Privacy policy
Draft document. Every [TO BE PROVIDED] block must be completed and legally reviewed before going live.
Data controller
[TO BE PROVIDED — identity and contact details.]
Data collected
Orders: name, email, phone, addresses. Account: profile and addresses. Contact and newsletter: email. No card data is stored by the site (payment handled by PayPal).
Purposes & legal bases
Performance of the contract (orders, account), legitimate interest (answering requests), consent (newsletter).
Retention periods
[TO BE PROVIDED — order data is kept per accounting obligations, generally 10 years.]
Processors
PayPal (payment), Supabase (database/storage), Brevo (email), Vercel (hosting). [TO BE PROVIDED — data location, transfer safeguards outside the EU.]
Your rights
Access, rectification, erasure, objection, portability, restriction. To exercise your rights: [TO BE PROVIDED — dedicated email]. You may lodge a complaint with the CNIL.