Privacy Policy

1. Data controller

The controller responsible for processing personal data collected on karykrea.com is the association KaryKréa, 7 Impasse Jean Carasso, 94360 Bry-sur-Marne. For any question about your data: karykrea@gmail.com.

2. Data we collect

a) Shop orders

When you make a purchase: name, email, phone number (optional), and — only in the case of postal delivery — delivery address. This data is strictly necessary to process your order. We never collect or store your bank details: payment is handled entirely by our provider, Stripe.

b) Audience measurement

With your consent (via the banner shown on your first visit), we measure site traffic (page views, time spent) using an in-house tool, with no profiling and no sharing with third parties. You may withdraw this consent at any time by clearing your browser's browsing data for this site.

c) Shopping basket

The contents of your basket are stored locally in your browser (local storage, not a cookie) for the duration of your visit. This data is strictly necessary for the operation of the service you requested (keeping your items while you browse): it does not require consent under cookie regulations, and is never transmitted to our servers until you confirm an order.

d) Forms (contact, reviews, exhibitors)

Information you voluntarily enter into our forms (name, email, message, review) is used solely to respond to your request or to moderate your review before publication.

3. Why we process your data, and the legal basis

• Performance of a contract (Art. 6.1.b GDPR): processing your order, delivering it, and contacting you about it.
• Legal obligation (Art. 6.1.c GDPR): retaining invoices and order data for accounting purposes.
• Consent (Art. 6.1.a GDPR): audience measurement, revocable at any time.
• Legitimate interest (Art. 6.1.f GDPR): responding to your contact messages and moderating published reviews.

4. Who has access to your data

Your data is never sold. It may be shared with our service providers, strictly as needed to operate the service:

• Stripe (online payment) — payment data is provided directly to Stripe, never via our servers.
• Vercel (hosting of the site and the order database).
• Google (Gmail) (sending order confirmation emails).
• A postal carrier, only if postal delivery is selected (name and delivery address).

5. Retention period

• Order data: retained for 10 years for accounting purposes (legal obligation, Article L123-22 of the French Commercial Code).
• Audience measurement data: 13 months maximum, in line with CNIL recommendations.
• Contact messages / reviews: for as long as necessary to process your request, followed by limited archiving.

6. Your rights

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the right to access, rectify, erase, restrict, object to, and port your data. To exercise these rights, contact us at karykrea@gmail.com. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

7. Security

The site is served over HTTPS. Payments are processed by Stripe (PCI-DSS Level 1 certified). Access to order data on the admin side is protected by a secret access token that is not indexed by search engines.

8. Changes

This policy may be updated from time to time. The date of the last update appears at the top of this page. For any question, contact karykrea@gmail.com.