Privacy Policy

Data controller

Kaspushop is an online store operated directly by KASB SYSTEMS, which uses it to showcase its expertise and the technologies it offers to its clients.

KASB SYSTEMS (SASU, 47 rue Vivienne, 75002 Paris, France) is the controller for the processing of personal data carried out on this site and for the orders placed on it. Contact: contact@kaspushop.fr.

Data processed

• Identity and contact details: first name, last name, email and phone number, entered at checkout or in the Shopify customer account. The phone number is required for delivery. It is only used for marketing by SMS and with your consent; any commercial canvassing by phone call requires your prior consent, except within an ongoing contract.
• Orders, delivery and billing addresses, purchase history.
• Payment: card details (number, expiry date, security code, cardholder name) are entered in Shopify's secure form and sent to its payment provider. KASB SYSTEMS never has access to the full card number. When paying with PayPal or Klarna, these services receive the information needed for the payment and process it under their own privacy policy.
• Technical data: IP address, browser, requested pages, date and time (server logs); cart identifier, kept in the browser; cookies needed for sign-in and language choice.
• Messages sent to contact@kaspushop.fr: email address, name and message content, with any attachments.
• Mandatory data: checkout fields not marked as optional are needed to place and deliver the order; without them, the order cannot go through. Signing up for marketing emails and SMS is always optional.

Purposes and legal bases

• Manage orders and the customer account: payment, delivery, tracking, order-related communication and after-sales service (performance of the contract).
• Answer messages sent to contact@kaspushop.fr (legitimate interest: responding to the requests received).
• Send you offers, news and cart reminders by email or SMS, only if you have agreed to it (consent). Every message lets you unsubscribe in one click, and you can withdraw your consent at any time.
• Ensure the proper operation and security of the site: server logs, blocking of malicious addresses and IP address sent to Shopify for its bot protection (legitimate interest: keeping the site available and protecting its users).
• Comply with our legal and accounting obligations (legal obligation).

Automated decisions

KASB SYSTEMS makes no decision producing legal effects concerning you or similarly significantly affecting you based solely on automated processing.

If you pay with Klarna, Klarna may assess your payment request, including by automated means, under its own responsibility; its privacy policy, shown during payment, sets out your rights.

Processors and recipients

Data is accessible only to authorised staff of KASB SYSTEMS. It is shared, each for its own part, with the following recipients:

• Shopify (Shopify International Limited, Ireland), processor: the store is hosted by Shopify, which collects and processes customer data (catalog, customer accounts, orders, checkout page) on behalf of KASB SYSTEMS. Information submitted to the store is shared with Shopify and its providers, some of which are located in other countries. For some services, Shopify acts on its own behalf, under its privacy policy.
• Address suggestions: while you enter your address at checkout, Shopify queries a service such as Google Autocomplete.
• Payment: Shopify Payments (Shopify International Limited) and its payment providers for cards and Klarna, and PayPal for PayPal payments. KASB SYSTEMS, which operates the store, receives the payments. These providers, Klarna and PayPal also process some data on their own behalf, in particular for their legal obligations (fraud and money laundering prevention).
• Delivery: Colissimo, Chronopost and Mondial Relay receive the details needed for delivery (name, address, phone number and email for parcel tracking).
• OVHcloud (OVH SAS, France), processor: hosting of the site and of the KASB SYSTEMS server (servers in Canada) and of the contact@kaspushop.fr mailbox (Zimbra, servers in France).
• Marketing: marketing emails and SMS are sent by KASB SYSTEMS with its own tools (kasbsystems.fr).
• Administrative or judicial authorities, only upon a request provided for by law.

Transfers outside the European Union

Some data is processed outside the European Union: in Canada, by OVHcloud for site hosting and by Shopify Inc., a country recognised as adequate by the European Commission; in other countries where Shopify's providers are located, for example for address suggestions, under the European Commission's standard contractual clauses.

A copy of these safeguards can be obtained on request at contact@kaspushop.fr. Shopify's are set out in its data processing addendum.

Retention periods

• Customer account: for the duration of the business relationship, then 3 years after the last contact; inactive accounts are then deleted.
• Orders and invoices: 10 years (accounting obligation).
• Marketing: until you withdraw your consent, and at most 3 years after the last contact. An unsubscribe request is kept for 3 years so that it is respected.
• Messages received at contact@kaspushop.fr: 3 years after the last exchange. You can ask for their deletion at any time at this address.
• Web server logs: 14 days; log of blocked addresses: 5 weeks at most.
• Customer area session: 30 days at most; cart identifier: until the cart is empty or no longer exists at Shopify.
• Bank card data: never stored by KASB SYSTEMS.

Your rights

You have the rights of access, rectification, erasure, restriction and portability of your data. To exercise them, write to contact@kaspushop.fr or to KASB SYSTEMS, 47 rue Vivienne, 75002 Paris, France. You will receive an answer within one month, which may be extended by two months for a complex request; proof of identity is only requested if there is doubt about your identity.

Right to object: you may object at any time, on grounds relating to your situation, to processing based on the legitimate interest of KASB SYSTEMS, and, without giving any reason, to marketing. You can also withdraw your consent to marketing emails and SMS at any time, in one click from any message or by writing to contact@kaspushop.fr.

After your death: you can set instructions on the retention, erasure and communication of your data and appoint a person to carry them out; failing that, your heirs may exercise certain rights. You can also choose whether or not to have your data communicated to a third party you designate.

To object to some processing that Shopify carries out on its own behalf, go to privacy.shopify.com.

KASB SYSTEMS has not appointed a data protection officer: contact@kaspushop.fr is the point of contact for any question about your data.

You may lodge a complaint with the CNIL (www.cnil.fr).

Cookies

The site only uses trackers that are strictly necessary for the service you request; they are exempt from consent. No audience-measurement, advertising or tracking cookie is set on kaspushop.fr.

• Sign-in: shopify_customer_state, shopify_customer_nonce and shopify_customer_locale, 5 minutes, during sign-in.
• Customer area: shopify_customer_at, shopify_customer_rt, shopify_customer_idt and shopify_customer_exp, 30 days at most.
• Language: NEXT_LOCALE, until the browser is closed, only if you choose a language other than your browser's.
• Cart: kaspu_cart_id, kept in the browser's local storage until the cart is empty or no longer exists at Shopify.
• Sign-in and checkout pages: hosted by Shopify, which sets its own cookies there, described in its cookie policy.

Updates

This policy may change, for example when a new processing activity is added. The date of the version in force is shown at the top of this page.