Privacy Policy

Version in force as of 7 October 2026.

Data controller

Personal data collected on pebbles.lumiria.app (Galets shop) is processed by MENDING, SAS, SIREN 992364364, 60 rue françois 1er, 75008 Paris, as data controller, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés). Contact: [email protected].

Data collected

• Identity and contact details: surname, first name, e-mail address, telephone, delivery and billing addresses.
• Orders: products, amounts, order history, exchanges with customer service, withdrawal or return requests.
• Payment: the payment method used and its last four digits; full card details are collected directly by our provider Stripe and are never transmitted to us.
• Browsing: technical data (IP address, browser, pages viewed) and, with your consent, analytics and advertising cookies.

Purposes and legal bases

• Processing and delivering your order, managing payment, invoicing, parcel tracking, customer service, returns and guarantees: performance of the contract.
• Preventing payment fraud: legitimate interest.
• Keeping invoices and accounting records: legal obligation.
• Sending you offers by e-mail: consent, which can be withdrawn at any time via the unsubscribe link in each e-mail.
• Reminding you of an unfinished basket: consent or, depending on the shop's settings, legitimate interest, with the option to object in one click.
• Measuring audience and the effectiveness of our advertising, including by sending conversion information to Meta: consent collected via the cookie banner.

Recipients

Your data is intended for authorised staff of MENDING and our processors, limited to what they need:

• Stripe (payment, fraud prevention);
• Railway (platform hosting, servers in the European Union);
• Amazon Web Services (sending transactional e-mails, servers in Sweden);
• Cloudflare (site security and performance);
• our suppliers and their logistics providers, as well as carriers, for preparing and delivering your order;
• 17TRACK (parcel tracking);
• Meta Platforms, only if you have accepted advertising cookies.

Transfers outside the European Union

Some of our providers are established outside the European Union, notably in the United States. These transfers are governed by the European Commission's adequacy decision on the EU-US Data Privacy Framework where the provider participates in it, or otherwise by the European Commission's standard contractual clauses.

Your delivery name, address and telephone number are transmitted to our suppliers, some of whom are established outside the European Union, notably in China, solely for the purpose of preparing and shipping your order. This transfer is necessary for the performance of the contract you have concluded with us (Article 49(1)(b) GDPR) and is limited to data strictly necessary for delivery.

Retention periods

• Order and customer data: for the duration of the commercial relationship, then 5 years from the last order, in line with the limitation period for civil actions.
• Invoices and accounting records: 10 years (Article L.123-22 of the French Commercial Code).
• Marketing: 3 years from your last contact.
• Unfinished baskets: 30 days.
• Cookies: 13 months maximum; your choice is kept for 6 months.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time and to set instructions regarding your data after your death. To exercise these rights, write to [email protected] or to MENDING, 60 rue françois 1er, 75008 Paris. We respond within one month.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr).

Security

We implement appropriate technical and organisational measures to protect your data: encrypted communications (HTTPS), restricted individual access with two-factor authentication, encryption of secrets, and logging of actions.