Confidentiality

G A O P É

 

PRIVACY POLICY

Processing of Personal Data of Platform Users

Version 1.0 — June 2026

GAOPÉ (SAS, 141 rue Saint-Denis, 75002 Paris, RCS Paris 101 826 543) is responsible for processing your personal data collected via the www.gaope.eu Platform, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Data Collected

1.1 When creating an account

• First and last name
• Email address
• Password (stored in encrypted form)
• Country of residence

1.2 When placing an order

• Shipping and billing address
• Payment data (processed directly by Stripe — GAOPÉ does not store card numbers)
• Order history
• Correspondence related to the order (customer service, returns)

1.3 When browsing

• IP address
• Browser and device type
• Pages visited, visit duration
• Cookie data (subject to your consent)

2. Purposes and legal bases of processing

• Management of User accounts — Performance of a contract (Art. 6.1.b GDPR)
• Order processing and tracking — Performance of a contract (Art. 6.1.b GDPR)
• Fraud prevention and security — Legitimate interest (Art. 6.1.f GDPR)
• Platform improvement (analytics) — Consent (Art. 6.1.a GDPR)
• Commercial communication and newsletter — Consent (Art. 6.1.a GDPR)
• Legal obligations (accounting retention) — Legal obligation (Art. 6.1.c GDPR)

3. Data Recipients

Your personal data is transmitted to the following recipients, to the strict extent necessary for the performance of their services:

• Shopify Inc. — hosting of the Platform and checkout management
• Stripe Inc. — payment processing and disbursements to Sellers
• Klaviyo Inc. — sending transactional and marketing emails (subject to your consent)
• GAOPÉ Sellers — identity, shipping address, and information related to your order, transmitted to the relevant Seller only
• Competent authorities — in case of a legal or regulatory obligation

GAOPÉ does not sell your personal data to third parties. No data is transmitted to third parties for advertising purposes without your prior consent.

4. Transfers outside the European Union

Some of our providers (Shopify, Stripe, Klaviyo) are established in the United States. These transfers are governed by appropriate safeguards in accordance with the GDPR, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

5. Retention Periods

• Account data: Account lifetime + 3 years after inactivity
• Order data: 10 years (legal obligation — Art. L. 213-1 French Consumer Code)
• Browsing data and analytics cookies: Maximum 13 months (CNIL recommendation)
• Marketing emails (consent): 3 years from the last contact, or until consent is withdrawn
• Payment data: Not stored by GAOPÉ — processed directly by Stripe

6. Your Rights

In accordance with the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — obtain a copy of your data
• Right to rectification (Art. 16 GDPR) — correct inaccurate data
• Right to erasure / right to be forgotten (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) — particularly to processing for direct marketing purposes
• Right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise your rights, contact GAOPÉ at: contact@gaope.fr or by mail at GAOPÉ, 141 rue Saint-Denis, 75002 Paris.

In case of an unresolved complaint, you can contact the CNIL: www.cnil.fr — 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

7. Security

GAOPÉ implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure. Payment data is fully processed by Stripe, which is PCI-DSS certified, and does not pass through GAOPÉ's servers.

8. Cookies

For information relating to the cookies used on the Platform, their purposes, retention periods, and the third parties involved, please consult our Cookie Policy accessible at the bottom of each page of the Platform via the "Cookie Management" link.

9. Changes to this Policy

GAOPÉ reserves the right to modify this Privacy Policy at any time to comply with changes in applicable regulations or its processing practices. The applicable version is the one published on the Platform on the date of your visit.

In case of a substantial modification, GAOPÉ will inform account holders by email with reasonable notice.

GAOPÉ — 141 rue Saint-Denis — 75002 Paris — contact@gaope.fr — July 2026