Privacy policy

1. Data controller

The data controller is Le 19e Trou, a micro-enterprise whose details are given in the legal notice. For any question about data protection: contact@le19emetrou.fr.

2. Data collected

Le 19e Trou collects the following categories of data, for clearly defined purposes:

• Identification data: surname, first name — provided when you order.
• Contact details: email address, delivery address, phone number (optional).
• Order data: product, quantity, amount, date, order number.
• Payment data: processed exclusively by our provider Stripe; Le 19e Trou does not keep any card data (card number, security code).
• Browsing data: for visitors who accept analytics cookies, aggregated audience data (pages viewed, duration, traffic source) is collected via Google Analytics. For visitors who refuse, anonymised audience measurement (hashed IP, no cookie) is kept for 13 months, in line with CNIL decision no. 2020-091.
• Advertising measurement data: if you arrive on the site from a Meta advert, measurement events are sent to Meta to assess the effectiveness of our campaigns. These are viewing a page, viewing a product, adding to the basket, starting checkout and, where applicable, completing the order. They include the advertising click identifier in the address you arrived from, your IP address and your browser. The order event also includes the amount, the currency and the products bought, as well as matching identifiers derived from your email, phone number, name and delivery address. These identifiers are hashed (SHA-256) before being sent: Meta never receives this information in plain text. This happens regardless of your cookie choice — see sections 3 and 6, and your right to object in section 7.

3. Purposes and legal bases

• Performance of a contract (Article 6(1)(b) GDPR): processing orders, delivery, customer service, returns, customer relationship.
• Legal obligation (Article 6(1)(c) GDPR): keeping accounting and tax records (invoices) for 10 years, as required by the French Commercial Code.
• Legitimate interest (Article 6(1)(f) GDPR): anonymised audience measurement to understand how the site is used, fraud prevention, securing administrator access, and measuring the effectiveness of our advertising campaigns (sending the measurement events to Meta described in section 2). Our interest in measuring the return on our advertising spend is balanced against your rights: the identifiers sent are hashed, are not used to profile you individually on our site, and you can object at any time (section 7).
• Consent (Article 6(1)(a) GDPR): Google Analytics cookies and Meta advertising cookies. Consent is collected via the cookie banner and can be withdrawn at any time. Refusing prevents these cookies from being set and the corresponding scripts from loading; it does not, however, prevent the server-side sending of the measurement events described above, which relies on legitimate interest.

4. Retention periods

• Customer data (identification, delivery): 3 years from the last contact, for the purposes of the business relationship.
• Order and billing data: 10 years (accounting and tax obligation, article L.123-22 of the French Commercial Code).
• Analytics browsing data: 13 months maximum.
• Administrator connection data: 1 year (article L.34-1 of the French Post and Electronic Communications Code).

5. Recipients and processors

Data is accessible only to authorised staff of Le 19e Trou and to its processors, strictly within the scope of their work:

• Stripe Payments Europe Ltd (Ireland) — payment processing; PCI-DSS level 1 certified.
• Vercel Inc.(United States) — hosting of the site and database; safeguards through the European Commission's standard contractual clauses.
• Brevo (France) — transactional emails (confirmation, shipping).
• OVH (France) — domain name and business email.
• Carriers (La Poste, Mondial Relay or equivalent) — physical delivery of the product.
• Google Ireland Ltd — only if you have accepted analytics cookies.
• Meta Platforms Ireland Ltd (Ireland) — measuring the effectiveness of our advertising campaigns. Receives the conversion events described in section 2, with hashed identifiers. Meta acts as a joint controller for this measurement.

No data is transferred outside the European Union without an appropriate legal framework (adequacy decision or standard contractual clauses).

6. Cookies

Cookies that are strictly necessary for the site to work (session, basket, remembering your consent choice, your language and currency) are set without prior consent, as the regulations allow.

Audience measurement cookies (Google Analytics) and the Meta advertising pixel (cookie _fbp) are only set once you accept them via the banner. If you refuse, these scripts are not loaded and these cookies are not set.

One exception: the _fbc cookie. If you arrive from a Meta advert, the address contains a click identifier. Our server stores it in this cookie as soon as you arrive, without waiting for your answer to the banner, so that your visit can be linked to the advert concerned. This cookie contains only the click identifier, is kept for 90 days and does not identify you by name. It falls under advertising measurement based on legitimate interest, to which you can object (section 7).

What refusing does not cover. Refusing applies to cookies and scripts placed in your browser. It does not prevent our servers from sending the measurement events described in section 2 when you arrive from an advert — this relies on legitimate interest, not on your consent. You have a specific right to object, described in section 7.

You can change your choice at any time by clearing the ecf_cookie_consent_v1 entry from your local storage, which will show the banner again.

7. Your rights

Under the GDPR and the French Data Protection Act, you have the following rights over your data:

• Right of access: obtain a copy of the data concerning you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure("right to be forgotten"): unless retention is required by law.
• Right to restriction of processing.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: in particular to profiling or direct marketing.
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing.

Objecting to advertising measurement.Sending measurement events to Meta (section 2) relies on legitimate interest. You can object at any time, without giving a reason, by writing to the address below with the subject "objection to advertising measurement". We will then stop all transmission concerning you. This has no effect on the processing of your orders.

To exercise these rights, write to contact@le19emetrou.fr stating the purpose of your request. You will receive a reply within 30 days at most.

8. Security

Le 19e Trou implements reasonable technical and organisational measures to protect data: end-to-end TLS encryption (HTTPS), encrypted storage at rest, password-protected administrator access with attempt limits, and logging of sensitive access. If a data breach is likely to put your rights at risk, you will be informed as soon as possible in accordance with Article 34 GDPR.

9. Complaints to the CNIL

If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr/fr/plaintes.

10. Changes to this policy

This policy may change to reflect legal or operational developments. Any substantial change will be flagged by a visible notice on the site and the update date at the top of this page will be revised.