Privacy policy

Data controller

The company publishing the site sapedeluxe.com, whose full identification appears in the legal notice. Contact: contact@sapedeluxe.com.

No data protection officer has been appointed to date: the volume of processing does not require one. For any question about your data, write to the address above.

What we collect, and why

Order

Surname, first name, postal address, email, phone. Legal basis: performance of the contract. Retention: 10 years (accounting obligation).

Basket that reached payment

If you enter your details and then reach the payment screen without paying, the order is recorded with the status « awaiting payment ». That is what lets us find your request if you come back, and answer you if you write. Legal basis: legitimate interest. Retention: 90 days, then automatic deletion.

Payment

No banking data is stored by SAPEDELUXE. Only a transaction reference and the last four digits of the card are kept, to follow up refunds.

Piece suggestions

If you accept audience measurement, the pieces you view are noted on your device only (twelve at most, forgotten after 30 days) to suggest matching pieces in your basket. Nothing is sent to our servers or to anyone. Refusing audience measurement clears this list. Legal basis: consent.

Address suggestions

While you type your delivery address, the text goes through our server (without your IP address or cookies) to the IGN geocoding service for France, or to Photon (komoot, OpenStreetMap data) for other countries, to suggest real addresses. Nothing is kept. Legal basis: legitimate interest (avoiding delivery errors).

Newsletter

Email address only. Legal basis: consent. Retention: until you unsubscribe, which takes one click from any message.

Audience measurement

Counters, and nothing else: by day, by arrival channel (Meta, TikTok, Google, email, direct…) and by step reached (visit, product page, add to basket, checkout, order). No IP address, no page path, no identifier that survives the tab being closed, no third-party cookie, nothing passed on to anyone. Your journey cannot be reconstructed from these figures. Legal basis: consent, collected through the banner. Nothing is stored before acceptance, and refusing is enough not to be measured. Retention: 13 months.

Advertising (TikTok, Snapchat)

Only if you accept the « Advertising » option in the banner. The TikTok and Snapchat pixels are then loaded and store their cookies (_ttp, _scid). When you view a piece, add it to your basket, start or pay for an order, the event is sent to these platforms with the amount, the pieces involved, the ad click identifier (ttclid, ScCid), your IP address and your browser. For a purchase, your email address and phone number are sent hashed (SHA-256), never in plain text. Purpose: measuring how well our ads perform. Legal basis: consent, which you can withdraw at any time with « Manage cookies » at the bottom of the page. Retention on our side: with the order, deleted along with it; on the platforms' side, under their own policies.

Customer service

The content of our exchanges. Legal basis: legitimate interest. Retention: 3 years after the last contact.

What we do not do

We do not sell data. We do not pass it to brokers. We do not build an advertising profile from purchases. No data is passed to a social network without separate, explicit consent.

Processors

The providers below process data on our behalf, under contracts compliant with article 28 of the GDPR.

Hosting

Vercel Inc. (United States): standard contractual clauses, pages hosted in a European region.

Payment

Stripe Payments Europe Ltd (Ireland): the payment page is hosted by Stripe, and no card data passes through the site. Stripe receives the email address, the amount and the order number.

Advertising

TikTok Technology Limited (Ireland) and Snap B.V. (Netherlands), only with your consent to the advertising option. These platforms are responsible for their own use of the data they receive, under their own policies.

This list has to be kept up to date. A privacy policy that does not name its processors is not compliant.

Cookies

The site stores two strictly necessary technical cookies: the contents of your basket and the choice you made in the banner. They require no consent and are used for no tracking.

Audience measurement and advertising trackers (TikTok, Snapchat) are only stored after acceptance, each for its own option. Refusing is as simple as accepting: one click, on a button of equal visual weight. The choice can be changed at any time with the « Manage cookies » link at the bottom of every page.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You may also set instructions on what happens to your data after your death.

To exercise them, write to contact@sapedeluxe.com. An answer within one month. If you disagree with our response, you may refer the matter to the CNIL, the French data protection authority, at 3 place de Fontenoy, 75007 Paris, or lodge a complaint at cnil.fr.

Security

The site is served over HTTPS only. Order data is encrypted at rest at the host. Access to the admin panel is protected by a long random password and by a session that expires.