This privacy policy describes how Atelier la Sylle collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (EU Regulation 2016/679, 'GDPR') and French Law No. 78-17 of 6 January 1978 as amended, known as the 'Informatique et Libertés' (Data Protection) Act.

1. Data controller

Atelier la Sylle
38 rue des Cailleboudes, 91620 La Ville du Bois
SIRET: 99424464800014 — Intra-community VAT: FR58994244648
Telephone: 07 78 35 62 37
Email: contact@atelier-la-sylle.fr

2. Personal data collected

We only collect the data necessary for the purposes described below:

Identity data: title, surname, first name.
Contact data: email address, telephone number, postal addresses (billing and delivery).
Professional data (where applicable): company name and business contact details.
Order data: products ordered, amounts, purchase history, quotes.
Connection data: authentication event log, IP address, technical browsing data.

No password is collected or stored. Access to your account is based on passwordless authentication: a one-time code (OTP) is sent to you by email at each login. This code is valid for a few minutes and can only be used once.

3. Purposes and legal bases of processing

Managing orders, deliveries and invoicing — performance of the contract (Art. 6.1.b GDPR).
Managing the customer account and authentication — performance of the contract and legitimate interest in securing access (Art. 6.1.b and 6.1.f).
Responding to requests via the contact form — legitimate interest (Art. 6.1.f).
Compliance with legal and accounting obligations — legal obligation (Art. 6.1.c).
Prevention of fraud and abuse — legitimate interest (Art. 6.1.f).

4. Anti-spam measures and form security

The site does not use any third-party service such as reCAPTCHA. The only forms accessible without being logged in are the account login (via one-time code, without a password) and the contact form. The latter is protected by a rate limit: a single visitor (identified by their IP address and email address) may only send 3 requests per minute, in order to prevent automated and abusive submissions.

5. Recipients of the data

Your data is never sold. It may be shared, strictly as necessary, with:

our payment provider Stripe, for the secure processing of transactions;
our carriers and logistics providers, for the delivery of orders;
our host and technical service providers, acting as processors within the meaning of the GDPR;
authorised administrations and authorities, where required by law.

Atelier la Sylle does not transfer any data outside the European Union without appropriate safeguards compliant with the GDPR.

6. Retention period

Customer account data: kept for as long as the account is active, then archived or deleted in the absence of activity.
Order data and invoices: kept for 10 years under accounting and tax obligations.
Authentication event log: kept for 60 days then automatically purged.
Requests via the contact form: kept for as long as necessary to process the request.

7. Cookies

The site places cookies that are strictly necessary for its operation. For details, see our Cookie Policy.

8. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability of your data, as well as the right to set out directives regarding their fate after your death. You may exercise these rights at any time by writing to contact@atelier-la-sylle.fr or by post to the address above, providing proof of your identity.

9. Complaint to the CNIL

If, after contacting us, you believe that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés, CNIL), 3 Place de Fontenoy, 75007 Paris — www.cnil.fr.

10. Changes to the policy

This policy may be updated at any time to reflect legal or technical developments. The applicable version is the one published on the site at the time of your visit.

Privacy Policy