Privacy policy
Who is responsible for your data?
LONILEAD SAS, trading as La Carafe, is responsible for processing personal data for the operation of www.la-carafe.fr, customer orders and customer relations. LONILEAD SAS has share capital of €2,949,160 and is registered with the Bordeaux Trade and Companies Register under number 410 089 866. Its address is 48 rue Ferdinand-Buisson, 33130 Bègles, France. For privacy questions and rights requests, write to contact@la-carafe.fr or this postal address.
Data and sources
Data you provide through purchases, forms, account use or customer-service correspondence include your identity, email address, telephone number, billing and delivery addresses, orders, transaction references, preferences, messages and supporting documents relevant to your request. Fields necessary to process an order or request are identified when collected. Without them, the relevant service cannot be provided. Optional marketing choices are separate from the purchase.
Technical data arise from using the site: IP address, browser and device information, pages and interactions, referring pages, campaign information and browser or basket identifiers. Order, payment, delivery and service updates can also come from the providers carrying out those operations. Review data include the review content and information you submit with it; do not include private information in a public review.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Taking, paying for, preparing and delivering orders; managing a customer account you use; answering requests linked to a purchase | Performance of the contract or steps requested before entering it |
| Handling withdrawal, statutory guarantees, refunds, invoices and accounting records | Contract and applicable legal obligations |
| Customer-service correspondence, handling reviews, securing the shop and establishing or defending claims | Contract where relevant; legitimate interests in answering requests, receiving customer feedback, preventing abuse and protecting legal rights, balanced against your rights |
| Marketing emails | Consent where required; the existing-customer exception applies only if its legal conditions are met, including similar products and an opportunity to object |
| Audience measurement, advertising attribution and activity linked to a marketing profile | Consent for optional tracking where required. Only genuinely necessary operations or operations satisfying a legal exemption can be carried out without it |
Marketing is by email. You can unsubscribe using the link in a marketing email or by contacting us. Buying, accepting sales terms, opening an email or importing a record into a tool does not by itself establish marketing consent. Withdrawal of consent does not affect the lawfulness of earlier processing based on that consent. You may object to direct marketing at any time, including associated profiling.
Providers and recipients
Recipients include authorised La Carafe personnel and providers involved in the service: Shopify for the shop and checkout; payment providers offered during payment; DPD and Chronopost for the delivery services used; Klaviyo for email, forms and associated activity; Judge.me for customer reviews; Analyzify for measurement and advertising attribution; Axeptio for cookie choices; Pennylane for invoicing and accounting. Google and Meta are also recipients for the measurement and advertising tools described in the cookie policy. Data relevant to a dispute may be provided to ANM Consommation, advisers, courts or competent authorities where necessary.
Shopify acts as a processor for merchant processing covered by its data-processing agreement and as a separate controller for certain additional services. Shopify Network Intelligence is enabled for this shop: Shopify's own privacy information applies to processing for which it determines the purposes. See Shopify's privacy policy. Providers' roles depend on the service; installing an application does not mean that every feature is used.
Klaviyo's configuration allows earlier anonymous site activity to be associated with a profile after identification. That association and campaign or browsing segmentation can be used for marketing analysis; they do not make consent unnecessary. Technical measurement includes events about form display. Our cookie policy describes choices and the observed technical behaviour rather than promising that refusing cookies stops every network request.
How retention is determined
Retention depends on the purpose, the progress of the relationship and legal obligations, not a single lifetime for the whole customer profile. The criteria are:
- Orders, account services and customer support: information needed to carry out the service and resolve outstanding deliveries, returns, guarantees and requests, followed by retention of necessary evidence for applicable limitation periods or an identified dispute. Account closure does not erase invoices or evidence that must lawfully be retained.
- Accounting documents and supporting records: ten years from the end of the relevant financial year. Pennylane is used for accounting archives. That obligation does not justify keeping a marketing profile active for ten years.
- Electronic consumer contracts of at least €120: the French statutory ten-year archive period applies. For immediate delivery it runs from conclusion; for deferred delivery the contract is retained until delivery and for ten years afterwards. You may request access.
- Marketing: retention is assessed using the source and date of collection, the permission or other valid basis, the end of the customer relationship and the last relevant voluntary contact. CNIL's reference is three years from collection or the prospect's last active contact, or the customer relationship followed by three years. This is a reference for assessing necessity, not a claim that every profile is automatically deleted at three years. A technical import, an outgoing email or an opening alone is not a new voluntary contact.
- Objections and consent evidence: the minimum information needed to honour your choice and demonstrate it, taking account of the duration of the relevant processing and applicable claims. Unsubscribing is distinct from deleting all records.
- Navigation, attribution and security: the relevant session, choice or measurement purpose and, where an incident or dispute exists, the evidence needed to resolve it and applicable limitation rules. Cookie expiry, server-side retention and accounting archives are different matters; no uniform 13-month rule applies.
These criteria do not describe an automatic deletion system. A right to erasure can be limited by a legal retention obligation or the establishment, exercise or defence of legal claims; a necessary archive is not a basis for continued promotional use.
International processing
The international infrastructure of these providers can involve processing outside the European Economic Area, including in the United States and Canada. EU hosting alone does not rule out international access. Transfers are subject to the GDPR: an applicable adequacy decision within its scope or appropriate safeguards, including standard contractual clauses and any necessary supplementary measures. A provider's general contractual documents do not mean that every service uses the same mechanism. Contact us to obtain information and a copy of safeguards relevant to your data, with confidential material protected where necessary.
Your rights
Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction and portability. You may object on grounds relating to your situation to processing based on legitimate interests and object to direct marketing without giving reasons. You may withdraw consent and provide instructions concerning your data after death under French law. The GDPR also protects you against solely automated decisions producing legal or similarly significant effects, subject to its exceptions and safeguards, including human intervention and the right to contest a decision.
Write to contact@la-carafe.fr. Identity evidence may be requested only where reasonable doubts justify a proportionate check. We must respond without undue delay and normally within one month. If complexity or the number of requests requires an extension of up to two further months, we must inform you within the first month and explain why. You may complain to the CNIL or the competent supervisory authority, including in your country of habitual residence, work or the alleged infringement.
Cookies and policy changes
The cookie policy covers cookies, local storage and associated tracking, including their purposes and controls. Email-marketing permission is not permission for optional site or email tracking. Changes to this policy do not retrospectively create consent or remove your rights.