Politique de confidentialité

1. Who is responsible for your data

The operator of total-hearth.shop determines why and how personal data is processed through this store and therefore acts as the data controller for those activities. Contact requests concerning personal data may be sent to info@total-hearth.shop. The website name and email alone do not replace the separate corporate identity and address disclosures required in a complete French Legal Notice; see the Legal Notice section of this document.

2. Data we collect

Identity and contact data, such as name, email address, telephone number, billing address and delivery address.

Order and transaction data, such as products purchased, order value, currency, discounts, returns, refunds and customer-service history.

Payment-related data. Payments are processed by authorised payment providers; we generally receive transaction status, payment method and limited identifiers rather than complete card details.

Device and usage data, such as IP address, browser, device type, pages viewed, referring URLs, cookie identifiers and security logs.

Communications and preference data, including enquiries, reviews, marketing choices and consent records.

Compatibility or technical information voluntarily supplied for product support, such as appliance brand, model, measurements or photographs.

3. Purposes and legal bases

We process data to take steps at your request and perform the sales contract, including checkout, payment, order confirmation, fulfilment, delivery, returns, refunds and customer support. We process data to comply with legal obligations such as accounting, tax, product-safety, consumer-protection and fraud-reporting duties.

Where necessary for our legitimate interests, balanced against your rights, we use data to secure the store, prevent fraud, maintain service records, improve products and website performance, establish or defend legal claims, and understand aggregated business performance. Marketing emails and non-essential cookies are used on the basis required by applicable law, generally consent. You may withdraw consent at any time without affecting earlier lawful processing.

4. Shopify and service providers

Our store is powered by Shopify. Shopify and its affiliates process information to provide the commerce platform, hosting, checkout, security, analytics and related functions. We may also use payment providers, carriers, fulfilment partners, customer-support tools, email providers, fraud-prevention services, professional advisers and technical vendors. They receive only data reasonably necessary for their function and are subject to contractual or legal obligations.

5. Cookies and similar technologies

Strictly necessary technologies may be used to operate checkout, keep the cart, secure sessions, remember privacy choices and provide requested functions. Analytics, personalisation and advertising technologies are used only where an appropriate legal basis exists. Where consent is required, they should remain inactive until consent is obtained.

You must be able to accept or refuse non-essential cookies with comparable ease and later change your choice through the available preference controls. Browser settings may also block or delete cookies, although blocking necessary technologies can impair store functions.

6. Marketing

We send electronic marketing only where permitted. Marketing consent is separate from the purchase of goods. Every marketing email should include an unsubscribe method, and you may also object by contacting us. Service communications about orders, safety, recalls, returns or security are not marketing and may still be sent when necessary.

7. International data transfers

Shopify and other providers may process data outside France or the European Economic Area. Where GDPR transfer restrictions apply, we rely on an adequacy decision, approved standard contractual clauses or another lawful safeguard, together with supplementary measures where appropriate. Information about relevant safeguards may be requested through our privacy contact.

8. Retention

We retain personal data only for as long as reasonably necessary for the stated purpose, legal retention obligations, dispute periods and security needs. Order, invoice and accounting data may be retained for the period required by French law. Customer-service records are retained long enough to handle orders, warranties and claims. Marketing data is retained until consent is withdrawn or the applicable retention period expires. Security logs and cookie data are retained for proportionate periods.

9. Your GDPR rights

Access: obtain confirmation and a copy of personal data, subject to lawful limits.

Rectification: correct inaccurate or incomplete data.

Erasure: request deletion where a legal ground applies.

Restriction: ask us to limit processing in specified circumstances.

Portability: receive eligible data in a structured, commonly used, machine-readable format.

Objection: object to processing based on legitimate interests and object at any time to direct marketing.

Withdrawal of consent: withdraw consent at any time for future processing.

Automated decisions: receive protections where a decision based solely on automated processing produces legal or similarly significant effects.

To exercise a right, email info@total-hearth.shop and describe the request. We may request proportionate information to verify identity, but will not ask for more than necessary. We normally respond within one month, subject to lawful extension for complex or numerous requests. Rights can be limited where the GDPR or other law permits or requires continued processing.

10. Complaints to the CNIL

If you believe data has been handled unlawfully, please contact us so we can investigate. You also have the right to lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French supervisory authority, through its official complaint channels.

11. Security and breaches

We use administrative, organisational and technical measures designed to protect data against unauthorised access, loss, alteration or disclosure. No internet service is completely secure. Where a personal-data breach creates a legally reportable risk, we will notify the competent authority and affected individuals as required.

12. Children

The store is not directed to children. We do not knowingly seek to collect personal data from children for independent purchasing. If you believe a child has supplied data without appropriate authorisation, contact us so we can review and delete it where required.

13. Third-party links

Our site may link to independent websites. Their privacy practices are controlled by their own operators. Review the privacy information of any external service before supplying data.

14. Changes and contact

We may update this policy to reflect legal, operational or technical changes. The current version will show a revised effective date. Material changes will be communicated where required. Privacy questions and rights requests may be sent to info@total-hearth.shop.