Privacy policy

putsch.org collects the bare minimum: no user accounts, no ad trackers, and no audience measurement without your explicit consent. This page describes what is actually processed, why, for how long, and your rights (EU Regulation 2016/679, GDPR, and the French Data Protection Act).

Data controller

NYWAL, a French SAS with a share capital of €100, Nanterre RCS 990 053 654, registered office at 6 square de l'Hippodrome, 92210 Saint-Cloud, France. Contact for any data matter: [email protected]. A data protection officer is not required given the processing carried out; the address above serves as the point of contact.

What is processed

Contact form : name, email address, subject and message. Purpose: answering your request. Legal basis: legitimate interest, or pre-contractual steps where your request concerns an order or a booking. Retention: 12 months after the last exchange. The form is relayed by FormSubmit (formsubmit.co), which delivers the message to our inbox without keeping it for other purposes.

Direct emails : same purposes and retention as the form.

Orders : identity, delivery and billing addresses, order history and payment details are collected on the Shopify-hosted checkout, with Shopify acting as processor. No banking data passes through or is stored on putsch.org. Purpose: performance of the sales contract. Retention: duration of the commercial relationship, then accounting records for the statutory periods (up to 10 years, art. L.123-22 of the French Commercial Code).

Cart : your cart contents are stored locally in your browser (localStorage). They are only sent to Shopify when you proceed to checkout, and never leave your device before that.

Language preference : your language choice is stored locally (localStorage, key « putsch-lang ») to serve you the right version of the site. It never leaves your device.

Both local storages are strictly necessary to the service you request: under the CNIL guidelines they are exempt from consent. Your audience-measurement choice is also stored locally (localStorage, key « putsch-consent ») so the question is not asked again on every page: remembering a refusal is exactly what the CNIL requires.

Analytics : Google Analytics 4 (Google Ireland Ltd), only after you agree. Until you accept, no measurement script is loaded and nothing is sent to Google: no cookie, no IP address, no page view. If you accept, Google sets its cookies (_ga, _ga_*) to build audience statistics. Legal basis: your consent (art. 6.1.a GDPR), valid for six months and revocable at any time through the « Cookies » button in the footer. Google keeps the data for 14 months; transfers outside the EU are covered by standard contractual clauses (art. 46 GDPR). Shopify checkout pages and third-party sites (Shotgun, Instagram, TikTok) set their own cookies on their own domains, under their own responsibility.

Recipients

Data is neither sold nor rented. It is only shared with the providers needed to serve you: Shopify (shop and payment), carriers (delivery), FormSubmit (form relay) and LibraHost (site hosting, which processes the technical connection logs needed to provide and secure the service). Each only accesses the data needed for its task.

Transfers outside the European Union

Shopify is established in Ireland and belongs to an international group: any transfers outside the EU are covered by the safeguards of article 46 GDPR (European Commission standard contractual clauses).

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data (GDPR, art. 15 to 22), and to set directives on what happens to it after your death (art. 85 of the French Data Protection Act). To exercise them: [email protected], stating the object of your request. Answer within one month.

You may lodge a complaint with the CNIL: www.cnil.fr, or CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Security

The site is served entirely over HTTPS. We never handle banking data ourselves: payment happens on a Shopify-secured page.