Privacy policy
Privacy Policy
Updated on 25 September 2026
HEDONIST LABS attaches particular importance to protecting the personal data of its customers and visitors. This policy describes the processing we carry out, its purposes and legal bases, and the rights you have.
1. Data controller
HEDONIST LABS, SAS (simplified joint-stock company) with a share capital of 11 875 €, registered with the Paris Trade and Companies Register (RCS) under No. 884 875 295, whose registered office is located at 10 rue de la Paix, 75002 PARIS.
Contact: support@hedonistlabs.com — 01 82 28 67 47.
HEDONIST LABS has not appointed a Data Protection Officer; any request regarding your data can be sent to the contact above.
2. Data collected
Depending on how you use the website, we collect:
- Identification and contact data: surname, first name, email address, delivery and billing postal address, telephone number.
- Order data: products ordered, amount, purchase history, correspondence with customer service.
- Connection data: IP address, browser type, pages visited, timestamps.
No banking data is collected or stored by HEDONIST LABS. Payments are processed directly by our providers Shopify Payments and PayPal, which are the sole recipients of card data. HEDONIST LABS only has access to the status of the transaction and, where applicable, the last four digits of the card.
Data that must be provided in order to process your order is marked as mandatory when entered; without it, the order cannot be fulfilled.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Management of orders, delivery, invoicing and after-sales service | Performance of the contract (Art. 6(1)(b) GDPR) |
| Management of the customer account | Performance of the contract |
| Sending marketing communications and newsletters | Consent (Art. 6(1)(a)), which can be withdrawn at any time |
| Audience measurement, personalisation and targeted advertising | Consent, collected via the cookie management tool |
| Prevention and detection of fraud and unpaid amounts | Legitimate interest (Art. 6(1)(f)) |
| Retention of invoices and accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Handling of complaints and disputes | Legitimate interest |
No decision producing legal effects concerning you is made solely on the basis of automated processing.
4. Recipients
Your data is accessible to authorised HEDONIST LABS staff, as well as to service providers acting as processors on our behalf:
- Shopify — hosting of the website and online store, payment processing (Shopify Payments);
- PayPal — payment processing;
- La Poste / Colissimo — delivery of orders;
- emailing, customer support and audience measurement providers.
These providers only have access to the data necessary to perform their tasks and are contractually bound to process it in accordance with the GDPR.
HEDONIST LABS does not sell or rent your data to third parties for marketing purposes.
Your data may also be disclosed to administrative or judicial authorities where required by law.
5. Transfers outside the European Union
Some of our providers are established outside the European Union or may transfer data there:
- Shopify: Canada, a country benefiting from an adequacy decision of the European Commission;
- Providers established in the United States (in particular audience measurement and advertising tools): transfers governed by their certification under the EU-US Data Privacy Framework (DPF) or, failing that, by the standard contractual clauses adopted by the European Commission.
You can obtain a copy of the applicable safeguards by writing to us at support@hedonistlabs.com.
6. Retention periods
- Order and billing data: duration of the contractual relationship, then archived for ten (10) years under accounting obligations (Article L. 123-22 of the French Commercial Code).
- Customer account data: lifetime of the account, then three (3) years from the last contact.
- Marketing data: three (3) years from the last contact or the withdrawal of consent.
- Cookies and trackers: data collected via trackers subject to consent is retained for a maximum of twenty-five (25) months; the consent itself is retained for six (6) months.
- Correspondence with customer service: for as long as necessary to handle the request, then archived for the duration of the applicable limitation periods.
7. Your rights
In accordance with Regulation (EU) 2016/679 and French Data Protection Act No. 78-17 of 6 January 1978, as amended, you have the following rights:
- right of access to your data;
- right to rectification of inaccurate or incomplete data;
- right to erasure of your data, in the cases provided for by the GDPR;
- right to restriction of processing;
- right to object to processing, in particular for marketing purposes;
- right to portability of the data you have provided to us;
- right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- right to set out directives regarding what happens to your data after your death.
You can exercise these rights by writing to support@hedonistlabs.com or by post to HEDONIST LABS, 10 rue de la Paix, 75002 PARIS.
We respond within one month of receiving your request, which may be extended by two months if the request is complex or if requests are numerous; you will be informed if this is the case.
You are not systematically asked for proof of identity. We only request identification if there are reasonable doubts about the identity of the person making the request, in accordance with Article 12(6) of the GDPR.
Complaints. If, after contacting us, you believe that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 — www.cnil.fr.
8. Marketing communications
You only receive marketing communications by email if you have expressly consented to them, or if you are already a customer and the communication concerns products similar to those you have purchased.
Every message contains a working unsubscribe link. You can also unsubscribe at any time by writing to support@hedonistlabs.com.
Your data is not passed on to partners for their own marketing purposes.
9. Cookies and trackers
A cookie is a file placed on your device when you visit a website, which records information about your browsing.
Cookies placed without consent
In accordance with Article 82 of the French Act of 6 January 1978, the only trackers placed without your prior consent are those strictly necessary for the operation of the website: cart management, login session, payment security, and remembering your cookie choices.
Cookies subject to your consent
Non-exempt audience measurement, personalisation and advertising trackers are only placed after your consent has been obtained, expressed through a clear affirmative action via the cookie management tool displayed on your first visit.
Continuing to browse does not constitute consent. You can accept, refuse, or configure your choices tracker by tracker. Refusing non-essential trackers does not prevent you from browsing the website or placing an order.
You can change or withdraw your choice at any time via the cookie management tool accessible from the footer of the website. Your consent is retained for six months, after which you will be asked to make your choice again.
List of trackers
[TO BE COMPLETED — see note below]
Note for Anthony: the list must reflect the trackers actually placed by your website, with the issuer, purpose and retention period for each. The previous version listed Google AdSense, DoubleClick, Google AdWords Conversion, Facebook Connect and Twitter Advertising — most likely none of these are actually active, while those that are (Shopify Analytics, Meta pixel, Google Analytics 4, etc.) were not listed. Check the actual list in your browser console (Application tab → Cookies) or in your consent management tool, then enter it here.
To find out more about managing cookies: cnil.fr/fr/cookies-les-outils-pour-les-maitriser.
10. Security
HEDONIST LABS implements appropriate technical and organisational measures to protect your data against destruction, loss, alteration, unauthorised disclosure or access: encryption of communications, restricted access rights, secure hosting and outsourcing of payment data processing to certified providers.
We will never ask you to send us your bank card details by email, telephone, fax or post.
11. Changes to this policy
HEDONIST LABS may update this policy to adapt it to regulatory changes or to its processing activities. The applicable version is the one published online on the date you consult it; the date of the last update appears at the top of the document.