiling, where it produces legal effects or significantly affects you.
2. How to exercise your rights
You may exercise your rights through two channels: • Self-service from your personal area /account/data-rights: you can request a full export of your data in JSON format (right of access and portability) and initiate the deletion of your account (right to erasure). • By email to dpo@wishpride.com for any other request (targeted rectification, objection, restriction, withdrawal of consent, contestation of automated decision). Clearly state your request, your account identifier, and attach a copy of an ID document (only where necessary to resolve a reasonable doubt about your identity — GDPR art. 12(6)).
3. Response deadlines
In accordance with article 12(3) of the GDPR, we respond to your request within one (1) month from receipt. This period may be extended by two (2) additional months in case of complex requests or high request volume; we will inform you within the initial month with the reasons for the extension. For the right to erasure, deletion is effective immediately (account deactivated) with a 30-day grace period during which you can cancel your request, then permanent deletion.
4. Free of charge
The exercise of your GDPR rights is entirely free. In accordance with article 12(5) of the GDPR, we may charge or refuse a request only if it is manifestly unfounded or excessive, particularly due to its repetitive character. In such a case, we will provide written reasons for our decision and any charge will strictly correspond to actual administrative costs.
5. Reasoned refusal
If we do not act on your request, we will inform you within one month with the reasons for refusal and the available remedies (complaint to the CNIL and judicial remedy). Possible grounds for refusal include in particular: inability to identify the requester, manifestly unfounded request, conflict with a legal retention obligation (for example obligation to retain billing data, CSAM moderation logs, or data necessary for the defence of a right in court).
6. Complaint to the CNIL
If you consider that your rights are not respected, you may lodge a complaint with the competent French supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy — TSA 80715 75334 PARIS CEDEX 07, France Phone: +33 1 53 73 22 22 Online form: https://www.cnil.fr/en/plaintes If you reside in another EU Member State, you may also lodge a complaint with the supervisory authority of your place of residence (list at https://edpb.europa.eu).
7. Judicial remedy
Independently of a complaint to the CNIL, you have the right to an effective judicial remedy (GDPR art. 79). In France, the competent civil court is either that of the place where the data controller has an establishment (Montpellier) or that of your habitual place of residence, at your choice.
8. Data Protection Officer (DPO)
As WishPride is published by a small sole proprietorship, the formal designation of a Data Protection Officer (DPO) is not mandatory under article 37 of the GDPR (the cumulative conditions of article 37(1)(b) and (c) on 'systematic large-scale monitoring' and 'large-scale processing' of special categories are not met in V1). However, given the nature of the data processed (kink-soft orientations and preferences that may fall under the 'sex life' category within the meaning of article 9 of the GDPR), we will appoint a certified external DPO upon exceeding significant thresholds (indicatively: 5,000 active users, or 10,000 cumulative registrations). In V1, the GDPR contact point is Damien Altman, publisher, reachable at dpo@wishpride.com.