Privacy Policy
This English version is a courtesy translation. Only the French version is legally binding; in the event of any discrepancy, the French version prevails.
1. Introduction
L'Atelier Brillance attaches great importance to the protection of your personal data. This policy describes the data we process, for what reasons, on what legal basis, to whom they are disclosed, how long they are kept, and how to exercise your rights.
It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and with French Law No. 78-17 of 6 January 1978 as amended, known as the "Informatique et Libertés" (Data Protection) Act.
2. Data controller
L'Atelier Brillance, SARL (French limited liability company) with a share capital of €500.00, Trade and Companies Register (RCS) Cherbourg 101 492 478
26 Rue des Fougères, Tourlaville, 50110 Cherbourg-en-Cotentin, France
Email: latelierbrillancecherbourg@gmail.com
Telephone: 06 98 25 05 78
3. Data processed, purposes and legal bases
3.1. Booking a service
| Data | Surname and first name, email address, telephone number, additional information provided voluntarily (vehicle, specific requests) |
| Purposes | Management of appointments, confirmations and reminders, SMS notifications relating to the service in progress, invoicing |
| Legal basis | Performance of the contract or of pre-contractual measures taken at your request (Article 6(1)(b) GDPR) |
3.2. Business area
| Data | Company name, contact name, business email address, telephone number, business sector, fleet size, login credentials (the password is stored in irreversibly encrypted form) |
| Purposes | Management of the account and of the relationship with partner businesses, monitoring and invoicing of services |
| Legal basis | Performance of the contract (Article 6(1)(b) GDPR) |
3.3. Contact form
| Data | Name, email address, telephone number (optional), content of the message, attached photographs where applicable |
| Purposes | Replying to your request, drawing up a quote |
| Legal basis | Pre-contractual measures taken at your request (Article 6(1)(b) GDPR) and legitimate interest in replying to enquiries (Article 6(1)(f)) |
3.4. Orders on the online shop
| Data | Surname and first name, email address, billing address, delivery address or selected parcel shop, telephone number (for a delivery), where applicable company name and intra-Community VAT number, content and amount of the order, delivery method, parcel tracking number, date of acceptance of the Terms of Sale, technical payment identifiers provided by Stripe |
| Purposes | Processing and monitoring of the order, preparation and shipping, transmission to the carrier for the delivery of the parcel and the delivery notice, issuing and sending invoices and credit notes, customer service, management of the right of withdrawal and of the legal guarantees |
| Legal basis | Performance of the contract of sale (Article 6(1)(b) GDPR) and compliance with legal obligations, in particular accounting and tax obligations (Article 6(1)(c)) |
Online withdrawal. When you exercise your right of withdrawal via the "Withdraw from the contract here" link, we record your surname and first name, your order number, the products concerned, the email address at which you wish to receive the acknowledgement of receipt, and the date and time of your declaration. These data are used to process your withdrawal and to keep proof of it (Article 6(1)(b) and 6(1)(c) GDPR).
Parcel shop search. To show you nearby parcel shops, the postcode you enter, or your location if you use the "Near me" button and allow it in your browser, is sent to Mondial Relay (Article 6(1)(b) GDPR). This search is not recorded in our database: it is only kept in memory for a few minutes, with the location rounded to about a hundred metres, to avoid repeating it. The map shown with the list uses OpenStreetMap base maps: your browser downloads them from the OpenStreetMap Foundation's servers, which then receive your IP address.
Bank details. Payment is made on the secure page of our payment service provider Stripe. Your bank card details are entered and processed directly by Stripe: L'Atelier Brillance never has access to them and does not store them.
3.5. Website security
| Data | IP address |
| Purposes | Protection against abuse and intrusion attempts (limiting the number of requests on forms, payment and login) |
| Legal basis | Legitimate interest in ensuring the security of the website (Article 6(1)(f) GDPR) |
The IP address is processed temporarily, in memory, and is not recorded in a database.
3.6. No direct marketing and no automated decision-making
Your data are not used for direct marketing purposes. They are not subject to any fully automated decision-making or to any profiling.
3.7. Telephone canvassing
You can register free of charge on Bloctel, the French opt-out list for telephone canvassing: bloctel.gouv.fr.
4. Mandatory data
The data marked as mandatory in the forms are necessary to process your request. Without them, the booking, the reply or the order cannot be processed.
5. Recipients of the data
Your data are intended for the authorised staff of L'Atelier Brillance. They are also disclosed, strictly to the extent necessary, to the following service providers:
| Service provider | Role | Location |
|---|---|---|
| MILO | Design and maintenance of the website | France |
| Hostinger International Ltd (Cyprus) | Hosting of the website's servers and database | France (Paris) |
| Stripe (Stripe Payments Europe, Ltd., Ireland) | Processing of shop payments | European Union, with transfers to the United States |
| Google (Gmail service) | Sending emails: confirmations, invoices, order tracking | European Union and United States |
| Cal.eu | Management of the service booking calendar | European Union |
| OVHcloud | Sending service tracking text messages (SMS) | France |
| Mondial Relay or Chronopost, depending on the delivery method chosen, or any other carrier | Delivery of parcels and delivery notices: name, delivery address or parcel shop, email address, telephone number. Parcel shop search: postcode or location | France |
| OpenStreetMap Foundation (United Kingdom) | Base maps for the parcel shop map, downloaded by your browser: IP address | United Kingdom |
| Our chartered accountant | Bookkeeping: invoices and credit notes | France |
Stripe also processes certain data on its own behalf, in particular for fraud prevention and compliance with its regulatory obligations, in accordance with its own privacy policy.
Finally, your data may be disclosed to administrative or judicial authorities where required by law. They are not sold, rented or transferred to third parties for commercial purposes.
6. Transfers outside the European Union
Certain service providers (Stripe, Google) may process your data in the United States. These transfers are governed by the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework for certified entities and, failing that, by the standard contractual clauses adopted by the European Commission. OpenStreetMap base maps are served from the United Kingdom, which the European Commission recognises as providing an adequate level of protection. You can obtain information about these safeguards by contacting us.
7. Retention periods
| Data | Period |
|---|---|
| Service bookings | 3 years from the last service |
| Business accounts | Duration of the business relationship, then 3 years after it ends |
| Contact form messages | 3 years from the last exchange |
| Shop orders and withdrawal declarations | 3 years after the last order, for customer service and the legal guarantees |
| Contracts of sale of an amount equal to or greater than €120 including VAT | 10 years from delivery |
| Invoices, credit notes and accounting documents | 10 years from the end of the financial year |
| IP address (security) | A few minutes to a few hours, in memory only |
When these periods expire, the data are deleted or anonymised. Data required to comply with a legal obligation are kept in intermediate archiving, with restricted access.
8. Cookies and trackers
The website uses no advertising, audience measurement or social network cookies. Only trackers that are strictly necessary for its operation are used, and these are exempt from consent:
| Tracker | Purpose | Duration |
|---|---|---|
| Business area session cookie | Keeping you logged in and security | 7 days |
| Administration session cookies (workshop staff) | Keeping you logged in and security | 8 hours |
| Browser local storage "ab_cart_v1" | Remembering the contents of the basket | Until the order is confirmed or the basket is deleted |
| Browser local storage "ab_delivery_v1" | Remembering the delivery method and parcel shop chosen in the basket | Until a new choice is made or the browser data is deleted |
The payment page is hosted by Stripe, on its own domain. Stripe may place there the cookies necessary for payment security and fraud prevention.
The map on the "Opening hours" ("Horaires") page is provided by Google Maps. It only loads if you click on "Show map" ("Afficher la carte"): Google may then place its own cookies. The Cal.eu booking module, when you use it to book a service, may place the trackers necessary for its operation.
9. Your rights
You have the following rights over your data:
- right of access: to obtain confirmation that data concerning you are being processed, and to receive a copy of them;
- right to rectification of inaccurate or incomplete data;
- right to erasure, within the limits provided for by law, in particular where there is an obligation to retain the data;
- right to restriction of processing;
- right to data portability for the data you have provided to us, where the processing is based on the contract;
- right to object to processing based on legitimate interest, on grounds relating to your particular situation;
- right to set guidelines concerning what happens to your data after your death.
To exercise these rights, write to us at latelierbrillancecherbourg@gmail.com or at the postal address given in section 2. Proof of identity may be requested in the event of reasonable doubt. We reply within one month, which may be extended by two months taking into account the complexity or number of requests.
If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.
10. Security
L'Atelier Brillance implements appropriate technical and organisational measures to protect your data: encryption of exchanges (HTTPS protocol), passwords stored in irreversibly encrypted form, access to the administration restricted to authorised staff with two-factor authentication available, limiting the number of attempts on forms and login, no storage of bank details.
11. Changes to this policy
This policy may be amended, in particular to take account of legal developments or new services. In the event of a substantial change, you will be informed by appropriate means.
Last updated: 15 September 2026.