Privacy policy

This policy explains what personal data we process when you visit the Trovenza shop or place an order there, why, for how long and with whom we share it, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

Data controller

2THEMOON, SASU, 5 rue Frédéric Mistral, 84360 Lauris, France (RCS Avignon 894 993 807). Email: contact@trovenza.shop.

The data we process

Orders and delivery

• Data: email address, name, country, product ordered, amount, order date and number; for a digital product, the date and time of your consent to immediate download (proof that you waived your right of withdrawal); for a physical product, the delivery address and phone number.
• Purposes: recording and fulfilling the order, letting you download the file or delivering it to you, sending you emails about the order, and handling refunds, complaints and guarantees.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR) and, for accounting records, our legal obligations (Article 6(1)(c)).
• Retention: order data and accounting records, 10 years from the end of the financial year (Article L123-22 of the French Commercial Code); email address, 5 years after your last order (limitation period, Article 2224 of the French Civil Code). The delivery address and phone number are not copied into our database: they remain with Stripe and are passed on to our supplier for shipping.

Payment

Payment is processed by Stripe. You enter your card details directly on Stripe's payment page: we never have access to them and receive only the payment result and the order information. Stripe also processes certain data on its own behalf, in particular to prevent fraud and comply with its legal obligations, as described in its own privacy policy.

Order notifications to the seller

For each important event (sale, shipment, refund, payment dispute), an automatic message is sent to the seller via the Telegram messaging app so that the order can be handled without delay. This message contains at most the order number, the product, the amount, the country and, for a dispute, its reason; never your name, email address, postal address or phone number. Legal basis: our legitimate interest in handling orders promptly. Retention: 12 months at most.

Measuring product page performance (A/B testing)

To find out which layout of a product page works best, we show each visitor one of its versions, chosen at random, and count how many visitors view the page or click the buy button. This is strictly statistical audience measurement, for our own use only.

To do this, the page stores in your browser's local storage (localStorage) a random identifier (“ab:sid”), the version assigned for each product page (“ab:<product>:<language>”) and the date these items were created (“ab:ts”). This information is never renewed when you come back and is deleted 13 months after it was created; a version is then assigned to you again on your next visit.

Your browser then sends us events (product page view, click on the buy button), each made up of this identifier, the version seen and the type of event, to which we add the date. We do not record your IP address, your browser or any other personal data with them, and we do not combine them with any other processing: the identifier is never sent to Stripe or linked to an order. If you make a purchase, the sale is counted for the page version you saw, as a separate entry that does not contain your identifier. This data is used solely to produce statistics per page version: it is not used for advertising and is not shared with any ad network or social network.

Legal basis: our legitimate interest in improving our pages (Article 6(1)(f) GDPR). This anonymous audience measurement, limited to our own statistics, is exempt from consent under Article 82 of the French Data Protection Act (loi Informatique et Libertés) and the CNIL's guidelines on cookies and other trackers, which is why the shop shows no cookie banner. Retention: events are deleted after 13 months; the data stored in your browser lasts 13 months at most and is not extended at each visit.

You can refuse this measurement at any time, with no effect on your browsing or your purchases, using the button below. Your choice is remembered in your browser (“ab:off”) until you undo it or clear the site's data, and your identifier is deleted. Once you have refused, no event is sent and your purchases are not attributed to any page version. You can also delete this data at any time in your browser settings (site data or local storage); this also removes your refusal.

Hosting and security

To display the website and protect it against abuse, our host Cloudflare processes your IP address and technical connection data (browser, page requested, date and time). Legal basis: our legitimate interest in providing a secure and available website. Cloudflare keeps this data for a limited period, in accordance with its own rules.

Communications with us

If you write to us, we use your contact details and the content of your messages to reply to you and handle your request. Legal basis: performance of the contract or our legitimate interest in responding to requests. Retention: 3 years after our last exchange.

We do not use your data for direct marketing and we do not sell it.

Recipients and service providers

Your data is accessible to the seller and, as far as is relevant to each of them, to the following recipients:

• Cloudflare, Inc. (United States): website hosting and security;
• Supabase, Inc. (United States): database and file storage, on servers located in the European Union (Ireland);
• Stripe (Stripe Payments Europe, Limited, Ireland): online payment;
• Telegram: messaging service for order notifications to the seller, without your contact details;
• the email service provider we use to send you emails about your order;
• for a physical product: our supplier, which uses the AliExpress platform (Alibaba Group), and its carrier, which receive your name, delivery address and phone number to prepare and deliver the parcel;
• our accountant and, on request, the authorities entitled to receive it (tax authorities, courts), as part of our legal obligations.

Transfers outside the European Union

Cloudflare, Supabase and Stripe belong to groups established in the United States, where data may be accessible. These transfers are governed by the European Commission's standard contractual clauses and, for certified companies, by the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

Telegram and AliExpress process data outside the European Union. For a physical product, passing your delivery details to our supplier is necessary for the performance of the contract you have concluded with us (Article 49(1)(b) GDPR).

Your rights

You have the right to access, rectify and erase your data and to data portability, the right to restriction of processing and the right to object to processing based on our legitimate interest. You can also give instructions on what should happen to your data after your death.

To exercise these rights, write to us at contact@trovenza.shop or by post to 2THEMOON, 5 rue Frédéric Mistral, 84360 Lauris, France. We will reply within one month.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the data protection authority in your country of residence.

Cookies and local storage

• The shop uses no advertising cookies, no third-party analytics tools and no social media buttons. Fonts and images are served by our own website.
• Only the A/B test described above stores information in your browser (local storage “ab:sid”, “ab:<product>:<language>” and “ab:ts” for 13 months at most, plus “ab:off” if you refuse the measurement). This anonymous audience measurement is exempt from consent, so the shop shows no cookie banner.
• The payment page is hosted by Stripe on its own domain: Stripe uses its own cookies there, in particular to secure the payment and prevent fraud.
• Our host Cloudflare may set a technical cookie that is strictly necessary to protect the website against malicious bots.
• The website's administration area uses session cookies reserved for the seller; they do not concern visitors to the shop.

Security

The website is served over HTTPS (encrypted connection), access to the database is restricted to the seller and protected, and we do not keep any card details.

Changes

We may update this policy to reflect changes to the shop or to the regulations; the date of the last update is shown at the top of the page. See also our legal notice.