Privacy policy

1. Data controller. Personal data collected on the SHASHA Collection website is processed by [TO BE COMPLETED: legal company name and address of the data controller]. For any question about your data, you can contact us via the Contact page.

2. Data collected. Depending on how you use the site, we collect: your identity and contact details (name, email, phone number, delivery and billing addresses) when placing an order or creating an account; your order history, favourites and reviews; your email address if you subscribe to the newsletter; technical connection data needed for the site to function (session, cart, security).

3. Purposes. This data is used to process your orders and deliveries, manage your customer account, keep the site secure, contact you when needed, and, where you have consented, send you marketing communications such as the newsletter or an abandoned cart reminder.

4. Legal basis. Processing is based, depending on the case, on performance of the sales contract, compliance with a legal obligation, our legitimate interest in keeping the site secure and functioning properly, or your consent, in particular for the newsletter and abandoned cart reminders.

5. Data recipients. Your data may be shared with technical service providers strictly necessary for the site to operate: site hosting (Vercel) and database hosting (Neon), transactional email delivery (Resend), and, where applicable, our payment and delivery providers. These providers only use your data to perform the services entrusted to them.

6. Retention period. Your data is kept for as long as necessary to manage our commercial relationship, then archived in accordance with legal obligations, in particular accounting and tax requirements.

7. Your rights. In accordance with the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability and to define guidelines on what happens to your data after your death. You can exercise these rights via our Contact page. You also have the right to lodge a complaint with the French data protection authority (CNIL).

8. Cookies. The use of cookies is described in our cookie policy.

9. Security. We implement reasonable technical and organisational measures to protect your data against unauthorised access, alteration or disclosure, including password encryption and secure connections.

[TO BE COMPLETED: full identity of the data controller and, where applicable, contact details for a data protection officer, before going into production.]