Last update: September 24, 2026
This policy explains how Nuvipil, operated by Eva Millot, sole proprietorship, collects and processes personal data in the context of visiting the shop, orders, payment, delivery, customer service, returns, communications, and site security.
1. Data controller and contact
Eva Millot – Nuvipil
4 Place de la Mairie
30150 Roquemaure – France
SIRET: 108 497 298 00019
E-mail: contact@nuvipil.fr
For any questions regarding data protection or to exercise your rights, you may write to this email or postal address. Nuvipil has not appointed a Data Protection Officer to date; therefore, the point of contact is the data controller indicated above.
2. Legal framework
Processing is carried out in accordance with Regulation (EU) 2016/679 of April 27, 2016 ("GDPR"), the amended French Act no. 78-17 of January 6, 1978 known as the "Data Protection Act" ("Informatique et Libertés"), as well as French rules applicable to electronic communications, prospecting, and cookies or other trackers.
3. Data that may be collected
Depending on your use of the shop and the services requested, the following categories may be processed:
- Identity and contact details: surname, first name, postal address, delivery and billing address, email address, and, when provided or necessary, telephone number;
- Order data: ordered products, variants, quantities, prices, discounts, date, order number, order status, delivery information, returns, refunds, and warranties;
- Payment and transaction data: payment method, status, and transaction references necessary for payment tracking. Full bank card details are processed by payment service providers and are not intended to be stored directly by Nuvipil;
- Customer account data: information and preferences linked to the account when an account is created;
- Communications: content of messages sent to customer service, withdrawal requests, complaints, and documents voluntarily transmitted;
- Technical and browsing data: IP address, information regarding the browser and terminal, technical logs, pages visited, and data collected by cookies or similar technologies;
- Preferences: choices regarding cookies and, when used, prospecting or commercial communications;
- Security data: information necessary for fraud prevention, securing the site, and incident management.
Nuvipil does not request sensitive data within the meaning of Article 9 of the GDPR for the sale of its products. You are asked not to spontaneously transmit such information in contact forms.
4. Purposes and legal bases
| Purpose | Main legal basis |
|---|---|
| Responding to a request before purchase | Pre-contractual measures taken at your request |
| Taking, paying for, preparing, shipping, and tracking an order | Performance of the contract |
| Managing returns, refunds, withdrawals, and warranties | Performance of the contract and legal obligations |
| Managing customer service and complaints | Performance of the contract and legitimate interest in managing the customer relationship, depending on the nature of the request |
| Issuing and keeping accounting and tax documents | Legal obligation |
| Preventing fraud, ensuring site security, and defending rights | Legitimate interest, subject to the rights and freedoms of individuals |
| Sending commercial communications when consent is required | Consent |
| Offering a customer similar products or services when the law allows it | Legitimate interest, with a simple and free right to object |
| Placing or reading non-strictly necessary cookies/trackers | Consent when legally required |
| Responding to requests to exercise rights or to competent authorities | Legal obligation |
5. Mandatory and optional data
Information identified as necessary for the order, payment, or delivery is mandatory for the performance of the contract. If it is not provided, the order may not be able to be processed. Information collected for optional purposes, including certain cookies or commercial communications, does not condition the ability to purchase.
6. Data sources
Data primarily comes from you when you place an order, create an account, fill out a form, exercise a right, or contact Nuvipil. Certain technical data is collected automatically when using the site. Information may also be received from service providers involved in payment, shipping, delivery, fraud prevention, or the operation of Shopify, to the extent necessary for their services.
7. Recipients and processors
Data is only shared with persons or service providers who need it for their mission and within the necessary limits. Depending on the service used, this may include in particular:
- Shopify, which provides the e-commerce platform and certain associated technical functions;
- payment service providers actually offered during checkout;
- DSers and, in the context of fulfilling a dropshipping order, the supplier responsible for preparing the product and the necessary logistics providers;
- carriers and delivery service providers;
- the messaging service provider used for professional communications, including Zoho if this service is enabled;
- technical, security, or support providers strictly necessary for the operation of the shop;
- professional advisors, courts, administrations, or competent authorities when required by law or when communication is necessary for the establishment, exercise, or defense of a legal claim.
Suppliers or logistics companies responsible for shipping an order do not need to receive the Client's full payment data.
8. Shopify and visitor data
The shop operates on Shopify. Depending on the features used, Shopify processes data to provide its services to the merchant and may carry out certain processing operations under its own responsibility. Data subjects may consult the privacy information published by Shopify to understand these processing operations.
9. Transfers outside the European Economic Area
Certain technical, payment, logistics, or order fulfillment providers may process data in countries located outside the European Economic Area. When a transfer is subject to Chapter V of the GDPR, it must rely on an appropriate legal mechanism, such as a European Commission adequacy decision, standard contractual clauses accompanied, if necessary, by supplementary measures, or another mechanism provided for by the GDPR.
Data transmitted for shipment is limited to that necessary to identify the recipient, prepare and route the order, and ensure its tracking.
10. Retention periods
Nuvipil does not retain data longer than necessary for its purpose, subject to legal archiving obligations and the timeframes necessary for the exercise or defense of legal claims.
- Orders and customer relations: retention in the active database for the duration necessary for processing the order and after-sales service, then intermediate archiving when necessary for compliance with a legal obligation or the defense of a legal claim;
- Accounting documents and supporting documents: retention for the applicable legal durations, in particular ten years for the accounting documents concerned;
- Prospecting to a lead: in principle, up to three years from the collection or the last contact from the lead, unless objection or withdrawal of consent occurs sooner;
- Prospecting to a customer: during the commercial relationship and then, in principle, up to three years after its end for this purpose, subject to the right to object;
- Requests to exercise rights: for the duration necessary to process the request and provide proof of its processing, according to applicable obligations;
- Choices regarding cookies: for a proportionate duration; the CNIL generally recommends a duration of six months before requesting a choice again, subject to a change requiring new consent.
11. Cookies and other trackers
The shop uses cookies and similar technologies. Some trackers are strictly necessary for the operation of the service or for a feature expressly requested, in particular for security, the shopping cart, authentication, or the ordering process. When they meet the legal conditions for exemption, they are not subject to consent.
Trackers that are not strictly necessary, including those used for personalization, non-exempt analysis, or marketing, must only be placed or read after consent has been obtained when it is required.
11.1 Consent management
For users subject to French and European rules, the cookie management device must allow accepting or refusing optional trackers with an equivalent degree of simplicity and personalizing choices when management by purpose is offered.
Silence or simply continuing to browse does not constitute consent. Consent can be withdrawn at any time as easily as it was given. Refusing optional cookies must not prevent access to the essential functions of the shop.
11.2 Categories of trackers
- Necessary: security, shopping cart, authentication, preferences essential to the service, and operation of payment;
- Preferences: memorization of choices intended to personalize the experience when they are not strictly necessary;
- Analysis and audience measurement: understanding site usage when the conditions for an exemption are not met;
- Marketing: attribution, measurement, or advertising personalization when such a feature is used.
Any cookies or pixels added by a third-party application or service must also respect the choices expressed in the consent manager.
12. Commercial prospecting
Messages necessary for the fulfillment of an order, delivery, security, or a Client request are transactional communications. They do not, by themselves, constitute registration for promotional communications.
When consent is necessary to send electronic prospecting, it results from a free and positive choice. A pre-ticked box or solely accepting the T&Cs does not constitute consent. Every commercial communication must allow for simple and free objection or unsubscription.
13. Security and data breaches
Nuvipil implements technical and organizational measures adapted to the risks in order to protect data against unauthorized access, loss, alteration, or unlawful disclosure. Service providers are also required to apply the measures incumbent upon them.
In the event of a personal data breach, Nuvipil applies the obligations of documentation, notification to the CNIL in cases where the GDPR requires it and, when high risk justifies it, notification of the concerned individuals.
14. Your rights
Under the conditions provided for by the GDPR and the Data Protection Act, you may have the following rights:
- right of access to your data and to obtain a copy;
- right to rectification of inaccurate or incomplete data;
- right to erasure in cases provided for by the regulations;
- right to restriction of processing;
- right to object, in particular at any time to commercial prospecting;
- right to portability when the conditions for this right are met;
- right to withdraw consent at any time, without calling into question the lawfulness of the processing carried out before this withdrawal.
To exercise your rights, write to contact@nuvipil.fr or to Nuvipil – Eva Millot, 4 Place de la Mairie, 30150 Roquemaure, France. An identity document is only requested when there is reasonable doubt regarding the identity of the requester and to the extent necessary for this verification.
Nuvipil responds within the timeframes provided for by the regulations. Some data may be retained despite a request for erasure when a legal obligation or legal ground requires it.
15. Complaint to the CNIL
If you consider, after having contacted Nuvipil, that your rights are not respected, you may file a complaint with the Commission nationale de l'informatique et des libertés (CNIL), in particular via its website www.cnil.fr/fr/plaintes.
16. Minors
The shop is not specifically intended for children. Nuvipil does not seek to knowingly collect personal data from children that would not be necessary for an order validly placed under the conditions provided for by law. When a minor's consent is used as a legal basis for a service directly offered to them, the specific applicable French rules are respected.
17. Guidelines regarding data after death
Under the conditions provided for by the Data Protection Act, any person may define guidelines regarding the retention, erasure, and communication of their personal data after their death.
18. Automated decision-making and profiling
Nuvipil does not take, on its own initiative, any decision producing legal effects or similarly and significantly affecting a Client based solely on fully automated processing. Some payment or fraud prevention service providers may nevertheless use their own automated mechanisms in accordance with their terms and privacy policies.
19. Policy update
This policy may be modified to take into account changes to the shop, service providers, processing, or regulations. The date of the last update appears at the top of the document. When a change requires new information or new consent, the necessary measures are taken before the processing concerned.