Privacy policy
This policy describes how SARL KACTUS, registered under number 985194737, with its registered office at 341 Rte de Saint Jean de Bournay, 38440 Villeneuve de Marc, France, collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and French data protection law.
Data controller: KACTUS — contact: letstalk@kactus-klothing.com
Article 1 — Data collected
When you make a purchase, we collect: name, address, email, and payment details (processed by our payment provider, see Article 4).
When you browse our site, we automatically receive your IP address and information about your browser and operating system.
With your consent, we may send you marketing emails about our products and news.
Article 2 — Legal basis and purpose of processing
| Purpose | Legal basis |
|---|---|
| Order processing, delivery, invoicing | Performance of a contract (Art. 6.1.b GDPR) |
| Managing returns and warranties | Legal obligation (Art. 6.1.c GDPR) |
| Sending marketing communications | Consent (Art. 6.1.a GDPR) |
| Website security, fraud prevention | Legitimate interest (Art. 6.1.f GDPR) |
Article 3 — Consent
When you provide your data to complete an order, verify a payment or arrange delivery, we consider that you consent to its collection for that purpose only.
For any other purpose (notably marketing), we obtain your express consent, which you may withdraw at any time by contacting us at letstalk@kactus-klothing.com or via the unsubscribe link in our emails.
Article 4 — Hosting and processors
Our shop is hosted by Shopify Inc. (a US-based company), which hosts our data on secure servers.
Payments are processed by Shopify Payments and/or PayPal, in accordance with the PCI-DSS standard. Your card details are encrypted and not retained by KACTUS. Transaction data is kept only for as long as necessary to process the order.
Transfers outside the European Union: as Shopify is a US company, some data may be transferred and processed outside the EU. These transfers are governed by the European Commission's Standard Contractual Clauses and the safeguards provided by Shopify (see Shopify's privacy policy: shopify.com/legal/privacy).
We also use the Meta Pixel (Meta Platforms Inc., a US company) for advertising measurement and retargeting on Facebook/Instagram. Data shared with Meta (technical identifiers, pages visited) is governed by Standard Contractual Clauses and Meta's privacy policy: facebook.com/privacy/policy. This processing only occurs after you give your explicit consent via the cookie banner.
Other third-party providers (carriers, email tools, etc.) may have access to certain data, strictly to the extent necessary to perform their service. We recommend reviewing their own privacy policies.
Article 5 — Retention period
- Order and invoicing data: 10 years (statutory accounting obligation).
- Customer account / marketing data: 3 years from the last contact, unless you object or request earlier deletion.
- Payment data: not retained by KACTUS beyond transaction processing.
Article 6 — Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access, rectification and erasure
- Right to restriction of processing
- Right to data portability
- Right to object, notably to marketing
- Right to withdraw consent at any time
To exercise these rights, contact us at letstalk@kactus-klothing.com.
You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr.
Article 7 — Security
Your data is protected by SSL encryption and, for payment data, by AES-256 encryption, in accordance with the PCI-DSS standard. While no method of transmission over the Internet is 100% secure, we apply all reasonable industry standards.
Article 8 — Cookies
Our site uses the following cookies, mainly necessary for the shop to function:
| Cookie | Purpose | Duration |
|---|---|---|
| session_id | Shopify session identifier | Session |
| _shopify_visit | Internal visit statistics | 30 minutes |
| shopify_uniq | Unique visitor counting | 24h |
| cart | Shopping cart contents | 2 weeks |
| _secure_session_id | Secure session identifier | Session |
| storefront_digest | Access to password-protected shop | Session |
| _fbp, fr (Meta Pixel) | Targeted advertising and performance measurement for Meta/Facebook/Instagram campaigns — non-essential cookies, set only after consent | Up to 90 days |
These advertising cookies are only set after you give consent via the banner displayed when you arrive on the site. You may withdraw this consent at any time via the site's cookie settings.
Article 9 — Age of consent
By using this site, you confirm that you have reached the legal age of majority in your country of residence, or have the consent of a parent or legal guardian.
Article 10 — Changes to this policy
We reserve the right to update this policy at any time. Any significant change will be notified on this page.
Contact — Complaints
For any question, request to exercise your rights, or complaint: letstalk@kactus-klothing.com