This English version is provided for convenience; the French version prevails.
Who is responsible for your data
The data controller is SPIRUMANNE SARL, 57 avenue d’Ax-les-Thermes, 11340 Belcaire, France — SIREN 881 205 157, RCS Carcassonne.
- Contact for any question relating to personal data — info@spirumanne.com
- Telephone — +33 (0)6 13 12 29 18
No data protection officer (DPO) has been appointed to date. Requests relating to personal data are handled directly at info@spirumanne.com, which acts as the single point of contact (to validate).
This processing is governed by Regulation (EU) 2016/679 (GDPR) and by Law no. 78-17 of 6 January 1978 as amended.
The data we collect
When you place an order
The shop runs on WordPress and WooCommerce. Creating an account and placing an order leads to the collection of:
- identity — title, surname, first name;
- contact details — email address, telephone number;
- addresses — delivery address, billing address, chosen pick-up point;
- order data — products, quantities, amounts, delivery method, order number, purchase history;
- customer account — username, password (stored in irreversible encrypted form), preferences;
- technical data — IP address at the time of the order, timestamp, for fraud prevention and proof of consent to the terms of sale.
We do not collect or keep any card data.
When you pay
Payment is processed by our providers: PayPlug, Stripe and PayPal. Bank details are entered in their secure environment and never pass through our servers. We receive only the result of the transaction, a payment identifier, the amount and, where applicable, the last four digits of the card.
Each of these providers is a data controller for its own purposes (fraud prevention, regulatory obligations). Their respective policies apply in addition to this one.
When we write to you
Transactional emails (order confirmation, dispatch tracking, reply to the contact form) are sent by authenticated SMTP. In the development environment, messages are intercepted by Mailpit and never leave the local server; in production, they are sent by [[TO COMPLETE: production email sending provider]].
[[TO COMPLETE: production SMTP provider (name, address, hosting country) and any newsletter sending tool.]]
When you contact us
The contact form collects your name, your email, possibly your telephone number and order number, the subject and content of your message, and an attachment where applicable. These elements are used only to reply to you.
When you subscribe to the newsletter
We collect your email address, and only that, with your explicit consent. Every email includes an unsubscribe link.
When you browse
Cookies and trackers are set according to your choices (see the “Cookies” section). Our host’s logs also record technical data (IP address, date, pages visited, user agent) for security and proper operation.
Why we collect it, and on what basis
| Purpose | Data concerned | Legal basis | Retention | |—|—|—|—| | Process and deliver your order | Identity, contact details, addresses, order | Performance of the contract (Art. 6.1.b) | Duration of the relationship, then legal archiving | | Collect payment and prevent fraud | Transaction identifier, amount, IP | Performance of the contract and legitimate interest (Art. 6.1.b and f) | 13 months for transaction evidence data | | Issue and keep invoices | Identity, addresses, order details | Legal obligation (Art. 6.1.c) | 10 years from the close of the financial year | | Manage your customer account | Username, history, preferences | Performance of the contract (Art. 6.1.b) | Until the account is deleted, or after 3 years without activity | | Reply to your requests | Content of the form or email | Legitimate interest (Art. 6.1.f) | 3 years from the last exchange | | Send the newsletter | Email address | Consent (Art. 6.1.a) | Until consent is withdrawn, then 3 years | | Measure site audience | Aggregated browsing data | Prior consent (or documented CNIL exemption) | 13 months maximum | | Ensure site security | Technical logs | Legitimate interest (Art. 6.1.f) | 12 months | | Handle a complaint or dispute | Full file | Legitimate interest (Art. 6.1.f) | Duration of the applicable limitation period |
We carry out no automated decision-making and no profiling producing legal effects concerning you.
Who it is shared with
Your data is neither sold, nor rented, nor assigned for commercial purposes. It is communicated only to the recipients necessary for performance of the service:
- Site host — [[TO COMPLETE: host, address and data hosting country]]
- Payment providers — PayPlug (France), Stripe, PayPal.
- Carriers — La Poste / Colissimo and Mondial Relay, for the data strictly necessary for delivery (name, address, telephone, tracking email).
- Email sending service — [[TO COMPLETE: production email sending provider]]; in development, Mailpit locally.
- Invoicing tool — WooCommerce invoicing extension, hosted with the site.
- Accounting and tax obligations — our accountancy firm and, where applicable, the tax authorities.
Hosting country for our main processing: [[TO CONFIRM: data hosting country]]. Some payment providers may carry out transfers outside the EU, framed by the European Commission’s standard contractual clauses or an adequacy decision.
[[TO COMPLETE: final list of processors, with hosting countries and the basis for any transfer outside the EU.]]
Cookies and trackers
The site uses Complianz as its consent manager. On your first visit, a banner lets you accept, refuse or customise your choices — refusing is as simple as accepting, in accordance with the CNIL’s recommendations.
Three families of trackers:
- Strictly necessary cookies — session, basket, account login, remembering your consent choice, fraud protection. They do not require your agreement, as the site cannot work without them.
- Audience measurement cookies — traffic statistics. Subject to your prior consent, unless a documented CNIL exemption applies to the configuration deployed.
- Third-party cookies — set by payment providers during a transaction, or by external content you choose to load (video, map). Subject to your consent.
We use no advertising cookies and carry out no cross-site tracking for marketing purposes.
Changing your choices at any time. A “Manage cookies” link is available in the footer. You can also configure your browser to refuse or delete cookies; some site functions, including the basket, may then no longer work.
Consent and cookies are kept for no longer than 13 months.
The detailed list of cookies actually set (name, publisher, purpose, duration) is given in our cookie policy, kept up to date by Complianz.
How long we keep it
The periods are shown in the table above. In summary:
- Orders — during the commercial relationship, then archived for the legal periods.
- Customer accounts — until the account is deleted, or after three years without activity.
- Invoices and accounting documents — ten years, as a legal obligation.
- Contact messages — three years from the last exchange.
- Newsletter — until you withdraw your consent.
- Technical logs — twelve months.
- Cookies and consent — thirteen months at most.
At the end of these periods, the data is deleted or anonymised, except for what the law requires us to archive.
Your rights
You have the following rights over your personal data:
- Access — to obtain confirmation that data concerning you is being processed, and to receive a copy of it.
- Rectification — to correct inaccurate or incomplete data.
- Erasure — to request the deletion of your data, subject to our legal retention obligations (invoices in particular).
- Restriction — to request the temporary freezing of disputed processing.
- Objection — to object to processing based on our legitimate interest, and at any time to commercial prospecting.
- Portability — to receive in a structured format the data you have provided to us, or to ask for it to be transmitted to another data controller.
- Withdrawal of consent — at any time, for processing that depends on it (newsletter, non-essential cookies).
- Post-mortem instructions — to organise what happens to your data after your death.
How to exercise them. Write to info@spirumanne.com, or by post to Spirumanne SARL, 57 avenue d’Ax-les-Thermes, 11340 Belcaire. State your request and, if necessary, attach proof of identity where there is reasonable doubt about who you are.
We reply within one month, extendable by two months for complex requests, in which case we inform you.
Complaint. If our reply does not satisfy you, you can contact the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
Security
We implement technical and organisational measures suited to our size: HTTPS/TLS encryption of exchanges, passwords stored as irreversible hashes, regular updates to WordPress, WooCommerce and extensions, restricted and authenticated administrator access, regular encrypted backups.
No system is infallible. In the event of a data breach likely to entail a high risk to your rights, we will inform you and the CNIL, under the conditions provided for by the GDPR.
Minors
The site is not intended for minors under 15 and we do not knowingly collect their data. Any order presupposes the legal capacity to contract.
Changes
This policy may be updated to reflect technical, legal or organisational developments. The applicable version is the one published on this page.
Last updated — 25 October 2026 (to validate)