Privacy Policy

1. Who is responsible for processing your data

The data controller for information collected on this site is:

2. What data we collect and why

We collect only the data necessary to provide our services. For each processing activity, we specify the legal basis under Article 6 of the GDPR.

Creating a customer account

Data collected: first name, last name, email address, password (encrypted).
Legal basis: performance of contract (Article 6.1.b GDPR).

Placing an order

Data collected: first name, last name, shipping and billing address, phone number, email address, order history.
Legal basis: performance of contract (Article 6.1.b GDPR), legal accounting obligations (Article 6.1.c GDPR).

Payment

No payment data is stored on our servers. Transactions are processed directly by our payment providers (Stripe, PayPal, Alma), who are solely responsible for the security of that data.

Newsletter

Data collected: email address, first name (optional).
Legal basis: consent (Article 6.1.a GDPR), which can be withdrawn at any time via the unsubscribe link in each email.

Contact form

Data collected: name, email address, message content.
Legal basis: legitimate interest in responding to your request (Article 6.1.f GDPR).

Customer support via Telegram (Replain)

If you contact us via our customer chat powered by Replain and Telegram, your conversation is transmitted to our team. No additional personal data is collected beyond what you voluntarily share with us.
Legal basis: legitimate interest in responding to you (Article 6.1.f GDPR).

3. How long we retain your data

4. Who we share your data with

Your data is never sold, rented or exchanged. It may be transmitted to:

• OVH SAS (France), our hosting provider, which hosts the site and database.
• Mailrelay (Spain, EU), for sending our newsletter.
• Stripe Payments Europe (Ireland, EU), for card payments.
• PayPal (Europe) S.à r.l. (Luxembourg, EU), for PayPal payments.
• Alma SAS (France), for instalment payments.
• Telegram Group Inc. and its subsidiaries (see section 5), for customer chat exchanges.
• Carriers: Colissimo, Mondial Relay, Chronopost, for order deliveries.

All our European service providers are contractually committed to GDPR compliance.

5. Transfers of data outside the European Union

If you use our customer chat powered by Telegram, your messages pass through Telegram's servers, whose legal entities are based in the British Virgin Islands (Telegram Group Inc., Telegraph Inc.) and Dubai, UAE (Telegram FZ-LLC). Telegram governs these transfers through standard contractual clauses approved by the European Commission, in accordance with Article 46 of the GDPR.

6. Cookies

Our site uses only the following cookies:

Strictly necessary cookies (placed without consent, in accordance with Article 82 of the French Data Protection Act):

• Session cookie to maintain your shopping cart
• Language preference cookie
• Logged-in user session cookie

We do not use any advertising cookies, third-party analytics tools (Google Analytics or otherwise), or social media cookies.

You can delete cookies at any time through your browser settings.

7. Your rights

Under the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

• Right of access: know what data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure (right to be forgotten): request deletion of your data, within the limits of legal retention obligations.
• Right to restriction of processing.
• Right to data portability: receive your data in a structured, readable format.
• Right to object to processing, particularly for direct marketing.
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to define directives regarding the retention, deletion and communication of your data after your death.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL (French Data Protection Authority): 3 place de Fontenoy, 75007 Paris, or via cnil.fr.

8. Data security

We implement appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS / TLS), restricted data access, regular backups, hosting on secure OVH infrastructure (France).

No system is infallible. In the event of a data breach likely to result in a risk to your rights and freedoms, we will inform you and notify the CNIL in accordance with Article 33 of the GDPR.

9. Changes to this policy

This policy may be updated to reflect legal or technical changes. The date of the last update is shown at the top of this page. We encourage you to check it regularly.

10. Contact