Privacy policy

Last updated: 30 July 2026

1 — Data controller

The controller for the personal data processing carried out on this site is:

Frédéric Silve, sole trader (entrepreneur individuel, EI), trading under the name Les Roses De Lola.

Address: 18 rue Edward Durst, 22650 Beaussais-sur-Mer, France
SIREN: 492 435 078
Email: contact@lesrosesdelola.com
Telephone: +33 7 56 85 56 29

2 — Purpose of this policy

This policy explains how Les Roses De Lola collects, uses, stores and shares the personal data of visitors, customers, gift recipients and users of the Souvenir Connecté®.

It applies in particular when:

  • browsing the site;

  • creating or using a customer account;

  • placing an order or making a payment;

  • contacting customer service;

  • signing up to marketing communications;

  • using the Souvenir Connecté®;

  • recording or listening to a voice message.

3 — Data collected

Depending on how the site and services are used, the following categories of data may be collected:

Identification and contact data

  • first name and surname;

  • email address;

  • telephone number;

  • billing and delivery address;

  • information about the recipient of a gift.

Order data

  • products ordered;

  • order amount and date;

  • order number;

  • delivery method;

  • tracking, returns, refunds and complaints;

  • history of exchanges with customer service.

Payment data

The information needed for payment is processed by the payment providers offered at checkout.

Les Roses De Lola does not retain full bank card numbers.

Browsing data

  • IP address;

  • device and browser type;

  • pages viewed;

  • actions taken on the site;

  • technical identifiers;

  • data collected by cookies and similar technologies.

Data linked to the Souvenir Connecté®

  • the email address used to send the QR code;

  • the identifier of the QR code and of the associated page;

  • the voice file or other recorded content;

  • the date the content was created or modified;

  • technical information needed to operate and secure the service;

  • requests for changes, support or deletion.

4 — Specific points about the Souvenir Connecté®

The Souvenir Connecté® gives access to a page associated with a personal QR code, on which a message can be recorded or played.

The page is not intended to be publicly indexed. Anyone holding the QR code or its link can nonetheless reach its content. The buyer and the recipient should therefore avoid sharing it publicly.

Whoever records content warrants that they hold the rights and permissions required. Where a message contains another person’s voice or information about them, their agreement must be obtained where necessary.

Content is processed solely to create, host, secure and maintain the Souvenir Connecté®, and to respond to support requests.

The buyer, or the person concerned, may request access to, correction of, retrieval of or deletion of content by writing to contact@lesrosesdelola.com. Verification may be requested in order to prevent unauthorised modification or deletion.

5 — Sources of the data

Data may be collected:

  • directly from the customer or user;

  • from the recipient when they use the Souvenir Connecté®;

  • automatically while browsing the site;

  • from payment, delivery or service providers;

  • from Shopify and the apps used by the store;

  • from advertising partners, only under the conditions permitted by the applicable rules and by the user’s choices.

6 — Purposes and legal bases

Performance of the contract

Data is used to:

  • process and confirm orders;

  • collect payments;

  • prepare and track deliveries;

  • handle returns and refunds;

  • provide and maintain the Souvenir Connecté®;

  • respond to customer requests.

This processing is necessary for the performance of the contract entered into with the customer.

Legal obligations

Certain data is retained in order to comply with accounting, tax, customs, administrative and consumer protection obligations.

Legitimate interest

Data may be used to:

  • secure the site and the services;

  • prevent fraud;

  • defend the seller’s rights;

  • improve how the store works;

  • measure service performance where the applicable rules allow it.

Consent

Consent is relied on where necessary, in particular for:

  • certain audience measurement cookies;

  • advertising cookies;

  • certain marketing communications;

  • advertising personalisation;

  • similar technologies placed by third-party services.

Consent may be withdrawn at any time.

7 — Whether information is required

Information marked as mandatory is needed in order to process the order or provide the service requested.

Without it, the order, delivery, payment or access to the Souvenir Connecté® may not be possible.

All other information is optional.

8 — Recipients and service providers

Data is accessible only to the people and providers who need it in order to operate the site and the services.

It may in particular be shared with:

  • Shopify, which provides the e-commerce platform;

  • payment providers, in particular Shopify Payments, PayPal or Alma, depending on the customer’s choice;

  • suppliers, logistics partners and carriers responsible for preparing or delivering an order;

  • the technical providers responsible for hosting and operating the Souvenir Connecté®;

  • email and communication services;

  • customer review management tools;

  • providers of audience analytics, security and fraud prevention;

  • advertising partners, only where the applicable rules and the user’s choices allow it;

  • administrative or judicial authorities where a legal obligation requires it.

Where a supplier ships a product directly, only the data needed to prepare and deliver the order is passed to them.

Les Roses De Lola does not sell the voice files or the content entrusted to the Souvenir Connecté®.

9 — Shopify

The store is hosted and operated using Shopify services.

Data entered on the site is processed by Shopify and may be passed to its sub-processors in order to provide, secure and improve the store’s services.

Shopify may also act as controller for certain processing linked to its own services and features.

For more information: https://www.shopify.com/legal/privacy

The portal for exercising certain rights with Shopify is available at: https://privacy.shopify.com/en

10 — International transfers

Some providers, in particular Shopify and certain technical or advertising services, may process data outside the European Economic Area.

These transfers are governed by the mechanisms provided for by the applicable rules, in particular:

  • an adequacy decision;

  • the European Commission’s standard contractual clauses;

  • binding corporate rules;

  • any other safeguard recognised by the GDPR.

11 — Retention periods

Data is kept only for as long as necessary for its purpose.

The main periods applied are as follows:

  • order and customer relationship data: for the duration of the contractual relationship, then for the periods needed to handle guarantees and any disputes;

  • invoices and accounting records: ten years;

  • data used for marketing outreach: for the duration of the commercial relationship, then three years after it ends or after the customer’s last contact;

  • data of a prospect who has not ordered: three years from collection or from last contact;

  • inactive customer account: deleted or anonymised after a reasonable period of inactivity, generally two years, unless an obligation requires otherwise;

  • requests sent to customer service: while the request is being handled, then for the period needed for evidence and defence of rights;

  • connection and security data: for the period strictly necessary to the security of the service;

  • cookie choices: generally six months.

Voice files and Souvenir Connecté® content are kept for as long as the service remains active, with no scheduled expiry date, unless deletion is requested, a legal obligation applies, the content is unlawful, or the service is permanently discontinued.

Some copies may remain temporarily in secure technical backups before being permanently deleted.

12 — Cookies and similar technologies

The site uses cookies and similar technologies to:

  • make the site work;

  • keep the basket and preferences;

  • secure payments and accounts;

  • measure audience;

  • embed certain external content;

  • personalise communications and advertising.

Strictly necessary cookies may be used without consent.

Non-exempt audience measurement, advertising and personalisation cookies are only placed after consent has been obtained.

Visitors can accept, refuse or customise their choices from the banner shown on their first visit.

They can change their choice at any time through the “Your privacy choices” link in the footer of the site.

Refusing non-essential cookies does not prevent an order from being placed.

13 — Marketing communications

Les Roses De Lola may send communications relating to orders and to the running of the services without any specific marketing consent.

Promotional communications are sent under the conditions permitted by law.

Recipients can unsubscribe at any time using the link in every marketing email, or by writing to contact@lesrosesdelola.com.

Unsubscribing does not stop the messages needed to track an order or to operate the Souvenir Connecté®.

14 — Security

Les Roses De Lola and its providers put in place appropriate technical and organisational measures to protect data against:

  • unauthorised access;

  • loss;

  • alteration;

  • disclosure;

  • destruction;

  • unlawful use.

No system can, however, guarantee absolute security.

In the event of a breach presenting a risk to individuals, Les Roses De Lola will make the notifications required by the applicable rules.

15 — Data concerning minors

The store is intended for people with the legal capacity to make a purchase.

Where a message recorded in the Souvenir Connecté® contains the voice or data of a minor, the person submitting that content must hold the necessary authority or permission.

A parent or legal guardian may request the deletion of a minor’s data by writing to contact@lesrosesdelola.com.

16 — Your rights

Under the GDPR, data subjects may have the following rights:

  • right of access;

  • right to rectification;

  • right to erasure;

  • right to restriction of processing;

  • right to object;

  • right to data portability;

  • right to withdraw consent;

  • right to give directions about what happens to their data after their death, where the law allows it.

These rights can be exercised by writing to contact@lesrosesdelola.com.

The request should state which right is being exercised and provide the information needed to identify the data concerned. Proof of identity may be requested only where this is necessary to prevent unauthorised disclosure or deletion.

A response is given within the period set by the applicable rules, generally one month.

17 — Complaint to the CNIL

Anyone may lodge a complaint with the French data protection authority:

Commission nationale de l’informatique et des libertés
https://www.cnil.fr

We do recommend contacting Les Roses De Lola first, so that we can try to resolve the matter.

18 — Third-party links and services

The site may contain links to, or content from, third-party services, in particular payment platforms, social networks or video services.

These services have their own privacy policies. Les Roses De Lola does not control the processing carried out directly by those third parties once the user has left the store or chosen to use their service.

19 — Changes to this policy

This policy may be amended to reflect changes to the site, the services, the providers or the applicable rules.

The date of the last update is shown at the top of the page.

20 — Contact

For any question about this policy or about exercising your rights:

Frédéric Silve EI – Les Roses De Lola
18 rue Edward Durst
22650 Beaussais-sur-Mer
France

Email: contact@lesrosesdelola.com
Telephone: +33 7 56 85 56 29