Privacy Policy
Last updated:
1. Introduction
We are committed to protecting your personal information. This Privacy Policy explains how Pointet Workshop collects, processes, stores and protects personal data when you use its website, account, ordering and contact services in France and the European Union.
Processing depends on the service you use and the relevant legal basis described below. Visiting the website does not constitute consent to every form of personal-data processing. The operator responsible for your data is identified in the Contact section.
2. Personal Data We Collect
Account and order information
- Your email address and full name, which are required to register an account.
- A hashed password, account identifier, role, email-verification status and account creation/update dates.
- Current orders and purchase/order history, including customer name and email, products, selected colours, quantities, prices, order dates and statuses.
- Basket contents associated with your account.
Optional information and correspondence
Account records can include a referral relationship. When contacting us, you provide the selected service and your project description, together with any other information you choose to include in your message.
You may voluntarily provide a phone number or delivery address in correspondence to arrange an order or delivery. These are not required account-registration fields; the current account and order records do not have dedicated phone or delivery-address fields. A delivery address may be needed to fulfil a delivery you request.
Authentication and session information
Authentication cookies contain access and refresh tokens used to authenticate requests and renew sessions. They are security credentials, separate from profile information. Server-side session records include a hash of the refresh token, session and account identifiers, expiry and revocation information, usage timestamps, IP address and browser/device user-agent information. We also process your language preference through a separate cookie.
3. How We Use Personal Data
- Create and manage accounts, verify email addresses and authenticate users.
- Maintain authenticated sessions and securely renew authentication.
- Manage baskets, process orders and maintain purchase/order history.
- Fulfil purchased products and arrange delivery using the necessary details supplied for that purpose.
- Contact you when necessary about an order and respond to enquiries or support requests.
- Remember your chosen language.
- Protect accounts and website security, including detecting misuse of refresh tokens.
- Comply with applicable legal obligations.
4. Legal Basis for Processing
The applicable legal basis depends on the purpose of the processing:
- Performance of a contract or steps requested before a contract: account services, authentication needed to access them, order processing, fulfilment, requested delivery and related customer support.
- Legal obligations: keeping records required by applicable accounting or other laws, and responding to binding legal requests.
- Legitimate interests: protecting the website and accounts against misuse, handling general enquiries and establishing or defending legal claims, where those interests are not overridden by your rights and freedoms.
- Consent: only for a specific activity that is presented to you as relying on your consent. No separate consent-based analytics or advertising activity is currently implemented. Optional information is not automatically processed on the basis of consent; its purpose determines the legal basis.
5. Data Retention
We retain personal information only for as long as necessary to provide the requested services, manage the contractual relationship, meet applicable legal or accounting obligations, and resolve disputes or enforce agreements where necessary. The appropriate period depends on the record, its purpose and any legal requirements.
Pending registrations expire after 24 hours by default, or are consumed when email verification is completed. The application does not specify a fixed deletion period for account, order or authentication-history records. Token expiry ends a credential's validity; it does not automatically delete the related records.
6. Data Security
We use technical safeguards including password hashing, hashed refresh-token storage, signed access tokens, refresh-token rotation, request-origin checks and access controls. Appropriate organisational measures are also needed to protect information and limit its use to authorised purposes.
The default authentication cookie settings include:
- HttpOnly: prevents JavaScript running in the browser from directly reading the authentication cookies.
- Secure: restricts transmission to HTTPS when enabled.
- SameSite=Lax: limits cross-site cookie transmission and helps reduce certain cross-site request risks.
The local HTTP development setup disables Secure. The deployed HTTPS service must have it enabled; its live configuration has not yet been verified. These measures reduce risk but do not guarantee absolute security.
8. User Rights Under GDPR
Depending on the circumstances and applicable legal conditions, you may:
- Request access to your personal data and information about its processing.
- Have inaccurate or incomplete data corrected.
- Request deletion where there is no overriding reason to retain the data.
- Request restriction of processing in the circumstances provided by law.
- Object, on grounds relating to your situation, to processing based on legitimate interests.
- Request portability of data you supplied where processing is automated and based on consent or a contract.
- Withdraw consent where an activity relies on it, without affecting the lawfulness of processing before withdrawal.
- Lodge a complaint with a competent supervisory authority.
In France, the supervisory authority is the CNIL (Commission Nationale de l'Informatique et des Libertés). Use the contact details below to exercise your rights. We may request information reasonably necessary to verify your identity. Some records may need to be retained to meet legal obligations or address legal claims, even after a deletion request.
10. International Data Transfers
External communication and storage services may involve processing outside the European Economic Area (EEA). The project includes a WhatsApp contact link and S3 media storage, but the production hosting locations, recipient arrangements and applicable transfer safeguards have not been confirmed.
Where a transfer outside the EEA takes place, it must meet the GDPR's transfer requirements, for example through an applicable adequacy decision or appropriate safeguards. We do not claim that a particular mechanism is already in place.
[Operator to supply: relevant recipients and destination countries, applicable transfer mechanism, and how to obtain information about or a copy of any safeguards.]
11. Changes to This Privacy Policy
We may update this policy when website functionality, data-processing practices or legal requirements change. The Last updated date identifies the latest revision. Any additional notice required for a material change will be provided as applicable.
12. Contact
For privacy or cookie questions, or to request access, correction, deletion or the exercise of another GDPR right, email alexdrobyszfr@gmail.com. Please describe your request and the account or order it concerns. Do not send passwords or authentication tokens.
Website: Pointet Workshop.
Data controller: [Operator's full legal name to be supplied].
Postal address: [Operator's postal address to be supplied].