Privacy policy

Last updated: October 28, 2026

Data controller

The controller of the personal data collected on this site is:

  • Name: Julien Chopin, micro-entrepreneur (Les Krosmagouilles de Tankouille)
  • SIREN: 853488823
  • Address: 14 rue des Loisirs 51220 COURCY, France
  • Email: contact@krosmagouilles.fr

Data collected and purposes

Member area

When you create a member area by signing in with Google, Facebook or Discord, the following data is collected from these services:

  • Email address
  • Username / display name
  • Avatar (profile picture)

Your account also keeps the site language you have chosen, so that it is shown on your other devices and we can write to you in that language.

This data is used to identify your account and let you find your Krosmaster collection, favourites, cart and orders. No password is kept by the site. Your collection can be made visible through a share link (username and collection content); this setting is managed from your personal space.

Orders

When you place an order, the following are collected:

  • your surname, first name, postal address (home delivery) or chosen pickup point, country;
  • your phone number and contact email address, passed on to the carrier for tracking and delivery notices;
  • the content and amount of the order, the delivery method, the parcel tracking number;
  • the payment method used (card, Bancontact…) and the transaction reference;
  • the site language at the time of the order and the version of the terms and conditions of sale accepted;
  • where applicable, exchanges relating to a return or a refund.

This data is used to prepare, ship and track your order, issue the invoice, send you order-related emails (confirmation, shipment, availability at the pickup point, delivery, refund) and handle after-sales service. If you tick “Save these details”, they are kept on your account for your next orders; you can change or delete them at any time from “My account”.

Your bank details never pass through this site: they are entered directly in the secure form of Stripe, our payment provider, and are never shared with us.

If an order is not paid within the reservation period, a single reminder email may be sent to you the following day; it is not sent if you have paid or placed a new order in the meantime.

Reviews of your order (Google Customer Reviews)

After payment, the confirmation page offers you to leave a review with Google Customer Reviews. Nothing is sent to Google unless you click this button: the click opens Google's service, which asks for your consent. If you accept, Google receives your email address, the order reference, the delivery country and the estimated delivery date, and sends you an optional survey about your order after delivery. This processing is based on your consent; Google then processes this data under its own privacy policy.

Conversations with the shop

From “My conversations” in your personal space, you can ask a question (general, about an item, about an order) or request photos of the actual copies in your cart before ordering. The following are kept: your messages and our replies, the subject, the item or order concerned, the cart items covered by a photo request and the photos we send you. This data is used to reply to you; an email notifies you of each reply, and an email notifies us of each of your messages. A conversation with no response from you 7 days after our reply is closed, but remains viewable.

Newsletter and alerts

If you subscribe to the newsletter (with or without an account), only your email address is kept, with the date of your subscription and its confirmation. It is used only to send you the Krosmaster news, is never passed on to third parties, and each mailing contains a one-click unsubscribe link. The same applies to back-in-stock alerts for your favourites, which you turn on or off from your personal space.

Legal bases

  • Performance of the contract and pre-contractual measures (article 6.1.b of the GDPR): member area, collection, cart, conversations with the shop (questions, photos before ordering), order processing, delivery and tracking, after-sales service.
  • Legal obligation (article 6.1.c): invoicing and bookkeeping.
  • Consent (article 6.1.a): newsletter, back-in-stock alerts, saving your details to your account. You can withdraw it at any time.
  • Legitimate interest (article 6.1.f): reminder of an unpaid order, payment fraud prevention (provided by Stripe), site security.

Retention periods

  • Account (with the collection, favourites and cart): as long as your account exists. You can delete it yourself at any time, at the bottom of the “My account” page, or ask us by email.
  • Details saved to the account: until you delete them from “My account” or your account is deleted (if an order is linked to them, they stay with that order, see below).
  • Orders and invoices: 10 years from the end of the financial year (article L123-22 of the French Commercial Code), including the delivery and billing details they contain. This data is kept even if the account is deleted, but is then only used to meet this obligation and any guarantees.
  • Saved cart: until the order or the deletion of the account.
  • Conversations with the shop (messages and photos): as long as your account exists; they are deleted with it.
  • Newsletter and alerts: until you unsubscribe.
  • Login session: until it expires or you sign out.

Data recipients

The data collected is neither sold nor shared with third parties for commercial or advertising purposes. Only the following have access to it, as far as they are concerned:

  • OVH SAS (France): hosting of the site, database and images, sending of emails;
  • Stripe Payments Europe Ltd (Ireland): online payment, refunds and fraud prevention;
  • Mondial Relay (France): delivery of your parcel (name, address or pickup point, phone, email);
  • Google, Meta (Facebook) and Discord: sign-in providers, only if you use them to sign in;
  • Google (Google Customer Reviews): satisfaction survey after delivery, only if you accept it on the order confirmation page;
  • the authorised administrations (tax authorities, URSSAF), on request and within the scope of their duties.

Some of these providers (Discord, Google, Meta, Stripe) may process data outside the European Union, in particular in the United States. These transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

Your rights

In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights regarding your personal data:

  • Right of access to your data
  • Right to rectification
  • Right to erasure (“right to be forgotten”), within the limits of legal retention obligations
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw your consent at any time
  • Right to set guidelines for what happens to your data after your death

You can delete your account yourself at the bottom of the “My account” page. To exercise your other rights, or if you prefer to write to us, contact us at the following address: contact@krosmagouilles.fr. Your saved details and subscriptions can also be managed directly from “My account”.

We undertake to respond to your request within one month at most. If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the data protection authority of your country of residence in the European Union (list of authorities).

Security

Exchanges with the site are encrypted (HTTPS), access to the data is restricted to the operator and the providers listed above, and payment is entirely delegated to Stripe, which is PCI DSS certified.

Cookies and local storage

The site only uses trackers that are strictly necessary for it to work, which do not require prior consent:

  • a session cookie, which keeps you signed in to the member area;
  • a "language" cookie, which keeps the site language you have chosen for one year, and, if you are signed in, a cookie that matches this language with your account's;
  • your browser's local storage, which keeps your cart while you're not signed in, your latest item option choices and a few display preferences (sorting, card language); this data never leaves your browser;
  • on the payment page, cookies set by Stripe for transaction security and fraud prevention;
  • at the Delivery step, the pickup point selection map, provided by Mondial Relay.

On the order confirmation page, the Google Customer Reviews service is only loaded if you click the button that offers it; Google may then set or read its own cookies.

No analytics, advertising or marketing tracking cookies are used.

Contact

For any question about this privacy policy: contact@krosmagouilles.fr