Privacy policy

Version of 20 October 2026. This is a translation of the French original (« Politique de confidentialité »); in the event of any discrepancy, the French version prevails.

This policy explains how your personal data are processed when you visit the Fonea website, create an account, place an order or write to us, in accordance with Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

1. Data controller

The data controller is [to be completed], [to be completed], [to be completed], which operates the Fonea shop. Your orders, addresses, reviews and preferences are specific to each shop: they are neither shared with the company's other shops nor used on their behalf. Your login (email address and password) may, however, be common to several shops of [to be completed]: it then lets you log in to those other shops, without passing your data from one shop to another. Deleting your account on one shop erases your data for that shop, except orders and invoices, which are kept for the periods required by law; the login itself is deleted when no shop uses it any longer.

Contact for any question about your data: contact@fonea.shop. No data protection officer has been appointed, as this appointment is not mandatory.

2. Data collected

• Identity and contact details: surname, first name, email address, telephone number (optional, unless the carrier requires it for delivery).
• Delivery and billing: postal addresses.
• Orders: products purchased, amounts, history, acceptance of the terms of sale (date and version), withdrawal requests and exchanges with customer service.
• Customer account (optional): login identifier, saved addresses, preferences, acceptance of the terms of use; the password is encrypted by our authentication provider and is never accessible to us.
• Payment: your card details are entered directly with Stripe; we never have access to them.
• Reviews: rating, text, first name and initial published; email and order number kept as proof of purchase.
• Newsletter and preferences: email address, language, proof and date of your consent or unsubscription.
• Cart: products, options and quantities (your wishlist stays in your browser and is not sent to us).
• Browsing: anonymous audience statistics and, only with your consent, Google Analytics audience measurement (see the cookie policy).

Information marked as mandatory in forms (name, email, delivery address) is necessary to process your order: without it, the order cannot be placed. Other information is optional.

3. Purposes, legal bases and retention periods

• Orders, delivery, after-sales service and legal guarantees: performance of the contract and the seller's legal obligations. Retention: 10 years from delivery or from the end of the financial year (proof of the contract, article L213-1 of the French Consumer Code and article L123-22 of the French Commercial Code).
• Payment and fraud prevention: performance of the contract and legitimate interest in combating fraud. Retention: with the order; payments started but not completed: 30 days (90 days if a bank transfer is awaited).
• Invoicing and accounting: legal obligation. Retention: 10 years.
• Customer account: performance of the contract (terms of use). Retention: until the account is deleted, or 3 years without login or purchase.
• Customer service and contact form: pre-contractual measures, performance of the contract or legitimate interest in answering your requests. Retention: 3 years.
• Withdrawal requests: legal obligation. Retention: with the order.
• Complaints, disputes and mediation: legitimate interest in defending our rights and legal obligation. Retention: until the dispute is closed, then 5 years.
• Verified reviews, moderation and notices: legitimate interest in providing consumers with reliable information and legal obligations (French Consumer Code, Regulation (EU) 2022/2065). Retention: as long as the review is published; notices: until they are handled, then 1 year after that.
• Newsletter and offers from the shop: your consent, which can be withdrawn at any time. Retention: until you unsubscribe, or 3 years without interaction; an unsubscribed address is kept for 3 years to respect your objection.
• Offers sent to our customers for similar products from the same shop: legitimate interest, within the framework of article L34-5 of the French Post and Electronic Communications Code, with the option to object when ordering and in every email. Retention: 3 years after your last purchase.
• Reminder of an unfinished cart: your consent only (dedicated box, unticked by default), which you may withdraw at any time; a single reminder is sent. Retention: 90 days after the cart was last changed.
• Saved cart: a service you request (pre-contractual measures), in your browser and, if you are logged in, in your account. Retention: 90 days after the cart was last changed.
• Wishlist: stored only in your browser until you delete it; it is not sent to us.
• Anonymous audience measurement: legitimate interest; you can object to it. Retention: detailed statistics 25 months, identifier 13 months at most.
• Google Analytics (if the shop uses it): your consent. Retention: cookies 13 months at most, data 14 months at most.
• Website security and technical logs: legitimate interest and security obligation. Retention: 1 year at most.
• Product safety and recalls: legal obligation (Regulation (EU) 2023/988): if a product is recalled, we inform its buyers. Retention: that of the orders.
• Exercise of your rights: legal obligation. Retention: 5 years.

Data kept to comply with a legal obligation are archived with restricted access and are used only for that obligation.

4. Recipients

Your data are accessible only to the authorised staff of the operator and, within the limits of their tasks, to:

• Google Cloud / Firebase (Google): hosting of the database, account authentication and file storage;
• Vercel Inc.: website hosting;
• Resend Inc.: sending emails (orders, account, newsletter);
• Stripe: online payment, as processor and, for fraud prevention and its regulatory obligations, as independent controller;
• Google Analytics, only with your consent;
• our suppliers responsible for preparing and shipping orders (in particular CJ Dropshipping, AliExpress, BigBuy and Printful) and carriers, which receive only your name, delivery address and telephone number;
• our accountant, the consumer mediator in the event of a dispute, and administrative or judicial authorities upon lawful request.

Your data are never sold or rented.

The fonts used on the site and in our emails are hosted on the shop's own domain: displaying them sends no data to Google or to any other font provider.

5. Transfers outside the European Union

Some recipients are established or process data outside the European Union:

• United States (Google, Vercel, Resend, Stripe): transfers based on the adequacy decision for the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) for certified companies, and otherwise on the European Commission's standard contractual clauses;
• China and Singapore (suppliers that ship certain products): only the data needed for delivery are transmitted; these transfers are governed by the European Commission's standard contractual clauses, together with a risk assessment, or, failing that, are based on their necessity for the performance of the contract you have concluded (article 49(1)(b) GDPR).

You can obtain a copy of these safeguards by writing to contact@fonea.shop.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing and portability of your data, as well as the right to object at any time to processing based on legitimate interest and, without having to give reasons, to direct marketing. You may withdraw your consent at any time, without affecting the processing carried out before its withdrawal, and set guidelines for what happens to your data after your death.

From your account ("My personal data"), you can download your data and delete your account. For any other request, write to contact@fonea.shop: proportionate verification of your identity may be requested (for example your order number and the email used for the order). We reply within one month, which may be extended by two months for complex requests. You can unsubscribe from promotional emails in one click, using the link in each of them or your email app's unsubscribe button where it offers one.

If you give us your telephone number, you can register free of charge on the French Bloctel list to object to telephone canvassing.

7. Automated decisions

No decision producing legal effects concerning you is taken solely on the basis of automated processing. Stripe may refuse a payment following an automated fraud-risk analysis: you can then contact us to obtain human intervention.

8. Cookies and trackers

The website uses trackers that are essential to its operation (cart, login, language and currency choice), anonymous audience measurement to which you can object and, only with your consent, Google Analytics. They are detailed in the cookie policy; you can change your choices at any time using the "Manage cookies" link at the bottom of every page.

9. Security

We implement appropriate technical and organisational measures: encrypted connection (HTTPS), access to data limited to authorised persons only, secure account authentication, limits on abusive attempts and payment delegated to Stripe. No bank details are stored on our servers.

10. Complaint to the CNIL

If, after contacting us, you consider that your rights have not been respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (cnil.fr), or with the supervisory authority of your country of residence.

11. Updates

This policy may change, in particular in the event of new processing or a new provider; the version in force is dated at the top of the page. For any question: contact@fonea.shop.