Last updated: October 5, 2026
1. Data controller
Lucas Carbonnier, sole trader (EI – micro-entreprise) trading as Velunora, 5 rue des Écoles, 57380 Pontpierre, France. Contact for any question about your data: contact@velunora.fr.
2. Data collected and purposes
- Orders and delivery (name, addresses, email, phone if provided, order content) – legal basis: performance of the contract.
- Customer service (your messages and exchanges) – legal basis: performance of the contract and legitimate interest.
- Accounting and legal obligations (invoices, transaction records) – legal basis: legal obligation.
- Security and fraud prevention (technical data, IP address) – legal basis: legitimate interest.
- Newsletter and offers, only if you sign up – legal basis: consent, which you can withdraw at any time via the unsubscribe link.
- Analytics and advertising through optional cookies, only with your consent – see our cookie policy.
Payment data is processed directly by our payment providers; we do not have access to your full card number.
3. Recipients
Your data is only shared with the service providers who need it: Shopify (store hosting), payment providers, our partner supplier and the carriers who prepare and deliver your order, and our accountant where applicable.
4. Transfers outside the European Union
Our partner supplier, who ships your order, is located in China: your name, delivery address, phone number if provided and order content are sent to them because this transfer is necessary to fulfil your order (article 49.1.b GDPR). Shopify may also process data outside the EU, notably in Canada and the United States, with appropriate safeguards (adequacy decisions or standard contractual clauses). Learn more: Shopify's privacy policy.
5. Retention periods
- Orders and invoices: 10 years (accounting obligations);
- Customer account: until deleted, or 3 years after your last activity;
- Customer service exchanges: 3 years after the last exchange;
- Newsletter: until you unsubscribe, or 3 years after your last contact;
- Cookies: 13 months maximum; your consent choice is kept for 6 months.
6. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, to withdraw your consent, and to give instructions on what happens to your data after your death. Write to us at contact@velunora.fr; we reply within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or the authority of your country.
7. Security
We take reasonable measures to protect your data (restricted access, encrypted connections, reputable providers). As no system is infallible, we will inform you of any breach likely to put your rights at risk.