Privacy Policy

Last update: July 29, 2026

The purpose of this Privacy Policy is toInform site users The English Shop (https://www.theenglishshop.fr)methods of collection and processing of their personal data, in accordance with the Regulation (EU) 2016/679 of April 27, 2016 (General Data Protection Regulation — GDPR) and Law No. 78-17 of January 6, 1978 Relative to thecomputer, files and freedoms, modified.

1. Responsible for processing

The person responsible for processing personal data is:

• S & D Clesinger
• Represented by Didier Clement
• Address: 103 rue Ganterie, 76000 Rouen, France
• Email: contact@theenglishshop.fr

2. Personal data collected

as part of theUse of The English Shop website and its services, the following categories of personal data may be collected:

• Last name and first name
• Email address
• telephone number
• Address
• Payment data (handled exclusively by PCI-DSS certified providers, not stored on our servers)

3. Purposes and legal basis of processing

in accordance withArticle 6 of the GDPR, each processing of personal data is based on a specific legal basis. The table below details the purposes, legal bases and applicable retention periods:

Purpose of the treatment	legal basis	Data concerned	shelf life
Technical operation of the site ensure proper operation, safety andTechnical site optimization	legitimate interest of the data controller (article 6.1.f GDPR)	IP address, connection data, browser type, pages viewed	1 year (connection logs) — 13 months maximum for measurement data daudience
Contact Request Management respond to requests frominformation sent via the contact form	Consent of the person (Article 6.1.a) or pre-contractual measures at the request of the person (article 6.1.b)	Last name, first name, email, phone, message content	3 years from the last contact (CNIL recommendation relating to prospect management)
Sending commercial communications (newsletter) sending dinformation, dnews and dOffers to registrants	explicit consent of the person (Article 6.1.a GDPR and Article L.34-5 of the CPCE)	Email, first name (if applicable), Statistics DOpening and clicking	tillupon withdrawal of consent (unsubscribe), then 3 years from unsubscribe
User account management Creation and administration of personal spaces, access management and preferences	Execution ofa contract to which the person is a party (Article 6.1.b GDPR)	Login identifiers, email, history ofAccount activity	5 years after the deletion of the account or the end of the contractual relationship (Civil law of common law)
Order management and billing Order processing, invoicing, delivery, after-sales service and accounting follow-up	Execution ofA contract (article 6.1.b) and legal obligation (article 6.1.c — Retention of accounting documents)	Identity, postal address, email, telephone, order history, billing data	5 years after the end of the contractual relationship — 10 years for accounting documents (article L.123-22 of the Commercial Code)
Comment management Publication and moderation of comments posted on the site	legitimate interest of the data controller (article 6.1.f GDPR)	Name or nickname, Email, Comment content, IP address	3 years from publication, or untilWith deletion request
measure dAudience and advertising follow-up analysis of site traffic, improvement ofuser experience and, where applicable, broadcasting targeted ads	explicit consent of the person (Article 6.1.a GDPR and article 82 of the Data Protection Act)	Cookie identifiers, browsing data, truncated IP address, advertising identifiers	13 months maximum from the filing of the cookie (CNIL recommendation of September 17, 2020)

4. Shelf life

Personal data is kept for the duration strictly necessary for the purposes for which it is processed, as indicated in the table above. Beyond these durations, the data is irreversibly deleted or anonymized.

Some data can be kept longer in the event ofLegal obligation:

• Billing and accounting data: 10 years from the end of theExercise (article L.123-22 of the Commercial Code);
• Contractual data: 5 years from the end of the contractual relationship (Civil law prescription, article 2224 of the Civil Code);
• Connection data (logs): 1 year (decree n°2011-219 of February 25, 2011).

5. Data recipients

The personal data collected is intended for the data controller and, where applicable, its subcontractors acting on its behalf and according to its instructions, in strict compliance with the GDPR.

The subcontractors currently involved in data processing are:

• O2Switch Sarl — Hosting of the site and data
• Active Trail — Management and sending of newsletters
• stripe — Secure processing of online payments
• Google LLC — Measurement ofAudience (Google Analytics), Tag Management (Google Tag Manager) and/or Advertising (Google Ads)

Each subcontractor is bound by a processing contract in accordance with theArticle 28 of the GDPR, guaranteeing the security and confidentiality of the data processed on behalf of the data controller.

No personal data nis assigned, sold or traded for commercial purposes with third parties unrelated to the purposes described in this policy.

6. Data security

The data controller implements all appropriate technical and organizational measures within the meaning of theArticle 32 of the GDPR to guarantee security, theintegrity and confidentiality of personal data, and in particular preventthey are deformed, damaged, or unauthorized third parties have access to them.

Measures include:

• encryption of data in transit (HTTPS/TLS protocol);
• regular data backups;
• Limiting access to data to authorized persons only;
• Regular updates to software and security systems.

7. Your rights

In accordance with Articles 15 to 22 of the GDPR and articles 48 to 56 of the Data Protection Act, you have the following rights over your personal data:

• right toaccess (Article 15 GDPR): Get confirmation that your data is processed and receive a copy in a structured format;
• Right of rectification (Article 16 GDPR): Have any inaccurate or incomplete data concerning you correct;
• right to theerasure (Article 17 GDPR): request the deletion of your data, under the conditions provided for by the regulations;
• Right to restriction of processing (Article 18 GDPR): Obtaining the limitation of the processing of your data in certain cases provided for by the GDPR;
• right toopposition (Article 21 GDPR): oppose the processing of your data for reasons relating to your particular situation, or oppose processing for commercial prospecting purposes;
• Right to portability (Article 20 GDPR): Receive the data you have provided in a structured, commonly used and machine-readable format;
• Right to withdraw consent : withdraw your consent at any time for processing based on this legal basis, without this calling into question the lawfulness of the processing carried out before the withdrawal;
• Right to set post-mortem directives : Define guidelines for conservation,erasure and communication of your data after your death (article 85 of the Data Protection Act).

To exercise theone of these rights, send your request accompanied byA proof ofIdentity to:

• Email: contact@theenglishshop.fr
• Mail: S & D Clesinger — 103 Rue Ganterie, 76000 Rouen, France

the controller sundertakes to respond to your request within a maximum period ofa month from its receipt, in accordance with theArticle 12.3 GDPR. This period may be extended by two additional months in case of complexity of the request.

8. Complaint to the CNIL

If you believe, after having contacted us, that your rights to your personal data are not respected, you have the possibility oflodge a complaint with the National Commission ofComputing and Freedoms (CNIL) :

• Address: 3, place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
• Phone: 01 53 73 22 22
• Website: www.cnil.fr