Privacy Policy
Data Controller
Treelanks is the data controller for personal data collected through the website treelanks.com. We are committed to protecting your privacy and processing your personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and applicable French data protection law.
Data We Collect
We collect the following categories of personal data, depending on how you interact with our website:
| Category | Examples | Source |
|---|---|---|
| Identity data | First name, last name | Provided by you |
| Contact data | Email address, phone number, postal address | Provided by you |
| Order data | Products ordered, order history, transaction references | Generated on purchase |
| Payment data | Payment method, transaction status (no card numbers stored) | Payment processor |
| Technical data | IP address, browser type, device type, pages visited | Collected automatically |
| Communication data | Messages sent to us via email or contact form | Provided by you |
We do not collect sensitive data (such as health, racial or ethnic origin, or biometric data). We do not purchase personal data from third parties.
Purposes & Legal Basis
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling your order | Performance of a contract |
| Sending order confirmation and invoices | Performance of a contract |
| Managing returns, refunds and complaints | Performance of a contract |
| Complying with legal and tax obligations | Legal obligation |
| Preventing fraud and ensuring security | Legitimate interest |
| Improving the website and user experience | Legitimate interest |
| Sending marketing communications (if opted in) | Consent |
Where we rely on legitimate interest as our legal basis, we have assessed that our interests are not overridden by your rights and interests. You may object to this processing at any time (see § 7).
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
- Customer account and order data: 5 years from the end of the contractual relationship (French commercial law requirement).
- Accounting and invoice data: 10 years (French accounting law requirement).
- Marketing data: 3 years from your last interaction with Treelanks, or until you withdraw consent.
- Technical logs: 12 months.
After these periods, your data is securely deleted or anonymised.
Recipients & International Transfers
Your personal data may be shared with the following categories of recipients, strictly for the purposes described in § 3:
- Shopify Inc. — our e-commerce platform and order management system (servers in the United States and Europe). Shopify is certified under the EU–US Data Privacy Framework.
- Hostinger International Ltd. — our web hosting provider (Cyprus / EU).
- Shipping carriers — for the purpose of delivering your order (name and delivery address only).
- Payment processors — for the purpose of processing your payment (they are independent data controllers for their own processing).
- Legal and regulatory authorities — where required by applicable law.
We do not sell your personal data to third parties. Where data is transferred outside the European Economic Area, we ensure adequate safeguards are in place (standard contractual clauses or equivalent).
Cookies
Our website uses cookies and similar tracking technologies. Cookies are small text files placed on your device that allow us to recognise your browser and remember certain information.
We use the following types of cookies:
- Essential cookies: necessary for the website to function (shopping cart, session management). These cannot be disabled.
- Analytics cookies: help us understand how visitors use the site (pages visited, time spent). Used only with your consent.
- Marketing cookies: used to deliver relevant advertisements. Used only with your consent.
You can manage your cookie preferences at any time via the cookie banner on our website, or through your browser settings. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
Your Rights
Under the GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us at hello@treelanks.com. We will respond within 30 days. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).
Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include SSL/TLS encryption for data in transit, access controls, and regular security reviews.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and, where required, inform you directly without undue delay.
Minors
Our website is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at hello@treelanks.com and we will promptly delete it.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically.
For significant changes, we will notify you by email (if we hold your contact details) or by a prominent notice on the website.
Contact
For any question, request or complaint regarding the processing of your personal data: