Legal information
Privacy
Updated on
We collect only what we need to sell you a piece, organise an appointment, keep your account and your reviews, secure the site, or notify you when you have asked us to. No data is sold, and no decision about you is taken by fully automated processing.
- Company name
- GRACE ET COMPAGNIE
- Legal form and share capital
- SARL au capital de 1 000 € · RCS Créteil 535 328 355
- SIRET
- 535 328 355 00016
- EU VAT number
- FR18 535 328 355
- Registered office
- 34 rue du Bois l’Abbé, 94500 Champigny-sur-Marne
- Telephone
- +33 6 46 57 70 83
No data protection officer has been appointed: for any question about your data, write to us at contact@graceetcompagnie.fr or use the My rights page.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Order (name, address, telephone, email, pieces) | Preparing, delivering, invoicing, guaranteeing | Contract | 10 years for paid orders and their invoices (accounting obligation), in a restricted-access archive, then deleted. An order never paid: 30 days |
| Payment | Collecting payment for the order | Contract | Processed by Stripe: we never receive your card number, only confirmation of the payment |
| Account (email, sizes, favourite houses, wish list) | Showing you what suits you | Contract | Until the account is deleted, or after 3 years without a sign-in or an order: an email warns you 30 days beforehand |
| Appointments and piece searches | Answering and welcoming you | Pre-contractual steps | 3 years after our last exchange |
| Order requests and business projects (name, company, email, telephone, piece or need) | Answering you, ordering the piece from the house, preparing a proposal | Pre-contractual steps | 3 years after our last exchange |
| Messages from the Contact page | Answering you | Legitimate interest (answering your request) | 3 years after our last exchange |
| Alerts and private sales | Notifying you, at your request | Consent | Until you unsubscribe, then 30 days; an unconfirmed sign-up is deleted within 7 days |
| Reviews | Publishing a verified review | Consent | For as long as the review is published; 30 days for a rejected review |
| Photos attached to a return request | Preparing your exchange or refund | Contract | 6 months after the return is closed. The information a device adds to a photo (location, date) is not kept; a photo we cannot accept is not kept either. An automatic check, carried out on our server, alerts our team to a photo that does not seem to show the piece: it decides nothing |
| Photos attached to a piece search | Recognising and finding the piece you are looking for | Pre-contractual steps | 6 months after the search is closed, and no later than 3 years after our last exchange. The information a device adds to a photo (location, date) is not kept; a photo we cannot accept is not kept either |
| Emails we send you (confirmation, tracking, invoice) | Keeping you informed about your order | Contract | 1 year after sending; the invoice itself is kept for 10 years |
| Requests about your data and complaints | Answering them, proving the answer given | Legal obligation | 5 years after the request is closed |
The information requested in the forms is necessary to process them: without it, we cannot prepare an order or answer a request. The other fields are optional. The host also keeps technical connection data (including the IP address) for one year, as required by law.
Only the people at the house who need it have access. We use providers who act only on our instructions:
- Stripe Payments Europe, Ltd (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland), for payment. Card numbers are entered with Stripe and never pass through our servers.
- OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which hosts the site and its database.
- An email delivery provider, which sends the site’s messages (confirmations, order tracking, alerts) from servers located in the European Union (Ireland).
- Our domain name and email provider: the emails you write to us pass through it.
- CyberHealth (Ken DJIWAN, sole trader, SIREN 109 804 047), which designed the site and operates it technically, for maintenance operations only.
- The carrier or courier you choose, for delivery (your name, your address, your telephone number).
Some of these providers, notably our payment provider, belong to groups established outside the European Union: any transfers of data are governed by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework.
You have the right to access your data, to have it corrected, to have it erased, to restrict its use, to object to processing, to receive it in a file (portability), to withdraw your consent at any time, and to give instructions on what happens to your data after your death.
- From your account: “Download my data” and “Delete my account” take effect immediately for whatever we are able to erase; invoices are kept for the period required by law.
- For everything else, or if you do not have an account: the My rights page, or an email to contact@graceetcompagnie.fr.
We reply within one month, which may be extended by two months for a complex request (we will then let you know before the end of the first month). So as not to disclose anything to someone else, we may ask you to confirm your identity. Deleting an account does not affect invoices, which we must keep for ten years.
If, after writing to us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL: Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (cnil.fr/fr/plaintes).
We protect your data with technical and organisational measures appropriate to the risks, and we entrust its processing only to providers offering sufficient guarantees. In the event of a data breach likely to put you at risk, we inform the CNIL within 72 hours and, if the risk is high, we inform you directly.
See the Cookies page.