Privacy Policy

Data controller

[TODO], [TODO] — contact: boutiquekpopclothes@gmail.com.

Data collected

Orders: first and last name, delivery and billing addresses, email, phone number if given, ordered products, order history. Payment is handled by Stripe: we never see or store your full card number.

Customer account (optional): email, password (stored encrypted), saved addresses.

Contact form: name, email, order number if given, message.

Technical data: server logs (IP address, pages visited, browser), kept for security and to fix errors. We do not use any advertising or audience-measurement tracking, and we do not send newsletters.

Purposes and legal bases

Processing, producing, shipping and invoicing your orders, and customer service: performance of the contract.

Managing your account: performance of the contract, at your request.

Answering your messages: our legitimate interest in answering you.

Accounting and tax obligations: legal obligation.

Security of the website and fraud prevention: legitimate interest.

Recipients and processors

Your data is only shared with the service providers needed to run the shop, under contract and for these purposes only:

Stripe (payment processing); Hostinger, which hosts the website and its order database in the European Union; Cloudflare (storage and delivery of product images, R2 service); Resend (sending transactional emails: order confirmation, shipping, password reset); our print partners and their carriers, who receive only the data needed to produce and deliver your order (name, delivery address, phone number if given, ordered items).

Some of these providers may transfer data outside the European Union (for example to the United States); these transfers are covered by the safeguards provided by the GDPR (adequacy decision or standard contractual clauses). We never sell your data.

Retention periods

Order data: for the duration of the business relationship, then archived for the legal period (10 years for accounting documents). Customer account: until you delete it, or 3 years after your last activity. Messages: 3 years after the last exchange. Server logs: up to 12 months.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. To exercise them, write to boutiquekpopclothes@gmail.com; we answer within one month. If you think your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

Security

The website is served over HTTPS, passwords are stored encrypted, and access to the data is restricted to the people and providers who need it.