Last updated: September 15, 2026
This page explains which personal data are processed when you visit profelaine.com, when you write to me and when you subscribe to my newsletter, why, for how long, and how to exercise your rights.
1. Who is responsible for your data?
Elaine Ramos, sole trader (entrepreneur individuel, EI) registered in France, teacher of French as a foreign language.
Email for your requests: elaine.ramos@profelaine.com
Further information about the website’s publisher is given in the legal notice.
2. In short
- The website places no cookies or trackers on your device while you browse: no audience measurement, no advertising, no embedded social media buttons.
- Your data are never sold or rented and are not used for advertising.
- The contact form is only used to reply to your request and, if you wish, to offer you lessons.
- You only receive the newsletter if you subscribe and confirm your subscription. You can unsubscribe at any time using the link included in every newsletter.
3. Contact form
Data: your name, your email address and your message. When you send it, the following are added automatically: date and time, the address of the page, your browser type and your IP address.
Why: to reply to your request and, if you wish, to offer you lessons.
Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). For requests sent on behalf of a company (for example a relocation agency): my legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).
How: your message is sent by email, from the website’s server, to my professional mailbox (Microsoft 365). Since 13 September 2026, each message is also saved in the website’s database.
Retention: if you do not become a student, your message and our exchanges are deleted 3 years after our last exchange. If you become a student, they are kept for the duration of the lessons, then for 3 years after the lessons end; invoices are kept for 10 years for accounting obligations.
Messages received in 2025: messages received between March and September 2025 through the website’s old form (with the IP address and browser type) are kept in the website’s database. They follow the same rule: they are deleted 3 years after our last exchange.
If you write to me directly at the email address shown on the website, your message reaches the same Microsoft 365 mailbox and follows the same retention periods.
4. Newsletter
Data:
- your email address (your first name is not requested);
- the list or lists you are subscribed to (French, English or Portuguese list, depending on the page where you subscribed);
- the date, time and IP address of your subscription and of your confirmation.
Why: to send you my newsletter. It is sent in French to all subscribers, whichever page they subscribed on. It contains:
- language points: a useful structure, explained with examples from everyday or professional life;
- exam news: TCF IRN, TCF Canada, TEF Canada, DELF and DALF, with sample topics and method tips;
- news about my lessons: new conversation workshops and updates on my lessons, in Paris and online;
- the French-speaking world: an article or a piece of news about life in France, Quebec and beyond.
Legal basis: your consent (Article 6(1)(a) GDPR). The subscription box is never ticked in advance. After sending the form, you receive an email with a confirmation link: without that click, you receive no newsletter. Unconfirmed subscriptions are deleted automatically after 30 days.
No tracking of opens or clicks: I do not measure whether the newsletter is opened or whether its links are clicked.
New subscription notice: for each new confirmed subscription, I receive a notice containing the email address of the person who subscribed. This notice is sent to elaine.ramos@profelaine.com, my professional mailbox (Microsoft 365).
Protection against abuse: to prevent mass sign-ups by bots, the IP address used to subscribe is also kept for 30 days in an anti-abuse register, and the form may display a captcha hosted on the website itself (no external service, no cookie).
Unsubscribing: every newsletter contains an unsubscribe link, which opens a page where a single button confirms that you want to unsubscribe, without any login or password. If your email program shows an “Unsubscribe” button, it takes effect at once.
Sending the messages: newsletters are sent through the MailPoet sending service, owned by Automattic. For each mailing, MailPoet receives your email address and the content of the message. According to MailPoet, sending logs are deleted automatically after 3 months. For people in the European Economic Area, the responsible Automattic entity is Aut O’Mattic A8C Ireland Ltd. (Grand Canal Dock, 25 Herbert Place, Dublin, D02 AY86, Ireland). Data may be transferred outside the European Union, in particular to the United States; Automattic states that it relies on the European Commission’s standard contractual clauses for these transfers. Automattic privacy policy: https://automattic.com/privacy/
Where your data are: the subscriber list is stored in the website’s database, on its server (see section 9).
Retention: as long as your subscription is active. After you unsubscribe, your address is kept for 3 years with the status “unsubscribed”, only to make sure you no longer receive the newsletter; addresses whose 3-year period has ended are deleted during the check carried out every year in January. You may ask for complete erasure of your data at any time.
5. Cookies and trackers
During a visit, the website places no cookies and uses no trackers on your device (checked on 13 September 2026 on 8 pages of the website). This is why there is no consent banner. If a service that places cookies were ever added, a banner would first ask for your consent and this page would be updated.
- Audience measurement: none.
- Fonts: they are hosted on the website’s server; your browser does not contact Google Fonts.
- Social media: the Instagram, Facebook and LinkedIn icons are simple links. No content from these networks is loaded unless you click; after a click, the policy of that network applies.
- Newsletter: subscribing places no cookie.
- Website administration: only the accounts that manage the website (myself and my technical provider) receive login cookies when they sign in to the administration area.
6. Instagram posts
The home page may display my latest Instagram posts. The website’s server retrieves them from Instagram (Meta) using my own account; your browser does not contact Instagram to display them and no data about you are sent to Meta.
7. Testimonials
The website publishes testimonials (first and last name, and sometimes job title, employer or city). Anyone can ask for their testimonial to be removed at any time by writing to elaine.ramos@profelaine.com.
8. Server logs and protection against attacks
Data: like any website, the server records each visit in technical logs: IP address, date and time, page requested, response code, referring page and browser type.
Why: to keep the website secure (detect and block attacks) and fix technical problems. Legal basis: my legitimate interest in protecting the website and its visitors (Article 6(1)(f) GDPR).
Retention: 90 days for the web server access logs, then automatic deletion; 30 days for the server’s system log.
Newsletter links: the confirmation, unsubscribe and subscription management links contain, in an encoded but not encrypted form, your email address and a token specific to your subscription. When you click one of them, the full link address is recorded in the access logs, like any page requested, and follows the same retention period (90 days).
Automatic protection (CrowdSec): software analyses these logs on the server and blocks, for 4 hours, IP addresses that behave like attackers; its local alerts are kept for 7 days at most. When a known attack is detected, the IP address involved, the date and the type of attack are sent to the company CrowdSec (20 rue Maurice Arnoux, 92120 Montrouge, France), which uses them to maintain a shared list of malicious addresses; the logs themselves are not sent. A normal visit triggers no transmission. According to its privacy policy, CrowdSec acts as a joint controller, keeps these addresses in its active list for 3 months at most, then makes them progressively less precise until they are anonymised after one year at the latest, and uses hosting providers (AWS, Google Cloud) with standard contractual clauses for any transfer outside the European Union. CrowdSec privacy policy: https://www.crowdsec.net/privacy-policy
9. Hosting, providers and recipients
Only the following people and companies have access to your data, and only to the extent relevant to their role:
- Myself, Elaine Ramos: messages, newsletter, testimonials.
- WS Agency (WS Agency SAS, 47 rue Vivienne, 75002 Paris, France): design and technical maintenance of the website, administration of the server on my behalf; technical access to the server and database.
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France): rental of the server that hosts the website, its database and logs. This server is located in OVH’s data centre in Gravelines (France).
- Microsoft (Microsoft 365): my professional mailbox, which receives the contact form messages and the notices of new newsletter subscriptions (section 4).
- Automattic (MailPoet): sending the newsletter (section 4).
- CrowdSec: IP addresses of detected attacks (section 8).
Backups: the website’s database is copied every day on the server itself. Backups are kept for 7 days at most.
10. Security
The website is only available over an encrypted connection (HTTPS). Server administration is restricted to a private network, the server is protected by a firewall and by the automatic attack detection described above, and GPS coordinates are removed from photos uploaded to the website.
11. Your rights
At any time you may ask to access your data, to have them corrected or erased, to restrict their use and to receive the data you provided in a machine-readable format (portability), and you may object to processing based on my legitimate interest. Where processing is based on your consent, you may withdraw it at any time, without affecting what was done before. You may also give instructions about what happens to your data after your death (Article 85 of the French Data Protection Act, loi Informatique et Libertés).
To exercise these rights, write to elaine.ramos@profelaine.com. I reply within one month. If there is reasonable doubt about your identity, I may ask for proof.
If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL, online at www.cnil.fr or by post to: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
12. Changes
This page is updated whenever the processing described changes. The date of the last update is shown at the top of the page. This page is a translation of the French version; in case of any difference, the French version prevails.