Privacy policy

The controller of the processing described below is http5000, simplified joint-stock company (société par actions simplifiée, SAS), RCS Lyon 431 903 376, whose registered office is at 3 rue Passet, 69007 Lyon, France.

Any question about this policy, and any request to exercise your rights, can be sent to info@mirumiru.eu or by post to the registered office.

Given the nature and volume of the processing carried out, the company has not appointed a data protection officer: it does not fall within any of the cases where an appointment is mandatory under article 37 of the GDPR.

The website only collects the data you enter yourself, and the data technically needed for it to work.

Basket

Items, shades, quantities and amounts in your current basket, linked to an anonymous session identifier.

Order

Email address, first name, surname, phone number, billing address and, where applicable, a separate delivery address or the chosen pick-up point, plus the company name for delivery to a workplace (optional).

Customer account

Email address, password (never stored in plain text: only a cryptographic hash is kept), saved details and order history.

Payment

Payment method chosen, amount, status and transaction reference. Card numbers are not collected, processed or stored by us: they are entered in a form operated by Stripe.

Technical data

IP address, date and time of connection, browser type, error logs generated by the servers.

No sensitive data within the meaning of article 9 of the GDPR is collected. No data is bought, rented or collected from third parties.

Each processing operation serves a specific purpose and relies on a legal basis identified in article 6 of the GDPR.

Managing the basket

Keeping your selection from one page to the next. Legal basis: legitimate interest in providing a usable online shop (art. 6.1.f).

Processing the order

Recording, preparation, dispatch, tracking, after-sales service, handling a withdrawal. Legal basis: performance of the contract (art. 6.1.b).

Taking payment

Authorising and settling the transaction, preventing fraud. Legal basis: performance of the contract (art. 6.1.b) and legitimate interest in preventing fraud (art. 6.1.f).

Invoicing and accounting

Issuing invoices, keeping the accounts, VAT returns. Legal basis: legal obligation (art. 6.1.c).

Running a customer account

Access to your history and saved details. Legal basis: performance of the contract (art. 6.1.b), at your request.

Sending the newsletter

News, ideas for use and offers, only if you have expressly consented. Legal basis: consent (art. 6.1.a GDPR and article L34-5 of the French Postal and Electronic Communications Code). You can withdraw at any time, in one click, using the unsubscribe link in every email.

Keeping our customers informed

Information about products similar to those you have bought from us, unless you objected when your address was collected (article L34-5, paragraph 4, of the French Postal and Electronic Communications Code). Legal basis: legitimate interest (art. 6.1.f). Every message lets you object free of charge, in one click.

Keeping the website secure

Technical logging, detection of abuse and incidents. Legal basis: legitimate interest in the security of the service (art. 6.1.f).

Apart from these two cases, you only receive transactional emails (order confirmation, preparation, invoice, reminder of an unfinished payment). Anyone who has unsubscribed is never contacted again, and your details are never passed on to third parties for marketing purposes.

No decision producing legal effects is taken on the basis of automated processing, and no profiling is carried out.

Current basket

One year at most, the lifetime of the session cookie, or until you delete it yourself from your browser.

Order data

For the whole of the business relationship, then three years from the last contact, for follow-up and evidence purposes.

Customer account

Until the account is deleted, or after three years of complete inactivity, preceded by a reminder.

Newsletter and customer information

Until you withdraw your consent or object, and at the latest three years after your last purchase or your last contact with us.

Accounting records

Ten years, in accordance with article L123-22 of the French Commercial Code. This period is set by law: it cannot be shortened on request.

Tax records

Six years, in accordance with article L102 B of the French Tax Procedures Code.

Technical logs

Six months at most.

At the end of these periods, the data is deleted or irreversibly anonymised.

Your data is never sold, rented or passed on for advertising purposes. It is accessible to authorised staff of the company and passed only to the service providers needed to fulfil the order, each acting strictly within the scope of its task.

Hosting

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the European Union.

Card payment

Stripe Payments Europe, Limited (Ireland) and the Stripe group entities. Recipient of the card details, the amount and the payer's identity.

Delivery

The carrier responsible for delivery, which receives the name, delivery address and phone number needed to hand over the parcel.

Transactional emails

Resend, which receives the email address and the content of messages relating to the order. Sending region: European Union (Ireland, eu-west-1 region).

Address entry

The French national address database (api-adresse.data.gouv.fr), queried from our servers as you type, to suggest standardised French addresses.

Accounting

The company's chartered accountants, which receive the accounting records.

Transfers outside the European Union. The website hosting, the database and the email sending infrastructure are located in the European Union, in Germany and Ireland respectively.

Our payment and email providers do, however, belong to groups based in the United States and may process some data there. These transfers are covered by the European Commission’s standard contractual clauses and, in Stripe’s case, by its certification under the EU-US Data Privacy Framework.

Finally, data may be disclosed to administrative or judicial authorities where the law requires it.

Exchanges between your browser and the website are encrypted (HTTPS/TLS). The session identifier is stored in an httpOnly cookie, out of reach of the page’s JavaScript, which protects it from being stolen by a script.

Customer account passwords are never stored in plain text. Card details never pass through our servers at any point.

Access to order data is restricted to authorised people, each with their own login.

The website only places the trackers strictly necessary for it to work. It uses no analytics, advertising or social media cookies.

The details of what is actually placed are on the cookies page.

Under the conditions laid down in articles 15 to 22 of the GDPR, you have the following rights over the data that concerns you:

• Access: confirmation that it is being processed, and a copy of it;
• Rectification: having inaccurate or incomplete data corrected;
• Erasure: asking for it to be deleted, subject to the retention periods required by law;
• Restriction: freezing its use while a dispute is being resolved;
• Objection: objecting to processing based on our legitimate interest, on grounds relating to your particular situation;
• Objection to marketing: at any time, without giving a reason, in one click from any message or by writing to us (article 21.2 of the GDPR);
• Portability: receiving the data you have provided to us in a structured, machine-readable format;
• Post-mortem instructions: deciding what happens to your data after your death (article 85 of French law no. 78-17 of 6 January 1978).

If, after contacting us, you feel that your rights have not been respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).

Address

CNIL, 3 place de Fontenoy, TSA 80715
75334 Paris Cedex 07, France

Online

cnil.fr/fr/plaintes

This policy may be updated to reflect legal or technical changes. The applicable version is the one published on this page; the date of the last update is shown at the top of the document.