Privacy Policy

Data controller

KASB SYSTEMS (SASU, 47 rue Vivienne, 75002 Paris, France) is the controller for processing related to the use of the Kaspushop application and to the sales it makes on its own behalf. Contact: contact@kaspushop.fr.

Roles by type of access

Kaspushop is both an online store and a management tool for merchants.

For orders placed on stores operated by third-party merchants, the merchant is the controller and KASB SYSTEMS acts as a processor. For stores operated by KASB SYSTEMS itself, KASB SYSTEMS is the controller.

Data processed — customer area (store)

• Customer account identity and contact details (name, e-mail), via the Shopify customer account.
• Orders, delivery and billing addresses, purchase history.
• Technical browsing and cart data (necessary cookies).

Data processed — merchant / admin area

• Wallet address, SIWE message and signature, authentication nonce.
• Session data (NextAuth).
• Store information: name, address, opening hours and rating (from Google), catalog and orders (via Shopify).
• Farcaster identifier (FID) when resolved.

Purposes and legal bases

• Provide the service and fulfil orders (performance of the contract).
• Authenticate and secure access (legitimate interest and performance of the contract).
• Comply with our legal and accounting obligations (legal obligation).
• Maintain, secure and improve the service (legitimate interest).

Processors and partners

• Shopify — customer accounts, catalog, orders and hosted checkout page.
• OVHcloud — website and backend hosting (servers in Canada).
• Upstash — technical storage of authentication nonces.
• Neynar — Farcaster identifier resolution (merchant area).
• Google (Places) — store location information.
• Coinbase / Base — wallet authentication (merchant area).

We use the following providers, each bound by a GDPR-compliant agreement:

Transfers outside the European Union

Some data may be processed outside the EU: in Canada (hosting and Shopify), a country recognised as adequate by the European Commission; and in the United States (Upstash, Neynar, Google, Coinbase / Base), framed by the EU-US Data Privacy Framework or standard contractual clauses.

Retention periods

Sessions rely on JWT tokens with a maximum lifetime of 30 days; authentication nonces expire in 10 minutes and are single-use. Account and order data are kept for the duration of the relationship, then archived according to applicable legal periods.

Customer account data is kept for the duration of the relationship and up to 3 years after the last contact; order and invoicing documents are kept for 10 years under accounting obligations; connection logs up to 12 months; card data is not stored by the site.

Your rights

You have the rights of access, rectification, erasure, objection, restriction and portability. To exercise them: contact@kaspushop.fr.

You may lodge a complaint with the CNIL (www.cnil.fr).

Cookies

The site uses necessary technical cookies (session, cart, security).

No audience-measurement, advertising or third-party tracking cookie is set; therefore no consent is required.

Updates

This policy may be updated; the applicable version is the one published on the website.