Privacy Policy

Endemik SAS places particular importance on protecting your personal data. This policy describes the processing activities carried out in connection with the operation of the petdesign.fr website, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and amended Law No. 78-17 of 6 January 1978.

1. Data controller

Endemik SAS has not appointed a data protection officer, as this appointment is not mandatory given the nature and volume of its processing activities.

2. Data collected

2.1. Data you provide to us

• Identity: surname, first name, title;
• Contact details: email address, telephone number, delivery and billing addresses;
• Professional data (PRO accounts): company name, SIRET number, intra-Community VAT number, declared business activity;
• Order data: products ordered, amounts, purchase history, delivery method, order notes;
• Account data: login credentials, preferences;
• Content: messages sent via the contact form or chat, product reviews and ratings.

2.2. Data collected automatically

• Technical data: IP address, browser type and version, operating system, screen resolution;
• Browsing data: pages visited, visit duration, products viewed, traffic source;
• Cookies and trackers: see Article 7.

2.3. Payment data

Endemik SAS does not collect, store, or process any bank card data. Payments are processed directly by approved providers (Shopify Payments, PayPlug, PayPal, Oney Bank), which are PCI-DSS certified. We are only provided with information about whether the transaction was successful or unsuccessful, as well as the last four digits and the card network.

3. Purposes and legal bases

Each processing activity is based on a defined legal basis:

Purpose	Legal basis	Retention period
Order management, delivery, after-sales service	Contract performance Art. 6.1.b GDPR	Duration of the business relationship, then 5 years (commercial limitation period)
Billing and accounting obligations	Legal obligation Art. 6.1.c GDPR	10 years from the close of the financial year
Customer account management	Contract performance Art. 6.1.b GDPR	Until the account is deleted, or 3 years without activity
Verification and management of business accounts	Performance of the contract and legitimate interest Art. 6.1.b and Art. 6.1.f GDPR	Duration of the business relationship, then 3 years
Sending commercial communications	Consent Art. 6.1.a GDPR	Until consent is withdrawn, or 3 years without interaction
Responding to requests via form or chat	Legitimate interest Art. 6.1.f GDPR	3 years from the last contact
Audience measurement and Site improvement	Consent Art. 6.1.a GDPR	Maximum of 25 months
Fraud prevention	Legitimate interest Art. 6.1.f GDPR	Duration of the analysis, then 6 months
Customs formalities (export outside the EU)	Legal obligation Art. 6.1.c GDPR	3 years (customs regulations)
Customer review management	Consent Art. 6.1.a GDPR	3 years from publication

4. Data recipients

Your data is accessible to authorized Endemik SAS personnel and disclosed, strictly to the extent necessary, to the following categories of recipients:

• Hosting and e-commerce platform: Shopify International Limited (Ireland);
• Payment service providers: Shopify Payments, PayPlug, PayPal, Oney Bank;
• Carriers: GLS France, Colissimo, FedEx, and any other carrier selected for your order — your identity, address, telephone number, and email address are transmitted to them for delivery purposes;
• Customs authorities, for shipments outside the European Union: identity, address, content and value of the Products, tax or customs identification numbers;
• Technical service providers: messaging, customer review management, and customer service tools integrated into the Site;
• Chartered accountant and statutory auditor, as part of legal obligations;
• Administrative or judicial authorities, pursuant to a lawful request.

Endemik SAS does not sell, rent, or exchange any personal data for commercial purposes.

5. Transfers outside the European Union

Certain providers, particularly Shopify, may process data outside the European Union, mainly in the United States and Canada.

These transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR: the European Commission's adequacy decision concerning Canada, participation in the EU-U.S. Data Privacy Framework, or standard contractual clauses for providers established in the United States.

A copy of these safeguards may be obtained upon request via the Site's contact page.

6. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy;
• Right to rectification: have inaccurate or incomplete data corrected;
• Right to erasure: obtain the deletion of your data, subject to our legal retention obligations;
• Right to restriction: request the temporary suspension of disputed processing;
• Right to object: object to processing based on legitimate interest, or to direct marketing at any time;
• Right to data portability: receive your data in a structured, machine-readable format, or request that it be transferred to another data controller;
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out previously;
• Right to define directives concerning what happens to your data after your death.

6.1. Exercising your rights

Your requests should be submitted via the Site contact page or the online chat. Proof of identity may be requested in the event of reasonable doubt about the requester's identity.

Endemik SAS will respond within one month of receiving the request, extendable by two months in the event of complexity, in which case you will be informed.

6.2. Complaints

If, after contacting us, you believe that your rights have not been respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr

7. Cookies and trackers

The Site uses cookies and similar technologies. During your first visit, a banner allows you to accept, reject, or configure non-essential cookies. Your choice is retained for thirteen months and can be changed at any time via the dedicated link in the footer.

7.1. Strictly necessary cookies

Essential to the operation of the Site, they do not require your consent: session management, shopping cart, security, authentication, and remembering your consent and language preferences.

7.2. Audience measurement cookies

They help us understand how the Site is used so that we can improve it. They are placed only with your consent and have a lifespan of no more than thirteen months, while the collected data is retained for a maximum of twenty-five months.

7.3. Advertising and social media cookies

If placed by third parties with your consent, they are used to measure the effectiveness of our campaigns and offer you tailored content.

7.4. Settings

In addition to the Site banner, you can configure your browser to reject all or some cookies. However, rejecting strictly necessary cookies may impair the Site’s operation, particularly the shopping cart and ordering process.

8. Security

Endemik SAS implements appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure, alteration, or destruction: encryption of communications using the TLS protocol, hosting on certified infrastructure, access control based on authorization, and the use of PCI-DSS-certified payment service providers.

In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed as soon as possible, in accordance with Article 34 of the GDPR.

9. Minors

The Site is not intended for persons under fifteen years of age. No data is knowingly collected from a minor under fifteen without the consent of the holder of parental authority.

If you discover that a minor has provided us with data without this authorization, please contact us: the data will be deleted without delay.

10. Automated decision-making

Endemik SAS does not carry out any profiling or fully automated decision-making that produces legal effects concerning you. Fraud-prevention tools offered by our payment service providers may generate risk scores, but any decision to suspend or cancel an order is subject to human intervention.

11. Amendments

This policy may be amended to reflect legal, technical, or organizational developments. The applicable version is the one published on the Site on the date of your visit. In the event of a material change, you will be informed by appropriate means.

12. Business transfer

In the event of a merger, acquisition, or transfer of all or part of Endemik SAS’s business, your data may be transferred to the acquiring entity, which would be bound by the same protection obligations. You would be informed in advance and would retain your rights, including the right to object, under the conditions set out in Article 6.