Privacy Policy

CorshCrafts places great importance on protecting your personal data. This privacy policy explains how we collect, use, protect and process your data in accordance with the General Data Protection Regulation (GDPR).

This page describes the personal data processing the website actually carries out; it is updated whenever that processing changes.

1. Data controller

Data controller: Alexandre Bourdin, sole trader operating the CorshCrafts website

Address: Monthieux, 01390, France

Email: alex@corshcrafts.art

2. Personal data collected

2.1 Data collected through the contact form

When you use our contact form, we collect the following information:

• Name: to identify you and reply to you personally
• Email address: to reply to your request
• Phone number (optional): to contact you if needed
• Message: the content of your request

2.2 Data collected when you buy from the shop

When you make a purchase in our online shop, we collect the following information:

• First and last name: to identify your order and prepare its shipment
• Email address: to send you the order confirmation and tracking
• Phone number (optional): to contact you if needed about the delivery
• Delivery address: street, city, postal code, country — needed to ship your order
• Order note (optional): any special instructions you wish to send us

Payment information (card number, etc.) is processed directly by our payment provider Stripe and never passes through our servers.

2.3 Login data (administration)

To administer the website, we use session cookies that authenticate administrators. These cookies do not concern visitors to the website.

2.4 Browsing data

We use two privacy-friendly analytics tools to measure the website’s traffic: Vercel Analytics and Umami (published by Umami Software, Inc.). These tools collect aggregated, anonymized data (pages visited, browser and device type, country of origin, performance) without using tracking cookies or keeping personally identifying data.

2.5 Shop reopening notification

When the shop is temporarily closed, you can leave us your email address to be told when it reopens. This address is used only to send you that one-off notification — no newsletter, no marketing — and is then deleted once the notification has been sent.

2.6 Data collected when you accept a quote online

When you accept a custom order quote through the secure link sent to you, we record the date of acceptance and your IP address as proof of your agreement (legitimate interest / proof of performance of the contract).

2.7 Email correspondence

When you write to our business address, the content of your messages, their subject, their dates and the images attached to them are imported into our customer follow-up tool to keep a history of your order. Only exchanges with customers already registered in our tool are imported; the other messages in our mailbox (suppliers, newsletters, other third parties) are never copied into our systems. Attachments that are not images are mentioned in the imported message but are not kept.

2.8 Testimonials

When you leave a testimonial through the dedicated form, we collect your first name, the description you choose to give (optional) and the text of your testimonial, as well as the date you agreed to its publication. If you use the personal link received after an order, the testimonial is linked to that order. No email address is requested. Each testimonial is reviewed before publication; only your first name, your description and your text may appear on the website.

2.9 Data collected through the configurator

When you request a quote from the configurator, we collect your first name, your last name, your email address, the configuration you chose and, if you provide them, your world and any additional information. This data is used to reply to you and to prepare your quote. If your request leads to an order, it is attached to your customer file.

2.10 Language of our exchanges

When you write to us through the contact form, place an order, request a quote or ask to be told when the shop reopens, we record the language of the site you are using (French or English). It lets us write to you, and send you your links and documents, in your language. It is kept with the request or order it relates to and, if a customer file is opened in your name, with that file.

3. Purposes of collection

Your personal data is collected for the following purposes:

• Answering your requests: handling and replying to your messages sent through the contact form
• Processing shop orders: preparing, shipping and tracking your online purchases, and sending you order confirmations and delivery updates
• Processing payments: collecting your payments securely through our provider Stripe
• Managing custom orders: drawing up quotes and following custom projects
• Communication: keeping you informed about the progress of your request or order
• Correspondence follow-up: keeping the history of your email exchanges with us to follow up and carry out your order
• Reopening notification: letting you know by email when the shop reopens, if you asked for it
• Testimonials: publishing on the website, after review, the testimonials you agreed to share
• Legal obligations: keeping data to meet our accounting and tax obligations

4. Legal basis for processing

The processing of your personal data is based on:

• Your consent: when you send the contact form, sign up for the shop reopening notification or send a testimonial
• The performance of a contract or of pre-contractual measures: for your quote requests from the configurator, processing your shop purchases and custom orders, including following up the correspondence related to your order (art. 6(1)(b) GDPR)
• Legitimate interest: for the anonymous analysis of the website’s traffic (Vercel Analytics and Umami) and for following up pre-contractual exchanges with a customer before an order is concluded
• Compliance with legal obligations: keeping commercial and accounting data

5. Data retention periods

Your data is kept for the following periods:

• Contact messages: 3 years from receipt of the message
• Configurator quote requests: 3 years from the request; if it leads to an order, kept with that order's data
• Order data: 10 years, in accordance with accounting obligations
• Invoices and credit notes: kept 10 years from the end of the financial year in which they were issued, in accordance with article L123-22 of the French Commercial Code
• Proof of quote acceptance (date and IP address): kept with the data of the order concerned (10 years, accounting obligations)
• Reopening notification email: kept until the shop reopens, then deleted as soon as the notification is sent
• Admin session cookies: the length of the session (a few hours)
• Imported email correspondence: kept with your customer file data for as long as that file exists in our follow-up tool; it is not deleted automatically after a fixed period
• Testimonials: kept until you withdraw your consent; on simple request, your testimonial is removed from the website and deleted

After these periods, your data is automatically deleted or anonymized.

6. Recipients of the data

Your personal data is intended only for CorshCrafts and is never sold, rented or transferred to third parties for commercial purposes.

We may share certain data with:

• Stripe: secure payment provider, for processing your card transactions when you buy from the shop. Stripe is PCI-DSS Level 1 certified. Privacy policy: stripe.com/fr/privacy
• Resend: transactional email provider, for contact confirmations and order notifications
• Vercel: website host and provider of the anonymous traffic analytics service (Vercel Analytics)
• Umami Software, Inc.: provider of the Umami anonymous traffic analytics service (aggregated data, no cookies). Privacy policy: umami.is/privacy
• Cloudinary: image hosting provider, for storing the images attached to the email correspondence imported into your order follow-up
• Legal authorities: on official request, as part of legal obligations

Your email correspondence is hosted by OVHcloud (a French host, with data kept within the European Union). This provider receives no additional data from us: it hosts the business mailbox from which we import exchanges with our customers into our follow-up tool.

7. Data security

We implement appropriate technical and organizational measures to protect your personal data against:

• Unauthorized access
• Accidental loss or destruction
• Unlawful or fraudulent use
• Unauthorized disclosure

These measures include: encrypted connections (HTTPS), password hashing, regular backups, and restricted access to data.

8. Cookies

Our website uses only essential technical cookies:

• Authentication cookies: let administrators log in to the administration area

We do not use tracking or advertising cookies. The traffic analytics tools (Vercel Analytics and Umami) work without cookies and collect no personally identifying data.

9. Your rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: to obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification: to correct or update inaccurate or incomplete data
• Right to erasure (“right to be forgotten”): to request the deletion of your data under certain conditions
• Right to restriction of processing: to request that the processing of your data be temporarily suspended
• Right to data portability: to receive your data in a structured, commonly used format
• Right to object: to object to the processing of your data on legitimate grounds
• Right to withdraw your consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal

How to exercise your rights

To exercise these rights, you can contact us:

• By email: alex@corshcrafts.art

We undertake to reply within one month at most. You may be asked for proof of identity to confirm who you are.

Complaints to the CNIL

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL): www.cnil.fr

10. Data transfers outside the EU

Your personal data is mainly hosted within the European Union. Some of our technical providers (Stripe, Resend, Vercel, Umami Software, Inc., Cloudinary) may process data in the United States as part of their services.

These providers offer appropriate safeguards under the GDPR, in particular through the European Commission’s Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. We make sure these transfers meet the data protection standards in force.

11. Changes to this privacy policy

This privacy policy may be updated to reflect changes in our data processing practices. We encourage you to check this page regularly. The date of the last update is shown at the bottom of the page.

12. Contact

For any question about this privacy policy or the processing of your personal data, you can contact us through our contact form.

• Email: alex@corshcrafts.art