Privacy Policy

1. Who is responsible for your data

The data controller is Sunnyshop211, a French sole trader established in 2017, which designs and sells handmade miniatures, furniture and dioramas for dolls. This policy covers www.sunnyshop211.com and its French, English, German and Spanish versions.

For any question about your personal data, write to [email protected]. Full details about the publisher of this website are available in our legal notice.

Given the size and nature of the business, Sunnyshop211 is not required to appoint a Data Protection Officer: requests are handled directly by the shop owner.

2. The data we collect

We only collect the data needed to run the shop. Depending on how you use the site:

• Orders: first and last name, email address, phone number, billing and shipping addresses, order contents and amount, parcel tracking number.
• Customer account: email address, encrypted password (or a single-use sign-in link), language, order history, wishlist, loyalty points.
• Payment: we never see or store your card number. It is entered directly with our payment provider. We only keep the transaction reference, amount, status and payment method type.
• Newsletter: your email address and the date you subscribed.
• Forms (contact, product question, custom order request): name, email address, the content of your message, and any images or reference links you choose to attach.
• Product reviews: display name, email address (never published), rating and review text.
• Sunny assistant: the content of the messages exchanged with the assistant, the language used, your IP address and, if you are signed in, your account identifier.
• Technical data: IP address, browser type, pages viewed, dates and times, recorded in server and delivery-network logs for security purposes.
• Audience measurement: only if you have consented (see the Cookies section).

We do not collect any special category data within the meaning of Article 9 GDPR (health, political or religious beliefs, sexual orientation, etc.) and we ask you not to send us any in your messages.

3. Why we use it and on what legal basis

• Processing your orders, issuing invoices, shipping parcels, handling returns and after-sales support — performance of the contract.
• Managing your customer account, wishlist and loyalty points — performance of the contract.
• Preparing and following up custom order quotes — performance of the contract or pre-contractual steps.
• Answering your messages and the questions you ask the Sunny assistant — legitimate interest in responding to our visitors and customers.
• Keeping accounting records and meeting our tax obligations — legal obligation.
• Sending you the newsletter — your consent, which you can withdraw at any time.
• Publishing your product reviews — your consent, given when you submit the review.
• Measuring site audience — your consent.
• Securing the site, preventing fraud and limiting abuse and automated submissions — legitimate interest in protecting the shop and its customers.

No decision producing legal effects concerning you is taken on a solely automated basis. The Sunny assistant only provides information and can pass your request on to a human.

4. Cookies and local storage

• Strictly necessary cookies: session, basket, security, and remembering your language and cookie choice. These do not require consent.
• Audience measurement (Google Analytics 4): these cookies are only set after your explicit acceptance. Without a stored consent, no measurement script is loaded; when it is, your IP address is anonymised.
• Browser local storage: your basket, wishlist and assistant conversation history (kept for 48 hours) are stored on your own device. You can clear them at any time by deleting the site data in your browser.

We use no advertising cookies, no social network tracking pixels and no third-party trackers for profiling or targeted advertising.

5. Who your data is shared with

We never sell, rent or trade your personal data. It is only passed to the providers required to run the service, who act as processors and are contractually bound to protect it:

• Stripe and PayPal — processing card payments, wallets and payment buttons.
• Carriers and postal services (La Poste / Colissimo, Mondial Relay, international carriers) — delivering your parcels.
• Our hosting provider — dedicated server hosting the site and the database; Cloudflare — content delivery, filtering and attack protection.
• Our email delivery providers — transactional emails: order confirmation, sign-in link, gift card, replies to your requests.
• Intuit Mailchimp — sending the newsletter, if you are subscribed.
• Google — audience measurement, only if you have consented.
• DeepSeek — the artificial intelligence model that generates the Sunny assistant's answers. Only the messages you write in the chat and the technical context required are sent to it; never your payment data.
• Backblaze B2 — encrypted backups of the site and database.

Your data may also be disclosed to the competent administrative or judicial authorities where the law requires it.

6. Transfers outside the European Union

Some of our providers are established outside the European Union, in particular in the United States (Stripe, PayPal, Google, Cloudflare, Mailchimp, Backblaze) and in China (DeepSeek, for assistant conversations). These transfers are governed by the European Commission's Standard Contractual Clauses and, where applicable, by the EU–US Data Privacy Framework.

If you would rather your messages were not processed outside the European Union, do not use the Sunny assistant and contact us directly by email instead: your request will be handled in exactly the same way.

7. How long we keep your data

• Orders, invoices and accounting records: 10 years from the end of the accounting year (legal obligation).
• Customer account: for the lifetime of the account, then 3 years after your last activity.
• Contact and custom quote requests: 3 years after the last exchange.
• Newsletter: until you unsubscribe, after which your address is removed from the mailing list.
• Product reviews: for as long as the review is published on the relevant product page.
• Sunny assistant conversations: 90 days, then automatically deleted.
• Single-use sign-in links: a few minutes, then they expire.
• Technical and security logs: 12 months maximum.
• Audience measurement: 14 months.
• Encrypted backups: rotating over the last 5 backups, older ones being overwritten.

8. Your rights

Under the General Data Protection Regulation and the French Data Protection Act, you have the following rights:

• Right of access: obtain a copy of the data we hold about you.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure: request deletion of your data, subject to our legal retention obligations.
• Right to restriction of processing.
• Right to data portability: receive your data in a machine-readable format.
• Right to object, in particular to direct marketing.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing already carried out.
• Right to give instructions on what happens to your data after your death.

To exercise these rights, write to [email protected] describing your request. We may ask for proof of identity if we have reasonable doubts about who you are. We reply within one month, extendable by two months for complex requests.

Every newsletter email contains a one-click unsubscribe link you can use without contacting us.

If you are not satisfied with our response, you may lodge a complaint with the French data protection authority (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr — or with the supervisory authority of your own country of residence.

9. Security

We apply appropriate technical and organisational measures:

• Encrypted connections to the site end to end (HTTPS / TLS).
• Passwords stored as hashes, never in plain text.
• Restricted, authenticated and logged administration access.
• Web application firewall, request rate limiting and anti-abuse protection.
• Encrypted, off-site backups.
• Payments handled by PCI-DSS certified providers: no card data ever passes through our servers.

No system is infallible. In the event of a data breach likely to result in a high risk to your rights and freedoms, we would inform you and notify the CNIL within the legally prescribed time limits.

10. Children

The site is aimed at an adult audience of collectors and makers. We do not knowingly collect data about children under 15 (the age of digital consent ranges from 13 to 16 across EU countries) without the consent of a holder of parental responsibility. If you believe a child has sent us data, please write to us and we will delete it.

11. Social networks and third-party platforms

Sunnyshop211 has a presence on Pinterest, Instagram, YouTube and TikTok. The links and share buttons on this site are plain hyperlinks: they load no script or pixel from those platforms on our pages and send them nothing until you click.

When you click a share or pin link, you leave our site: the platform concerned then processes your data under its own privacy policy, over which we have no control.

When we publish our own content on those platforms, including through their application programming interfaces (APIs), only information about our products and our shop is transmitted — never our customers' personal data.

12. Changes to this policy

We may update this policy to reflect changes to the site, to our providers or to applicable regulations. The version that applies is always the one published on this page, together with its update date. If we make a substantial change, we will inform you by an appropriate means.

13. Contact us

For any question about this policy or about how we process your personal data, write to [email protected]. We answer every request.