Privacy Policy & Data Protection

Lire cette page en français

Last updated: July 2026

1. Who is the data controller?

The controller of the data collected on this website is:

• Les idées de la forêt — artisanal micro-business
• Workshop based in Thônes (Haute-Savoie), France
• Contact: contact@lesideesdelaforet.com

For any question relating to the protection of your data, you can write to us at this address with "GDPR" in the subject line.

2. What data do we collect?

We only collect the data strictly necessary for the purposes described below:

• Account data: last name, first name, email address, password (encrypted) when you create an account;
• Order and delivery data: postal address, phone number, order contents;
• Payment data: processed directly and exclusively by our provider Stripe. We never store your card numbers;
• Personalisation data: text, name, date or files you send us for your custom creations;
• Contact data: messages sent via our forms or by email;
• Browsing data: anonymised or pseudonymised technical data (pages viewed, device type) for statistical purposes.

3. Why? Purposes and legal bases

Each processing operation is based on a legal basis provided for by Article 6 of the GDPR:

• Manage your orders and delivery — performance of the sales contract;
• Manage your customer account — performance of the contract;
• Respond to your requests — legitimate interest in providing customer service;
• Send you our newsletter — only with your consent, which can be withdrawn at any time;
• Comply with our accounting and tax obligations — legal obligation;
• Measure website audience — legitimate interest, using aggregated statistics.

4. Who has access to your data?

Your data is never sold. It is accessible to our team and to carefully selected processors, acting on our instructions and contractually bound to comply with the GDPR:

• Stripe — secure payment processing;
• Google (Firebase) — website hosting, database and authentication;
• Colissimo / La Poste — delivery of your parcels;
• Zoho Mail and Resend — sending and receiving our transactional emails.

5. Transfers outside the European Union

Some of our providers may process data outside the European Union. In such cases, these transfers are strictly governed by the safeguards provided for by the GDPR: the European Commission's Standard Contractual Clauses, or adherence to the EU–US Data Privacy Framework. We ensure that a level of protection equivalent to that of the European Union is maintained.

6. How long do we keep your data?

• Customer account: for as long as the account is active, then deleted after 3 years of inactivity;
• Orders and invoices: 10 years, in accordance with accounting obligations;
• Newsletter: until you unsubscribe, then removed from our lists;
• Contact messages: 3 years from the last exchange;
• Browsing statistics: 25 months maximum.

7. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data at any time:

• Right of access — obtain a copy of the data we hold;
• Right to rectification — correct inaccurate or incomplete data;
• Right to erasure ("right to be forgotten") — request deletion of your data;
• Right to restriction of processing;
• Right to object — in particular to direct marketing;
• Right to data portability — receive your data in a reusable format;
• Right to withdraw your consent at any time;
• Right to give instructions regarding the fate of your data after your death.

8. How to exercise your rights

Simply write to us at contact@lesideesdelaforet.com. We will reply within a maximum of one month. Proof of identity may be requested if there is reasonable doubt about your identity.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the French data-protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL) — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr, or with the supervisory authority of your EU country of residence.

9. Cookies and trackers

Our website only uses cookies necessary for its proper operation (session, cart, authentication) as well as audience-measurement cookies. Non-essential cookies are only placed with your consent, which you can withdraw at any time via your browser settings. No third-party advertising cookies are used for the purpose of reselling data.

10. Security of your data

We implement appropriate technical and organisational measures to protect your data: encryption of exchanges (HTTPS), password encryption, strict access control, hosting on secure infrastructure, and outsourcing of payment to a PCI-DSS certified provider. In the event of a data breach likely to create a risk to your rights, we would notify the CNIL and, where applicable, the individuals concerned, within the time limits set by the GDPR.

11. Protection of minors

Our website is intended for an adult audience. We do not knowingly collect data concerning minors under the age of 15 without the consent of the holders of parental authority.

12. Changes to this policy

This privacy policy may change to reflect changes in our practices or in regulations. Any substantial modification will be indicated on this page, whose last-updated date appears at the top of the document. In the event of any discrepancy of interpretation, the French version prevails.