Privacy policy

1. Data controller

The data controller is MEDITERRA NÉGOCE & SERVICES (CherlyPrints), an EURL registered with the Paris Trade and Companies Register under number 131 637 019, 231 rue Saint-Honoré, 75001 Paris, France — contact@cherlyprints.com.

We have not appointed a data protection officer (it is not required for our business). For any question about your data: contact@cherlyprints.com.

2. Data we collect

Data you give us:

• Identity and contact: first name, last name, email address, phone number (order)
• Address: delivery address; address saved in your account if you enter one
• Account: password (stored with irreversible encryption), dates of sign-up, last login and email confirmation
• Order: contents, amounts, shipping costs, promo code, language, status, tracking number, date you accepted the terms of sale (no right of withdrawal for personalised products)
• Photos you send to make your magnets, with their quantity and orientation
• Messages you send us by email

Data collected while you browse:

• Cart identifier: a random identifier, in a cookie, to find your cart if you have no account
• Technical data: IP address and connection data, used for security and abuse prevention, and recorded in the server logs
• Visitor statistics: pages viewed (without the parameters or identifiers in their address), referring site, browser and device type, screen resolution, pseudonymous visitor identifier, truncated IP address, collected by Matomo
• Advertising, if you accept it: cookie identifiers, pages viewed and purchases (number and amount), collected by Google Ads
• Google Customer Reviews, if you accept it: order number, email address, delivery country and estimated delivery date, sent to Google on the order confirmation page; Google only sends you the survey if you accept it in its window

Data we receive from third parties:

• Stripe: payment status and transaction identifier
• Mapbox: standardised address (street, city, postcode, country) matching the suggestion you choose

If you send photos showing other people, you confirm that you have their consent. We only use these photos to make your magnets.

3. Why we use your data and for how long

4. Required data

The fields requested to order (email, first name, last name, phone, delivery address) and to create an account (first name, last name, email, password) are required: without them we cannot make or deliver your order, or create your account. Your phone number is only used by the carrier and to reach you if there is a delivery problem. Creating an account is optional: you can order without one.

5. Who can access your data

Your data is only accessible to the publisher (MEDITERRA NÉGOCE & SERVICES) and to the providers who help us run the service, limited to what they need:

We do not sell your data. It may be disclosed to the authorities where the law requires it.

6. Transfers outside the European Union

Some providers may process data outside the European Union. These transfers are safeguarded:

• Stripe, LLC, Mapbox, Inc. and Google LLC (USA): European Commission adequacy decision (EU-US Data Privacy Framework), these companies being certified
• Cloudflare, Inc. (USA; possible access, your photos being stored in Europe): EU-US Data Privacy Framework and the standard contractual clauses of its data processing agreement
• Zoho (possible access from outside the EU for support): European Commission standard contractual clauses in its data processing agreement
• InnoCraft Ltd (New Zealand; your browsing data is hosted in the European Union): European Commission adequacy decision (decision 2013/65/EU)

You can get a copy of these safeguards by writing to contact@cherlyprints.com.

7. Security and automatic deletion

The site is served over HTTPS. Passwords are stored with irreversible encryption. Your session is kept in cookies that page scripts cannot read. Your photos are stored in a private space and only shown through temporary one-hour links. Administration is restricted to the publisher. Sensitive requests (sign-up, forgotten password) are rate-limited.

These deletions are automatic:

• photos of an order, 30 days after delivery and at most 90 days after the order;
• customisations never ordered (drafts, items left in the cart) and their photos, after 30 days without activity;
• accounts without login or order for 3 years, and accounts never confirmed after 30 days;
• orders and invoices, 10 years after the end of the financial year.

8. Automated decisions

We make no decision producing legal effects concerning you based solely on automated processing, and we do no profiling.

9. Your rights

You have the following rights over your data:

• access: get a copy of your data;
• rectification: correct inaccurate data;
• erasure: ask us to delete your data, except what we must keep (invoices);
• restriction: temporarily freeze the use of your data;
• objection to processing based on our legitimate interest, for example visitor statistics, directly from the cookie policy;
• portability: receive the data you gave us in a machine-readable format;
• withdrawal of consent, at any time, without affecting what was done before;
• post-mortem instructions: decide what happens to your data after your death (French Data Protection Act, art. 85).

From your account, under "My information", you can view and edit your name and address, download your data as JSON and delete your account. If you ordered without an account, or for any other request, write to contact@cherlyprints.com from the email address used for the order. We reply within one month and may ask you to prove your identity if we have reasonable doubts.

If you think your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr/plaintes), or with the authority of your country.

10. Cookies

The cookies and other trackers used on the Site, and how to manage your choices, are described in our cookie policy.

11. Changes

We may change this policy to reflect changes to the Site or to the law. The date of the last update is shown at the top of the page. If there is a significant change, we will tell you on the Site or by email.