PRIVACY POLICY

1. Introduction

SHIDO ATELIER ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you visit our website and purchase our products.

This policy is drafted in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council — the General Data Protection Regulation ("GDPR") — as well as the French Data Protection Act (Loi Informatique et Libertes, as amended) and the French e-privacy directive (Directive 2002/58/EC transposed into French law).

2. Data Controller

3. What Data We Collect

We collect and process the following categories of personal data:

3.1 Identity and Contact Data

• First and last name
• Email address
• Phone number (if provided)
• Billing and shipping addresses

3.2 Payment Data

• Credit/debit card details (processed directly by our payment service provider — we never store full card numbers on our servers)
• Billing information linked to transactions

3.3 Browsing and Device Data

• IP address
• Browser type and version
• Operating system
• Device type and identifiers
• Pages visited, time spent on pages, and navigation paths
• Referring URL and exit pages
• Screen resolution and language settings

3.4 Account Data

• Account credentials (email and hashed password)
• Order history and preferences
• Saved addresses and wishlist items

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Order Processing and Fulfilment

To process your orders, handle payments, manage deliveries and returns, and provide order-related customer support. This includes communicating order confirmations, shipping updates, and invoices.

4.2 Account Management

To create and manage your customer account, authenticate your identity, maintain your profile, and provide personalized features such as order history and saved preferences.

4.3 Marketing Communications

To send you promotional emails, newsletters, and product announcements — only when you have given explicit prior consent. You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly.

4.4 Analytics and Website Improvement

To analyse website usage patterns, improve our services, and optimise the user experience. Analytics data is collected in an anonymised or pseudonymised form whenever possible.

4.5 Legal Compliance and Security

To comply with applicable legal obligations (including tax and accounting requirements), prevent fraud, detect and address technical issues, and protect the security of our website and users.

5. Legal Basis for Processing

Under Article 6 of the GDPR, we rely on the following legal bases to process your personal data:

6. Data Storage and Retention

6.1 Where Your Data Is Stored

Your personal data is stored using Firebase, a cloud platform operated by Google LLC, hosted on Google Cloud Platform infrastructure within the European Union (EU). Google Cloud complies with the GDPR and has been certified under the EU Cloud Code of Conduct. Data transfers outside the EU, if any, are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

6.2 Retention Periods

• Customer account data: Retained for the duration of your account plus 3 years after last activity, unless you request earlier deletion.
• Order and transaction data: Retained for 5 years from the date of transaction, as required by French tax and commercial law (Code de Commerce, Art. L123-22).
• Marketing consent records: Retained for 3 years from the date of consent or until withdrawal.
• Browsing and analytics data: Retained for a maximum of 13 months from collection, in accordance with CNIL recommendations.
• Support tickets and correspondence: Retained for 2 years from the resolution date.

When the applicable retention period expires, your data is securely deleted or anonymised so that it can no longer identify you.

7. Your Rights Under GDPR

Under the GDPR and French data protection law, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to Be Forgotten" (Art. 17): You may request deletion of your personal data, subject to certain legal exceptions (e.g., outstanding orders, legal retention obligations).
• Right to Data Portability (Art. 20): You may request to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller.
• Right to Restriction of Processing (Art. 18): You may request that we limit the processing of your data in certain circumstances — for example, while we verify the accuracy of your data or assess a legal claim.
• Right to Object (Art. 21): You may object to the processing of your data based on legitimate interest or for direct marketing purposes at any time.
• Right to Withdraw Consent (Art. 7): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

8. Cookies

Our website uses cookies and similar tracking technologies. For full details on the cookies we use, their purposes, and how to manage them, please refer to our Cookie Policy.

Non-essential cookies are only placed on your device after you have given your explicit consent via our cookie consent banner. You may withdraw this consent at any time.

9. Third-Party Services

We share your personal data with the following categories of third-party service providers, each acting as a data processor under GDPR-compliant data processing agreements:

• Firebase / Google Cloud Platform: Cloud infrastructure, authentication, database hosting, and analytics. Google LLC processes data on our behalf under its Data Processing Agreement (DPA) and in compliance with the GDPR.
• Payment Service Provider: [Payment provider name to be completed] — processes payment card transactions securely. Card data is not stored on our servers.
• Analytics Provider: Collects anonymised or pseudonymised usage data to help us understand how visitors interact with our website.
• Shipping and Logistics Partners: Receive your name, address, and contact information solely for the purpose of delivering your orders.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL (HTTPS) protocols
• Encryption of data at rest via Firebase/Google Cloud managed encryption
• Secure authentication mechanisms with password hashing
• Role-based access controls limiting data access to authorised personnel only
• Regular security reviews and vulnerability assessments
• Incident response procedures in accordance with GDPR breach notification requirements (Art. 33 and 34)

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is entirely secure. We cannot guarantee absolute security but are committed to maintaining a high standard of data protection.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Commission Nationale de l'Informatique et des Libertes (CNIL) within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (GDPR Article 34).

12. International Data Transfers

Your data is primarily stored and processed within the European Union. In the event that any data is transferred outside the EU/EEA, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other legally recognised transfer mechanisms in compliance with GDPR Chapter V.

13. Children's Data

Our products and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@shidoatelier.com and we will take steps to delete such data promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.

Where changes materially affect how we process your data, we will provide additional notice — such as a prominent notice on our website or an email notification — before the changes take effect.

15. Right to Lodge a Complaint with the CNIL

We encourage you to contact us first so that we may attempt to resolve your concern before you approach the CNIL. However, you are not obligated to do so, and you retain the right to lodge a complaint at any time.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please do not hesitate to reach out:

• Email: support@shidoatelier.com
• Contact form: shidoatelier.com/contact