Privacy and personal data protection policy

Last updated: 16 April 2026

1. Introduction
2. Data collected
3. Purposes and legal bases
4. Data recipients
5. Transfers outside the EU
6. Retention periods
7. Your rights
8. Data security
9. Social networks
10. Cookies and trackers
11. Personalised advertising
12. Changes
13. Contact

1. Introduction

1.1 Purpose of this policy

FANAVENUE (hereinafter "we", "our" or "the Company") attaches particular importance to the protection of your personal data and to the respect of your privacy.

The purpose of this privacy policy (hereinafter the "Policy") is to inform you, clearly and transparently, of how we collect, use, store and protect your personal data when you browse the website (hereinafter the "Site") or interact with our services.

It has been drawn up in accordance with:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter the "GDPR");
French Act No. 78‑17 of 6 January 1978 on information technology, data files and civil liberties (known as the "French Data Protection Act"), as amended by Act No. 2018‑493 of 20 June 2018 and Order No. 2018‑1125 of 12 December 2018.

1.2 Definition of personal data

Personal data means any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a surname, first name, telephone number, email address, postal address, IP address, online identifier or one or more factors specific to that person's identity.

1.3 Data controller

The controller of your personal data is:

FANAVENUE

11 rue de la Cotterie, 40230 Saint‑Vincent‑de‑Tyrosse, France

Email: contact@fanavenue.com

SIRET: 449 393 370 000 50

1.4 Data Protection Officer (DPO)

For any question relating to the processing of your personal data, you may contact our Data Protection Officer:

by post: FANAVENUE – DPO, 11 rue de la Cotterie, 40230 Saint‑Vincent‑de‑Tyrosse, France
by email: contact@fanavenue.com

2. Personal data collected

We only collect the data strictly necessary for the purposes described below, in accordance with the data minimisation principle (article 5 of the GDPR).

2.1 Data collected while browsing

When you browse the Site, we may collect:

your IP address;
data relating to your browser and device (type, version, operating system, language);
the pages viewed, the date and time of the visit and its duration;
session identifiers and advertising identifiers through cookies and trackers (see section 10).

2.2 Data collected when creating a customer account

title, surname, first name;
email address;
password (stored in hashed form);
telephone number;
delivery and billing postal address.

2.3 Data collected when placing an order

identification and contact data (see 2.2);
order details (products, amount, date);
payment data (bank card numbers are not stored by us, they are processed directly by our approved payment provider, see section 4).

2.4 Data collected when contacting customer service

surname, first name, postal address, telephone number, email address;
the content of your request and the history of our exchanges;
where applicable, a recording of the call after prior notice.

2.5 Sensitive data

We do not collect any "sensitive" data within the meaning of article 9 of the GDPR (racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation, etc.).

2.6 Minors

The Site is not intended for people under the age of 15. We do not knowingly collect data relating to minors under 15 without the consent of the holder of parental authority, in accordance with article 7‑1 of the French Data Protection Act.

2.7 Mandatory or optional fields

Fields marked with an asterisk in our forms are mandatory in order to process your request or perform the contract. Without them, we will not be able to act on your request. All other fields are optional.

3. Purposes and legal bases of processing

In accordance with article 6 of the GDPR, each processing operation we carry out relies on a legal basis. The table below details the purposes pursued and their legal basis.

Purpose	Legal basis	Data concerned
Management of your customer account	Performance of the contract (art. 6.1.b GDPR)	Identification, contact details, login credentials
Order processing, tracking and delivery	Performance of the contract (art. 6.1.b GDPR)	Identification, contact details, address, order details
Payment management and fraud prevention	Performance of the contract and legitimate interest (art. 6.1.b and 6.1.f GDPR)	Payment data, connection data
Customer service and complaint handling	Performance of the contract (art. 6.1.b GDPR)	Identification, contact details, content of exchanges
Sending newsletters and marketing emails	Consent (art. 6.1.a GDPR)	Email address, preferences
Marketing emails to our customers about similar products	Legitimate interest (art. 6.1.f GDPR) and art. L. 34‑5 of the French Postal and Electronic Communications Code	Email address, purchase history
Personalisation and targeted advertising	Consent (art. 6.1.a GDPR) through cookies	Browsing data, purchase history
Audience measurement and statistics	Consent or legitimate interest depending on the tool	Anonymised or pseudonymised browsing data
Compliance with our legal obligations (accounting, tax)	Legal obligation (art. 6.1.c GDPR)	Billing data
Handling requests to exercise rights	Legal obligation (art. 6.1.c GDPR)	Identification, content of the request
Defence of our rights in the event of a dispute	Legitimate interest (art. 6.1.f GDPR)	All data relevant to the dispute

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal (see section 7).

4. Data recipients

Your personal data is intended for the authorised internal departments of FANAVENUE (sales, customer service, logistics and accounting departments).

It may also be shared, within the limits of their respective duties and subject to a confidentiality undertaking, with:

our processors within the meaning of article 28 of the GDPR: the Site host, email service provider, customer service provider, logistics and delivery providers, online payment provider, IT maintenance providers;
our banking partners for payment management and fraud prevention;
our advisers (accountants, lawyers, statutory auditors) strictly within the scope of their duties;
administrative and judicial authorities upon lawful request, or where required by a legal or regulatory obligation.

We enter into a contract compliant with article 28 of the GDPR with each of our processors, setting out the guarantees provided for the protection of your data.

Apart from the cases listed above, we do not sell, rent or transfer your personal data to third parties for commercial purposes.

5. Data transfers outside the European Union

Our processing operations are in principle carried out within the European Union.

However, some of our processors or partners (in particular providers of marketing or hosting solutions, or social network operators) may be located outside the European Economic Area. In that case, such transfers are governed by one of the mechanisms provided for in Chapter V of the GDPR:

an adequacy decision of the European Commission (for example for transfers to the United States under the Data Privacy Framework for certified companies);
standard contractual clauses adopted by the European Commission;
binding corporate rules (BCR);
where applicable, additional technical and organisational measures.

You may obtain a copy of, or further information about, these safeguards by contacting our data protection contact (see section 1.4).

6. Retention periods

Your personal data is kept for as long as is strictly necessary to achieve the purposes for which it was collected, and is then archived or deleted in accordance with the following periods:

Type of data	Retention period
Customer account data	For the entire duration of the business relationship, then 3 years from the customer's last contact, for marketing purposes
Order and invoice data	10 years from the end of the financial year (accounting obligation, art. L. 123‑22 of the French Commercial Code)
Tax documents	6 years (art. L. 102 B of the French Tax Procedure Code)
Bank card data	Not stored by FANAVENUE; in the case of a stored card and with your agreement, until the card expires, by our payment provider (CNIL recommendation)
Card security code (CVV)	Never stored
Connection logs	1 year from the last connection (art. L. 34‑1 of the French Postal and Electronic Communications Code)
Cookies and trackers	A maximum of 13 months from the time they are placed; data collected through cookies: a maximum of 25 months
Consent records (evidence)	3 years from the withdrawal of consent or the end of the relationship
Data used for marketing purposes	3 years from the prospect's last contact
Data relating to a request to exercise rights	The time needed to handle the request, then 1 year (or 3 years where proof of identity was provided)
Data relevant to a dispute	The duration of the proceedings and until all remedies have been exhausted

At the end of these periods, the data is deleted or irreversibly anonymised.

7. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights over your personal data:

Right of access (art. 15): to obtain confirmation as to whether your data is being processed, and to obtain a copy of it.
Right to rectification (art. 16): to have inaccurate or incomplete data corrected.
Right to erasure (art. 17), known as the "right to be forgotten": to obtain the deletion of your data in the cases provided for by the GDPR.
Right to restriction of processing (art. 18): to obtain a temporary freeze on processing.
Right to data portability (art. 20): to receive your data in a structured, commonly used, machine‑readable format, and to transmit it to another controller.
Right to object (art. 21): to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, as well as to any processing for direct marketing purposes (without having to give a reason).
Right to withdraw your consent at any time, where processing is based on it, without affecting the lawfulness of processing carried out before the withdrawal.
Right not to be subject to an automated individual decision producing legal effects or significantly affecting you (art. 22). We do not carry out any such decision‑making on the Site.
Right to give instructions on what happens to your data after your death, in accordance with article 85 of the French Data Protection Act.

How to exercise your rights

You may exercise your rights:

by email at: contact@fanavenue.com;
by post at: FANAVENUE – Data Protection, 11 rue de la Cotterie, 40230 Saint‑Vincent‑de‑Tyrosse, France;
directly from your customer account for certain operations (updating your information, deleting your account, managing your communication preferences).

Proof of identity will only be requested where there is reasonable doubt as to your identity, in accordance with article 12.6 of the GDPR and the recommendations of the CNIL. In that case, the copy of the identity document provided will be deleted once the verification is complete.

We undertake to respond to your request within one month of receiving it, which may be extended by two months for complex or multiple requests (you will be informed if this is the case).

Right to lodge a complaint with a supervisory authority

If, after contacting us, you consider that your rights have not been respected, you have the right to lodge a complaint with the French data protection authority (Commission Nationale de l'Informatique et des Libertés, CNIL):

Website: www.cnil.fr
Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Phone: 01 53 73 22 22

8. Data security

We implement appropriate technical and organisational measures to ensure the security, confidentiality and integrity of your personal data, and to protect it against loss, alteration, disclosure or unauthorised access, in particular:

encryption of communications using the HTTPS/TLS protocol;
hosting of data in secure data centres located within the European Union;
control and traceability of access to data;
a strong password policy and storage of passwords in hashed form;
regular backups;
regular updates of systems and applications;
staff training and awareness;
careful selection of processors and contractual safeguards.

Payments are handled by an approved payment provider through a secure interface. FANAVENUE has no access to your full banking details.

Fraud prevention

In order to secure payments, we carry out fraud risk analysis on the basis of our legitimate interest. Depending on the results, we may ask for supporting documents, or delay or cancel an order. You may object to this processing at any time under the conditions set out in section 7.

Data breach notification

In the event of a data breach likely to result in a high risk to your rights and freedoms, we undertake to inform you as soon as possible, in accordance with article 34 of the GDPR, and to notify the CNIL within 72 hours where required (art. 33 GDPR).

9. Social networks

The Site may contain social network plug‑ins (in particular Facebook, Instagram, Twitter/X, Pinterest, LinkedIn, etc.).

When you interact with these plug‑ins (for example by clicking "Like" or "Share"), the publisher of the social network concerned may collect information about your browsing and link it to your user account, in accordance with its own terms.

For some of these plug‑ins, FANAVENUE and the social network publisher may act as joint controllers within the meaning of article 26 of the GDPR, for the collection and transmission stage (CJEU, 29 July 2019, Fashion ID, C‑40/17). Beyond that stage, each publisher acts as an independent controller.

To find out how each social network uses your data, we invite you to read their respective privacy policies.

If you do not want your data to be transmitted to these social networks, we recommend that you:

do not interact with the plug‑ins present on the Site;
log out of your social network account before browsing the Site;
browse in private mode;
set your cookie preferences (see section 10).

10. Cookies and trackers

10.1 What is a cookie?

A cookie is a small text file placed on your device (computer, tablet, smartphone) when you visit a website. For as long as it remains valid, it makes it possible to identify your device on subsequent visits.

10.2 Cookies used on the Site

We use several categories of cookies:

Category	Purpose	Legal basis	Consent
Strictly necessary	Operation of the Site, security, basket, authentication	Legitimate interest	No
Audience measurement	Traffic statistics, improvement of the Site	Consent (unless exempted by the CNIL)	Yes, unless exempted
Functional	Storing your preferences (language, currency, etc.)	Consent	Yes
Advertising	Display of targeted advertising, advertising performance measurement	Consent	Yes
Social networks	Content sharing, social plug‑ins	Consent	Yes

10.3 Managing your consent

On your first visit to the Site, a banner allows you to accept, decline or fine‑tune non‑essential cookies. Declining is just as easy as accepting (CNIL recommendation).

You can change your choices at any time by clicking the "Manage cookies" link at the bottom of the Site.

Your consent or refusal remains valid for a maximum of 6 months, in accordance with the recommendations of the CNIL.

10.4 Configuring your browser

You can also configure your browser to refuse or delete cookies:

Google Chrome: support.google.com
Mozilla Firefox: support.mozilla.org
Safari: support.apple.com
Microsoft Edge: support.microsoft.com
Opera: help.opera.com

Please note: refusing certain cookies may affect how the Site works.

11. Personalised advertising

Subject to your express consent collected through the cookie banner, we may, based on your browsing data and purchase history, show you personalised advertising, on the Site and on other partner websites.

You can withdraw your consent at any time through the "Manage cookies" link at the bottom of the page, or directly from the advertising preference tools made available by the advertising networks concerned (for example youronlinechoices.eu).

12. Changes to this policy

This Policy may change in line with legal, case‑law or technical developments, or changes in our practices. The date of the last update appears at the top of the document. We invite you to review it regularly.

In the event of a substantial change, we will inform you by an appropriate means (information banner, email).

13. Contact

For any question relating to this policy or to the processing of your personal data:

FANAVENUE, Data Protection Department