Privacy policy
Last updated: 28 August 2026
This policy explains what personal data we collect when you visit Cascades & Sens or place an order, why we collect it, how long we keep it, and what rights you can exercise. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended.
1. Who is responsible for your data
The data controller is Manon Panier, sole trader, 367 route de la Fougère, 73100 Grésy-sur-Aix, France — SIRET 90341364900034.
For any question, or to exercise your rights: manondecascadesetsens@gmail.com.
Given the size of the business and the nature of the processing, appointing a data protection officer is not mandatory and none has been appointed.
2. What data, why, and on what basis
2.1 Placing and following an order
- Data: surname, first name, delivery and billing address, email address, telephone number (if provided), order contents, amount, date, purchase history.
- Purpose: processing the order, shipping it, keeping you informed, handling returns, refunds and after-sales service.
- Legal basis: performance of the contract (article 6.1.b of the GDPR).
- Mandatory nature: this data is necessary — without it, the order cannot be processed.
2.2 Payment
- Data: amount, means of payment, transaction status, fraud detection elements. We never have access to your bank card number : it is entered directly with the payment provider.
- Purpose: collecting payment, preventing fraud.
- Legal basis: performance of the contract and legal obligation (articles 6.1.b and 6.1.c).
2.3 Invoicing and accounts
- Data: identity, billing address, detail and amount of transactions.
- Purpose: drawing up and keeping accounting records.
- Legal basis: legal obligation (article 6.1.c of the GDPR; article L123-22 of the French Commercial Code).
2.4 Customer account
- Data: login credentials, saved addresses, order history.
- Purpose: saving you from re-entering your details and giving you access to your orders.
- Legal basis: performance of the contract, at your request.
2.5 Newsletter
- Data: email address, sign-up date, open and click statistics.
- Purpose: sending you our new pieces and news.
- Legal basis: your consent (article 6.1.a), given at sign-up. You can withdraw it at any time, in one click, from the unsubscribe link in every message — without affecting the lawfulness of earlier sendings.
2.6 Replying to your messages
- Data: name, email address, content of your message.
- Purpose: replying to you and keeping a record of the exchange.
- Legal basis: legitimate interest (article 6.1.f) — giving you an answer and being able to evidence it.
2.7 Audience measurement and running the site
- Data: pages viewed, products viewed, cart, IP address, device and browser type, session identifiers.
- Purpose: running the site and the cart, measuring traffic, securing the service.
- Legal basis: legitimate interest for strictly necessary trackers, consent for audience measurement and advertising trackers. See our Cookie Policy.
2.8 Advertising and campaign measurement
- Data: pages and products viewed, items added to the cart, purchases, advertising identifiers set by Meta and Pinterest, IP address, device type.
- Purpose: measuring what our posts and advertisements actually return, and showing you our pieces again on Pinterest, Instagram and Facebook after your visit.
- Legal basis: your consent (article 6.1.a of the GDPR), collected through the cookie banner. Until you accept, none of these trackers is placed and no data is sent to them. You can change your mind at any time through the "Cookie preferences" link at the bottom of every page.
This processing involves profiling for advertising purposes: the pages you view are used to infer your interests and to choose the ads shown to you elsewhere on the web. It produces no legal effect concerning you, and it affects neither the prices displayed nor the handling of your order.
3. What we do not do
- We do not sell your personal data.
- We do not rent or exchange our customer files.
- We make no automated decision producing legal effects concerning you, and we carry out no profiling for scoring purposes. The only profiling we perform is for advertising, subject to your consent, and described in section 2.8 — it changes neither the prices nor the terms offered to you.
- We collect no sensitive data within the meaning of article 9 of the GDPR — no health data, no religious or philosophical belief. If you send us such data spontaneously in a message, we do not use it for any purpose.
4. Who receives your data
Your data is accessible to the data controller and to the following providers, who act on our instructions:
| Recipient | Role | Location |
|---|---|---|
| Shopify International Ltd | Hosting the shop, managing orders and customer accounts, processing payments | Ireland — Shopify group in Canada and the United States |
| AW Dropship | Picking and shipping orders (name and delivery address only) | Spain — European Union |
| Carriers | Carrying and tracking the parcel (name, address, telephone if needed) | European Union and destination countries |
| Banks and payment providers | Collection, refunds, fraud prevention | European Union |
| Meta Platforms Ireland Limited | Campaign measurement and targeted advertising on Facebook and Instagram — only if you have consented | Ireland — group established in the United States |
| Pinterest Europe Limited | Campaign measurement and targeted advertising on Pinterest — only if you have consented | Ireland — group established in the United States |
| Shopify — "Network Intelligence" service | Use of customer data, aggregated with that of other Shopify merchants, to improve Shopify's services, advertising targeting and the personalization of the shop | Ireland — Shopify group in Canada and the United States |
Your data may also be disclosed to administrative or judicial authorities where the law requires it.
5. Transfers outside the European Union
Some providers, notably Shopify, belong to groups established in Canada and the United States. Your data may therefore be transferred outside the European Economic Area.
These transfers are governed:
- by the adequacy decision of the European Commission concerning Canada, for the organizations subject to it;
- by the standard contractual clauses adopted by the European Commission (implementing decision (EU) 2021/914), together with additional technical measures, for other transfers.
Meta and Pinterest. Their contracting entities are established in Ireland, but the data collected by their trackers is transferred to the United States. These transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, where the provider is certified under it, and otherwise on the standard contractual clauses mentioned above. That adequacy decision is currently under appeal before the Court of Justice of the European Union; were it annulled, these transfers would then rely on the standard contractual clauses alone.
You can obtain a copy of the safeguards in place by writing to manondecascadesetsens@gmail.com.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Orders, invoices and accounting records | 10 years from the close of the financial year (article L123-22 of the French Commercial Code) |
| Active customer account | For the whole duration of the relationship, then 3 years with no order and no login |
| Prospects and newsletter subscribers | 3 years from your last contact, or until you withdraw your consent |
| Messages sent to customer service | 3 years from the last exchange |
| Proof of cookie consent | 6 months ; the trackers themselves, 13 months at most, and the data derived from them, 25 months at most |
| Data relating to a dispute | Until the avenues of appeal have expired |
At the end of these periods, the data is deleted or irreversibly anonymized.
7. Your rights
You have the following rights at any time:
- Access — obtain confirmation that we process data concerning you and receive a copy of it;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure — have your data deleted, except where the law requires us to keep it (accounting records in particular);
- Restriction — request the temporary freezing of processing you contest;
- Objection — object to processing based on our legitimate interest, and at any time and without reason to direct marketing;
- Portability — receive, in a machine-readable format, the data you provided to us, and have it transmitted to another organization;
- Withdrawal of consent — at any time, for the processing that depends on it;
- Post-mortem directives — decide what happens to your data after your death (article 85 of the French Data Protection Act).
How to exercise them: write to manondecascadesetsens@gmail.com setting out your request. We reply within one month, extendable by two months if the request is complex — we would tell you if so. If there is serious doubt about your identity, we may ask you for proof; we will not keep it beyond the handling of your request. Exercising these rights is free of charge.
8. Complaints
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority :
CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
9. Security
We implement appropriate technical and organizational measures: encrypted connection (HTTPS) across the whole site, administration interface protected by password and two-factor authentication, hosting with a certified provider, and access limited to the people who need it.
As no system is infallible, in the event of a data breach likely to create a high risk to your rights and freedoms, we would inform you as soon as possible, in accordance with article 34 of the GDPR.
10. Minors
The site is not aimed at minors and orders are reserved for persons of legal age. We do not knowingly collect data concerning minors. If you hold parental authority and find that a child has sent us data, write to us: we will delete it without delay.
11. Changes to this policy
This policy may change to reflect a change in our practices or in the regulations. The date of the last update appears at the top of the page. In the event of a substantial change, we will inform you by an appropriate means.