⚠️ This English text is a translation provided for convenience. The French version is the authoritative one; in the event of any discrepancy, the French text prevails.

This page explains what personal data the DuvalFly shop collects, why, how long it is kept and what rights you have. It describes how the site actually works, not a boilerplate template.

One thing worth knowing up front: we store as little as possible. The site itself keeps no customer file. Orders live with Stripe, our payment provider, which is also our single source of truth on the matter.

1. Who is responsible for your data

The data controller is Smart Horizon SRL, which operates the DuvalFly shop. Its address, company number and full contact details are on the Legal notice page.

For any question about your data, or to exercise your rights: contact@duvalfly.com.

We have not appointed a data protection officer: the size of the business and the nature of the processing do not require one.

2. What we collect, in practice

When you place an order

Payment and the collection of your details are handled by Stripe, through its payment form embedded in our checkout page. Stripe collects and processes:

• your first and last name;
• your email address;
• your delivery and billing address;
• your telephone number, requested for delivery;
• the details of your order and the amount paid.

At checkout, Stripe collects the name, email address, delivery address and telephone number. The telephone number is needed by the carriers: Mondial Relay uses it to send an SMS when the parcel is ready at the pickup point.

What our content management system does not hold

The catalogue, the texts and the photographs on the site are managed in Sanity. That content is public by nature and holds no customer personal data: no name, no address, no email, no order history.

After a payment, our site receives a notification from Stripe and uses it solely to update stock levels and to mark the payment as already handled, so the same item is not deducted twice. That marker contains no information about you.

Your basket

The contents of your basket are stored in your own browser (local storage, key "boutique_panier_v1"). It is not sent to us and does not leave your device until you go to checkout. Clearing your browser data deletes it.

When you write to us

If you contact us by email or through a form on the site, we process the information you give us — name, email, the content of your message — in order to reply.

Messages sent from the contact form on the Site arrive in the contact@duvalfly.com mailbox. They do not pass through any third-party ticketing platform.

If you subscribe to the newsletter

[TO COMPLETE: the newsletter is not connected at this date — the form on the site is not linked to any provider. When it is, name the provider here (MailerLite, Brevo...), state that subscription rests on your consent, that it can be withdrawn at any time through the unsubscribe link, and specify the retention period. If no newsletter is planned, delete this section and remove the forms from the site.]

Technical data

Like any website, ours receives technical information needed to run and to stay secure: IP address, browser type, pages requested, date and time. This is processed by our host Cloudflare to deliver pages and protect us from abuse.

We use no analytics tool and no advertising cookie. We do not track you from one site to another.

The Site uses no analytics tool and sets no non-essential cookie: no consent banner is therefore displayed. If such a tool is added, this section will be updated and a banner put in place.

3. Why we process this data, and on what basis

• Processing, preparing and shipping your order, and answering you afterwards — legal basis: performance of the contract of sale.
• Issuing and keeping invoices, meeting our accounting and tax obligations — legal basis: a legal obligation.
• Preventing payment fraud and securing the site — legal basis: our legitimate interest, and that of Stripe.
• Sending you the newsletter, where applicable — legal basis: your consent, which you may withdraw at any time.

We take no automated decisions with legal consequences for you. We do no advertising profiling.

4. Who has access to your data

Only the providers needed to run the shop, each in their own role:

• Stripe — payment, collection of order details, invoicing;
• Cloudflare — hosting and delivery of the site;
• Sanity — content and catalogue management (no customer data);
• the carrier you chose — name and delivery address, to deliver the parcel;
• [TO COMPLETE: professional email provider used to receive and send the shop email];
• [TO COMPLETE: newsletter provider, once it is in place];
• the accountant of Smart Horizon SRL, who receives the sales invoices and Stripe payment statements, under accounting and tax obligations.

We do not sell, rent or exchange your data with anyone. It may be disclosed to an authority where the law requires it.

5. Transfers outside the European Union

Stripe and Cloudflare are American companies which may process data outside the European Union. These transfers are governed by the mechanisms provided for by the GDPR: standard contractual clauses approved by the European Commission and, where applicable, the EU–US Data Privacy Framework.

[TO COMPLETE: check in the Stripe and Cloudflare contracts which transfer mechanism actually applies, and state it precisely.]

6. How long we keep it

• Order and invoicing data: kept with Stripe for the period required by Belgian accounting obligations. 7 years.
• Emails and customer service requests: 3 years after the last exchange.
• Newsletter subscription: until you withdraw your consent, then deleted.
• Technical data held by the host: a short period, set by Cloudflare for its security and delivery needs.
• Basket: in your browser, until you clear it.

7. Your rights

The GDPR gives you the right:

• to access the data we hold about you;
• to have it corrected if it is inaccurate;
• to ask for its erasure, unless we must keep it under a legal obligation, such as an invoice;
• to ask for the restriction of a processing operation;
• to object to processing based on our legitimate interest;
• to receive your data in a reusable format (portability);
• to withdraw your consent at any time, for the newsletter.

To exercise these rights, write to us at contact@duvalfly.com. We reply within one month. We may ask you to confirm your identity, so as not to disclose your data to someone else.

8. Security

The site is served over HTTPS only. Payments are handled by Stripe, whose infrastructure is certified for processing card data. Access to our Stripe dashboard and to our content management tool is protected by named accounts.

No system is invulnerable. Should a security incident affect your data and present a risk to you, we would inform you and notify the data protection authority, as the GDPR requires.

9. If you believe we are not respecting your rights

Write to us first: most problems are settled in an exchange. You may also, at any time, lodge a complaint with the competent Belgian authority:

Data Protection Authority — Rue de la Presse 35, 1000 Brussels, Belgium — autoriteprotectiondonnees.be

If you live in another European Union country, you may also contact the data protection authority of your own country.

10. Changes to this page

We update this page when the site changes — a new tool, a new provider, a new purpose. The date of the last update is shown below.

Last updated: [TO COMPLETE: date — to be set on the day of publication]