Customer service:+33 (0)5 56 44 47 69
Excellent256 reviews

Legal

Privacy and cookies

Back to policies

This English version is provided for information only. In the event of any discrepancy, the French version prevails.

01

Data controller

Personal data collected on artetor-bordeaux.fr is processed by Sarl BGC (Art & Or), 55 rue Saint-James, 33000 Bordeaux, France, RCS Bordeaux 790 402 978, in accordance with Regulation (EU) 2016/679 (« GDPR ») and French law no. 78-17 of 6 January 1978 as amended (« Informatique et Libertés »).

For any question about your data: info@artetor-bordeaux.fr or by post to the address above. Art & Or is not required to appoint a data protection officer; this address is your single point of contact.

02

Data processed, purposes, legal bases and retention periods

We only collect the data needed for each purpose. Mandatory form fields are marked; without them, the request cannot be processed.

Customer account (creation, login, including with Google)

  • Data: Surname, first name, e-mail, telephone, addresses, encrypted password
  • Legal basis: Performance of the contract (art. 6.1.b GDPR)
  • Retention period: Until the account is deleted, which you can request at any time

Orders, delivery, invoicing and after-sales service

  • Data: Identity, contact details, addresses, products ordered, amounts, payment method used (never the card number)
  • Legal basis: Performance of the contract; legal obligation for invoices
  • Retention period: Accounting records: 10 years (article L123-22 of the French Commercial Code); customer file: 5 years after the last order (limitation period)

Payment and fraud prevention

  • Data: Payment data entered directly with the provider (CAWL, PayPal, Alma)
  • Legal basis: Performance of the contract; legitimate interest (fraud prevention)
  • Retention period: Kept by the payment provider according to its obligations; Art & Or neither receives nor stores the card number

Contact, appointment and valuation requests (website forms)

  • Data: Name, e-mail, telephone, message, jewellery reference
  • Legal basis: Pre-contractual measures at your request; legitimate interest in replying to you
  • Retention period: 3 years after the last exchange

Newsletter

  • Data: E-mail address
  • Legal basis: Consent (voluntary subscription)
  • Retention period: Until you unsubscribe (link in every e-mail or request by e-mail), and at most 3 years without interaction

Audience measurement, journeys, surveys and session recording (PostHog)

  • Data: Pages viewed, searches, clicks, steps of the purchase journey, device, approximate city, survey answers; internal customer identifier if logged in (never the name or e-mail); browsing recordings with inputs and personal data masked
  • Legal basis: Consent (cookie banner)
  • Retention period: Events: 25 months at most; browsing recordings: 30 days; cookie: 12 months

Grouping of visitors by interests (segments)

  • Data: Jewellery categories viewed, visit frequency, account age, order dates
  • Legal basis: Consent (cookie banner)
  • Retention period: Same as audience measurement. No automated decision with legal or similarly significant effect is taken on this basis (article 22 GDPR)

Detection and correction of technical errors (Sentry)

  • Data: Error message, page, browser, internal customer identifier if logged in; recording of the 60 seconds preceding the error only if you accepted cookies (texts and inputs masked)
  • Legal basis: Legitimate interest (proper functioning of the site); consent for the recording
  • Retention period: 30 days

Site security (technical logs)

  • Data: IP address, browser, page requested, date and time, result of the request; for administrator logins, country of connection (alert in the event of a login from abroad)
  • Legal basis: Legitimate interest (protecting the site and its users) and security obligation (art. 32 GDPR)
  • Retention period: 14 days; 1 year for security events (logins and refused attempts, partially masked e-mail; administrator actions; vulnerability scanning)

Anonymous internal statistics (sales, cookie banner choices, performance)

  • Data: Aggregated counters without identifier (number of orders, refused payments, "accept" or "refuse" answers)
  • Legal basis: Legitimate interest; no personal data
  • Retention period: 90 days
03

Recipients and transfers outside the European Union

Your data is accessible only to authorised staff of Sarl BGC and to the providers below, to the extent they need it, under a processing agreement (article 28 GDPR) or as separate controllers for their own obligations (payment). It is never sold or used for advertising purposes.

  • OVH SAS - Hosting of the site, the database and the logs. Location: France.
  • Cloudflare (R2 storage) - Hosting of product photos (no customer data). Location: European Union and United States (standard contractual clauses, Data Privacy Framework).
  • Resend - Sending of e-mails (order confirmation, password, replies) and newsletter list. Location: United States (standard contractual clauses, Data Privacy Framework).
  • CAWL (Crédit Agricole), PayPal Europe, Alma - Card payment, PayPal and instalment payment. Location: European Union.
  • Carrier chosen at checkout - Delivery of your parcel. Location: France / European Union.
  • Google - Login with a Google account (if you choose it); map and appointment booking (loaded only if you click). Location: European Union and United States (Data Privacy Framework).
  • PostHog - Audience measurement, session recording and surveys (with your consent). Location: European Union (Germany).
  • Sentry (Functional Software) - Detection of technical errors. Location: European Union (Germany).
  • Trustpilot - Display of the customer review rating (with your consent). Location: European Union (Denmark).

Where a provider processes data outside the European Union, the transfer is governed by an adequacy decision of the European Commission (Data Privacy Framework) or by standard contractual clauses, a copy of which is available on request.

04

Cookies and trackers

On your first visit, a banner lets you accept or refuse non-essential trackers, each as easily as the other. Until you have answered, none of them is set. You can change your mind at any time via the "Manage cookies" link at the bottom of every page; your choice is kept for 6 months. The map (Shops page) and the appointment calendar are provided by Google, which may set its own cookies when these pages are displayed.

  • artetor_consent - Remember your cookie choice. Duration: 6 months. Consent: Not required (strictly necessary).
  • _medusa_jwt, _medusa_cart_id, _medusa_cache_id, _medusa_pending_customer, _medusa_locale - Login to your account, cart, language and up-to-date display of the catalogue. Duration: 1 to 7 days (language: 1 year). Consent: Not required (strictly necessary).
  • ph_*_posthog - Audience measurement and session recording (PostHog). Duration: 12 months. Consent: Required.
  • Sentry local storage - Recording of the moments preceding an error. Duration: Session. Consent: Required.
  • Trustpilot cookies - Display of the rating widget. Duration: As per Trustpilot. Consent: Required.
  • Google cookies (NID…) - Google Maps (Shops page) and appointment calendar, set by Google when these pages are displayed. Duration: As per Google (up to 6 months). Consent: Set by Google.

If you refuse, the site remains fully usable. Only an anonymous counter records that the banner received a "refuse" answer (without cookie or identifier), so that we know what share of visitors our statistics represent.

05

Security

The site is served exclusively over HTTPS; passwords are encrypted; access to data is restricted to authorised persons and logged; payments are entered directly with our certified payment providers. In the event of a data breach presenting a risk to you, we notify the CNIL within 72 hours and, if necessary, the persons concerned.

06

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (in particular, at any time and without justification, to direct marketing), the right to withdraw your consent at any time, and the right to set directives on what happens to your data after your death.

To exercise them, write to info@artetor-bordeaux.fr. We reply within one month (extendable by two months for a complex request, with notice to you). Proof of identity will only be requested in the event of reasonable doubt about your identity.

If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France - www.cnil.fr.

You may also register free of charge on the Bloctel telephone marketing opt-out list (www.bloctel.gouv.fr).

07

Updates

This policy may change (new service, new provider). The online version is the only applicable one; last updated: 19 October 2026.