Privacy Policy

1. Data controller

The Vintage Digger — contact@thevintagedigger.com

2. Data collected

As part of your use of the website, we collect:

• Customer account: e-mail address, hashed password
• Orders: first and last name, delivery address, phone number, e-mail
• Payment: card details are processed exclusively by Stripe (PCI-DSS) — we never keep any copy
• Browsing: technical data (IP address, browser) through server logs, with no advertising profiling

3. Purposes of processing

Your data is used for:

• Managing and tracking your orders
• Communication related to your order (confirmation, shipping)
• Managing your customer account
• Complying with our legal obligations (accounting, taxation)

We do not use your data for advertising purposes, nor do we sell it to third parties.

4. Legal basis

The processing of your data is based on: performance of the sales contract (orders), compliance with a legal obligation (accounting), and our legitimate interest (website security).

5. Data retention period

Order data is kept for 5 years from the order date (legal accounting requirement). Customer account data is kept until the account is deleted or after 3 years of inactivity.

6. Subprocessors and third parties

We rely on the following processors:

• Stripe — online payments (headquartered in the United States, standard contractual clauses)
• Supabase — database (hosted in Europe)
• Vercel — hosting (United States, standard contractual clauses)
• Sendcloud — shipping management

7. Your rights

Under the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to data portability
• Right to object and to restrict processing

To exercise your rights: contact@thevintagedigger.com. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

8. Cookies

The website only uses essential functional cookies (session, cart) required for the service to work. No advertising or third-party tracking cookie is set without your consent.