Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

Mireille Carrisi
Vaitele St
Apia
Samoa
Email: mail@mireille-carrisi.com

2. General Information and Scope

This Privacy Policy explains how personal data is collected and processed when you visit this website, apply as a model using the application form at app.mireille-carrisi.com, or contact Mireille Carrisi by email or WhatsApp, for example to send a booking request. Personal data means any information relating to an identified or identifiable natural person, such as a name, email address, phone number, photo, IP address, or communication content.

Mireille Carrisi is based in Samoa and works with models and clients worldwide, including in the European Union. Where the General Data Protection Regulation (GDPR) applies to the processing of your personal data, the information in this Privacy Policy is provided in accordance with it, and the legal bases referred to below are those of the GDPR.

Personal data is processed only where there is a lawful basis and only to the extent necessary for the purposes described below.

3. Hosting and Server Log Files

This website is hosted by RackNerd LLC, USA, on a server located in the United States. The hosting provider processes data only on behalf of Mireille Carrisi and to the extent necessary to provide the server. All connections to the website are encrypted (HTTPS).

When you access this website, your browser automatically transmits technical information to the web server, which records it in server log files. These log files contain your IP address, the date and time of access, the requested page or file (URL), the HTTP status code, the amount of data transferred, the referrer URL (the page you came from, if transmitted by your browser), and the user agent, which usually identifies your browser type and version and your operating system.

This information is processed to make the website available, maintain technical stability and security, prevent misuse, and diagnose errors. It is not used to create user profiles and is not combined with other data sources. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the website.

Server log files are deleted automatically after 14 days, unless further retention is required to investigate a specific security incident or for legal reasons.

4. Contact by Email

If you contact Mireille Carrisi by email, the personal data contained in your message, including your email address, name, and any information you provide voluntarily, will be processed to respond to your enquiry and manage the related communication.

The legal basis is Article 6(1)(b) GDPR if the communication relates to a contract or pre-contractual request, and Article 6(1)(f) GDPR for other enquiries. The legitimate interest is responding to messages and maintaining professional communication.

Email correspondence is retained for as long as necessary to handle the enquiry and any related business relationship, and longer where statutory retention duties or legitimate documentation interests apply.

5. Contact via WhatsApp

This website contains links to WhatsApp (wa.me). These are ordinary links: no WhatsApp content is embedded in this website, and no data is transmitted to WhatsApp simply by visiting it. Data is only transmitted when you click a WhatsApp link, which opens WhatsApp or its website.

If you contact Mireille Carrisi via WhatsApp, the following data is processed: your phone number, your WhatsApp profile name and, depending on your settings, your profile photo and status, as well as the content of your messages, including any photos or files you send. This data is used to respond to your message and, where applicable, to handle your booking request. The legal bases are Article 6(1)(b) GDPR for contract-related or pre-contractual communication and Article 6(1)(f) GDPR for other enquiries; the legitimate interest is offering a convenient and widely used way to get in touch.

WhatsApp is a service of WhatsApp Ireland Limited (for users in the European Region) or WhatsApp LLC, USA (for users elsewhere), which are part of Meta. WhatsApp processes data in connection with the use of its service as a separate controller under its own terms and privacy policy. In particular, WhatsApp processes metadata (such as phone numbers and the time of messages) and may transfer data to the United States and other countries. Message content is end-to-end encrypted. For details, please see WhatsApp's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea (European Region) and https://www.whatsapp.com/legal/privacy-policy (other regions).

If you prefer not to use WhatsApp, you can always contact Mireille Carrisi by email instead.

6. Model Applications

Applications to be represented as a model are made only through the application form of the agency's web application at app.mireille-carrisi.com. Applications by email or WhatsApp are not accepted. If you apply using the form, the following personal data is processed: your name, email address, phone number, age, height, weight, gender, the place where you live, information about your modelling experience (optional), and three photos of you (close-up, full body, posed). The time of your application and your confirmations (privacy policy, information about working with the agency, age) are stored as well. The web application runs on the same server in the United States as this website (RackNerd LLC, see section 3).

This data is processed to assess your application and to decide whether representation is possible, and to communicate with you about it. The legal basis is Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Where you voluntarily provide additional information that is not required for the application, the legal basis is your consent under Article 6(1)(a) GDPR, which you can withdraw at any time.

Application data is used only to assess your application and is not passed on to clients or other third parties without your agreement.

After submitting the application you receive an email with a confirmation link, and the application can only be processed once you have confirmed your email address. The verification code in this email is stored until the application is deleted.

Mireille Carrisi only represents models aged 18 and over. Please do not apply if you are under 18. Applications that turn out to come from persons under 18 are deleted.

An application that has not been answered is deleted automatically, including all photos, 4 weeks after it was submitted. If your application is declined, your application data, including photos, is deleted no later than 4 weeks after the decision. It is only kept longer if you have agreed to this, for example so that you can be considered for future opportunities. You can ask for your application to be deleted at any time. If representation is agreed, your data is processed further as part of the representation relationship.

7. Client Briefs and Booking Requests

If you send a brief or booking request on behalf of a client or company, the information you provide is processed, such as your name, company, position and contact details, as well as project details (client, concept, dates, location, usage and budget). This data is used to handle your request, propose suitable talent and, where applicable, prepare and carry out the booking.

The legal basis is Article 6(1)(b) GDPR where you are the contracting party yourself, and otherwise Article 6(1)(f) GDPR. The legitimate interest is communicating with business contacts and handling bookings. Booking-related correspondence and records are retained for as long as needed to handle the booking and for as long as statutory retention obligations (for example under tax or commercial law) require.

8. Fonts and Third-Party Requests

The fonts used on this website (DM Sans and Playfair Display) are hosted on this website's own server. When you open a page, all files are loaded from mireille-carrisi.com; no requests are made to third-party servers such as font or content delivery providers. Third-party services are only contacted if you actively click an external link, for example to WhatsApp (see section 5).

9. Cookies, Analytics and Tracking

This website does not use cookies, does not store any information in your browser (such as local storage), and does not use analytics tools, advertising trackers, social media plugins, or embedded third-party content such as videos or maps. The small script on this website is used only for the navigation menu and display effects and does not collect any data.

If this changes, this Privacy Policy will be updated accordingly and, where required, consent will be requested before such technologies are used.

10. Legal Bases

Where the GDPR applies, personal data is processed on the following legal bases, as indicated in the sections above:

• Article 6(1)(a) GDPR (consent), where you have given consent, for example to keep your application on file for future opportunities;
• Article 6(1)(b) GDPR (contract and pre-contractual steps), for example to handle applications, booking requests and representation;
• Article 6(1)(c) GDPR (legal obligation), where statutory retention duties apply;
• Article 6(1)(f) GDPR (legitimate interests), for example for the secure operation of this website and for general enquiries.

11. Recipients and Service Providers

Personal data may be processed by technical service providers that support the operation, hosting, maintenance, or security of this website and related communication systems, such as the hosting provider of this website (RackNerd LLC, USA, see section 3) and the provider of the email service. These providers process data only to the extent necessary for their services. When you use WhatsApp, WhatsApp processes data as a separate controller (see section 5).

Personal data is not sold. Data is disclosed to third parties only where necessary for the purposes described in this Privacy Policy, where required by law, or where you have given consent.

12. International Data Transfers

Mireille Carrisi is based in Samoa, which is outside the European Economic Area (EEA). If you contact Mireille Carrisi from the EEA, your personal data is therefore transferred to Samoa, for which there is no adequacy decision by the European Commission. Where these transfers are necessary to handle your enquiry, application or booking at your request, they are based on Article 49(1)(b) GDPR.

This website is hosted on a server in the United States (RackNerd LLC, see section 3), so the data processed when you visit the website, such as server log data, is processed in the United States. If you contact Mireille Carrisi via WhatsApp, data may also be processed in the United States and other countries (see section 5). Where the GDPR applies and personal data is transferred outside the EEA, appropriate safeguards are used where required, such as adequacy decisions, standard contractual clauses, or other legally recognized transfer mechanisms.

13. Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. The specific retention periods for server log files and applications are described in sections 3 and 6. After the relevant retention period expires, personal data is deleted or anonymized.

14. Your Rights

Depending on the applicable data protection law, and in particular where the GDPR applies, you have the following rights regarding your personal data:

• the right of access to your personal data (Article 15 GDPR);
• the right to rectification of inaccurate data (Article 16 GDPR);
• the right to erasure (Article 17 GDPR);
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability (Article 20 GDPR);
• the right to object to processing based on legitimate interests (Article 21 GDPR);
• the right to withdraw consent at any time with effect for the future (Article 7(3) GDPR).

To exercise your rights, please contact mail@mireille-carrisi.com.

15. Right to Lodge a Complaint

If the GDPR applies and you believe that the processing of your personal data infringes it, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement (Article 77 GDPR). A list of the supervisory authorities in the EU is available from the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

16. Security

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, loss, misuse, or alteration. Connections to this website are encrypted using HTTPS. Please note that communication by email can involve security risks and cannot be guaranteed to be completely secure.

17. Contact for Privacy Questions

If you have any questions about this Privacy Policy or the processing of your personal data, please contact Mireille Carrisi at mail@mireille-carrisi.com or by post at the address given in section 1.

18. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in legal requirements, technical developments, or the operation of this website. The version published on this page is the current version.