Privacy Policy

This policy explains what personal data we collect, why, how long we keep it and how you exercise your rights under the General Data Protection Regulation (GDPR) and the French data protection act.

What we collect, why, and on what basis

• Order data (name, delivery and billing address, email, telephone, pieces ordered, amounts, order history): to take, deliver and invoice your order, and to answer you about it. Basis: performance of the contract. Invoices are also kept to meet our accounting and tax obligations. Basis: legal obligation.
• Account data (the same, plus your password stored as a hash, your saved addresses and your wishlist): to give you an account. Basis: performance of the contract.
• Messages you send us and our replies: to handle your request. Basis: legitimate interest in answering our customers.
• Payment data: the card number is entered on Stripe systems and never reaches ours. We keep the payment reference, the amount, the result and the last four digits. Basis: performance of the contract and legal obligation.
• Technical and security data (connection logs, failed sign-in counters, anti-fraud signals): to keep accounts and the shop safe. Basis: legitimate interest in security.
• Audience measurement and advertising cookies: only if you accept them in the cookie banner. Basis: consent.

We do not sell personal data and we do not take decisions about you by automated means alone.

How long we keep it

• Orders and invoices: 10 years from the end of the accounting year, as French commercial law requires.
• Customer account: until you delete it, or 3 years after your last activity, after which we ask you whether to keep it.
• Messages: 3 years from the last exchange.
• Security and connection logs: 12 months.
• Cookie consent and the cookies you accepted: 6 months.

Who else processes it

We use a small number of processors, each bound by a contract under article 28 GDPR:

• Stripe Payments Europe, Ltd. (Ireland): card payments and fraud prevention.
• Cloudflare, Inc. (United States): delivery, caching and protection of the storefront.
• Brevo (France): order, account and service emails.
• Google Ireland Ltd.: Google Tag Manager and Google Analytics, loaded only after you accept analytics cookies.
• Dropleather Inc. (United States, with ateliers and warehouses in Morocco and the European Union): production and shipping of the pieces made to order for us. It receives the order lines, your name, delivery address, email and telephone, so the piece can be made and delivered, and keeps the order record for the time its own tax law requires.
• Our carriers: the delivery address and a contact detail, so the parcel can be delivered.

Transfers outside the European Union

Some of these providers process data outside the European Union, in particular in the United States and, for the making of the pieces, in Morocco. Those transfers rely on the European Commission standard contractual clauses or on an adequacy decision, together with the additional measures the provider documents. A copy of the safeguards can be requested from us.

Your rights

You may ask for access to your data, correct it, have it deleted, object to or restrict its processing, receive it in a portable format, withdraw a consent you have given, and give instructions about what happens to your data after your death.

If you are not satisfied with our answer you may complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr, or to the supervisory authority of the country where you live.

Cookies

The site sets the cookies it needs to work, and, with your consent, cookies for audience measurement and advertising. What each one does, how long it lasts and how to change your choice are set out on the Cookies page.