BijouxLune SAS is the data controller responsible for the processing of your personal data.

Registered Address: [Adresse], France · SIRET: [Numéro SIRET]

Data Protection Officer (DPO): [Nom du DPO] · dpo@bijouxlune.com

This Privacy Policy is established in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation — GDPR) and French Law No. 78-17 of 6 January 1978 (Informatique et Libertés), as amended.

Identity Data: First name, last name, date of birth (optional).

Contact Data: Email address, postal address, telephone number.

Transaction Data: Order history, payment method (card type only — we do not store full card numbers), delivery address.

Technical Data: IP address, browser type, operating system, pages visited, cookies (see Section 9).

Communication Data: Customer service correspondence, newsletter preferences.

Contract performance (Art. 6(1)(b) GDPR): Processing orders, managing your account, providing customer service, handling returns and refunds.

Legal obligation (Art. 6(1)(c) GDPR): Compliance with tax, accounting, and consumer protection regulations.

Legitimate interest (Art. 6(1)(f) GDPR): Fraud prevention, website security and improvement, internal analytics.

Consent (Art. 6(1)(a) GDPR): Marketing communications, non-essential cookies, third-party analytics. You may withdraw consent at any time.

Your data may be shared with the following categories of recipients, exclusively for the purposes described above:

• Payment processors (PCI-DSS compliant) · Delivery carriers · IT hosting providers (EU-based) · Analytics tools (anonymised data) · Legal authorities when required by law.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

Your data is primarily stored and processed within the European Economic Area (EEA). Where transfers outside the EEA are necessary (e.g., certain IT providers), they are subject to Standard Contractual Clauses (SCCs) approved by the European Commission or an adequacy decision, in accordance with Chapter V of the GDPR.

Customer accounts: Data is retained for the duration of the account's existence, plus 3 years after the last activity for commercial prospecting purposes.

Transaction data: Retained for 10 years as required by French accounting and tax regulations.

Cookies & technical data: Maximum 13 months (in accordance with CNIL recommendations).

Customer service correspondence: 5 years from the last contact.

You have the following rights regarding your personal data:

Right of access: Obtain confirmation of whether your data is processed and receive a copy.

Right to rectification: Correct inaccurate or incomplete data.

Right to erasure ("right to be forgotten"): Request deletion of your data under certain conditions.

Right to restriction: Restrict processing in specific circumstances.

Right to data portability: Receive your data in a structured, commonly used, machine-readable format.

Right to object: Object to processing based on legitimate interest or for direct marketing purposes.

Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact our DPO at dpo@bijouxlune.com. We will respond within one (1) month. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr.

Our website uses cookies and similar technologies. Upon your first visit, a cookie consent banner will allow you to accept or refuse non-essential cookies.

Strictly necessary cookies: Required for the website to function (basket, session). No consent required.

Analytics cookies: Help us understand how visitors interact with our site. Placed only with your consent.

Marketing cookies: Used for targeted advertising. Placed only with your consent.

You can manage your cookie preferences at any time via the cookie settings accessible in the website footer. Cookie lifespan does not exceed 13 months in accordance with CNIL guidelines.

We implement appropriate technical and organisational measures to protect your personal data, including SSL/TLS encryption, access controls, regular security audits, and PCI-DSS compliant payment processing. Despite these measures, no system is entirely secure, and we cannot guarantee absolute security.

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from minors. If we become aware that data has been collected from a minor without parental consent, we will take steps to delete it promptly.

We reserve the right to update this Privacy Policy at any time. Significant changes will be communicated via email or a prominent notice on our website. We encourage you to review this page periodically.