Legal
Personal data
What we collect, why, for how long, and what you can require of us. Written to be checked line by line rather than skimmed.
Last updated 12 August 2026
Who is responsible
The controller for the processing described below is ECCLO, whose registered office and registration details are published on the legal notice page. Data protection questions may be addressed to support@ecclo.store.
What we process, and why
The table below is exhaustive for this site. We do not collect anything not listed, and each purpose has its own legal basis and its own retention period.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Fulfilling an order | Name, email, telephone, delivery address, order contents, order reference | Performance of the contract (art. 6.1.b GDPR) | Duration of the contract, then 5 years for commercial evidence; 10 years for accounting records |
| Customer service and complaints | Name, email, telephone, the content of your message, related order reference | Performance of the contract, and legitimate interest in answering enquiries (art. 6.1.b and 6.1.f) | 3 years from the last contact |
| Material enquiries | Name, email, the article asked about, the stated purpose, whether documentation is needed | Consent (art. 6.1.a) | 2 years from the last contact |
| Newsletter | Email address, date of consent | Consent (art. 6.1.a) | Until you unsubscribe, or 3 years without engagement |
| Customer reviews | Display name, rating, review text, purchase verification | Consent (art. 6.1.a) | 3 years from publication |
| Anonymous audience measurement | Page views, aggregated and not linked to an identifiable person | Consent (art. 6.1.a), refused by default | 13 months maximum |
What we do not do
- We do not sell, rent or exchange personal data with anyone.
- We do not profile customers or take automated decisions about them.
- We do not use advertising trackers or share identifiers with advertising networks.
- We do not require an account to buy, and we do not create one silently.
Who receives the data
Only staff who need it, and the processors required to run the service: the hosting provider, the carrier delivering your parcel, the payment provider configured for this storefront, and the email provider sending order and service messages. Each acts on documented instructions under article 28 of the GDPR.
Transfers outside the European Union
Hosting is provided by a company established in the United States. Where personal data is transferred outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision. You may request a copy of the guarantees in place at the address above.
Security
The site is served over HTTPS. Access to order data is restricted to the staff who process orders. No payment card details are collected or stored by this site at any point.
Your rights
Under the GDPR and the French Data Protection Act you have the right to:
- Right of access — obtain confirmation of what we hold about you, and a copy of it.
- Right to rectification — have inaccurate or incomplete data corrected.
- Right to erasure — have your data deleted where one of the grounds in article 17 applies.
- Right to restriction of processing — pause processing while a dispute about accuracy or lawfulness is resolved.
- Right to data portability — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller.
- Right to object — object to processing based on legitimate interest, on grounds relating to your particular situation.
- Right to withdraw consent — at any time, without affecting processing already carried out on that basis.
- Post-mortem instructions — give directions on what happens to your data after your death, as French law provides.
How to exercise them
Write to support@ecclo.store, or to ECCLO, 50 Rue de l'Egalité, 91590 D'Huison-Longueville, France. We answer within one month. Where a request is complex we may extend that by two months and will tell you why within the first month.
We may ask for proof of identity where there is genuine doubt about who is asking. We ask for no more than is needed to establish it.
Complaints
If you consider that your rights are not respected, you may lodge a complaint with the supervisory authority:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
https://www.cnil.fr
Cookies and local storage
What is stored in your browser, why, and how to change your choice is set out on the cookie page.