Privacy Policy
Last updated :
This privacy policy explains what personal data Sunnyshop211 collects on www.sunnyshop211.com, why we use it, who we share it with, how long we keep it and how you can exercise your rights.
1. Who is responsible for your data
The data controller is Sunnyshop211, a French sole trader established in 2017, which designs and sells handmade miniatures, furniture and dioramas for dolls. This policy covers www.sunnyshop211.com and its French, English, German and Spanish versions.
For any question about your personal data, write to [email protected]. Full details about the publisher of this website are available in our legal notice.
Given the size and nature of the business, Sunnyshop211 is not required to appoint a Data Protection Officer: requests are handled directly by the shop owner.
2. The data we collect
We only collect the data needed to run the shop. Depending on how you use the site:
- Orders: first and last name, email address, phone number, billing and shipping addresses, order contents and amount, parcel tracking number.
- Customer account: email address, encrypted password (or a single-use sign-in link), language, order history, wishlist, loyalty points.
- Payment: we never see or store your card number. It is entered directly with our payment provider. We only keep the transaction reference, amount, status and payment method type.
- Newsletter: your email address and the date you subscribed.
- Forms (contact, product question, custom order request): name, email address, the content of your message, and any images or reference links you choose to attach.
- Product reviews: display name, email address (never published), rating and review text.
- Sunny assistant: the content of the messages exchanged with the assistant, the language used, your IP address and, if you are signed in, your account identifier.
- Technical data: IP address, browser type, pages viewed, dates and times, recorded in server and delivery-network logs for security purposes.
- Audience measurement: only if you have consented (see the Cookies section).
- Pinterest measurement: after separate consent, page-visit, add-to-cart and purchase events, product identifiers, quantities, amounts and currency. Pinterest may also receive your IP address, browser/device information and cookie identifiers; this is not anonymous data.
We do not collect any special category data within the meaning of Article 9 GDPR (health, political or religious beliefs, sexual orientation, etc.) and we ask you not to send us any in your messages.
3. Why we use it and on what legal basis
- Processing your orders, issuing invoices, shipping parcels, handling returns and after-sales support — performance of the contract.
- Managing your customer account, wishlist and loyalty points — performance of the contract.
- Preparing and following up custom order quotes — performance of the contract or pre-contractual steps.
- Answering your messages and the questions you ask the Sunny assistant — legitimate interest in responding to our visitors and customers.
- Keeping accounting records and meeting our tax obligations — legal obligation.
- Sending you the newsletter — your consent, which you can withdraw at any time.
- Publishing your product reviews — your consent, given when you submit the review.
- Measuring site audience — your consent.
- Measuring conversions linked to Pinterest and enabling Pinterest marketing and personalisation uses — your separate consent.
- Securing the site, preventing fraud and limiting abuse and automated submissions — legitimate interest in protecting the shop and its customers.
No decision producing legal effects concerning you is taken on a solely automated basis. The Sunny assistant only provides information and can pass your request on to a human.
5. Who your data is shared with
We do not sell or rent your personal data. Depending on the service used and your consent choices, it may be received by the providers and partners below. Some act as processors; others, including payment services and Pinterest, may also process data for their own purposes described in their policies:
- Stripe and PayPal — processing card payments, wallets and payment buttons.
- Carriers and postal services (La Poste / Colissimo, Mondial Relay, international carriers) — delivering your parcels.
- Our hosting provider — dedicated server hosting the site and the database; Cloudflare — content delivery, filtering and attack protection.
- Our email delivery providers — transactional emails: order confirmation, sign-in link, gift card, replies to your requests.
- Intuit Mailchimp — sending the newsletter, if you are subscribed.
- Google — audience measurement, only if you have consented.
- Pinterest Europe Ltd. (Ireland) and Pinterest, Inc. (United States) — Pinterest conversion measurement and marketing uses, only after specific consent. This integration supplies no customer email address or phone number.
- DeepSeek — the artificial intelligence model that generates the Sunny assistant's answers. Only the messages you write in the chat and the technical context required are sent to it; never your payment data.
- Backblaze B2 — encrypted backups of the site and database.
Your data may also be disclosed to the competent administrative or judicial authorities where the law requires it.
6. Transfers outside the European Union
Some of our providers are established outside the European Union, in particular in the United States (Stripe, PayPal, Google, Cloudflare, Mailchimp, Backblaze) and in China (DeepSeek, for assistant conversations). These transfers are governed by the European Commission's Standard Contractual Clauses and, where applicable, by the EU–US Data Privacy Framework.
If you accept Pinterest, the data it receives may also be processed outside the European Union, including in the United States. Its privacy policy describes the applicable transfer mechanisms and safeguards stated by Pinterest.
If you would rather your messages were not processed outside the European Union, do not use the Sunny assistant and contact us directly by email instead: your request will be handled in exactly the same way.
7. How long we keep your data
- Orders, invoices and accounting records: 10 years from the end of the accounting year (legal obligation).
- Customer account: for the lifetime of the account, then 3 years after your last activity.
- Contact and custom quote requests: 3 years after the last exchange.
- Newsletter: until you unsubscribe, after which your address is removed from the mailing list.
- Product reviews: for as long as the review is published on the relevant product page.
- Sunny assistant conversations: 90 days, then automatically deleted.
- Single-use sign-in links: a few minutes, then they expire.
- Technical and security logs: 12 months maximum.
- Audience measurement: 14 months.
- Cookie choices: six months on your device. Retention periods for data received by Pinterest are described in its privacy policy; this six-month period is not a Pinterest data-retention period.
- Encrypted backups: rotating over the last 5 backups, older ones being overwritten.
8. Your rights
Under the General Data Protection Regulation and the French Data Protection Act, you have the following rights:
- Right of access: obtain a copy of the data we hold about you.
- Right to rectification: have inaccurate or incomplete data corrected.
- Right to erasure: request deletion of your data, subject to our legal retention obligations.
- Right to restriction of processing.
- Right to data portability: receive your data in a machine-readable format.
- Right to object, in particular to direct marketing.
- Right to withdraw your consent at any time, without affecting the lawfulness of processing already carried out.
- Right to give instructions on what happens to your data after your death.
To exercise these rights, write to [email protected] describing your request. We may ask for proof of identity if we have reasonable doubts about who you are. We reply within one month, extendable by two months for complex requests.
Every newsletter email contains a one-click unsubscribe link you can use without contacting us.
If you are not satisfied with our response, you may lodge a complaint with the French data protection authority (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr — or with the supervisory authority of your own country of residence.
9. Security
We apply appropriate technical and organisational measures:
- Encrypted connections to the site end to end (HTTPS / TLS).
- Passwords stored as hashes, never in plain text.
- Restricted, authenticated and logged administration access.
- Web application firewall, request rate limiting and anti-abuse protection.
- Encrypted, off-site backups.
- Payments handled by PCI-DSS certified providers: no card data ever passes through our servers.
No system is infallible. In the event of a data breach likely to result in a high risk to your rights and freedoms, we would inform you and notify the CNIL within the legally prescribed time limits.
10. Children
The site is aimed at an adult audience of collectors and makers. We do not knowingly collect data about children under 15 (the age of digital consent ranges from 13 to 16 across EU countries) without the consent of a holder of parental responsibility. If you believe a child has sent us data, please write to us and we will delete it.
12. Changes to this policy
We may update this policy to reflect changes to the site, to our providers or to applicable regulations. The version that applies is always the one published on this page, together with its update date. If we make a substantial change, we will inform you by an appropriate means.
13. Contact us
For any question about this policy or about how we process your personal data, write to [email protected]. We answer every request.
11. Social networks and third-party platforms
Sunnyshop211 has a presence on Pinterest, Instagram, YouTube and TikTok. Our links and share buttons are plain hyperlinks, with no tracker embedded in those buttons. Separately from these links, the Pinterest pixel described in the Cookies section may be enabled after your specific consent.
When you click a share or pin link, you leave our site: the platform concerned then processes your data under its own privacy policy, over which we have no control.
When we publish our own content on those platforms, including through their application programming interfaces (APIs), only information about our products and our shop is transmitted — never our customers' personal data.