Privacy policy

Who is responsible for your data

The data controller is Achraf Rahli, sole trader registered in France (entrepreneur individuel), trading as Zephyr, 24 rue de l’Orme au Charron, 77340 Pontault-Combault, France, SIREN 106 202 724.

For anything to do with your data, write to support@zephy-fan.com. We answer within one month, usually within a day.

What we collect

When you order:

• identity and contact details: first name, last name, email, phone if you give it
• delivery and billing address
• order data: products, amounts, order number, history, tracking
• the messages you send us on support, so we can follow up

When you browse:

• technical data: IP address, browser, device type, pages viewed, referrer
• cart contents, stored in your browser so your cart survives a refresh

We never receive or store your full card number, its expiry date or its security code. Those go straight to our payment provider.

We do not knowingly collect data from children under 16.

Why we use it, and on what basis

• to perform the contract: taking payment, shipping, returns, warranty and support
• to comply with the law: keeping invoices and accounting records
• for our legitimate interest: preventing fraud, securing the site, measuring audience, improving the product pages
• with your consent: marketing emails and non-essential cookies, which you can withdraw at any time

Automated decision-making is limited to fraud scoring performed by our payment provider before a payment is accepted. If a payment is refused on that basis you can write to us and we look at it by hand.

Who we share it with

Only the providers we need to run the shop, each acting on our instructions:

• payment and fraud prevention: Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Dublin 2, Ireland, through our checkout platform LuminaPay
• hosting of this website: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States
• carriers, for the delivery address and the tracking of your parcel
• our email provider, for order confirmations, shipping notices and, if you subscribed, the newsletter

We also disclose data where the law requires it, for example to a public authority acting within its powers.

We never sell, rent or exchange your data.

Where your data goes

Our hosting and some of our tools are operated by companies established in the United States. Transfers outside the European Economic Area are covered by the European Commission standard contractual clauses or by an adequacy decision, together with the technical measures those providers apply.

How long we keep it

• customer and order data: 3 years from your last contact with us, then deletion or anonymisation
• invoices and accounting records: 10 years, a legal obligation
• support emails: 3 years
• newsletter: until you unsubscribe, then 3 years for proof of your consent
• cookies and the consent they carry: 13 months maximum

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider in a portable format. You can object to processing based on our legitimate interest, and you can withdraw your consent to marketing at any time, with one click in any email we send.

Write to support@zephy-fan.com from the address used for your order, or tell us your order number. We may ask for something that lets us be sure it is you, and we answer within one month.

If you are in the European Union and you think we have got it wrong, you can lodge a complaint with a supervisory authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. In the United Kingdom, the ICO.

Californian residents may request details of the categories of personal information collected and ask for deletion, and we do not sell personal information as that term is defined by the CCPA.

Security

The site is served over HTTPS. Payment pages are hosted by our payment provider on their own certified infrastructure. Access to order data is limited to the people who handle orders and support, with unique accounts and two-factor authentication wherever the service supports it.

If a breach ever affected your data and put your rights at risk, we tell you and we notify the supervisory authority within the legal deadline.