Privacy policy

The data controller

Compagnie des Blasons, 6 rue du Château, 12190 Estaing, France, SIREN 944 919 968. For any question about your data: contact@marceletlesblondes.com.

What we collect, and why

Your order

name, delivery and billing address, e-mail address, telephone number if you give one, the items and their personalisation. Needed to perform the contract of sale.

Your review

if you leave a review from your order page, we record your first name, your rating, your text and the language it is written in, linked to the order. The workshop reads it before publication; once published, it appears on the product page and the home page, signed with your initial and dated by month, and in the page’s structured data. A few days after delivery, a single email invites you to leave one; it is not repeated. Your email address is never published. You can ask us to remove it at any time at the address above.

Your basket

an identifier held in a cookie named “cart”, linking your browser to the basket kept on our server. Without it the basket does not survive a page change.

Where you came from

if you arrive through a tagged link — a pin, a post — we add one to that day’s counter for the network’s name (“pinterest”), without storing anything in your browser and with no link to your order: one number per day and per network, tied to no one. The click identifier the platform adds to the address is never kept. During a visit that arrived through such a link, the time spent on screen is also counted: a seconds counter kept in the browser tab — not in a cookie —, sent with no page address and no identifier, and added up per day and per network. This seconds counter stays silent if your browser signals “Do Not Track” or “Global Privacy Control”.

Your messages to us

the content of what you send and our reply, to provide customer service.

Server logs

IP address, date, page requested, browser type. Kept for security and for the proper running of the site.

What we do not do

• no advertising tracker, no social network pixel, no profiling;
• a single cookie, ours, the basket one, and none set by a third party;
• the “share” buttons are plain links: nothing is loaded from Pinterest, Facebook or WhatsApp until you click;
• videos are links to YouTube: nothing is loaded from them until you press play; from then on, the video is served by YouTube (Google) in privacy-enhanced mode, which receives your IP address and applies its own rules;
• no font or image loaded from another domain: everything is served by us;
• no selling, sharing or renting of your data.

Audience measurement, without cookies

We measure traffic with Snorklee, a European service built to count visits without cookies and without a visitor identifier. It tells us which pages are read and where visitors come from — nothing more. It does not follow you from one site to another.

What is sent

the page address, without anything after the “?”; the domain name you arrive from, never the full address; how far down the page you scrolled; how long you stayed; and the fact — never the content — of a form submission, a download or a click to another site; and, on a product page, the fact of having started to personalise, opened the review screen and added to the cart — never what you typed.

What is not kept

neither your IP address nor your browser string. They are used for the length of the request to derive a country, a browser family and a device type, then discarded: they never enter the database.

What is never measured

pages carrying a private link — your order, your invoice — and the administration. They are not counted at all.

How to refuse

your browser’s “Do Not Track” or “Global Privacy Control” signal is enough: measurement stops on its own, with nothing to click.

Who processes data for us

We use processors, strictly for the purposes above:

OVH SAS

hosting of the site and the database. A French company, 2 rue Kellermann, 59100 Roubaix.

Mollie B.V.

payment processing, in the Netherlands. Your card details are entered on their systems and never pass through ours.

La Poste

carrying parcels: name and delivery address.

OpenStreetMap Foundation

looking up the address for the GPS coordinates bracelet. The address you type is sent to their geocoding service from our server, never from your browser, and with nothing that identifies you.

Snorklee

audience measurement, without cookies and without a visitor identifier. European service, hosted in the Union.

Brevo

sending order and shipping e-mails, and messages from the contact form: your e-mail address and the content of the message. French company.

Boxtal

buying shipping labels: name, delivery address and phone, passed on to the carrier. French company.

How long

Orders and invoices

ten years, as accounting and tax law requires.

Unconfirmed basket

thirty days, then deleted.

Customer service messages

three years after the last exchange.

Server logs

twelve months at most.

Where the data is

The site, the database and the orders are hosted by OVH, in France. Our processors are established in the European Union. No data is transferred outside the European Union.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over your data, and the right to give instructions on what happens to it after your death.

To exercise them, write to contact@marceletlesblondes.com. We answer within one month. If our answer does not satisfy you, you may complain to the French data protection authority, the CNIL: www.cnil.fr.

Changes

This policy may change, in particular when a new payment or delivery method goes live. The update date at the top of the page is the one that counts.