Privacy Policy

02Data we collect, and when

03Purposes & legal bases

Each processing operation rests on one of the legal bases provided by Article 6 GDPR / UK GDPR:

• Order management (processing, payment, delivery, tracking, returns, warranty) — performance of the contract.
• Invoicing and accounting — compliance with a legal obligation.
• Customer support and after-sales — performance of the contract and legitimate interest in answering you.
• Payment security and fraud prevention — legitimate interest in protecting the store and its customers.
• Newsletter — consent, freely given and withdrawable at any time via the unsubscribe link in every email.
• Audience measurement and site improvement — consent (non-essential cookies).
• Defence of our rights in the event of a dispute — legitimate interest.

04Recipients & processors

Your data is accessible only to our authorised staff and to the processors strictly necessary for the operation of the store, each bound by a data processing agreement compliant with Article 28 GDPR:

• Shopify International Ltd. (Ireland, for EEA/UK customers) — e-commerce platform and secure payment.
• Vercel Inc. — hosting of the website.
• Delivery carriers — identity and delivery details, strictly for shipping your parcel.
• Transactional email provider — order and shipping notifications, newsletter where subscribed.

Data may also be disclosed where the law requires it (courts, authorities). We never sell or rent personal data, and we conduct no advertising profiling.

05International transfers

Some processors process data outside the European Economic Area or the United Kingdom (notably in the United States and Canada). These transfers are covered by: an adequacy decision of the European Commission or the UK Government (EU–US Data Privacy Framework and its UK Extension; Canada for commercial organisations), or, failing that, the Standard Contractual Clauses of the European Commission supplemented by the UK International Data Transfer Addendum, together with additional technical measures (encryption in transit and at rest).

A copy of the relevant safeguards can be obtained by writing to support@adzenclick.com.

06Retention periods

• Order, invoice and accounting data — for the period required by tax and commercial law (up to 10 years depending on the country).
• Customer relationship and support data — 3 years after your last activity, then deletion or anonymisation.
• Newsletter data — until unsubscription, and at most 3 years after your last interaction.
• Cookies and measurement data — 13 months maximum, then aggregated.
• Fraud-prevention logs — 12 months.

At the end of these periods, data is securely erased or irreversibly anonymised.

07Cookies & similar technologies

08Security

We implement technical and organisational measures appropriate to the risk (Article 32 GDPR): TLS encryption of all exchanges, hosting with certified providers, strict limitation of access to order data, separation of environments, and no storage of card data on our systems. In the event of a personal data breach likely to result in a high risk to you, we will notify you and the competent supervisory authority within the legally required timeframes.

09Your rights

Under the GDPR and the UK GDPR you have, at any time and free of charge, the right to:

• Access — obtain confirmation that we process your data and a copy of it (Art. 15).
• Rectification — have inaccurate or incomplete data corrected (Art. 16).
• Erasure — obtain deletion of your data within the limits of our legal obligations (Art. 17).
• Restriction — obtain the freezing of a processing operation in the cases of Art. 18.
• Portability — receive the data you provided in a structured, commonly used, machine-readable format (Art. 20).
• Objection — object at any time to processing based on legitimate interest, and without any condition to direct marketing (Art. 21).
• Withdrawal of consent — for newsletter and cookies, with effect for the future (Art. 7).
• Post-mortem directives (where national law provides) — define instructions for your data after death.

10Children

The Site is not directed at children under 16 and we do not knowingly collect their data. If you believe a minor has provided us personal data, contact us: it will be deleted without delay.

11Changes to this policy

This policy may be updated to reflect legal, technical, or organisational developments. The date at the top of the page identifies the version in force. In the event of a substantial change affecting your rights, we will inform you by a visible notice on the Site or by email if we hold your address.