Privacy policy

Data controller

The company publishing the site sapedeluxe.com, whose full identification appears in the legal notice. Contact: contact@sapedeluxe.com.

No data protection officer has been appointed to date: the volume of processing does not require one. For any question about your data, write to the address above.

What we collect, and why

Order

Surname, first name, postal address, email, phone. Legal basis: performance of the contract. Retention: 10 years (accounting obligation).

Basket that reached payment

If you enter your details and then reach the payment screen without paying, the order is recorded with the status « awaiting payment ». That is what lets us find your request if you come back, and answer you if you write. Legal basis: legitimate interest. Retention: 90 days, then automatic deletion.

Payment

No banking data is stored by SAPEDELUXE. Only a transaction reference and the last four digits of the card are kept, to follow up refunds.

Newsletter

Email address only. Legal basis: consent. Retention: until you unsubscribe, which takes one click from any message.

Audience measurement

Counters, and nothing else: by day, by arrival channel (Meta, TikTok, Google, email, direct…) and by step reached (visit, product page, add to basket, checkout, order). No IP address, no page path, no identifier that survives the tab being closed, no third-party cookie, nothing passed on to anyone. Your journey cannot be reconstructed from these figures. Legal basis: consent, collected through the banner. Nothing is stored before acceptance, and refusing is enough not to be measured. Retention: 13 months.

Customer service

The content of our exchanges. Legal basis: legitimate interest. Retention: 3 years after the last contact.

What we do not do

We do not sell data. We do not pass it to brokers. We do not build an advertising profile from purchases. No data is passed to a social network without separate, explicit consent.

Processors

The providers below process data on our behalf, under contracts compliant with article 28 of the GDPR.

Hosting

Vercel Inc. (United States): standard contractual clauses, pages hosted in a European region.

Payment

Stripe Payments Europe Ltd (Ireland): the payment page is hosted by Stripe, and no card data passes through the site. Stripe receives the email address, the amount and the order number.

This list has to be kept up to date. A privacy policy that does not name its processors is not compliant.

Cookies

The site stores two strictly necessary technical cookies: the contents of your basket and the choice you made in the banner. They require no consent and are used for no tracking.

Audience measurement cookies are only stored after acceptance. Refusing is as simple as accepting: one click, on a button of equal visual weight. The choice can be changed at any time by clearing the site data from your browser.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. You may also set instructions on what happens to your data after your death.

To exercise them, write to contact@sapedeluxe.com. An answer within one month. If you disagree with our response, you may refer the matter to the CNIL, the French data protection authority, at 3 place de Fontenoy, 75007 Paris, or lodge a complaint at cnil.fr.

Security

The site is served over HTTPS only. Order data is encrypted at rest at the host. Access to the admin panel is protected by a long random password and by a session that expires.