Last updated: 20 October 2026.
This page explains what personal data Secure Shop collects, why, how long we keep it, who sees it, and how you can exercise your rights under the GDPR.
1. Who is responsible
Secure Shop SAS, simplified joint-stock company with a share capital of EUR 1,000, registered with the RCS of Lyon under number 000 000 000 (fictional), registered office: 1 rue de l'Exemple, 69000 Lyon, France.
Privacy contact: privacy@shop.example.com, or by post at the address above. We have not appointed a data protection officer; the privacy contact handles every question about your data.
2. What we collect, why, and for how long
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your account: first and last name, e-mail address, password (stored only as a hash, never readable), the postal addresses you enter (with a phone number if you give one) | To create and manage your account, take your orders and answer your questions | Contract | While your account is used; 2 years after your last activity it is anonymised (name, e-mail, phone and addresses removed) |
| Your orders: items, amounts, dates, billing and delivery addresses | To sell to you and to keep our accounts | Contract; legal obligation (accounting) | Invoices: 10 years (French accounting law), anonymised once your account is anonymised. Other order data: 2 years after your last activity |
| Your messages: what you write in the contact form (e-mail address, message, order reference if any, and any file you attach) | To answer you, including your privacy requests | Contract for order questions; legitimate interest otherwise | Account holders: removed with the account data, 2 years after the last activity. Without an account: 2 years after your last message |
| Technical visit data kept by the shop software: date of the visit, browser, operating system and language, and, where recorded, IP address and the page you came from | Running the shop and keeping it secure | Legitimate interest | Deleted after 2 years |
| Security logs: IP address, date and time, page requested, browser type, result code; alerts of our web application firewall | Protecting the shop against attacks and investigating incidents | Legitimate interest; our duty to secure your data | Up to 30 days |
| Your privacy requests: your customer number, the type of request and the dates, in our request register | Proving that we handled your request on time | Legal obligation (accountability, art. 5(2) GDPR) | 3 years after the request is closed |
| Privacy module records: your name and customer number, the action (consent given when you create your account or send the contact form, data export) and its date | Proving your consent and the exports you asked for | Legal obligation (accountability, art. 5(2) GDPR) | While your account is used; your name is removed when the account is anonymised, 2 years after your last activity |
Your name, e-mail address and a password are needed to create an account, and a postal address to place an order: without them we cannot open the account or take the order. The phone number is optional.
What we do not do
- We do not send e-mails at this time: no order confirmation, no password-reset e-mail, no newsletter. If this changes, we will update this policy first and name the e-mail provider.
- We do not take card payments and do not process any card data at this time.
- No marketing, no partner offers, no advertising, no audience measurement, no third-party trackers.
- No profiling and no automated decision about you.
- We do not sell your data.
3. Who receives your data
- Our authorised staff, each with a personal account, only for their task.
- Microsoft Azure, which hosts our server in a data centre in the European Union on our behalf, under a data processing agreement.
- Public authorities, only when the law requires it.
4. Where your data is stored
Your data is stored in the European Union. Our hosting provider belongs to a group based in the United States; any access to the data from outside the European Union is covered by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework, as provided in its data processing agreement.
5. Cookies
The shop only uses the cookies it needs to work. They do not need your consent (article 82 of the French Data Protection Act) and do not track you across websites. There is no advertising, social-network or audience-measurement cookie, so there is no consent banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
| PrestaShop-<hash> | Your cart and your login | Browser session: deleted when you close your browser or sign out |
| PHPSESSID | Technical session of the shop | Browser session: deleted when you close your browser |
Both are sent only over HTTPS and cannot be read by scripts on the page. Because they last only for the browser session, closing the browser signs you out and empties a guest's cart; a signed-in customer finds their cart again at the next login. You can block or delete cookies in your browser; the cart and login will then not work.
6. How we protect your data
- The shop is served over HTTPS only.
- The shop, its application and its database run in separate network zones; a web application firewall filters requests before they reach the shop.
- Our back office is not reachable from the internet: staff connect through an encrypted VPN, with a personal account and a second factor (one-time code).
- Passwords are stored as hashes and never written to logs. If a form field is blocked as an attack, its text can appear in the firewall's alert log.
- Access to personal data is limited to the staff who need it.
7. Your rights
You can at any time:
- access your data and receive a copy;
- rectify it;
- erase it (we keep invoices for 10 years, in anonymised form, because the law requires it);
- receive it in a reusable format (portability);
- object to its use based on our legitimate interest, or ask us to restrict its use.
How:
- Rectify: My account > Information and My account > Addresses.
- Access and portability: My account > GDPR - Personal data > Get my data (CSV or PDF).
- Anything else, including erasure: the contact form of the shop, privacy@shop.example.com, or a letter to the address in section 1.
We answer within one month (up to two more months for a complex request, and we will tell you why). We may ask you to prove that the account is yours before answering.
If you think we did not respect your rights, you can complain to the CNIL (Commission nationale de l'informatique et des libertés), www.cnil.fr.
8. Changes
We publish any change to this policy on this page, with its date.
Secure Shop is a fictional company run as a student project; its company details are fictional.