Privacy Policy

This English version is provided for convenience. This policy is governed by the GDPR and French law and, in the event of any discrepancy, the French version prevails.

At Braza Scent, we take the protection of your personal data very seriously. This privacy policy explains how we collect, use and protect your information.

1. Data controller

The controller of your personal data is Braza Scent, which can be contacted at: contact@brazascent.com.

2. Data collected

We collect the following data:

• Identification data: last name, first name, email address, phone number
• Delivery data: postal address
• Transaction data: order history, amounts
• Browsing data: cookies, IP address, pages visited
• Account data: login credentials

3. Purposes of processing

Your data is collected for the following purposes:

• Managing and processing your orders
• Delivering products
• Managing your customer account
• Customer service and answering your requests
• Sending newsletters and promotional offers (with your consent)
• Improving our services and your user experience
• Complying with our legal and regulatory obligations

4. Legal basis for processing

The processing of your data is based on:

• Performance of the contract: to process and deliver your orders
• Your consent: to send marketing communications
• Our legitimate interest: to improve our services
• Our legal obligations: to retain billing data

5. Recipients of the data

Your data may be shared with:

• Our payment providers: Stripe, for secure payment processing
• Our carriers: to deliver your orders
• Our technical subcontractors: hosting (Vercel), database (Supabase)

These providers are bound by confidentiality obligations and may only use your data for the intended purposes.

6. Retention period

We keep your data for the following periods:

• Account data: as long as your account is active, then 3 years after the last activity
• Order data: 10 years for accounting and tax purposes
• Marketing data: 3 years from your last interaction
• Cookies: 13 months maximum

7. Your rights

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request the deletion of your data
• Right to restriction: restrict the processing of your data
• Right to data portability: receive your data in a structured format
• Right to object: object to the processing of your data
• Right to withdraw your consent: at any time for processing based on consent

To exercise these rights, contact us at: contact@brazascent.com

8. Cookies

Our website uses cookies for:

• Essential cookies: required for the website to work (cart, authentication, payment) — always active, they do not require your consent
• Analytics cookies: Google Analytics and PostHog (hosted in the European Union), to understand how you use our website — loaded only after your explicit consent
• Personalisation cookies: to remember your preferences
• Marketing cookies: the TikTok pixel, used to measure the effectiveness of our ads — loaded only after your explicit consent

On your first visit, a banner lets you accept or refuse marketing cookies (both choices carry the same weight). You can change your choice at any time via the "Manage cookies" link at the bottom of every page, or through your browser settings.

9. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration. Payments are secured by Stripe and communications are encrypted via HTTPS.

10. International transfers

Some of our providers may be located outside the European Union. In that case, we make sure appropriate safeguards are in place (standard contractual clauses, certification, etc.).

11. Changes

We may update this privacy policy. In the event of a substantial change, we will inform you by email or via a notice on our website.

12. Complaints

If you believe that the processing of your data does not comply with the regulations, you can lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority): www.cnil.fr.