Last updated: 06/16/2025

1. Introduction

Kimberfeel is a brand belonging to the company SALAC which operates the online sales site accessible at the address www.kimberfeel.com

SALAC attaches great importance to the protection of your privacy and personal data. This policy describes how we collect, use, share, and protect your data when you use our e-commerce site.

It also allows you to know the origin and use of the information collected through Cookies, as well as to exercise your rights in accordance with current legislation. For any purchase via a marketplace, please refer to the privacy policy of the platform concerned, which acts as data controller.

2. Identity of the data controller

Company: SAS SALAC
Address: 227 Route des Grands Bois - 74370 Villaz
Contact: rgpd@kimberfeel.com

3. Data collected

We collect information about you when you use the Site, interact with us or make purchases, to provide you with the services requested and in particular to allow you to place orders on our Site and deliver your orders to you.

These allow us to know you better and send you offers on our products subject to your consent when required. Checks are also carried out to ensure the security of the Site and orders.

We may collect the following categories of personal data:

• Identity (name, first name)
• Contact details (address, telephone, email)
• Order information (product purchased, purchase history)
• Delivery and billing data
• Browsing data (cookies, pages viewed)
• Payment Data (via Paypal and Stripe) - No payment data is directly collected or stored.
• History of your contacts with us (Return request, complaint)
• Newsletter Consent and Marketing Preferences

4. Purposes and legal bases of processing

Processing and delivery of orders → Execution of the contract
Customer account management → Contract execution
Billing and accounting → Legal obligation
Sending newsletters → Explicit consent
Commercial prospecting → Consent
Analysis of business performance → Legitimate interest
Customer Service Management → Contract Execution
Cookie management → Consent / legitimate interest
Fight against fraud → Legitimate interest

5. Recipient of the data

The data is transmitted only to the following authorized recipients:

• Technical service providers (Shopify)
• Payment providers (Paypal and Stripe)
• Logistics providers and carriers
• Marketing and CRM providers

6. Transfers outside the European Union

Some processing may result in a transfer of data outside the EU, particularly within the framework of Shopify.

• Shopify : For merchants based in the European Union, personal data is controlled by Shopify's Irish subsidiary, Shopify International Ltd. This data may then be transferred to other regions, including Canada and the United States, in accordance with applicable laws (such as the GDPR).

Shopify takes steps to protect personal information when it is transferred outside the European Union. This includes legal safeguards to comply with European regulations. To learn more about data hosting and GDPR compliance with Shopify, you can consult official Shopify resources.

• Google Workspace : Data stored in Europe and transfers governed by standard contractual clauses or the Data Privacy Framework. For more information, see: https://www.policies.google.com/privacy

Appropriate safeguards are in place. The customer can obtain more information upon request.

7. Data retention period

• Customer data: 3 years from the last active contact in the active database
• Order data: 10 years (accounting obligation)
• Newsletter data: until unsubscribed or withdrawn consent
• Cookies: see specific durations in the cookies policy
• Online accounts: your personal data is retained for as long as you use or order products or are in contact with us

Inactivation criteria
Your customer account is considered inactive if, for 3 consecutive years, no purchase has been made on our Site or no interaction has been recorded (e.g.: no connection to your account, no opening of our commercial emails or newsletters)

Account deletion
At the end of this 3-year period, your customer account will be closed and your personal data will be deleted, if no legal obligation or dispute justifies their retention, or anonymized, in the event that statistical data must be retained without a link to your identity.

Exceptions to deletion
Certain data may be kept beyond this period if necessary for:

• Comply with a legal or regulatory obligation (e.g.: keeping invoices for 10 years).
• Manage an ongoing dispute or unresolved claim.

Your personal data and account will be deleted if you decide to delete your online account. To do so, you must notify us by contacting us either by email: rgpd@kimberfeel.com or by mail to the following address: SALAC - 227 Route des Grands Bois - 74370 Villaz

8. Rights of data subjects

In accordance with the GDPR, users have the following rights:

• Right of access, rectification, erasure
• Right to portability
• Right to object to processing or request its restriction
• Right to withdraw consent at any time
• Right to lodge a complaint with the CNIL

To exercise your rights: rgpd@kimberfeel.com

If after contacting us you consider that your rights are not respected, you can contact the CNIL: https://www.cnil.fr

9. Data security

The data controller implements appropriate technical and organizational measures:

• Secure hosting by Shopify
• Access to data limited to authorized persons
• Strong password authentication
• Google Workspace Security Plan
• Internal policy

10. Cookies and trackers

A detailed cookie management policy is available here . It specifies:

• The different types of cookies used
• Their purpose
• Their shelf life
• The configuration methods

11. Policy Update

This Privacy Policy may be updated at any time. The date of the last update will appear at the top of the page.