Privacy / GDPR

TODO_HUMAN: structural outline only — do not treat this as a complete policy.

• Data controller — TODO_HUMAN: same legal entity and contact as on the Mentions legales page.
• Data collected — TODO_HUMAN: enumerate precisely (e.g. email for the newsletter; name, address, email, order history for orders; device/IP if analytics are installed).
• Purpose of processing — TODO_HUMAN: e.g. order fulfilment, newsletter, fraud prevention, analytics.
• Legal basis — TODO_HUMAN: contract performance for orders, consent for newsletter and marketing cookies, legitimate interest where applicable.
• Recipients — TODO_HUMAN: list the processors actually in use (Shopify, payment processor, shipping carrier, email platform, and any analytics/ad platform once installed).
• Retention period — TODO_HUMAN
• Data subject rights — access, rectification, erasure, restriction, objection, portability. TODO_HUMAN: confirm the contact route and the response timeline (GDPR requires responding within one month).
• International transfers — TODO_HUMAN: state whether any processor moves data outside the EU/EEA and under what safeguard (e.g. Standard Contractual Clauses).
• Cookies — non-essential cookies (analytics, marketing) must not be set before consent is given. TODO_HUMAN: list the actual cookies/scripts in use once analytics or pixels are installed.
• Complaints — data subjects may lodge a complaint with the CNIL (cnil.fr).
• Contact — hello@creativity-and-chaos.com