Privacy Policy

Article 1 — Data controller

The controller is SAS Godé, a company with a simplified share capital of 375 800 €, RCS Saint-Quentin 449 160 902, with its head office located 15 bis, rue Augereau, 02420 Le Catelet, represented by Julien Godé.

For any questions concerning the protection of your data or the exercise of your rights: [email protected] or by mail to the address of the headquarters, specifying "Data protection". In view of the nature of its activity, SAS Godé is not required to appoint a Data Protection Officer (Article 37 GDPR); However, an internal focal point is responsible for these issues.

Article 2 — Treatments, purposes and legal bases

Order management and customer relationship — Purposes: processing, payment, preparation and delivery of orders; issue of payment confirmations and invoices; command tracking; after-sales service; management of returns, withdrawals and refunds. Legal basis: performance of contract (Art. 6.1.b GDPR) and compliance with legal accounting and tax obligations (Art. 6.1.c). Data: civility, surname, first name, corporate name, SIRET and intra-Community VAT number (professionals), billing and delivery addresses, country, e-mail, telephone, ordered products, amounts, promotional codes used, payment status (transaction identifier, last four digits and card mark, never full number), tracking number Colissimo, IP address and time stamping of the order.

Client account — Purposes: account creation and management, authentication, order history, address book, follow-up of warranty requests. Legal basis: performance of contract (art. 6.1.b). Data: identity, quality (individual or professional), SIRET and VAT where applicable, e-mail, password (preserved only in minced form), registered addresses, country, logbook.

Contact form and request for quotation — Purpose: processing and tracking your request. Legal basis: pre-contractual measures taken at your request (art. 6.1.b) or legitimate interest in responding to requests (art. 6.1.f). Data: name, company (optional), e-mail, telephone (optional), message object and content, IP address (anti-abuse).

Registration of the commercial guarantee 3 years — Purposes: verification of eligibility, issuance and electronic signature of the certificate, followed by interventions under guarantee. Legal basis: performance of the guarantee contract (art. 6.1.b) and legitimate interest in preventing fraud (art. 6.1.f). Data: identity, mailing address, country, e-mail, telephone (optional), device, serial number, reseller, billing date, invoice copy if applicable, status of application, processing note, signature request identifier and electronic signature audit log (time stamp, IP address, document footprint).

Commercial prospecting and newsletter — Purpose: sending product information, news and offers Godé. Legal basis: consent (art. 6.1.a GDPR and art. L34-5 of the Post and Electronic Communications Code) for individuals; legitimate interest for professional customers, with opposition at any time. Data: e-mail, name, purchase history. Each message has a unsubscribe link. No prospecting is carried out without the Customer being informed and able to oppose it.

Audience Measure — Purpose: aggregate attendance statistics to improve the site. Legal basis: consent (art. 82) Data: pages consulted, source, type of device and browser, truncated IP address. See the Cookie Management page.

Security and fraud prevention — Purposes: securing the site and API, limiting automated shipments, detecting fraudulent payments, keeping technical journals. Legal basis: legitimate interest (art. 6.1.f) and legal obligation to keep connection data (art. L34-1 CPCE and Decree No. 2021-1362). Data: IP addresses, timing, session identifiers, server logs.

Article 3 — Mandatory nature of information

The fields indicated as mandatory in the forms are necessary to execute your request or order; their absence prevents treatment. Other fields are optional. The intra-Community VAT number of traders established outside France is necessary to qualify for duty-free billing; it shall be verified with the VIES service of the European Commission.

Article 4 — Shelf life

Order data, confirmations of payment and invoices: kept for the duration of the commercial relationship and then archived ten years from the end of the financial year, under accounting obligation (article L123-22 of the Commercial Code) and fiscal obligation (article L102 B of the Tax Procedures Book). The data strictly necessary for proof of the contract concluded by electronic means for an amount greater than or equal to € 120 are retained ten years (article L213-1 of the Consumer Code and Decree No. 2005-137).

Customer account: during the duration of the account, then deletion after three years of inactivity (no connection or order), subject to the archiving of the above billing data. The Customer may request the deletion of his account at any time.

Guarantee registrations and certificates: duration of the commercial guarantee, increased by five years corresponding to the statutory limitation period (art. 2224 of the Civil Code); electronic signature audit logs are kept for the same period on a probationary basis.

Contact requests: time required for processing and then three years from the last exchange. Prospecting data: three years from the last contact from the prospect, or until the withdrawal of consent; professional clients: duration of the business relationship and then three years.

Payment data: the transaction identifier is kept with the order; no map data is stored by SAS Godé. The payment provider shall keep the data necessary for the management of claims and disputes for 13 months following the debit date (five months for deferred debit cards), in accordance with Article L133-24 of the Monetary and Financial Code.

Technical journals and IP addresses: 12 months. Audience measurement data: 13 months maximum for tracer, 25 months for aggregate statistics. Proof of consent or refusal of cookies: six months. At the end of these periods, data are irreversibly deleted or anonymized.

Article 5 — Recipients and subcontractors

The data are accessible to the authorized SAS Godé staff (sales administration, workshop, after-sales service, accounting) within their remit. They are never sold, leased or transferred to third parties for commercial purposes.

Subcontractors within the meaning of Article 28 GDPR, bound by contract and acting on instructions from SAS Godé: Association E-Cosplay, via its ENUM service (42 rue de Saint-Quentin, 02800 Beautor) — design, hosting and technical operation of the site on servers leased from OVH SAS (Roubaix, France); Amazon Web Services EMEA SARL — delivery of transactional emails via the Amazon SES service, Europe region (Paris); E-Cosplay e-sign — electronic signature and time stamping service for guarantee certificates, hosted in the European Union.

Recipients acting as independent controllers for the purposes of their own business: Lyra SAS Network (Systempay) and the Seller's bank — card processing, fraud control and 3-D Secure authentication; Poste SA (Colissimo) — delivery of parcels and follow-up notifications (name, delivery address, telephone and e-mail of the recipient); the accountant and, where appropriate, the administrative or judicial authorities authorised on request.

Article 6 — Transfers outside the European Union

Data are hosted and processed within the European Union. SAS Godé does not transfer data to a third country in the current operation of the site. If a provider were to carry out an ancillary transfer (technical support, safeguard), it would be governed by a European Commission adequacy decision or by standard contractual clauses adopted pursuant to Article 46.2c GDPR, the copy of which can be obtained on request at [email protected].

Article 7 — Security

SAS Godé implements the appropriate technical and organisational measures provided for in Article 32 of the GDPR: encryption of exchanges (TLS 1.2 and above, HSTS), storage of passwords in minced and salty form, session cookies signed and inaccessible to scripts (HttpOnly, SameSite), partitioning of administrative space, limitation of the flow of forms, logging of accesses, regular encrypted backups, updating of software components and staff awareness. Credit card data never transit through SAS servers Godé. In the event of a breach of data likely to create a high risk for your rights and freedoms, you will be informed of this under the terms of Article 34 of the GDPR.

Article 8 — Your rights

In accordance with articles 15 to 22 of the GDPR and articles 48 et seq. of the Information Technology Act, you have the following rights: right of access to your data and a copy thereof (art. 15); right to correct inaccurate or incomplete data (art. 16); the right to erasure in the cases provided for in Article 17, subject to legal conservation obligations; right to limitation of treatment (art. 18); right to portability of the data you have provided and processed on the basis of the contract or consent, in a structured, commonly used and machine-readable format (art. 20); right of opposition for reasons relating to your particular situation of treatment based on legitimate interest, and at any time and without reason to commercial prospecting (art. 21); The right to withdraw your consent at any time, without prejudice to the legality of prior treatment (art. 7.3).

In accordance with Article 85 of the Information Technology and Freedoms Act, you can define general or specific directives relating to the retention, erasure and disclosure of your data after your death, and designate a person responsible for their execution.

You can also register free of charge on the list of objections to the Bloctel telephone stall (www.bloctel.gouv.fr), in accordance with article L223-1 of the Consumer Code.

Article 9 — Procedure and claim

These rights are exercised by e-mail at [email protected] or by mail to SAS Godé, 15 bis, rue Augereau, 02420 Le Catelet, indicating your surname, first name, e-mail associated with the account or order number. In case of reasonable doubt about your identity, a copy of an identity document may be requested; It will be destroyed after verification. SAS Godé will reply to you within one month of receipt of the request, which may be extended by two months in view of the complexity or number of requests (Art. 12.3 GDPR). Client account holders can change their information and addresses directly and request the deletion of their account from the customer area.

If you feel, after contacting us, that your rights are not respected, you can file a complaint with the National Commission for Information Technology and Freedoms (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr (art. 77 GDPR), or refer the matter to the supervisory authority of your State of residence.

Article 10 — Minors

The site is for professionals and adults. Orders are reserved for adults with legal capacity. SAS Godé does not knowingly collect data on minors under the age of 15; legal representatives who would find such a collection can request the deletion at [email protected].

Article 11 — Automated decisions and profiling

No decision having legal effects or affecting you significantly is taken solely on the basis of automated processing (Art. 22 GDPR). Anti-fraud checks by the payment provider may lead to the refusal of a transaction; they are the responsibility of this provider and you can request human intervention by contacting your bank or [email protected].

Article 12 — Cookies and local storage

The use of cookies, local browser storage (basket, accessibility preferences) and audience measurement is detailed on the Cookie Management page, where you can change your choice at any time.

Article 13 — Update

This policy may be amended to reflect legal, technical or treatment developments. The applicable version is that published on this page, the date of which is at the foot of the page; any substantial modification of the purposes or recipients will be notified to you by e-mail if you have a customer account.