Privacy policy

 

This Privacy Policy describes how sunferem.store, referred to in this policy as “sunferem.store,” “we,” “us,” or “our,” collects, uses, stores, discloses, and protects personal data when you visit our website, create an account, place an order, contact us, subscribe to marketing communications, or otherwise use our services.

This Privacy Policy applies to visitors and customers located in France, the European Union, the European Economic Area, and other locations where our website and services are available.

For the purposes of the General Data Protection Regulation and applicable French data protection law, sunferem.store is the data controller for the personal data described in this policy.

You may contact us regarding privacy matters at:

Website: sunferem.store
Email: info@sunferem.store

1. Personal Data We Collect

“Personal data” means information that identifies you or can reasonably be linked to you.

Depending on how you interact with our website, we may collect the following categories of personal data.

1.1 Information You Provide Directly

We may collect information that you provide when you:

  • Place or attempt to place an order

  • Create or manage a customer account

  • Contact customer service

  • Request a return, refund, exchange, or cancellation

  • Subscribe to emails or promotional communications

  • Submit a review, survey response, or other content

  • Participate in a promotion or discount program

This information may include:

  • Full name

  • Billing address

  • Shipping address

  • Email address

  • Telephone number

  • Account login information

  • Order details

  • Product preferences

  • Size or style selections

  • Communications with customer service

  • Return and refund information

  • Marketing preferences

  • Any other information you voluntarily provide

1.2 Payment Information

When you make a purchase, payment information is collected and processed by our payment service providers.

Depending on the payment method selected, this information may include:

  • Payment card details

  • Billing information

  • Payment account identifiers

  • Transaction reference numbers

  • Payment authorization results

  • Fraud-prevention information

We generally do not directly store complete payment card numbers. Payment information is processed by authorized payment providers in accordance with their own privacy and security practices.

1.3 Information Collected Automatically

When you visit or interact with our website, certain technical information may be collected automatically, including:

  • Internet Protocol address

  • Browser type and version

  • Device type

  • Operating system

  • Language settings

  • Approximate location based on your IP address

  • Referring website or source

  • Pages viewed

  • Products viewed

  • Search activity

  • Links clicked

  • Shopping-cart activity

  • Checkout activity

  • Date and time of access

  • Session information

  • Cookie and similar technology identifiers

  • Website performance and error information

We use this information to operate the website, maintain security, understand website usage, improve performance, prevent fraud, and provide relevant content.

1.4 Information Received from Third Parties

We may receive personal data from third parties that help us operate our store, including:

  • Shopify

  • Payment processors

  • Shipping and logistics providers

  • Fraud-prevention providers

  • Analytics providers

  • Advertising and marketing partners

  • Customer-support providers

  • Social-media platforms

  • Applications installed on our Shopify store

The type of information received depends on the services used and your interactions with those third parties.

2. How We Use Personal Data

We may use personal data for the following purposes.

2.1 Providing Products and Services

We process personal data to:

  • Accept and process orders

  • Confirm purchases

  • Process payments

  • Arrange shipping and delivery

  • Provide order tracking

  • Create and manage customer accounts

  • Process returns, refunds, cancellations, and exchanges

  • Respond to customer-service requests

  • Communicate important order or service information

  • Provide products and services requested by customers

2.2 Operating and Improving the Website

We may use personal data to:

  • Operate and maintain our website

  • Remember shopping-cart selections

  • Personalize website features

  • Analyze website performance

  • Identify technical problems

  • Improve navigation and usability

  • Develop new products, services, and website functions

  • Understand customer interests and purchasing patterns

2.3 Security and Fraud Prevention

We may process personal data to:

  • Verify transactions

  • Detect suspicious activity

  • Prevent fraud and payment abuse

  • Protect customer accounts

  • Maintain website and network security

  • Enforce our contractual terms

  • Investigate unauthorized transactions

  • Protect our rights, customers, and service providers

2.4 Marketing and Advertising

Subject to applicable law and your choices, we may use personal data to:

  • Send promotional emails

  • Inform you about products, offers, or discounts

  • Measure the effectiveness of advertising

  • Display advertisements that may be relevant to your interests

  • Build or measure advertising audiences

  • Understand engagement with marketing communications

Where consent is legally required, we will use personal data for electronic marketing or non-essential advertising only after obtaining your consent.

You may withdraw your marketing consent at any time by using the unsubscribe link included in our promotional emails or by contacting us at info@sunferem.store.

Withdrawal of consent does not affect the lawfulness of processing performed before consent was withdrawn.

2.5 Legal and Regulatory Compliance

We may process personal data to:

  • Comply with tax and accounting obligations

  • Maintain legally required transaction records

  • Respond to lawful requests from authorities

  • Establish, exercise, or defend legal claims

  • Comply with consumer-protection requirements

  • Investigate violations of our policies

  • Fulfil other obligations imposed by applicable law

3. Legal Bases for Processing

Under the GDPR, we rely on one or more of the following legal bases when processing personal data.

3.1 Performance of a Contract

We process personal data when necessary to enter into or perform a contract with you, including to:

  • Process an order

  • Collect payment

  • Deliver products

  • Manage customer accounts

  • Provide customer support

  • Handle returns and refunds

3.2 Legal Obligations

We process personal data when necessary to comply with legal obligations, including tax, accounting, consumer-protection, fraud-prevention, and regulatory requirements.

3.3 Legitimate Interests

We may process personal data where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These legitimate interests may include:

  • Operating and improving our store

  • Protecting the security of our website

  • Preventing fraud

  • Understanding business performance

  • Handling customer inquiries

  • Defending legal claims

  • Maintaining appropriate business records

Where we rely on legitimate interests, we consider the nature of the data, the purpose of processing, the potential impact on individuals, and the safeguards available.

3.4 Consent

We rely on your consent where required, including for certain:

  • Marketing communications

  • Advertising technologies

  • Analytics technologies

  • Non-essential cookies

  • Personalized advertising activities

You may withdraw consent at any time.

4. Shopify

Our online store is hosted and supported by Shopify. Shopify provides the e-commerce platform that enables us to display products, process orders, manage customer accounts, and operate our website.

When you visit our store or place an order, personal data may be processed through Shopify’s systems and infrastructure.

Shopify may process personal data as our service provider or data processor and, for certain activities, as an independent data controller. Shopify may also use affiliated companies and approved subprocessors to provide its services.

Personal data relating to customers in the European Economic Area may be initially processed by Shopify’s European entity and may subsequently be accessed or processed by Shopify affiliates or service providers in other countries, subject to applicable transfer safeguards.

5. How We Disclose Personal Data

We may disclose personal data only where reasonably necessary for the purposes described in this policy.

5.1 Service Providers

We may disclose personal data to service providers that perform services on our behalf, including:

  • E-commerce platform providers

  • Payment processors

  • Shipping companies

  • Warehousing and fulfilment providers

  • Customer-support providers

  • Website hosting providers

  • Information-technology providers

  • Fraud-prevention providers

  • Analytics providers

  • Email and marketing providers

  • Advertising platforms

  • Professional advisers

These providers may process personal data only as necessary to perform their services, subject to applicable contractual and legal obligations.

5.2 Payment Providers

Payment providers process personal data necessary to authorize, complete, refund, or investigate transactions.

The payment provider available to you may depend on your location and the payment method selected at checkout.

5.3 Shipping and Fulfilment Providers

We may provide your name, delivery address, contact information, order details, and tracking information to suppliers, warehouses, postal operators, couriers, and other fulfilment partners involved in delivering your order.

5.4 Analytics and Advertising Partners

Where legally permitted and subject to your consent when required, we may disclose or make available certain device, browsing, and interaction data to analytics or advertising partners.

This information may be used to:

  • Measure website traffic

  • Analyze customer interactions

  • Assess advertising performance

  • Limit repeated advertisements

  • Present more relevant advertising

5.5 Legal Disclosures

We may disclose personal data where we reasonably believe disclosure is necessary to:

  • Comply with applicable law

  • Respond to a court order or lawful government request

  • Protect our legal rights

  • Prevent or investigate fraud

  • Protect the safety of customers or others

  • Enforce our Terms of Service

  • Establish, exercise, or defend legal claims

5.6 Business Transfers

If our business or assets are reorganized, transferred, merged, financed, sold, or acquired, personal data may be disclosed as part of that transaction, subject to applicable data protection law.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies, such as pixels, tags, local storage, and software development tools.

Cookies are small data files stored on your device when you visit a website.

We may use the following categories of cookies.

6.1 Strictly Necessary Cookies

These cookies are required for essential website functions, including:

  • Shopping-cart operation

  • Checkout processing

  • Account login

  • Security

  • Fraud prevention

  • Remembering privacy choices

These cookies generally cannot be disabled through our consent tool because the website may not function correctly without them.

6.2 Preference Cookies

These cookies remember choices such as language, region, account preferences, and other settings.

6.3 Analytics Cookies

These cookies help us understand:

  • How visitors use the website

  • Which pages are viewed

  • Whether errors occur

  • How visitors arrive at the website

  • How website performance can be improved

6.4 Advertising Cookies

Advertising cookies may be used to:

  • Measure advertising performance

  • Understand interactions with advertisements

  • Limit repeated advertising

  • Present advertising based on browsing activity

  • Create or measure advertising audiences

Where required by French or European law, analytics, advertising, and other non-essential cookies will not be placed or accessed before you provide valid consent.

You may accept, reject, or adjust non-essential cookies through the cookie consent tool available on our website.

You may also configure your browser to block or delete cookies. Blocking certain cookies may affect website functionality.

7. Marketing Communications

We may send marketing communications where:

  • You have provided consent;

  • You have requested such communications; or

  • Applicable law otherwise permits us to contact you.

Marketing communications may include information about:

  • New products

  • Promotions

  • Discounts

  • Store updates

  • Abandoned shopping carts

  • Similar products that may interest existing customers

Every promotional email will include an unsubscribe method.

Service communications relating to an existing order, account security, returns, refunds, or important changes are not marketing communications and may continue after you unsubscribe from promotional emails.

8. International Data Transfers

Our store, Shopify, and some of our service providers may operate in countries outside France or the European Economic Area.

As a result, personal data may be transferred to or accessed from countries whose data protection laws may differ from those in France.

Where required, international transfers will be protected through an appropriate legal mechanism, which may include:

  • A European Commission adequacy decision

  • Standard Contractual Clauses approved by the European Commission

  • Supplementary technical or organizational safeguards

  • Another legally permitted transfer mechanism

We take reasonable steps to require service providers to protect personal data in accordance with applicable law.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to:

  • Complete and administer transactions

  • Provide customer service

  • Maintain account records

  • Comply with tax, accounting, and commercial obligations

  • Resolve disputes

  • Enforce agreements

  • Prevent fraud

  • Establish or defend legal claims

The retention period may depend on:

  • The nature of the personal data

  • The reason it was collected

  • Whether you maintain an account

  • Whether an order or dispute remains unresolved

  • Applicable legal limitation periods

  • Tax and accounting requirements

  • Security and fraud-prevention needs

When personal data is no longer required, we may delete it, anonymize it, or securely isolate it until deletion is possible.

Withdrawing consent or requesting deletion does not always require immediate deletion where we have another lawful basis or a legal obligation to retain certain information.

10. Data Security

We use reasonable technical and organizational measures designed to protect personal data against:

  • Unauthorized access

  • Accidental loss

  • Unlawful disclosure

  • Alteration

  • Misuse

  • Destruction

These measures may include access controls, encrypted data transmission, account authentication, security monitoring, fraud-prevention tools, and restrictions on access to personal data.

However, no website, transmission method, or electronic storage system can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of your account credentials and should contact us promptly if you believe your account has been accessed without authorization.

11. Your Data Protection Rights

Subject to applicable law and any relevant limitations, you may have the following rights.

11.1 Right of Access

You may request confirmation of whether we process your personal data and obtain access to that data.

11.2 Right to Rectification

You may request correction of personal data that is inaccurate or completion of data that is incomplete.

11.3 Right to Erasure

You may request deletion of personal data in circumstances permitted by law.

This right is not absolute. We may retain information where necessary to comply with legal obligations, complete transactions, prevent fraud, or establish or defend legal claims.

11.4 Right to Restrict Processing

You may request that we temporarily or permanently restrict certain processing activities where the legal requirements are met.

11.5 Right to Data Portability

Where processing is based on consent or a contract and carried out by automated means, you may request eligible personal data in a structured, commonly used, and machine-readable format.

You may also request transmission of eligible data to another controller where technically feasible.

11.6 Right to Object

You may object to processing based on legitimate interests, including profiling based on those interests.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your rights or the processing is necessary for legal claims.

You may object to direct marketing at any time. Where you object to direct marketing, we will stop using your personal data for that purpose.

11.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing completed before withdrawal.

11.8 Rights Concerning Automated Decisions

You may have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you, except where such processing is authorized by law.

We may use automated tools to identify potential fraud, payment risk, account abuse, or security threats. Where a legally significant solely automated decision is used, applicable safeguards will be provided.

11.9 Right to Provide Instructions After Death

Where permitted by French law, you may provide instructions concerning the retention, deletion, and communication of your personal data after your death.

12. Exercising Your Rights

To exercise a privacy right, contact us at:

Email: info@sunferem.store

Please state that your request concerns personal data and describe the right you wish to exercise.

We may request information reasonably necessary to:

  • Verify your identity

  • Locate the relevant data

  • Protect your information from unauthorized disclosure

  • Understand and process your request

We will respond within the period required by applicable data protection law.

In certain circumstances, the response period may be extended where a request is complex or multiple requests have been submitted. Where an extension is permitted, we will inform you as required by law.

We will not normally charge a fee for exercising a data protection right. A reasonable fee may be charged, or a request may be refused, where permitted by law and where the request is manifestly unfounded or excessive.

13. Complaints to the CNIL

You have the right to lodge a complaint with a competent supervisory authority if you believe that the processing of your personal data infringes applicable law.

In France, the competent supervisory authority is the:

Commission Nationale de l’Informatique et des Libertés, commonly known as the CNIL

We encourage you to contact us first at info@sunferem.store so that we have an opportunity to address your concern. Contacting us does not limit your right to submit a complaint to the CNIL or another competent authority.

14. Third-Party Websites and Services

Our website may contain links to third-party websites, applications, payment services, or social-media platforms.

We do not control the privacy or security practices of independent third parties. Their handling of personal data is governed by their own privacy policies.

We encourage you to review the privacy information of any third-party service before providing personal data.

15. Children’s Privacy

Our website and products are intended for a general consumer audience and are not specifically directed to children.

We do not knowingly collect personal data from children in violation of applicable law.

Where a child’s consent requires authorization from a parent or legal guardian, personal data will be processed only where the applicable legal requirements have been satisfied.

If you believe that a child has provided personal data without legally required authorization, contact us at info@sunferem.store.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect:

  • Changes to our services

  • Changes to our data-processing practices

  • Changes to the service providers we use

  • Legal or regulatory developments

  • Security or operational requirements

The revised version will be published on this page with an updated “Last updated” date.

Where required by law, we will provide additional notice or request renewed consent before making a material change that affects consent-based processing.

17. Contact Us

For questions, requests, or concerns concerning this Privacy Policy or the processing of personal data, contact:

sunferem.store
Website: sunferem.store
Email: info@sunferem.store