Privacy policy
Data We Collect
We collect the following categories of personal data:
Identity and contact data: name, email address, phone number, delivery address
Order data: products purchased, order value, payment method (we do not store full card numbers), delivery tracking
Technical data: IP address, browser type, device information, pages visited on Narvexa-fr
Communication data: correspondence with our customer service team
We do not collect special-category data (health, biometric, political opinions, etc.).
Children's Data
Our website and products are not directed at children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will delete that data promptly. If you believe we may have collected data from a child under 16, please contact us at info@narvexa-fr.com.
How We Use Your Data
We process your personal data for the following purposes:
Purpose Legal Basis (GDPR Art. 6)
Processing and delivering your order Contract performance
Communicating about your order (confirmation, tracking, refunds) Contract performance
Responding to customer service requests Contract performance / Legitimate interest
Sending service messages (e.g., order updates) Contract performance
Improving our website and product offering (analytics) Legitimate interest / Consent (for cookies)
Marketing communications (if you opt in) Consent
Preventing fraud and securing our website Legitimate interest / Legal obligation
Complying with tax and accounting obligations Legal obligation
We do not sell your personal data to third parties.
Data Sharing
We share personal data only with:
Payment processors (for Visa, MasterCard, and PayPal transactions)
Delivery carriers (name, address, phone number for delivery purposes)
IT and hosting providers (for website operation and data storage)
Analytics providers (if you consent to analytics cookies)
All service providers are contractually bound to process data only on our instructions and to implement appropriate security measures.
Data Retention
Order and transaction data: retained for 10 years from the end of the fiscal year, as required by French accounting law
Customer account data: retained for the duration of the account, then deleted within 30 days of account closure
Marketing consent records: retained until consent is withdrawn, plus 3 years for proof of consent
Analytics data: retained for up to 13 months from collection
Customer service correspondence: retained for 3 years from the last contact
Your Rights
Under GDPR and French data protection law, you have the right to:
Access your personal data
Rectify inaccurate or incomplete data
Erase your data, subject to legal retention obligations
Restrict processing in certain circumstances
Object to processing based on legitimate interest
Data portability — receive your data in a structured, machine-readable format
Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
Lodge a complaint with the French data protection authority (CNIL — Commission Nationale de l'Informatique et des Libertés)
To exercise any of these rights, email info@narvexa-fr.com. We will respond within one month, extendable by two months for complex requests.
Security
We implement appropriate technical and organisational measures to protect personal data, including TLS encryption for data in transit and access controls for internal systems. In the event of a data breach that poses a risk to your rights, we will notify the CNIL within 72 hours and inform affected individuals without undue delay where required.
International Transfers
Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as European Commission adequacy decisions or Standard Contractual Clauses.