Last updated: October 22, 2026
This policy explains what personal data we collect when you visit shopnanapearl.com, download a free guide or buy a guide, why we use it, and what rights you have. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the French Data Protection Act (Loi n° 78-17 du 6 janvier 1978, “Informatique et Libertés”).
1. Who is responsible for your data
The data controller is [À COMPLÉTER : prénom et nom], Entrepreneur individuel (EI), trading as Nana Pearl, [À COMPLÉTER : adresse du siège], SIRET [À COMPLÉTER : SIRET]. See our Legal Notice.
Contact for any privacy question: nanapearl.shop@gmail.com.
We have not appointed a Data Protection Officer, as we are not required to (Article 37 GDPR).
2. What data we collect
- Order data: name, email address, billing address and country, order details, amount paid, discount code used, and your consent to immediate delivery and waiver of the right of withdrawal.
- Payment data: processed directly by our payment provider. We never see or store your full card number.
- Free guide data: the email address you give us to receive a free guide.
- Newsletter data: your email address and the date and proof of your consent, if you choose to subscribe.
- Customer service data: the content of your messages to us.
- Technical data: IP address, browser and device type, pages viewed and download logs, collected through cookies and similar technologies (see section 9).
We do not collect your body measurements. Anything you write in a guide stays on your own device or paper.
3. Why we use your data, and on what legal basis
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Processing your order, delivering your files, sending order emails | Performance of a contract (6.1.b) |
| Delivering a free guide you requested | Performance of a contract (6.1.b) |
| Handling your questions, complaints, withdrawal and guarantee requests | Performance of a contract (6.1.b) and legal obligation (6.1.c) |
| Keeping invoices and accounting records | Legal obligation (6.1.c) |
| Sending our newsletter and offers | Your consent (6.1.a), which you can withdraw at any time |
| Preventing fraud and securing the store | Our legitimate interest (6.1.f) |
| Audience measurement and advertising cookies | Your consent (6.1.a) |
Downloading a free guide does not subscribe you to our newsletter. You will only receive marketing emails if you tick the separate, optional box to subscribe.
4. How long we keep it
- Customer data (orders, contact): for the duration of our relationship, then 3 years after your last purchase or contact for marketing purposes, if you have consented.
- Accounting records and invoices: 10 years (Article L123-22 of the French Commercial Code).
- Proof of consent (withdrawal waiver, newsletter): for as long as needed to prove it, and at most for the limitation period for legal claims (5 years).
- Free guide and newsletter contacts: 3 years after your last interaction with us (for example, your last email opened or click), or until you unsubscribe.
- Cookies: 13 months at most; your cookie choices are kept for 6 months.
5. Who receives your data
We never sell or rent your personal data. We share it only with service providers that process it on our behalf (processors, Article 28 GDPR):
- Shopify International Limited (Ireland): store hosting, checkout, order management, digital file delivery (Digital Products app), and order emails.
- Bunny Fonts (BunnyWay d.o.o., Slovenia, EU): serves the website’s fonts. Your browser connects to its servers to load them; it sets no cookies and does not log visitors.
- Payment providers: Shopify and the payment partners shown at checkout, which process your payment securely.
- Email marketing: Shopify Messaging (Shopify Email), only if you subscribe to our newsletter.
- Analytics and advertising: Shopify Analytics, only with your consent. No third-party advertising pixel is installed at the moment; if we add one, it will be listed in our Cookie Policy and will only run with your consent.
For certain features (such as Shop Pay or the Shop app), Shopify acts as an independent controller. See the Shopify Consumer Privacy Policy.
We may also disclose data to public authorities when required by law.
6. Transfers outside the European Union
Some of our providers, or their sub-processors, are located outside the EU, mainly in Canada and the United States. These transfers are protected by:
- the European Commission’s adequacy decision for Canada;
- the EU–US Data Privacy Framework for US companies certified under it; and/or
- Standard Contractual Clauses adopted by the European Commission (Article 46 GDPR).
You can ask us for a copy of the relevant safeguards at nanapearl.shop@gmail.com.
7. Your rights
Under Articles 15 to 22 GDPR, you have the right to:
- access your data and receive a copy;
- correct inaccurate data;
- erase your data;
- restrict processing;
- receive your data in a portable format;
- object to processing based on our legitimate interest, and object at any time to marketing;
- withdraw your consent at any time, without affecting processing carried out before;
- give instructions on what happens to your data after your death (Article 85 of the French Data Protection Act).
To exercise these rights, email nanapearl.shop@gmail.com or use our contact page. We reply within one month. We may ask for proof of identity if we have a reasonable doubt. Every marketing email also contains an unsubscribe link.
You also have the right to lodge a complaint with the French data protection authority: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr. If you live in another EU country, you may also contact your local authority.
8. Residents of the United States
We do not sell your personal information, and we do not share it for cross-context behavioral advertising without your consent. You may ask us to access, correct or delete your personal information by emailing nanapearl.shop@gmail.com, or opt out on our Your Privacy Choices page. We will not discriminate against you for exercising your rights.
9. Cookies
We use cookies that are strictly necessary for the store to work (cart, checkout, security). These do not need your consent. Analytics and advertising cookies are placed only if you accept them in our cookie banner. You can change your choice at any time. Details are in our Cookie Policy.
10. Children
Our store is intended for adults. We do not knowingly collect data from children under 15. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
Our store runs on Shopify’s secure infrastructure (HTTPS encryption, PCI DSS-compliant checkout). Access to your data is limited to what is needed to serve you.
12. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significant effects (Article 22 GDPR).
13. Changes
We may update this policy. The date at the top shows the latest version. If the changes are significant, we will let you know by email or on the store.