Privacy Policy

This privacy policy informs you about the collection, use and protection of your personal data on the website selleriegz.com.

Who is responsible

The data controller is the company S.A.R.L. Ecurie Gonzalez (capital 1 000 €, RCS Salon B 814 699 401), registered office Chemin du Mas Pointu, 13800 Istres.

It operates the shop Sellerie GZ (10 Route d'Arles (RD 5), Ecurie Gonzalez, 13118 Entressen (Istres), 06 21 51 01 99) and the website selleriegz.com.

Personal data contact: contact@selleriegz.com or by post to the registered office. No data protection officer has been appointed.

What data and why

In the forms, optional fields are marked “Optional” and the others are required: without them, the account or order cannot be created or placed.

Customer account and guest order

Data: title, first name, surname, email, password (stored encrypted, never readable) and date of birth (optional: data that the customer chooses to provide, not a consent). Optional tick box to subscribe to the newsletter. Orders can be placed without an account (guest). Purpose: management of the account and purchases. Legal basis: contract.

Delivery and billing addresses

Data: name, address, telephone, company and VAT number (both optional). Purpose: delivery, billing and contact. Legal basis: contract.

Orders

Data: products, amounts, chosen carrier, history, invoices, messages exchanged about an order. Purpose: order fulfilment, after-sales service and accounting. Legal bases: contract for the order; legal obligation for the retention of invoices (Commercial Code).

Payment by bank card

Payment by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland). The card number is entered in Stripe's secure form, embedded in the page; the shop neither sees nor stores it. Stripe receives the amount, the name, the email and the delivery address for the payment and for fraud prevention.

A customer who has an account may, by ticking the box provided, save their card for their subsequent purchases on the shop: the card is stored by Stripe, the shop keeps only a reference and never sees the number; the customer can remove it at any time from the payment form.

Stripe also offers, as an option, its Link service (saving your payment information with Stripe to pay faster): optional, provided by Stripe under its own terms.

Legal bases: contract for the payment; legitimate interest for fraud prevention; consent for saving the card.

PayPal payment

Payment via PayPal (PayPal Europe, Luxembourg) with a PayPal account, for the payment and for fraud prevention. Legal bases: contract for the payment; legitimate interest for fraud prevention.

Delivery

Colissimo (La Poste), Mondial Relay, or collection / delivery by the shop. The carrier receives the recipient's name, address, telephone and email in order to deliver the parcel and notify the customer. Legal basis: contract.

Newsletter

Data: email, date and IP address of subscription; unsubscribe via the link in each mailing. Purpose: sending news. Legal basis: consent.

Contact form

Data: email, message, any attachment, order concerned. Purpose: replying to your requests. Legal bases: contract if linked to an order; legitimate interest otherwise.

Email alerts

Email and tracked product to notify you when it is back in stock. Legal basis: consent.

Wish list

Products added by a logged-in customer. Legal basis: contract.

Product reviews

Restricted to logged-in customers, moderated before publication; published under the name entered by the author, shortened to the first name and the initial of the surname. Legal basis: legitimate interest. You may object to this processing at any time.

Connection data

IP address and browser, recorded with connections and baskets (security, the shop's internal statistics, without any third-party tool). Legal basis: legitimate interest. You may object to this processing at any time.

Recipients

Your data is passed only to the service providers necessary for the shop's operation:

  • Payment and fraud prevention: Stripe Payments Europe, Ltd. and PayPal Europe.
  • Delivery: Colissimo (La Poste), Mondial Relay, or shop staff for collection or direct delivery.
  • Hosting: server in France (OVHcloud), stated in the legal notice.
  • Audience measurement: Google Analytics (Google Ireland Limited), loaded by Google Tag Manager only with your consent, with transmission to doubleclick.net without ad personalisation.
  • Product page videos: YouTube (Google) and Vimeo when a page containing a video is displayed.

No sale or rental of data. No automated decision-making.

Retention periods

Periods applied in line with the CNIL retail framework:

  • Account and marketing: 3 years after the last contact or the last order.
  • Invoices and accounting documents: 10 years (Commercial Code).
  • Order data: 5 years after the last order (limitation period).
  • Contact messages: 3 years.
  • Newsletter: until unsubscription.
  • Connection data: 1 year.
  • Shop cookies: 20 days at most.
  • sgz_consent cookie: 6 months.
  • Stripe cookies: __stripe_mid (1 year), __stripe_sid (30 minutes) and cookie of the m.stripe.com domain (more than one year, duration set by Stripe).
  • Google Analytics cookies (set after consent): _ga and _ga_<identifiant> (13 months at most), _gid (24 hours), _gat (1 minute).

Cookies

Shop cookies

Only cookies necessary for operation (session, basket, login, language), valid for 20 days at most.

Stripe cookies

Stripe's payment script, loaded at the payment step only, sets payment security and fraud prevention cookies: __stripe_mid (1 year), __stripe_sid (30 minutes) and a cookie of the m.stripe.com domain (more than one year, duration set by Stripe).

Audience measurement

Google Analytics (Google Ireland Limited, Dublin, Ireland) is loaded by Google Tag Manager only if the visitor clicks “Accept all” on the cookie banner displayed on their first visit; “Reject all” is just as simple, and refusing makes no difference to purchases. Nothing is sent to Google before consent.

Google Analytics measures page views, products viewed, additions to the basket and orders (number, amount, products), without the customer's name or email. With consent, Google Analytics also transmits these measurements to Google's advertising services (doubleclick.net domain) in order to compile audience statistics, without ad personalisation.

Basis: consent, which may be withdrawn at any time via the “Manage cookies” link at the bottom of every page (Google Analytics cookies are then deleted).

The visitor's choice is kept for 6 months in the sgz_consent cookie; the banner then reappears.

Google Analytics cookies, set only after consent: _ga and _ga_<identifiant> (13 months at most), _gid (24 hours), _gat (1 minute). No other measurement or advertising tool.

Product page videos

YouTube players in “cookie-free” mode (youtube-nocookie.com) or Vimeo. Displaying a page that contains a video transmits the visitor's IP address to YouTube (Google) or to Vimeo, which may set their own trackers when the video is played; these services may process data outside the EU.

Your rights and how to exercise them

In accordance with the GDPR and the French Data Protection Act (Informatique et Libertés), you have the following rights:

  • Access: obtain confirmation and a copy of your data.
  • Rectification: correct your inaccurate or incomplete data.
  • Erasure: obtain the deletion of your personal data.
  • Restriction: request the temporary freezing of the processing of your data.
  • Objection: object to processing based on our legitimate interest (product reviews, connection data, fraud prevention) and to direct marketing.
  • Portability: receive your data in a machine-readable format. Portability applies only to data processed on the basis of contract or consent.
  • Withdrawal of consent: withdraw your consent at any time (newsletter, card saving, alerts and Google Analytics cookies).
  • Post-mortem directives: define what happens to your data after your death.

The customer account offers a “My personal data” page: data download and deletion request.

You may also exercise your rights by email at contact@selleriegz.com or by post to the registered office: S.A.R.L. Ecurie Gonzalez, Chemin du Mas Pointu, 13800 Istres. We will reply within one month.

Complaints to the CNIL: www.cnil.fr.

Objection to telephone canvassing: Bloctel at www.bloctel.gouv.fr.

Security

We ensure the security of your data:

  • The password is stored encrypted and is never readable.
  • The card number is entered in Stripe's secure form: the shop neither sees nor stores it.
  • Exchanges are protected by the HTTPS protocol.
  • The server is hosted in France with OVHcloud.

Transfers outside the European Union

Hosting is provided on a server in France (OVHcloud).

A transfer outside the EU is possible via Stripe and PayPal, via Google Analytics after consent, and via YouTube or Vimeo for videos. It is governed by the appropriate safeguards provided for by the GDPR (Chapter V), a copy of which may be obtained on request from the contact. No other transfer is carried out.

Changes to the policy

This policy may be updated in line with legal or technical developments. Any update will be published on this page.

Last updated: 18/10/2026