Privacy policy

This policy explains what personal data we collect on luorland.com, why, how long we keep it and what your rights are.

Data controller

PICCOLO ROSSO (Luor Land shop), 7 rue Eva Kotchever, 75018 Paris, France, service-client@luorland.com.

Data collected and purposes

  • Customer account: first and last name, e-mail, password (encrypted), phone. To manage your account and orders (performance of the contract).
  • Orders and delivery: addresses, products ordered, delivery day and slot, history. To prepare, deliver and invoice your orders (performance of the contract, accounting obligations).
  • Business accounts: company name, SIRET, VAT number, company address. To check your business status against public registers (INSEE, the European Commission's VIES system) and grant business terms (performance of the contract).
  • Payment: card payments and SEPA direct debit mandates are handled by Stripe. We never see or store your card number; for direct debits we keep the mandate reference and the last four digits of the IBAN (performance of the contract).
  • Contact form and customer service: e-mail and message, to reply to you (legitimate interest).
  • Newsletter: your e-mail, only if you subscribe; you can unsubscribe at any time through the link in every mailing (consent).
  • Product reviews: display name and review content, if you post one (consent).
  • Security: IP address and technical connection data, to protect the site against abuse and bots (legitimate interest).

Recipients

Your data is intended for PICCOLO ROSSO and, as far as they are concerned, its service providers:

  • OVH (website and e-mail hosting);
  • Stripe (card payments and SEPA direct debit);
  • Cloudflare (content delivery, attack protection and Turnstile bot check);
  • the carrier delivering your order (name, address, phone);
  • our partner producers, only for the information needed to prepare the order.

We never sell or rent your data.

Transfers outside the European Union

The website's server is hosted by OVH in Canada, a country recognised by the European Commission as providing an adequate level of protection. Stripe and Cloudflare may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses.

Retention periods

  • Customer account: until deleted, then 3 years after the last contact for marketing purposes.
  • Invoices and accounting records: 10 years (French Commercial Code).
  • SEPA mandates: 14 months after the last debit, the period during which a debit can be disputed.
  • Customer service messages: 3 years.
  • Technical security logs: 12 months at most.

Cookies

The site only uses cookies needed for it to work: session and basket, language, payment security (Stripe) and bot check (Cloudflare). No advertising or audience-measurement cookies are set, so these cookies do not require your consent.

Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, to withdraw your consent and to give instructions about your data after your death. In your account, the "My personal data" section lets you download your data or request its deletion. You can also write to service-client@luorland.com; we reply within one month.

If you believe your rights have not been respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Updates

This policy may change; the version in force is the one published on this page.