Privacy Policy
Last updated:
1. Data controller
Opaleia is a brand operated by O’Créative (sole trader).
- Controller: Carole CHESSA
- Address: 330 Route des Collines, 26350 Le Chalon, France
- GDPR contact email: privacy@opaleia.fr
2. Data collected
- Account and orders: title, first and last name, addresses, email, phone number, order content, invoices, history.
- Payment: payment method, transaction identifier, last 4 digits of the card (never the full number or CVV).
- Delivery: carrier selection, tracking number.
- Customer support: messages, attachments, records required for follow-up.
- Marketing: contact preferences, newsletter subscriptions.
- Browsing and cookies: technical identifiers, logs, audience measurement, consent records.
- Food traceability: batch numbers, use-by/best-before dates, product quality information.
3. Purposes and legal bases
- Performance of a contract: account creation, order processing, payment, delivery, customer service.
- Legal obligations: invoicing, accounting, warranties, food recall and traceability.
- Legitimate interest: fraud prevention, site security, experience improvement, non-intrusive internal statistics.
- Consent: newsletter, marketing, non-essential cookies, reviews published with a displayed name where applicable.
4. Data retention periods
| Category | Period |
|---|---|
| Inactive customer account | 3 years after last contact or last order |
| Orders and invoices | 10 years (legal obligation) |
| Customer support | 3 years after closure |
| Marketing / newsletter | Until consent is withdrawn or 3 years after last contact |
| Audience measurement cookies | Up to 13 months |
| Food traceability | Statutory periods applicable to batches and recalls |
5. Recipients and processors
Data are accessible to authorised Opaleia staff and to service providers acting on our behalf:
- Payments: secure payment service providers (e.g. Stripe/Adyen/PayPal) – transaction identifiers.
- Hosting and emails: hosting provider and transactional email routing services.
- Shipping and logistics: carriers, pickup-point solutions, shipment preparation.
- Business tools: invoicing, accounting, fraud prevention, newsletter management.
- Analytics: audience measurement solutions, with your consent where required.
We do not sell your data. We require contractual confidentiality and security commitments from our processors.
6. Transfers outside the EU
If certain providers process data outside the EU, appropriate safeguards are implemented (standard contractual clauses, binding corporate rules, or EU hosting with anonymisation where possible). Information available upon request at privacy@opaleia.fr.
7. Your rights
- Right of access, rectification, erasure, restriction, portability, and objection.
- Withdrawal of consent at any time for processing based on consent (newsletter, non-essential cookies).
- Instructions regarding the handling of data after death.
To exercise your rights: privacy@opaleia.fr, with proof of identity if required.
Complaint: French Data Protection Authority (CNIL) – www.cnil.fr.
8. Security
Reasonable technical and organisational measures: encryption in transit, access control, backups, logging, incident management policies. No method offers absolute security, but we continuously improve our safeguards.
9. Cookies and trackers
A consent banner allows you to accept or refuse non-essential cookies. You can change your choices at any time via the “Manage my cookies” link.
Categories
- Necessary technical cookies: login, cart, checkout, security.
- Audience measurement: visit statistics, page views. Consent required if not strictly anonymised.
- Personalisation and marketing: recommendations, advertising, social networks. Consent required.
Settings
- Via the banner or the “Manage my cookies” link.
- Via your browser (blocking, deletion). Refusal may degrade certain features.
10. Minors
The website is intended for adults. Orders placed by minors must be made by the holder of parental authority.
11. Marketing communications
You receive marketing emails only if you have consented or pursuant to Article L34-5 of the French Postal and Electronic Communications Code for products similar to a previous order. You can unsubscribe at any time via the link in each email.
12. Reviews and UGC
If you publish a review, your first name or a chosen identifier may appear publicly. You may request modification or deletion of your review at privacy@opaleia.fr, subject to legal obligations.
13. Changes
We may update this policy. In the event of material changes, appropriate notice will be provided. The update date appears at the top of the page.
14. Contact details
Privacy-related questions: privacy@opaleia.fr.