Privacy policy
Privacy policy
Last updated: 16 October 2026
This page explains which personal data we collect on boutique.vintage-bike-shop.com, why, how long we keep it, who receives it and how to exercise your rights under Regulation (EU) 2016/679 (GDPR).
1. Data controller
36 Rayons (Vintage Bike Shop), SAS, 3152 route des Pyrénées, 64290 Aubertin, France – SIREN 130 518 178.
Contact for any question about your data: contact@vintage-bike-shop.com.
2. What we collect, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing and delivering orders, after-sales service, returns | Name, delivery and billing addresses, e-mail, phone, order content | Performance of a contract (Art. 6(1)(b)) | Duration of the business relationship, then 5 years |
| Invoicing and accounting | Invoices, amounts, payment method used | Legal obligation (Art. 6(1)(c)) | 10 years (French Commercial Code) |
| Customer account | Login details, contact details, order history | Performance of a contract | Until the account is deleted, or 3 years after last activity |
| Online payment | Transaction data (card numbers are entered with the payment provider and never stored by us) | Performance of a contract | Duration of the transaction |
| Newsletter and offers | Consent (Art. 6(1)(a)), or legitimate interest for customers regarding similar products | Until you unsubscribe, or 3 years after your last contact | |
| Answering your messages | Name, e-mail, message | Legitimate interest (Art. 6(1)(f)) | 3 years after the last exchange |
| Audience measurement (anonymised statistics) | Pages viewed, device type, approximate origin | Consent, collected through the cookie banner | Cookies: 13 months maximum; your choice is asked again every 6 months |
| Website security and fraud prevention | IP address, technical logs | Legitimate interest | 12 months maximum |
3. Recipients and processors
Your data is never sold. It is only accessible to the Vintage Bike Shop team and to the providers who need it for their task:
- Hosting: Hetzner Online GmbH (Germany, EU).
- Website maintenance: La Refonte (France).
- Payment: PayPlug (France) for card payments; PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) if you choose PayPal.
- Delivery: La Poste / Colissimo and DPD France.
- Newsletter: Brevo (Sendinblue SAS, France).
- Statistics: Google Analytics (Google Ireland Ltd), only if you accept it in the cookie banner.
4. Transfers outside the European Union
The website is hosted in the EU. Some providers (PayPal, Google) belong to US groups and may transfer data to the United States. These transfers rely on the European Commission's adequacy decision of 10 July 2023 (EU-US Data Privacy Framework), to which these companies have signed up, and on the Commission's standard contractual clauses. You can ask us for a copy of these safeguards.
5. Cookies
The website uses strictly necessary cookies (cart, session, account login, remembering your cookie choice), which do not require consent. Audience measurement cookies (Google Analytics) are only set if you click "Accept" in the banner; "Continue without accepting" refuses them just as easily. You can change your mind at any time with the "Manage cookies" link at the bottom of every page.
6. Your rights
You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object (in particular to marketing, at any time and without giving reasons), as well as the right to withdraw your consent.
To exercise them, write to contact@vintage-bike-shop.com or to 36 Rayons, 3152 route des Pyrénées, 64290 Aubertin, France. In your customer account, the "My personal data" section also lets you download your data or request its deletion. Every newsletter contains an unsubscribe link. We reply within one month.
If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.
7. Security
The website is served over HTTPS only, passwords are encrypted, administrative access is restricted, and card numbers never pass through our servers.
8. Changes
This policy may change, for example when a new provider is added. The date of the last update appears at the top of the page.