Legal Information
Privacy Policy
Policy applicable to the signet-luxury.store website. Version of [date]. Established in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and amended Law n° 78-17 of 6 January 1978.
1. Data Controller
The controller for the processing described below is:
- [Company Name], [legal form]
- [Full postal address]
- SIRET: [number]
- Contact for all data-related questions: [email address]
[If applicable:] Data Protection Officer: [name and contact details]. The designation of a DPO is not mandatory for an activity of this nature; in their absence, requests are handled at the above address.
2. Data Collected
We only collect data necessary for the purposes described in Article 3. No sensitive data as defined in Article 9 of the GDPR is collected.
| Category | Data Concerned | Origin |
|---|---|---|
| Identity and Contact | Last name, first name, email address, postal address, phone number if provided | Entered by the customer during the order process |
| Order | Ordered products, amount, date, order number, purchase history | Generated by the order |
| Waiver of the right of withdrawal | Timestamped mention of the request for immediate execution and the waiver | Box checked by the customer at the time of purchase |
| Payment | Type of payment method, transaction status, last four digits of the card | Transmitted by the payment provider. Complete bank details are never received or stored by us. |
| Navigation | IP address, pages visited, date and time, browser and device type | Automatically collected during the visit |
| Subscription to announcements | Email address | Voluntarily entered in the subscription form |
3. Purposes and Legal Bases
| Purpose | Legal Basis | Retention |
|---|---|---|
| Process the order, make content available, provide after-sales service | Contract performance (Art. 6.1.b) | Duration of the commercial relationship, then archiving |
| Establish and retain invoices and accounting documents | Legal obligation (Art. 6.1.c) — article L123-22 of the Commercial Code | 10 years from the end of the financial year |
| Retain proof of waiver of the right of withdrawal | Legal obligation and legitimate interest in establishing proof (Art. 6.1.c and 6.1.f) | 5 years from the order date |
| Prevent payment fraud | Legitimate interest (Art. 6.1.f) | Duration necessary for processing, maximum 13 months |
| Send publication announcements to registered persons | Consent (Art. 6.1.a) | Until withdrawal of consent, or 3 years without interaction |
| Measure site audience | Consent, or exemption if the measurement is strictly necessary and anonymized | 13 months for identifiers, 25 months for statistics |
The mandatory or optional nature of each data point is indicated at the time of collection. Data marked as mandatory are necessary for order execution: without them, the order cannot be processed.
4. Recipients and Processors
Data is neither sold, rented, nor transferred to third parties for advertising purposes.
It is accessible only to authorized persons within the publisher, as well as to the following service providers, acting as processors within the meaning of Article 28 of the GDPR:
- Shopify International Limited — site hosting, order and customer database management. Ireland, with processing that may occur in Canada and the United States.
- [Name of payment provider] — transaction processing and fraud prevention.
- [Name of digital delivery application] — sending purchased files.
- [Name of email sending service], if applicable — delivery of publication announcements.
Data may also be communicated to administrative or judicial authorities when required by law.
5. Transfers Outside the European Union
Some providers mentioned in Article 4 are established or operate outside the European Union, particularly in the United States and Canada.
These transfers are governed by appropriate safeguards provided for in Chapter V of the GDPR: standard contractual clauses adopted by the European Commission, adequacy decision where one exists, or certification under the EU-U.S. Data Privacy Framework.
A copy of the applicable safeguards can be requested at [email address].
6. Retention Periods
Retention periods are indicated for each purpose in Article 3. At the end of these periods, data is deleted or irreversibly anonymized, with the exception of documents whose retention is required by law.
7. Your Rights
You have the following rights, under the conditions provided by the GDPR:
- Access — obtain confirmation that data concerning you is being processed, and receive a copy thereof;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure — obtain the deletion of your data, subject to legal retention obligations, particularly accounting;
- Restriction — request the temporary freeze of disputed processing;
- Objection — object to processing based on legitimate interest, for reasons related to your particular situation;
- Portability — receive the data you have provided to us in a structured, machine-readable format;
- Withdrawal of consent — at any time, without affecting the lawfulness of previous processing;
- Post-mortem directives — define the fate of your data after your death, in accordance with Article 85 of the law of 6 January 1978.
These rights can be exercised by email to [email address] or by postal mail to [postal address]. A response will be provided within one month, extendable by two months in case of a complex request. Proof of identity may be requested in case of reasonable doubt about the requester's identity.
You can at any time lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés): CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
8. Cookies and Trackers
A cookie is a file placed on your terminal when you visit a site. The site uses:
- Strictly necessary cookies — maintaining the shopping cart, session, security, remembering your cookie choices. They do not require your consent as the site cannot function without them.
- Audience measurement cookies, if applicable — understanding which pages are visited. They are only placed after your consent, except when they fall under the exemption provided by the CNIL for measures strictly limited to anonymous traffic analysis.
- No advertising or retargeting cookies are placed.
You can withdraw your consent or configure cookie placement at any time from your browser settings. Refusing audience measurement cookies does not alter the use of the site or access to purchased content.
9. Security
Exchanges with the site are encrypted (HTTPS). Order data is hosted by Shopify, which implements the technical and organizational measures described in its security documentation. Access to the administration interface is restricted to authorized persons and protected by authentication.
Complete bank details never pass through our systems: they are transmitted directly to the payment provider.
10. Modifications
This policy may be modified to reflect legal, technical, or organizational changes. The applicable version is the one published on this page, the date of which appears at the top. Any substantial modification will be brought to the attention of the persons concerned.