Privacy policy
Data controller
The data controller is SARL La ferme de la Ruchotte, La Ruchotte, 21360 Bligny-sur-Ouche, France, who can be contacted at boutique@laruchotte.com. The seller has not appointed a Data Protection Officer; any question about your data may be sent to the address above.
Data processed and purposes
| Purpose | Main data | Legal basis | Retention period |
|---|---|---|---|
| Order and delivery management | Identity, contact details, order, address, correspondence | Performance of the contract | Period needed to process the order, then archiving in line with legal obligations |
| Payment and fraud prevention | Transaction data, technical identifiers | Contract and legitimate interest | According to the provider’s retention periods and applicable obligations |
| Accounting and tax obligations | Invoices, identity, accounting history | Legal obligation | Applicable legal periods, generally ten years for accounting records |
| Customer service, returns and guarantees | Order, messages, supporting documents, photographs | Contract, legal obligation, legitimate interest | Duration of the request, then proportionate retention for evidence purposes |
| Marketing communications | E-mail, preferences, relevant history | Consent or legitimate interest, as applicable | Until consent is withdrawn or three years after the last contact, subject to applicable rules |
| Audience measurement and advertising | Cookies, IP address, identifiers, browsing data | Consent where required | According to the period stated in the cookie manager |
Mandatory data
Data marked as mandatory is necessary for ordering, payment or delivery. Without it, the seller may be unable to fulfil the order. Optional data is identified as such.
Recipients
Data is accessible to the seller’s authorised staff and, to the extent necessary, to its service providers: e-commerce platform, host, payment provider, carrier, customer service tools, accounting, e-mail, audience measurement and technical providers. These include: Shopify (e-commerce platform and website hosting), UPS (parcel delivery), Bouton Rétractation UE – 401layers UG, Germany (management of withdrawal requests).
Card payment data is processed by Shopify Payments, Shopify’s payment solution. The seller does not store full card details, unless an expressly described and compliant system is in place.
Transfers outside the European Economic Area
Some providers may process data outside the European Economic Area. In that case, the seller ensures that a recognised transfer mechanism is in place, such as an adequacy decision or standard contractual clauses, and makes the relevant information available on request. The seller uses service providers established in the European Union. Only Shopify, the e-commerce platform and website host, may process data in Canada, a country recognised by the European Commission as providing an adequate level of protection, and, where applicable, in other countries under standard contractual clauses adopted by the European Commission.
Your rights
Under the conditions laid down by the GDPR and the French Data Protection Act, anyone may request access to, rectification or erasure of their data, restriction of or objection to certain processing, and data portability where applicable. Consent may be withdrawn at any time, without affecting processing carried out beforehand.
Requests should be sent to boutique@laruchotte.com. Proof of identity may be requested only where necessary to prevent disclosure to a third party. Anyone may lodge a complaint with the CNIL (the French data protection authority) at www.cnil.fr.
Cookies and trackers
Trackers strictly necessary for the website to function may be placed without consent where the law allows. Non-exempt audience measurement, personalisation, advertising or social media trackers are placed only with consent. Refusing trackers is as easy as accepting them, and you can change your choice at any time using the “Manage cookies” link in the website footer.
The cookies placed by the Shopify platform, their purposes and retention periods are detailed in Shopify’s cookie policy, under “Merchant stores”.
Security and minors
The seller implements technical and organisational measures appropriate to the risk. The website is not specifically intended for children. Where processing based on consent concerns minors, the specific applicable rules are complied with.