Skip to main content
Livraison express offerte dès 120 € · Retrait gratuit à Capens (31410) · Produits artisanaux du Sud-Ouest

Privacy policy

Last updated: 18 July 2026

Compliant with the GDPR (EU) 2016/679 and with the 2025-2026 recommendations of the CNIL, the French data protection authority.

1. Data controller

Stéphane LOUIS.
Maison Louis, SIRET: 90454054900022
9 bis rue des Vieilles Vignes, 31410 Capens, France
Contact: lemarchedeslouis@gmail.com

2. Data collected

We collect only the data that is strictly necessary (data minimisation principle, article 5 GDPR):

  • Order data: surname, first name, delivery and billing address, email, telephone
  • Connection data: truncated / pseudonymised IP address, browser, pages visited
  • Customer account data: credentials and order history where an account is created
  • Newsletter data: email, date and source of subscription, anonymised IP address, with explicit consent
  • Age verification: in accordance with article L.3342-1 of the French Public Health Code, the sale of alcoholic drinks to persons under 18 is prohibited. For any online order containing alcohol, we record the date and time of the age confirmation, a fingerprint of the IP address (pseudonymised SHA-256 hash), the network range (/24 for IPv4 or /64 for IPv6) and browser information (user agent)

3. Purposes and legal bases

PurposeLegal basis (GDPR)
Processing and tracking of ordersPerformance of the contract (art. 6.1.b)
Invoicing and accounting obligationsLegal obligation (art. 6.1.c)
Age verification (alcohol)Legal obligation (art. 6.1.c — French Public Health Code)
Identity verification of business customersLegal obligation (art. L561-12 — French Monetary and Financial Code) + performance of the contract (art. 6.1.b)
Management of the customer accountPerformance of the contract (art. 6.1.b)
Newsletter (sending news)Explicit consent (art. 6.1.a)
Anonymous browsing statisticsConsent (art. 6.1.a)
Responding to contact requests (“Information”, “After-sales”, “Press” and “Partnership” forms)Legitimate interest (art. 6.1.f) — replying to someone who writes to us
Preparing a quotationPre-contractual measures taken at the request of the data subject (art. 6.1.b)
Site securityLegitimate interest (art. 6.1.f)

4. Retention periods

  • Order and invoicing data: 10 years (accounting obligation)
  • Age verification data: 5 years, in line with the applicable criminal limitation period; data processed on the basis of compliance with a legal obligation (art. 6.1.c GDPR)
  • Identity verification data for business customers: at least 5 years after the end of the business relationship (art. L561-12 — French Monetary and Financial Code)
  • Contact and quotation requests: 3 years from the last exchange, then deleted
  • Active customer account: for the duration of the business relationship
  • Inactive customer account: deleted after 3 years without an order or a login
  • Newsletter: subscribers: duration of the subscription + 1 year; unsubscribed: 3 years
  • Connection logs: 12 months maximum
  • Analytics cookies: 13 months maximum

5. Recipients of the data

Your data is never sold or rented. Processors bound by contract (article 28 GDPR):

  • Payplug (BPCE Group – France): independent controller for payment data. Payplug privacy policy.
  • Transports BESSON (France): processing subcontractor for delivery data (surname, first name, delivery address, and -only if necessary and provided- email and telephone number).
  • La Poste – Colissimo (France) : processing subcontractor for delivery data (surname, first name, delivery address, and -only if necessary and provided- email and telephone number). La Poste – Colissimo Privacy Policy.
  • Aut O’Mattic A8C Ireland Ltd. / Automattic Inc. (Ireland / United States): site hosting. Transfers outside the EU are framed and certified under the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Transfers additionally benefit from the Standard Contractual Clauses (decision 2021/914) as a supplementary safeguard. DPA signed. automattic.com/privacy
  • Google LLC (United States): audience measurement with truncated / pseudonymised IP addresses via Google Analytics 4 before transmission, subject to your explicit agreement when choosing cookies. Transfers outside the EU are framed under the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Transfers additionally benefit from the Standard Contractual Clauses (decision 2021/914) as a supplementary safeguard. DPA signed. Google Ads Data Processing Terms

5a. Transfers of data outside the European Union

Our site is hosted by Automattic (United States). Automattic Inc. and Google LLC are certified under the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Transfers additionally benefit from the Standard Contractual Clauses (decision 2021/914) as a supplementary safeguard, which we have signed with Automattic in the form of a Data Processing Addendum (DPA). You may consult Automattic’s safeguards at automattic.com/privacy and the list of their sub-processors at automattic.com/subprocessor-list/.

6. Security (article 32 GDPR)

  • All your payments are secured and guaranteed by 3D Secure technology and two-factor authentication from your bank.
  • HTTPS/TLS encryption of communications
  • bcrypt hashing of passwords
  • Access to data restricted to authorised persons
  • Regular and secure backups

7. Your rights (articles 7 and 15 to 22 GDPR)

  • Right to withdraw consent (art. 7): withdraw your consent at any time for the newsletter (immediately, via the link at the bottom of each email, or from your account if you are a customer) or for analytics cookies (managed at the bottom of the site under Manage my cookies), without affecting the lawfulness of processing carried out before that withdrawal.
  • Right of access (art. 15): obtain confirmation that data concerning you is being processed, and receive a copy of it.
  • Right to rectification (art. 16): have inaccurate or incomplete data corrected.
  • Right to erasure (art. 17): request the deletion of your data (“right to be forgotten”), within the limits of statutory retention obligations.
  • Right to restriction of processing (art. 18): temporarily suspend the use of your data.
  • Right to data portability (art. 20): receive your data in a structured, commonly used and machine-readable format.
  • Right to object (art. 21): object to processing based on our legitimate interest, in particular for direct marketing purposes.
  • Right not to be subject to automated decision-making (art. 22): not to be subject to a decision based solely on automated processing (profiling) which produces legal effects or significantly affects you.

All customers may exercise their rights from a dedicated area within their account, available at the following link: My personal data.
Contact: lemarchedeslouis@gmail.com — Reply within 30 days.
If a complaint remains unresolved, you may refer the matter to the CNIL, the French data protection authority: www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

8. Cookies (CNIL recommendations 2024-2026)

Technical cookies set by the host

Our site is hosted on the WordPress.com infrastructure (Automattic Inc.). This infrastructure may set technical and internal measurement cookies (prefix “tk_”, domains stats.wp.com and pixel.wp.com) for its own operating, security and performance needs, acting as controller for those operations.
These trackers are independent of our own audience measurement tool (Google Analytics), which is itself subject to your prior consent.
Most recent browsers block these trackers automatically through their built-in anti-tracking protections.
Further information: automattic.com/privacy

Essential cookies (no consent required)

  • WordPress session, WooCommerce basket, security, consent preference

Analytics cookies (prior consent required)

  • Audience measurement with truncated / pseudonymised IP addresses — 13 months maximum

Marketing & functional cookies (prior consent required)

  • Google Maps, Google reviews, social media sharing — 13 months maximum

Refusing is as simple as accepting (CNIL recommendation). Preferences can be changed at any time via the link at the bottom of the page.

9. Data breaches (article 33 GDPR)

In the event of a breach likely to result in a risk to your rights, Maison Louis notifies the CNIL within 72 hours and informs you where the risk is high (article 34 GDPR).

10. Changes

This policy may be updated. In the event of a substantial change, customers who have consented to electronic communications will be informed by email.