1. Controller and contact details

The data controller is MISRULE SAS, 36 RUE DU LOUVRE, 75001 Paris, France, TVA: FR43937998417, SIRET: 937 998 417 00011. Privacy contact/DPO: contact@eliqvapoteur.com.

2. Categories of data and sources

1. We process: identification, contact and address data; account data; Order data (including payment identifiers); logistics data (tracking numbers, statuses); statements and consents (age, acceptances); technical logs (IP, device identifiers, timestamps); cookies/SDK data.
2. Data are obtained directly from the Customer, from payment systems, from Carriers, and from the Customer’s device (cookies/SDK).

3. Purposes and legal bases of processing

1. Performance of the contract (registration, purchase handling, payments, deliveries, returns, complaints) – Art. 6(1)(b) GDPR.
2. Compliance with legal obligations (accounting, tax settlement, OSS procedure and storage of evidence of place of consumption, product safety, responses to authorities) – Art. 6(1)(c) GDPR.
3. Age verification, fraud prevention, establishment and defence of claims – Art. 6(1)(c) and (f) GDPR.
4. Communications regarding public-law obligations in destination countries (e.g., reminders about recipient formalities) as part of order handling and our information duty – Art. 6(1)(b) and (c) GDPR.
5. Analytics and personalisation – either consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)) in line with ePrivacy; always with the right to object.
6. Service maintenance and security (logs, abuse prevention, testing) – Art. 6(1)(f) GDPR.

4. Data recipients

1. Data may be shared with: payment providers, logistics operators and Carriers, hosting and IT service providers, CRM/CS systems, accounting office, law firms, analytics providers, and competent public authorities where required (including tax/customs).

5. Transfers outside the EEA

1. Where chosen providers are located outside the EEA, we ensure legal grounds for transfer (EU Standard Contractual Clauses) and appropriate safeguards; a copy is available upon request.

6. Retention periods

1. Account data and purchase history – for the lifetime of the Account, then for periods required by accounting rules and limitation of claims.
2. Tax data and evidence for OSS – as required by law (generally 10 years from the end of the tax year).
3. Age verification data – to the minimum necessary extent and time; if we exceptionally process an ID copy, it is stored short-term and in a limited form (non-essential fields masked).

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (without affecting the lawfulness of processing before withdrawal). You may lodge a complaint with the CNIL or with the authority competent for your habitual residence.

8. Automated data and profiling

We do not make decisions producing legal effects based solely on automated processing. We may use profiling for analytics and offer personalisation; you have the right to object at any time.

9. Cookies and similar technologies

1. The Service uses cookies and similar technologies (e.g., local storage) for functionality and traffic analytics.
2. We use a consent mechanism (banner) to choose categories: Essential, Analytics; settings can be changed in the footer.
3. Cookie data may be linked to your account after login – only based on consents.

10. Security and breach notification

We apply appropriate technical and organisational measures (encryption, access control, pseudonymisation, security testing). Personal data breaches are notified in line with the GDPR; in case of high risk we inform affected individuals.

11. Minors

The Service is not intended for persons under 18, and we do not knowingly collect their data.

12. Changes to the Policy and contact

We reserve the right to amend this Policy; material changes will be announced on the Service and — where possible — by e-mail.

For data protection matters contact: contact@eliqvapoteur.com; postal address: 36 RUE DU LOUVRE, 75001 Paris, France.