At Roselyse, protecting your personal data is a priority. This policy explains what data we collect, why, how long we keep it and how to exercise your rights, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR), the UK GDPR, the Data Protection Act 2018 and amended French Law No. 78-17 of 6 January 1978 (“Informatique et Libertés”).
1. Data controller
The data controller is Dimitri Mauri, operator of the Roselyse brand — sole trader (EI), 2737 chemin de la Mourignette, 83340 Le Luc, France, SIRET 910 903 491 00017 — who can be contacted at info@roselyse.fr. Given the size of the business, no data protection officer (DPO) has been appointed; any request about your data can be sent to the same address.
2. Data we collect
We only collect the data we need, directly from you or when you browse the Website:
- Identity and contact details: first name, surname, email address, delivery and billing address, phone number (for the carrier).
- Order data: products bought, amount, date, order number, history of contact with customer service, returns and refunds.
- Payment data: processed directly by our secure payment provider; we never receive or store your full card number (only, where applicable, the last 4 digits and the expiry date).
- Messages: the content of contact forms and emails you send us.
- Reviews: rating, comment, first name, initial of your surname and, if you choose, a photo.
- Browsing data: IP address, device and browser type, pages viewed, preferences (language, cookie choices), depending on your cookie choices.
Please don't send us sensitive information (codes, passwords, card numbers) in your messages.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Processing and delivering your orders, sending the e-book, managing payments, invoices, returns and refunds | Performance of a contract (Art. 6(1)(b) GDPR) |
| Answering your requests through customer service | Performance of a contract or pre-contractual steps; otherwise, legitimate interests |
| Meeting our accounting, tax and warranty obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Preventing payment fraud and securing the Website | Legitimate interests (Art. 6(1)(f) GDPR) |
| Sending you our newsletter and offers | Consent, or legitimate interests for customers (similar products), with the right to object at any time |
| Collecting and publishing customer reviews | Legitimate interests / consent for photos |
| Measuring audience and running advertising campaigns | Consent (cookies) |
| Handling requests to exercise your rights | Legal obligation |
4. How long we keep data
| Data | Period |
|---|---|
| Customer data (orders, customer service) | For the duration of the business relationship, then 5 years (civil limitation period) |
| Invoices and accounting records | 10 years (Article L123-22 of the French Commercial Code) |
| Proof of contracts of £100 or more | 10 years (Article L213-1 of the French Consumer Code) |
| Marketing (customers and prospects) | 3 years from your last contact with us |
| Card details | Never stored by us; stored by the provider for the duration of the transaction and any disputes (13 months, or 15 months for deferred debit cards) |
| Contact form messages (no order) | 3 years from the last exchange |
| Cookies and trackers | 13 months maximum; consent choice kept for 6 months |
| Requests to exercise rights | 5 years |
5. Recipients and processors
Your data is intended for Roselyse. It is shared, strictly as needed, with our service providers (processors), who are contractually bound to confidentiality and security:
- Hosting and e-commerce platform: Shopify International Limited (Ireland)
- Payment: Shopify Payments (Stripe), Apple Pay
- Logistics and delivery: logistics partner and carriers (Colissimo, Colis Privé, Mondial Relay…) (name, address, phone, email for tracking)
- Emails and newsletter: Shopify Email
- Customer reviews: no tool at present
- Audience measurement and advertising (if you consent): Shopify Analytics
Your data may also be disclosed to the relevant authorities where required by law. We never sell or rent your data.
6. International transfers
Some providers may process data outside the European Union and the United Kingdom, in particular in the United States. These transfers are covered by an adequacy decision (for example the EU–US Data Privacy Framework and the UK Extension for certified companies) or, failing that, by standard contractual clauses or the UK International Data Transfer Addendum, supplemented by additional measures where needed. You can get a copy of these safeguards by writing to us.
7. Security
We use appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), PCI-DSS compliant secure payment, limited and password-protected access, and providers offering sufficient guarantees. If a data breach poses a risk to your rights, we will notify the CNIL (and the ICO where required) and, if necessary, inform you.
8. Your rights
You have the following rights over your data:
- the right of access and to receive a copy;
- the right to rectification;
- the right to erasure (subject to our legal retention obligations);
- the right to restrict processing;
- the right to object, in particular to direct marketing, at any time and without giving a reason;
- the right to data portability;
- the right to withdraw your consent at any time;
- the right to set instructions about what happens to your data after your death (under French law).
To exercise them, email info@roselyse.fr with your request. We may ask for proof of identity if we have reasonable doubts. We reply within one month, which may be extended by two months for complex requests; we'll let you know if this is the case.
9. Marketing and newsletter
If you're a customer, we may email you offers for products similar to those you've bought, unless you object. If you're not a customer, we only email you with your consent. Every email includes an unsubscribe link. In the UK, you can also register free of charge with the Telephone Preference Service (tpsonline.org.uk) to opt out of sales calls.
10. Customer reviews
After your purchase, we may invite you to leave a review. Your first name and the initial of your surname may be published with your review; your photo is only published with your consent. You can ask us to edit or delete your review at any time.
11. Children
The Website is intended for adults. We do not knowingly collect data from children under 13. If you think a child has sent us data, contact us so we can delete it.
12. Cookies
Our use of cookies and trackers is described in our cookie policy. You can change your choices at any time from the cookie banner or the Cookies page.
13. Changes
We may update this policy to reflect changes to our services or the law. The date of the last update is shown at the top of the page; if there are significant changes, we'll let you know.
14. Contact and complaints
For any question: info@roselyse.fr. If, after contacting us, you feel your rights have not been respected, you can complain to the Information Commissioner's Office (ICO) (ico.org.uk, 0303 123 1113) or to the French CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 – www.cnil.fr).
Information for users in the United Kingdom
When you are in the UK, we process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The legal bases are the performance of our contract with you, our legal obligations, our legitimate interests (site security, fraud prevention) and, for non-essential cookies and the newsletter, your consent, which you can withdraw at any time.
Our representative in the UK under Article 27 UK GDPR is: [to be completed: UK representative, if required]
Some of our service providers (Shopify, payment, email, Google) may process data outside the UK; transfers rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU standard contractual clauses.
You have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF – ico.org.uk – although we would appreciate the chance to deal with your concern first.