Privacy policy
Last updated:
This is a translation provided for convenience. The French version is the only legally binding one.
We collect as little data as possible: what we need to prepare and deliver your orders, and to reply to you. This page explains which data, why, and what your rights are.
Data controller
The controller of your personal data is:
Ferlion Macarons, SARL, RCS Libourne 502 527 732
9 rue Guadet, 33330 Saint-Émilion, France
Phone: +33 5 57 24 72 33
Email: contact@macarons-saint-emilion.com
Data we collect
- Orders: surname, first name, delivery and billing addresses, email, phone number, contents and amount of the order, history of our exchanges about the order. Payment details are entered directly with our payment provider Stripe; we never have access to them.
- Customer account: email address and the information needed to sign in, your order history.
- Contact form: name, email and the content of your message.
- Browsing: strictly necessary cookies (session, basket) and, only with your consent, audience measurement — see the cookies page.
Purposes and legal bases
- Processing, shipping and tracking your orders, handling after-sales service: performance of the contract.
- Managing your customer account: performance of the contract.
- Keeping our accounts and retaining invoices: legal obligation.
- Replying to your messages: legitimate interest in answering the requests sent to us.
- Preventing payment fraud: legitimate interest.
- Measuring the website’s audience: consent, which you can withdraw at any time.
We do not sell or rent out your data, and we do not use it for targeted advertising.
How long we keep data
- Orders, invoices and accounting records: 10 years from the end of the financial year (article L123-22 of the Code de commerce, the French Commercial Code).
- Customer account: until it is deleted, or 3 years after your last activity.
- Contact form messages: 3 years after the last exchange.
Recipients and processors
Your data is intended only for the people at Ferlion Macarons who need it, and for our processors, within the limits of their task:
- Stripe — online payment and fraud prevention;
- Vercel — website hosting;
- Neon — database hosting (European Union, Frankfurt);
- Resend — sending emails (order confirmations, replies to the contact form);
- Chronopost (La Poste group, France) — parcel labels and delivery.
Transfers outside the European Union
Some providers are based outside the European Union, in particular Vercel Inc. in the United States. These transfers are covered by the standard contractual clauses adopted by the European Commission. Stripe (Stripe Payments Europe, Ireland) and Resend (United States) may also transfer some data to the United States, under the EU–US Data Privacy Framework or the same standard contractual clauses. Chronopost processes your data in France.
Security
The website is served only over an encrypted connection (HTTPS), access to the administration is personal and password-protected, and we keep no bank details.
Your rights
You have the right to access, rectify, erase and port your data, the right to object to and restrict processing, the right to withdraw your consent at any time, and the right to set instructions for what happens to your data after your death.
To exercise these rights, email us at contact@macarons-saint-emilion.com or write to us at the address given above. We reply within one month; if we have reasonable doubts, we may ask you to prove your identity.
Complaints to the CNIL
If you believe your rights have not been respected, you can lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr (in French).