Privacy policy

Data controller

SONJA MARKOVIC, French sole trader (entrepreneur individuel — EI), operates L’atelier de Sonja and is responsible for the shop’s processing of personal data. Contact: latelierdesonja@gmail.com; +33 6 62 76 89 99; 15 Bis Avenue Caravadossi, 06000 Nice, France.

At latelierdesonja.com, we take care of your personal data and we are committed to guaranteeing its confidentiality and security.

The personal information we collect:

When you visit latelierdesonja.com, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies installed on your device. Additionally, as you browse the Site, we collect information about the web pages or individual products you view, the websites or search terms that referred you to the Site, and how you interact with the Site. site. We refer to this automatically collected information as "Device Information". Additionally, we may collect the personal data you provide to us (including, but not limited to, first and last name, address, payment information, etc.) during registration so that we can perform the contract.

This data also includes billing and delivery addresses, order references and amounts, and the contact details, subject and contents of messages you send us. Browsing without an account does not exclude the processing of technical identifiers, such as your IP address.

Why do we process your data?

We process the data necessary to handle orders, payments, deliveries and related enquiries to perform the contract or take the pre-contractual steps you request. We also process data required by our legal obligations. The shop uses Shopify and Shop Pay, email marketing, Meta/Facebook/Instagram, Google/GA4 and Pinterest, as well as Reputon Etsy Reviews and Shipping Rates Calculator. Processing is therefore not limited to security and anonymous statistics.

You can visit the Website without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. However, if you wish to use certain features of the website, or if you wish to receive our newsletter or provide other details by filling in a form, you may provide us with personal data, such as your e-mail address, first name , your name, your city of residence, your organization, your telephone number. You can choose not to provide us with your personal data, but then you may not be able to take advantage of certain features of the website. For example, you will not be able to receive our newsletter or contact us directly from the website. Users who do not know which information is mandatory are invited to contact us via the contact form.

Data recipients. Relevant information may be shared with service providers involved in store hosting, payments, shipping and parcel tracking, messaging, invoicing, backups and security. Shopify processes the data needed to operate the store on our behalf. The payment services offered, including Shopify Payments, Shop Pay and PayPal, are involved according to the method you choose. Carriers receive the information needed for delivery. Some providers also process data for their own obligations, including security or compliance; their policies explain this processing. The analytics and advertising services already listed are involved for the purposes and subject to the consent conditions described below.

Security and fraud prevention. We primarily use the protections provided by Shopify and payment providers, including the risk alerts and security mechanisms available in Shopify. When an order is flagged as suspicious, we may manually review its information and cancel it if we consider the risk sufficiently significant. We do not operate an independent internal fraud detection system. The legitimate interest pursued by these checks is to protect the store and its customers against fraud and misuse. Reliance on this legal basis requires the processing to be necessary and not overridden by your interests, rights and freedoms; it does not mean that a formal assessment has already been documented. Responses to enquiries unrelated to a contract pursue our legitimate interest in providing you with information.

Cookies and tracking technologies. The store distinguishes cookies strictly necessary for its operation from personalization, analytics and advertising cookies. Google/GA4, Meta/Facebook/Instagram and Pinterest services may be used to measure visits, product interactions and campaign results. Non-essential trackers, including advertising trackers and analytics that are not exempt from consent, require your prior consent where required by law. The “Manage cookies” button at the bottom of the site lets you accept, refuse or change your preferences and withdraw consent. Choices are remembered for your browser; you may need to make them again on another device or after clearing browser data.

Shopify Network Intelligence. This feature is enabled. Shopify may combine interaction and transaction data from our store, other merchants and Shopify to improve its analytics, personalization and advertising services. For these enhanced services, Shopify acts as a separate data controller. Targeted advertising and tracking technologies remain subject to required consent. See Shopify’s Consumer Privacy Policy and its privacy portal to learn about its processing and exercise your rights, including withdrawal or objection where applicable.

International transfers. Shopify services may involve processing outside the European Economic Area. For transfers covered by its data processing agreement, Shopify provides, in particular, for binding corporate rules for transfers within its group from the EEA and, depending on the circumstances, applicable standard contractual clauses. Processing by Shopify as a separate controller is described in its consumer policy. You can contact us for details of the destinations and safeguards applicable to your data.

Data retention

Customer and order data. Our customers’ information is stored in Shopify. We rely on its native features for technical data management. We currently have no internal procedure for periodically deleting old customer profiles, no automatic purge period set by us, and no independent automated deletion system. This does not mean that Shopify automatically deletes old profiles after a fixed period, or that all data may be retained indefinitely. Retention must be limited to what is necessary to handle orders, delivery, returns, warranties and related enquiries, and subsequently to legal obligations and the establishment, exercise or defence of legal claims for the applicable periods.

Applicable retention obligations require accounting records and supporting documents, including invoices, to be kept for ten years from the end of the financial year. For records subject to tax inspection, the statutory period is six years from their creation or the last recorded transaction, without shortening a longer accounting obligation. Electronic contracts with consumers worth at least €120 must be retained for ten years from delivery or performance, as well as for the preceding period. These obligations do not justify retaining all customer data indiscriminately.

Erasure requests. You can send us an erasure request. We can use the procedure provided in Shopify for its technical processing, subject to information that must be retained under legal obligations and other applicable exceptions to the right to erasure. Erasing personal data does not necessarily mean deleting the entire order history. This procedure does not cover Shopify’s separate processing associated with your relationship with services such as Shop or Shop Pay; you can exercise your rights for those services directly with Shopify.

Other categories of data. For contact enquiries, newsletter subscriptions and data associated with other services, no precise internal deletion or archiving period is currently confirmed. Retention periods and operational arrangements remain to be defined according to the purposes, legal obligations and individuals’ rights. Data must not be retained longer than necessary for those purposes. You can unsubscribe from the newsletter and exercise the rights described in this policy. A cookie’s lifespan is distinct from the retention period of data held by a service provider.

7. Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability of your data. You may object to processing based on legitimate interests, and to direct marketing at any time. You may withdraw consent as easily as you gave it. Not every right applies in the same way to every processing operation.

Send requests to latelierdesonja@gmail.com or the controller’s postal address. Additional identity information may be requested only where necessary in case of reasonable doubt. We respond within one month of receipt, extendable by two months where justified by complexity or the number of requests, with notice during the first month.

You may complain to the French supervisory authority, the CNIL, or another competent supervisory authority. Contacting us first may help resolve the issue but is not a condition of your right to complain.

Links to other websites:

Our website may contain links to other websites which are not owned or controlled by us. Please be aware that we are not responsible for these other websites or the privacy practices of third parties. We encourage you to be aware when you leave our website and to read the privacy statements of each website that may collect personal information.

Information security :

We secure the information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. We maintain reasonable administrative, technical and physical safeguards to protect against unauthorized access, use, modification and disclosure of personal data in its control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.

Legal Disclosure :

We will disclose any information we collect, use or receive if required or permitted to do so by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud or respond to a government request.

Contact information :

If you wish to contact us to further understand this policy or if you wish to contact us regarding any questions relating to individual rights and your personal information, you can send an email via our contact form.

Email marketing

Newsletter subscription is voluntary and is not required to place an order. Prospect marketing is based on consent. You can unsubscribe at any time using the link in a message or by contacting latelierdesonja@gmail.com. Withdrawing consent does not affect the lawfulness of earlier processing. Cookie consent does not constitute consent to receive marketing emails, and vice versa. Abandoned-cart marketing uses the email-subscription filter; placing items in a basket is not itself marketing consent.

Shopify Messaging is used for sending emails. Its settings include open measurement and link tracking to assess email results. These measurements may concern interactions with messages and visits from their links; they are separate from simply recording your subscription.