Article 1 – DATA COLLECTED

Depending on how you use the Site, we may collect the following categories of data:

1.1 Data You Provide to Us Directly

• Identification information: last name, first name, mailing address, email address, phone number
• Order details: description of the products ordered, customization options (engraving, metal, size, gemstones), shipping address, billing address
• Payment information: payment method used (banking information is processed directly by our secure payment service providers and is never stored by THEA JEWELRY)
• Communication data: messages sent via the contact form or by email to hello@thea-jewelry.com
• Preference data: newsletter subscription, communication preferences

1.2 Data Collected Automatically

• Browsing data: IP address, browser type, operating system, pages visited, duration of visit, traffic source
• Cookie and tracker data: see Article 5 below

Article 2 – PURPOSES AND LEGAL BASES FOR DATA PROCESSING

Your personal data is processed for the following purposes, based on the legal basis indicated:

2.1 Performance of the Contract (Art. 6.1.b of the GDPR)

• Order Processing and Tracking
• Delivery Management and Package Tracking
• Management of After-Sales Service (ASS), Warranties, and Returns
• Billing and Accounting Records

2.2 Legitimate Interest (Art. 6.1.f of the GDPR)

• Improving the User Experience on the Website
• Statistical Analysis of Audience and Browsing Behavior
• Fraud Prevention and Transaction Security
• Customer Review Management

2.3 Consent (Art. 6.1.a of the GDPR)

• Sending marketing communications and newsletters (Brevo)
• Placement of advertising and tracking cookies (Meta Pixel, Google Ads, TikTok Pixel)
• Placement of social media cookies (Instagram, Facebook, Pinterest, LinkedIn)

2.4 Legal Obligation (Art. 6.1.c of the GDPR)

• Retention of Transaction Data for Accounting and Tax Purposes
• Notification to the Competent Authorities Regarding a Court Order

Article 3 – RETENTION PERIODS

Your data is retained for the period strictly necessary to fulfill the purposes for which it was collected, in compliance with legal obligations:

• Customer account data: duration of the business relationship plus 3 years from the date of the last purchase or contact
• Order and billing data: 10 years from the end of the fiscal year (legal requirement)
• Browsing data and cookies: up to 13 months from the date of storage (CNIL recommendation)
• Sales prospecting data (newsletter): 3 years from the last contact or until consent is withdrawn
• After-sales service and claims data: applicable warranty period + statutory limitation period

At the end of these periods, your data will be permanently deleted or anonymized.

Article 4 – DATA RECIPIENTS AND PROCESSORS

THEA JEWELRY does not sell your personal data to third parties. Your data may be shared with the following categories of recipients, strictly for the purposes specified:

4.1 Payment Service Providers

Stripe — Secure Processing of Credit Card Payments | https://stripe.com/fr/privacy

PayPal — PayPal Payment Processing | https://www.paypal.com/fr/legalhub/privacy-full

Alma — Payment in installments | https://getalma.eu/privacy

Bancontact — Bancontact Payment Processing | https://www.bancontact.com/fr/privacy-policy

4.2 Delivery Providers

Colissimo (La Poste) — Shipping and Package Tracking in France | https://www.laposte.fr/donnees-personnelles

Bpost — Shipping and Package Tracking in Belgium | https://www.bpost.be/fr/politique-de-confidentialite

DHL — International Shipping and Package Tracking | https://www.dhl.com/fr-fr/home/notre-division/protection-des-donnees.html

4.3 Email Marketing

Brevo (formerly Sendinblue) — Newsletter and Transactional Email Management | https://www.brevo.com/fr/politique-de-confidentialite/

4.4 Analysis and Publicity

Google Analytics — Web Analytics and Browsing Behavior Analysis | https://policies.google.com/privacy

Google Ads — Targeted Advertising | https://policies.google.com/privacy

Meta Pixel (Facebook/Instagram) — Conversion Tracking and Targeted Advertising | https://www.facebook.com/privacy/policy/

TikTok Pixel — Conversion Tracking and Targeted Advertising | https://www.tiktok.com/legal/page/eea/privacy-policy/fr

4.5 Social Media

Instagram / Facebook / Pinterest / LinkedIn — Share buttons and built-in features | The respective privacy policies of each platform

4.6 Customer Reviews

THEA JEWELRY may use a third-party service to collect customer reviews. The data transmitted is limited to the information necessary to verify the purchase (email address, order number). The service provider will be specified when the feature goes live.

All of our subcontractors are contractually obligated to ensure the confidentiality and security of your data, in accordance with Article 28 of the GDPR.

Article 5 – COOKIES AND TRACKERS

5.1 Definition

A cookie is a small text file stored on your device (computer, smartphone, tablet) when you visit the Site. It is used to store information about your browsing activity.

5.2 Types of Cookies

The Site uses the following categories of cookies:

• Strictly necessary cookies: essential for the Site to function (shopping cart management, session management, security). No consent required.
• Audience measurement cookies (Google Analytics): These cookies are used to analyze website traffic and improve the Site. They require prior consent.
• Advertising cookies (Meta Pixel, Google Ads, TikTok Pixel): used to track conversions and deliver personalized ads. Requires prior consent.
• Social media cookies (Instagram, Facebook, Pinterest, LinkedIn): enable the integration of sharing features. Subject to prior consent.

5.3 Cookie Retention Period

Cookies that require consent are stored for a maximum of 13 months from the date they are set, in accordance with the CNIL's recommendations.

5.4 Managing Your Preferences

During your first visit, a banner will prompt you to set your cookie preferences. You can change your preferences at any time by clicking the «Cookie Settings» link at the bottom of the Site, or by configuring your browser. Declining non-essential cookies does not affect your ability to browse the Site or place an order.

Article 6 – YOUR RIGHTS

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:

• Right of access (Art. 15 of the GDPR): to obtain confirmation that personal data concerning you is being processed and to obtain a copy of it
• Right to Rectification (Art. 16 of the GDPR): Having Inaccurate or Incomplete Data Corrected
• Right to erasure (Art. 17 of the GDPR): Request the deletion of your data, subject to legal retention requirements
• Right to Restriction of Processing (Art. 18 of the GDPR): Request the Temporary Suspension of the Processing of Your Data
• Right to data portability (Art. 20 of the GDPR): to receive your data in a structured, machine-readable format
• Right to Object (Art. 21 of the GDPR): You may object at any time to the processing of your data for marketing purposes.
• Right to withdraw consent: You may withdraw your consent at any time for processing activities based on your consent, without this affecting the lawfulness of processing carried out prior to such withdrawal.
• Right to Establish Post-Mortem Directives: Specify the conditions for the retention and disclosure of your data after your death

6.1 How to Exercise Your Rights

To exercise your rights, please send your request by email to hello@thea-jewelry.com or by mail to: MAISON CANALI – 188 route d’Eyguières – 13200 ARLES, and include a copy of a valid form of identification.

We are committed to responding to you within a maximum of one (1) month from the date we receive your request. This timeframe may be extended to three (3) months in the case of complex or voluminous requests, with notification provided within one month.

6.2 Right to File a Complaint

If you believe that the processing of your personal data does not comply with applicable regulations, you have the right to file a complaint with the competent supervisory authority:

National Commission for Information Technology and Civil Liberties (CNIL)

3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07

www.cnil.fr | Phone: +33 1 53 73 22 22

Article 7 – DATA SECURITY

THEA JEWELRY implements appropriate technical and organizational measures to ensure the security, confidentiality, and integrity of your personal data, in particular to protect it against loss, alteration, unauthorized disclosure, or unauthorized access.

Payment transactions are secured using encryption protocols (SSL/TLS). Banking information is never stored on our servers and is processed exclusively by our PCI-DSS-certified payment service providers.

In the event of a data breach that could pose a high risk to your rights and freedoms, THEA JEWELRY is committed to notifying you as soon as possible, in accordance with Article 34 of the GDPR.

Article 8 – TRANSFERS OUTSIDE THE EUROPEAN UNION

Some of our service providers (including Google, Meta, and TikTok) may process your data outside the European Union. In such cases, THEA JEWELRY ensures that these transfers are governed by appropriate safeguards (standard contractual clauses approved by the European Commission, recognized certification mechanisms), in accordance with Chapter V of the GDPR.

You can view the privacy policies of each service provider via the links listed in Section 4 of this policy.

Article 9 – MINORS

The thea-jewelry.com website is intended for an adult audience. THEA JEWELRY does not knowingly collect personal data from individuals under the age of 16 without the prior consent of their parents or legal guardians. If you believe that a minor has provided us with personal data without authorization, please contact us at hello@thea-jewelry.com

Article 10 – CHANGES TO THIS POLICY

THEA JEWELRY reserves the right to modify this Privacy Policy at any time, in particular to comply with any regulatory, legal, or editorial changes. The current version is the one published on the Website, along with its update date. In the event of a substantial change, users subscribed to the newsletter will be notified by email.

Article 11 – CONTACT

If you have any questions regarding this Privacy Policy or the processing of your personal data:

Email: hello@thea-jewelry.com

Address: THEA JEWELRY – 188 Route d’Eyguières – 13200 ARLES – France