Privacy Policy
Last updated: August 1, 2026
AMENOLIA attaches particular importance to protecting the personal data of its customers and visitors. This policy describes what data we collect, why, on what legal basis, how long we keep it, with whom we share it, and what rights you can exercise.
It applies to the website www.amenolia.com as well as to all communications with our customer service.
1. Data Controller
AMENOLIA, a simplified joint-stock company with a share capital of 1,000 euros, whose registered office is located at 23 chemin des Cannes, 30210 Castillon-du-Gard, registered with the Nîmes trade and companies register under number 979 690 443.
Contact for any questions regarding personal data: privacy@amenolia.com
AMENOLIA acts as the data controller within the meaning of Regulation (EU) 2016/679, known as the GDPR, and the amended Law No. 78-17 of January 6, 1978.
2. Data We Collect
2.1 Data You Provide Us
- Identity and contact details: name, first name, email address, phone number, delivery address, billing address.
- Customer account: username, encrypted password, preferences, order history.
- Orders: items ordered, amounts, delivery method, payment method, returns and exchanges.
- Communications with customer service: content of your messages, photographs or videos submitted in support of a complaint.
- Wish list and loyalty program: saved items, points earned, rewards used.
- Supporting documents, in certain special cases: proof of identity, proof of address, last four digits of the payment method, sworn statement of non-receipt of a package.
2.2 Data Collected Automatically
IP address, browser and device type, pages viewed, session ID, current cart contents, and, subject to your consent, a random audience measurement identifier stored in a cookie.
2.3 Payment Data
We never have access to your full credit card number or visual cryptogram, and we do not keep any copy of it. This data is transmitted directly, via an encrypted connection, to our authorized payment provider. We only receive a transaction confirmation, the last four digits of the card, and the type of payment method used.
3. Purposes, Legal Bases, and Retention Periods
| Purpose | Legal Basis | Retention Period |
|---|---|---|
| Processing and tracking orders, delivery, billing | Performance of the contract (GDPR Article 6.1.b) | 5 years from the end of the contractual relationship |
| Retention of accounting documents and invoices | Legal obligation (Article L.123-22 of the French Commercial Code) | 10 years |
| Archiving of online contracts for an amount equal to or greater than 120 euros | Legal obligation (Article L.213-1 of the French Consumer Code) | 10 years from delivery |
| Customer account management | Performance of the contract | 3 years from the last contact, then deletion or anonymization |
| Customer service, complaints, returns and legal warranties | Performance of the contract and legal obligation | Duration of the case processing, then until the expiration of the legal warranty periods, i.e., 2 years |
| Photographs and videos submitted in support of a complaint | Performance of the contract | Duration of the case processing, then 2 years |
| Prevention and detection of payment fraud | Legitimate interest (GDPR Article 6.1.f) | Supporting documents deleted as soon as the doubt is resolved and no later than 30 days, unless a procedure is ongoing |
| Investigation with the carrier in the event of a package declared as not received | Performance of the contract | Proof of identity kept only for the duration of the investigation |
| Audience measurement and browsing analysis | Consent (GDPR Article 6.1.a and Article 82 of the French Data Protection Act) | 14 months from the last visit |
| Loyalty program | Performance of the contract | Duration of participation in the program, then 3 years |
| Commercial communications sent to customers | Legitimate interest for similar products (Article L.34-5 of the French Post and Electronic Communications Code) | 3 years from the last purchase or contact |
| Commercial communications sent to prospects | Consent (GDPR Article 6.1.a) | 3 years from the last contact, or until consent is withdrawn |
| Management of requests to exercise rights | Legal obligation | 3 years, the identity document provided being kept for 1 year |
| Management of disputes and legal actions | Legitimate interest | Duration of the procedure and appeal periods |
At the end of these periods, your data is deleted or irreversibly anonymized.
4. Recipients of Your Data
Your data is accessible only to authorized personnel at AMENOLIA, within the scope of their responsibilities. It is shared with the following service providers, acting as processors or as separate data controllers:
| Service Provider | Role | Location |
|---|---|---|
| Shopify International Ltd. and Shopify Inc. | Store hosting, order and customer account management | Ireland and Canada |
| Shopify Payments | Credit card payment processing | Ireland and United States |
| PayPal (Europe) S.à r.l. and Cie S.C.A. | PayPal payment processing | Luxembourg |
| Scalapay S.r.l. | Installment payment processing | Italy |
| La Poste and Colissimo | Package delivery | France |
| BON Loyalty | Loyalty program management | Oakville, ON, Canada |
| Google Ireland Ltd. | Customer service messaging and audience measurement (Google Analytics 4) | Ireland, with subsequent subcontracting to Google LLC in the United States |
Your data may also be shared with administrative or judicial authorities when required by law.
We do not sell your personal data or rent it to any third party for advertising purposes.
5. Transfers Outside the European Union
Some of our service providers are established outside the European Union or may host data there. These transfers are governed either by an adequacy decision by the European Commission, notably for Canada, the United Kingdom, and American companies certified under the EU-U.S. Data Privacy Framework, or by the standard contractual clauses adopted by the European Commission, supplemented where appropriate by additional technical measures.
You can obtain a copy of the applicable guarantees simply by contacting privacy@amenolia.com.
6. Cookies and Trackers
Strictly Necessary Cookies
Our site places cookies essential to its operation: maintaining your session, remembering your cart, securing payment, preventing fraud, and recording your cookie choices. These cookies are exempt from consent under Article 82 of the French Data Protection Act.
Audience Measurement
Subject to your consent, we use Google Analytics 4, provided by Google Ireland Limited, to measure website traffic, understand our visitors' journeys, and improve our product pages and checkout process.
This service places cookies, notably _ga and _ga_[identifier], allowing it to recognize your browser from one visit to the next using a random identifier. The data collected includes pages viewed, the date and duration of visits, the source of the visit, the type of device and browser, a truncated IP address, and, where applicable, products viewed and orders placed.
We do not transmit any data to Google that would allow it to identify you directly: neither your name, nor your email address, nor your postal address. Google Analytics advertising features are not enabled, and this data is not used for advertising targeting purposes.
No audience measurement cookie is placed and no data is transmitted to Google until you have accepted via our banner. If you refuse or ignore the banner, the service is not loaded.
Google Ireland Limited acts as a processor. Data may be transferred to the United States under the conditions described in Article 5 of this policy.
Durations
Non-essential cookies are kept for a maximum of 13 months and the collected data for a maximum of 14 months from your last visit.
Managing Your Choice
You can withdraw your consent at any time using the cookie management link at the bottom of each page, or by configuring your browser. Google also provides an additional Google Analytics disabling module that can be installed from your browser.
7. Your Rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
- Right of access: obtain confirmation that your data is being processed and receive a copy.
- Right to rectification: have inaccurate or incomplete data corrected.
- Right to erasure: request the deletion of your data, subject to our legal retention obligations, notably accounting and tax.
- Right to restriction: request a temporary freeze on processing.
- Right to object: object to processing based on our legitimate interest and, at any time and without reason, to direct marketing.
- Right to data portability: receive your data in a structured, machine-readable format, or request its transmission to another data controller.
- Withdrawal of consent: when processing is based on your consent, withdraw it at any time, without affecting the lawfulness of the processing carried out prior to withdrawal.
- Post-mortem instructions: define, in accordance with Article 85 of the French Data Protection Act, the fate of your data after your death. In the absence of instructions, your heirs may exercise certain rights.
No decision producing legal effects toward you is taken solely on the basis of automated processing. Our product recommendations and fraud prevention checks are systematically subject to human intervention.
How to Exercise Your Rights
Send your request to privacy@amenolia.com, or by mail to the address indicated in Article 1. We will respond within one month, extendable by two months in the event of a complex request, in which case we will inform you.
We may be required to verify your identity in the event of reasonable doubt. The document submitted for this sole purpose is kept for only one year.
To unsubscribe from our commercial communications, simply click the unsubscribe link in each of our emails. You will continue to receive messages related to your orders, which do not constitute direct marketing.
8. Security
We implement appropriate technical and organizational measures to protect your data: encryption of communications, password encryption, restricting access to authorized personnel only, logging access, and selecting service providers that offer sufficient guarantees and are bound by a subcontracting agreement compliant with Article 28 of the GDPR.
We recommend that you choose a strong password, do not share it with anyone, and never send us sensitive data through an unsecured channel.
9. Minors
Our products are intended for adults, and our general terms and conditions of sale reserve the conclusion of an order to persons legally capable of contracting.
We do not knowingly collect data concerning persons under fifteen years of age. If you are the holder of parental authority and find that such processing has occurred, write to us at privacy@amenolia.com: we will proceed with the deletion of the data concerned.
10. Complaints
If you believe that the processing of your data is not compliant with the regulations, we invite you to contact us first at privacy@amenolia.com.
You can also file a complaint with the National Commission for Information Technology and Liberties, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, telephone 01 53 73 22 22, www.cnil.fr.
11. Changes
We may update this policy to reflect changes in our processing or in the regulations. The applicable version is the one published on the site, with its update date shown at the top of the document. In the event of a substantial modification, we will inform you by an appropriate means.
