Last updated: 30 October 2026
SOUVENIRS ET COMPAGNIE (Souvenirs & Co), as data controller, is committed to protecting the privacy of users of its website souvenirs-paris.com, in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and the French Data Protection Act.
1. Data controller
SOUVENIRS ET COMPAGNIE, SARL
314 chemin des Fourches, 83310 Cogolin, France
Fréjus Trade and Companies Register (RCS) 500 173 554
Contact: [email protected]
2. Data we collect
Depending on how you use the website, we collect:
- Account and orders: last name, first name, email address, postal address, phone number;
- Payment: card details are processed exclusively by our payment providers (Stripe, PayPal) and are never stored on our servers;
- Browsing: IP address, browser type, pages visited (audience measurement subject to your consent);
- Contact form: email address, content of the message;
- Newsletter: email address.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Processing orders and deliveries | Performance of the contract |
| Creating and managing your customer account | Performance of the contract |
| Sending the newsletter | Consent |
| Audience measurement (Google Analytics) | Consent (cookie banner) |
| Protecting forms against bots (Google reCAPTCHA) | Legitimate interest |
| Website security and availability (Cloudflare) | Legitimate interest |
| Answering contact requests | Legitimate interest |
| Legal obligations (invoicing, accounting) | Legal obligation |
4. Retention periods
- Customer data: 3 years after the last order or contact;
- Invoices and accounting records: 10 years;
- Cookies and trackers: 13 months maximum;
- Contact requests: 1 year after the request is closed;
- Newsletter: until you unsubscribe.
5. Cookies and trackers
On your first visit, a banner lets you accept or refuse cookies that are not strictly necessary:
- Strictly necessary cookies: session, cart, language and website security; they do not require consent;
- Audience measurement: Google Analytics, enabled only if you accept it.
You can change your choices at any time with the cookie icon at the bottom right of the screen.
6. Recipients of the data
Your data is only shared with the providers needed for our services:
- Stripe and PayPal: payment;
- Colissimo (La Poste) and FedEx: delivery;
- OVH: website hosting, in France;
- Cloudflare: website delivery and security;
- Google: audience measurement (with your consent) and form protection (reCAPTCHA).
We never sell or rent your personal data.
7. Transfers outside the European Union
Some providers (Google, Stripe, PayPal, Cloudflare, FedEx) may process data outside the European Union, in particular in the United States. These transfers are covered by the EU–U.S. Data Privacy Framework or by the European Commission’s standard contractual clauses.
8. Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time, and the right to give instructions on what happens to your data after your death.
To exercise these rights, write to [email protected]. We reply within one month. You can also lodge a complaint with the French data protection authority (CNIL): www.cnil.fr.
9. Security
We take appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), restricted access, hosting in France and strong payment authentication (3D Secure).
10. Changes to this policy
This policy may be updated; the date of the last change is shown at the top of the page.