Privacy policy

This policy explains what personal data Wafmiou collects when you visit wafmiou.com, create an account or place an order. It says why, how long we keep the data and how to use your rights. It follows Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 ("Informatique et Libertés").

1. Data controller

Eden Wisniewski, sole trader, trading as Wafmiou
67 impasse de Mareins, 46160 Carayac, France
SIRET 891 716 953 00049
Email: contact@wafmiou.com – Telephone: 07 69 64 73 92

Wafmiou has not appointed a data protection officer. For any question about your data, write to contact@wafmiou.com.

2. Data we collect

  • Identity and contact details: surname, first name, delivery and billing addresses, email, telephone.
  • Orders: products bought, amounts, payment method used (without the card number), order history, returns and refunds.
  • Customer account: login details, saved addresses, preferences.
  • Communication with us: messages sent by email, by telephone or through the contact form.
  • Browsing: IP address, type of device and browser, pages viewed, products added to the basket, collected through cookies and similar technologies (see article 7).

The required fields of the order are needed to process and deliver it: without them, the order cannot be completed. Bank details are entered directly with our payment provider; Wafmiou never has access to them.

3. Purposes, legal bases and retention periods

  • Process, ship and follow your order; manage returns, refunds and guarantees: performance of the contract. Retention: 5 years from the order (limitation period).
  • Answer your requests and complaints: performance of the contract or legitimate interest. Retention: 5 years for a request linked to an order; 3 years after the last exchange for a simple question.
  • Keep the accounts and store invoices: legal obligation. Retention: 10 years (article L123-22 of the Commercial Code).
  • Manage your customer account: performance of the contract. Retention: until the account is deleted, or 3 years after your last activity.
  • Send you our newsletter and offers by email: consent. Retention: until you unsubscribe, and 3 years at most after your last contact with us.
  • Secure payments and prevent fraud: legitimate interest. Retention: the time needed to process the order, extended in case of a dispute until it is resolved.
  • Measure the audience of the site and show personalised ads: consent (cookie banner). Retention: 13 months at most for cookies.
  • Answer your requests to use your rights: legal obligation. Retention: the time needed to handle the request, then 5 years as proof.

4. Recipients

Your data is intended for Wafmiou and is never sold. It is passed on, only as far as needed, to:

  • Shopify (Shopify International Limited, Dublin, Ireland), which hosts the shop and processes data on our behalf;
  • our payment providers, to pay for the order and to fight fraud;
  • our logistics partner Hertwill (Estonia, EU) and the brand that ships your order from its workshop or warehouse, and their carriers: name, delivery address, telephone and contents of the order, for delivery only;
  • our email tools, for the emails linked to your order and, if you have signed up, the newsletter;
  • Google, only if you accept the audience measurement or advertising cookies;
  • administrative or judicial authorities, when the law requires it.

5. Shopify

The shop runs on Shopify. For some features (for example Shop Pay or the Shop app), Shopify may process some of your data as a separate controller. To find out more and to use your rights with Shopify, see Shopify's privacy policy for consumers and the Shopify privacy portal.

6. Transfers outside the European Union

Some providers, such as Shopify Inc. (Canada) or Google LLC (United States), may access data from a country outside the European Union. These transfers are covered by an adequacy decision of the European Commission (Canada; companies certified under the EU–US Data Privacy Framework) or, if there is none, by the standard contractual clauses of the European Commission. You can get a copy by writing to us.

7. Cookies

  • Strictly necessary cookies (basket, account login, security, remembering your cookie choice): they are needed for the site to work and are set without consent.
  • Audience measurement and advertising cookies: they are only set after you agree, through the banner shown on your first visit. Refusing is as easy as accepting, and refusing does not stop you from using the site.

These cookies are kept for 13 months at most. You can withdraw your consent at any time by deleting the cookies in your browser (the banner will then be shown to you again) or by writing to us at contact@wafmiou.com.

8. Your rights

You have the following rights over your data:

  • right of access, rectification and erasure;
  • right to restriction of processing;
  • right to object, in particular at any time and without giving a reason to direct marketing (an unsubscribe link is in every email);
  • right to portability of the data you have given us;
  • right to withdraw your consent at any time, without affecting the processing already carried out;
  • right to set directions about what happens to your data after your death.

To use them, write to contact@wafmiou.com or to Wafmiou, 67 impasse de Mareins, 46160 Carayac, France. We reply within one month. This period may be extended by two months for a complex request; we will tell you if that happens. If we have reasonable doubt about your identity, we may ask you for proof of it.

If you think your rights are not respected, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

9. Minors

The site is for adults. We do not knowingly collect data about minors under 15. If you think a minor has given us data, write to us and we will delete it.

10. Security

The site is available over HTTPS. Access to data is limited to the people who need it, and our providers must keep it confidential. No security measure is perfect, so we advise you to choose a strong password and not to share it.

11. Changes

We may change this policy to reflect changes in our services or in the rules. The date of the last update is at the bottom of the page; if there is an important change, we will tell you by a suitable means.

Last updated: 22 October 2026