Privacy policy

Contents

1. Data controller
2. Data collected
3. Purposes and legal bases
4. Mandatory information
5. Recipients of data
6. Shopify and international transfers
7. Retention periods
8. Cookies and other trackers
9. Data-subject rights
10. Automated decisions
11. Data security
12. Data concerning minors
13. Changes to this policy
14. Contact

1. Data controller

The data controller is:

Pierre Thiaville — Sole trader
Trading name: AluArtMountains
Address: 7 rue Aristide Briand, 69003 Lyon, France
Email: info@aluartmountains.com
Telephone: 06 27 07 55 18
SIREN: 827 807 231
SIRET: 827 807 231 00028

AluArtMountains determines the purposes and means of processing necessary to operate the store, manage orders, provide after-sales service and maintain customer relations.

2. Data collected

Data provided directly

AluArtMountains may collect information you provide when placing an order, making a contact request, requesting a wall mock-up, making a return or creating a customer account.

This information may include:

• first and last name;
• billing and delivery addresses;
• email address and telephone number;
• information about orders and products purchased;
• order history and communications with customer service;
• information needed to prepare a quotation;
• dimensions and characteristics of a bespoke project;
• photographs of a wall or interior sent to create a placement mock-up;
• photographs of the product and its packaging sent as part of an after-sales request;
• reviews, comments and photographs voluntarily submitted for publication;
• information associated with a customer account, where one is created.

Payment data

AluArtMountains does not receive full payment-card numbers. Data needed for payment is processed directly by Shopify and by the payment provider selected when the order is placed.

AluArtMountains may nevertheless receive certain transaction information, such as status, amount, payment method in partially masked form and any results of fraud checks.

Data collected automatically

When the website is browsed or used, certain technical data may be collected automatically:

• IP address;
• type of device used;
• browser and operating system;
• language and approximate geographic area;
• pages, collections and products viewed;
• date, time and approximate duration of visits;
• products added to the basket;
• source of the visit and certain interactions with the website;
• data needed for security, proper operation of the store and fraud prevention;
• cookies and other technical identifiers, depending on their purpose and the preferences expressed.

3. Purposes and legal bases

Order management

Data is used to record orders, process payments, organise production, ship products, provide tracking and manage after-sales requests.

This processing is based on performance of the contract with the customer.

Information requests, quotations and mock-ups

Information provided in connection with a contact request, quotation, professional project or wall mock-up is used to review the request and prepare a possible order.

This processing is based on taking pre-contractual steps at the data subject’s request and, depending on the nature of the request, on AluArtMountains’ legitimate interest in responding to requests received.

Accounting and legal obligations

Certain data is retained to issue invoices, maintain accounts, comply with tax obligations, administer guarantees and respond to requests from competent authorities.

This processing is based on the legal obligations applicable to AluArtMountains.

Customer service, returns and guarantees

Messages, photographs and documents sent to customer service are used to respond to requests, manage withdrawals, investigate complaints and apply guarantees.

This processing is based on performance of the contract, compliance with legal obligations and, where necessary, AluArtMountains’ legitimate interest in establishing, exercising or defending its rights.

Security and fraud prevention

Technical and transactional data may be used to secure the store, detect abnormal behaviour, prevent fraudulent payments and protect customer accounts.

This processing is based on AluArtMountains’ legitimate interest in protecting its business, website and customers.

Reviews and content submitted by customers

Where a customer voluntarily publishes a review, comment or photograph, the submitted data may be used to display that content on the website and present AluArtMountains projects.

The person is informed that the publication is public. Where necessary, consent is requested before publishing the person’s full name, photographs of their interior or any other information that identifies them.

Audience measurement and website improvement

Subject to preferences expressed in the cookie manager, measurement tools may be used to analyse use of the website, understand browsing journeys and improve content, functionality and performance.

Where consent is required, the relevant trackers must only be activated after consent has been obtained.

Commercial communications

AluArtMountains may send commercial information where the recipient has consented or where regulations permit offers concerning products similar to those already purchased.

Every commercial communication includes a simple means of unsubscribing. Consent may be withdrawn at any time.

Advertising and personalisation

Subject to the visitor’s consent, certain browsing data may be used to measure advertising campaign effectiveness, limit repetition or present more relevant content.

4. Mandatory information

Information marked as mandatory in forms is necessary to process the request or perform the order.

Without this information, AluArtMountains may be unable to respond to a request, prepare a quotation, process payment, produce or deliver a product.

Other information is optional. Its absence does not necessarily prevent use of the website or placement of an order.

5. Recipients of data

Data is accessible only to persons and providers who need it to perform their role.

It may in particular be transmitted:

• to Shopify, which provides hosting, the basket, customer accounts and part of the payment process;
• to payment providers selected by the customer;
• to partners responsible for producing and packaging photo prints;
• to carriers responsible for delivery;
• to the customer-review provider when a review is requested or published;
• to providers of email, customer support, security, audience measurement, advertising or cookie-management services when those services are enabled;
• to AluArtMountains’ professional advisers, including its accountant, legal adviser, insurer or technical providers, where necessary;
• to public authorities, courts or competent bodies where required by law.

Production partners and carriers receive only the information necessary to produce, ship and deliver the order.

Depending on the service concerned, some providers may act as processors for AluArtMountains or as separate controllers of their own processing.

AluArtMountains does not sell the personal data of customers or visitors to third parties.

6. Shopify and international transfers

The store is operated using the Shopify platform. For persons located in the European Economic Area, United Kingdom or Switzerland, data is initially processed by Shopify International Limited, established in Ireland.

Shopify may then use affiliated companies and processors located in different countries, in particular to provide hosting, security, payment, support and technical functionality for the platform.

Where data is transferred outside the European Economic Area to a country that does not benefit from an adequacy decision, such transfers must be covered by appropriate safeguards, such as standard contractual clauses, binding corporate rules or another mechanism recognised by the regulations.

Other providers used by AluArtMountains may also process data outside the European Economic Area, subject to the applicable safeguards.

For more information about how Shopify processes consumer data, see its consumer privacy policy.

7. Retention periods

Personal data is not retained indefinitely. Retention depends on the purpose and applicable legal obligations.

• Orders and contractual relationship: for the duration of the relationship with the customer, then archived for the periods necessary to manage guarantees, complaints and disputes.
• Invoices and accounting records: ten years from the end of the relevant financial year.
• Customer marketing data: during the commercial relationship, then for three years from its end or the last relevant contact.
• Prospect data: three years from collection or the last contact initiated by the prospect.
• Contact requests, quotations and mock-ups: while the request is processed, then for the period useful to follow up the project and defend AluArtMountains’ rights.
• After-sales cases and complaints: while the case is handled, then for the periods needed to establish, exercise or defend legal rights.
• Content published with the customer’s agreement: for the duration of publication or until that agreement is withdrawn, subject to applicable retention obligations.
• Cookie choices: generally for six months before a new choice may be requested.
• Audience-measurement or advertising trackers: according to the duration configured in the relevant tool and within regulatory limits.

Certain data may be archived for longer where retention is necessary to comply with a legal obligation, establish a right or defend AluArtMountains in a dispute.

8. Cookies and other trackers

Strictly necessary cookies

The website uses cookies essential to its operation, in particular to:

• remember products placed in the basket;
• secure login, forms and payment;
• retain the selected language, country or currency;
• operate customer accounts;
• balance technical load and maintain website availability;
• prevent fraudulent activity.

These cookies may be used without consent where they are strictly necessary for the service requested by the user.

Cookies requiring consent

Cookies or trackers for audience measurement, personalisation, advertising, social networks or certain third-party services may also be offered.

Where they are subject to consent, they must only be stored or read after the visitor has agreed.

The visitor must be able to accept or refuse non-essential trackers with the same level of ease.

The visitor may change or withdraw their choice at any time using the cookie-management tool available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Refusing non-essential cookies does not prevent access to the catalogue or placement of an order, but certain optional functions may be limited.

9. Data-subject rights

Depending on the circumstances and legal basis of processing, each person may exercise:

• a right of access to their data;
• a right to rectify inaccurate or incomplete data;
• a right to erasure where the legal conditions are met;
• a right to restriction of processing;
• a right to object to certain processing;
• a right to data portability;
• a right to withdraw consent at any time;
• a right to set instructions concerning the fate of their data after death, under the conditions provided by law.

Any request may be sent to:

info@aluartmountains.com

The request should state the requester’s identity, the right they wish to exercise and, where possible, the data or processing concerned.

Proof of identity will only be requested where there is reasonable doubt about the identity of the person making the request.

AluArtMountains normally responds within one month from receipt of the request. This period may be extended by two months where the request is complex or several requests have been received. The data subject is then informed of the extension.

If a difficulty persists, the data subject may lodge a complaint with the French Commission Nationale de l’Informatique et des Libertés: lodge a complaint with the CNIL.

10. Automated decisions

AluArtMountains does not, on its own behalf, make decisions producing legal or similarly significant effects based exclusively on automated processing of personal data.

Payment providers, Shopify and fraud-prevention tools may nevertheless use automated processes to assess the risk associated with a transaction, secure payment or detect suspicious activity.

Those providers may operate according to their own processing rules and privacy policies.

11. Data security

AluArtMountains and its providers implement appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, disclosure or unauthorised access.

These measures may include:

• encryption of communications with the website using HTTPS;
• limiting access to authorised persons only;
• protecting administrator accounts;
• updating the tools and applications used;
• backing up and monitoring technical services;
• selecting providers that offer appropriate safeguards.

As no system can guarantee absolute security, AluArtMountains asks users to protect their credentials, use strong passwords and report any suspicious activity.

12. Data concerning minors

The store is not specifically directed at minors. An order must be placed by a person with the required legal capacity or with the permission of their legal representative.

AluArtMountains does not seek knowingly to collect data concerning children unless it is necessary to perform a request or order.

13. Changes to this policy

This policy may be updated to reflect legal, regulatory, technical or commercial developments, or a change in the providers used.

The last-updated date is shown at the beginning of the page. The applicable version is the version published on the website when it is consulted.

Where a significant change concerns processing based on consent, new consent may be requested where necessary.

14. Contact

For any question concerning this policy or processing of personal data:

AluArtMountains
Pierre Thiaville — Sole trader
7 rue Aristide Briand
69003 Lyon, France
Email: info@aluartmountains.com
Telephone: 06 27 07 55 18