Privacy Policy

1. Who We Are
   This website is operated by Litaturot, based in Paris, France. We are the data controller responsible for your personal data.
   For any privacy-related enquiry: litaturot@gmail.com.
2. What Data We Collect
   When you place an order, we collect the following personal data: your full name, your shipping address, your email address, your payment information (processed directly and securely by Stripe, we never see or store your full card details).
3. Why We Collect It
   Your data is collected and processed for the following purposes:
   • Order fulfilment: to process your payment, pack, and ship your order.
   • Order communication: to send you confirmation and shipping updates.
   • Legal compliance: to meet our obligations under French and EU law.
     Your data is not processed for marketing purposes or direct communication beyond order-related correspondence.
4. Legal Basis for Processing
   Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:
   • Performance of a contract (Article 6(1)(b) GDPR): processing is necessary to fulfil your order.
   • Legal obligation (Article 6(1)(c) GDPR): where processing is required by law (e.g. invoicing and accounting obligations).
5. Who We Share Your Data With
   We share your data only with the third parties strictly necessary to fulfil your order:
   • Stripe: to process your payment securely. Stripe is GDPR-compliant and processes data in accordance with their own privacy policy, available at stripe.com/privacy
   • La Poste and their international carrier partners: to deliver your order. Only your name and shipping address are shared for this purpose.
     We do not sell, rent, or otherwise share your data with any other third party.
6. International Data Transfers
   As we ship worldwide, your shipping details (name and address) are shared with carrier partners in your country of destination. Where data is transferred outside the European Economic Area, we rely on our carriers’ own compliance frameworks and standard contractual clauses where applicable.
   Stripe may process data outside the EEA. They do so in compliance with GDPR using appropriate safeguards. For details, refer to stripe.com/privacy.
7. How Long We Keep Your Data
   We retain your personal data only for as long as necessary:
   • Order data (name, address, email): retained for 3 years from the date of your order, in line with French civil limitation periods
   • Accounting and invoicing data: retained for 10 years as required by French commercial law
8. After these periods, your data is permanently deleted.
9. Cookies
   This website uses only strictly necessary cookies, those required for the website to function (e.g. maintaining your shopping basket during a session). We do not use analytics, advertising, or tracking cookies.
10. Your Rights
    Under the GDPR, you have the following rights regarding your personal data:
    • Right of access: you may request a copy of the data we hold about you.
    • Right to rectification: you may ask us to correct inaccurate data.
    • Right to erasure: you may ask us to delete your data, subject to our legal retention obligations.
    • Right to restriction: you may ask us to limit how we process your data.
    • Right to object: you may object to processing based on legitimate interests.
    • Right to portability: you may request your data in a structured, machine-readable format.
      To exercise any of these rights, contact us at litaturot@gmail.com. We will endeavour to respond within 30 days.
      If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the French data protection authority: CNIL (Commission Nationale de l’Informatique et des Libertés).
11. Data Security
    We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is handled exclusively by Stripe and is never transmitted to or stored on our servers.
12. Changes to This Policy
    We may update this Privacy Policy from time to time. Any changes will be posted on this page. We encourage you to review it periodically.
    
    This Privacy Policy was last updated in March 2026.