Privacy Policy

1. Purpose of the Policy

This Privacy Policy explains how Hexeli collects, uses, stores, and protects the personal data of visitors and Customers of the website https://hexeli.com.

It also specifies the rights available to users in accordance with the General Data Protection Regulation, known as the "GDPR," and applicable French legislation.

2. Data Controller

The data controller for personal data collected on Hexeli.com is:

OZALO
Société par actions simplifiée unipersonnelle (SASU)
Registered under number 989 435 904 RCS Paris

• Registered office: 60 rue François 1er, 75008 Paris, France

• Email address: support@hexeli.com

• Phone: 01 84 16 45 42

Hexeli is the trade name under which the site and its services are operated.

3. Personal Data Collected

Depending on how the user navigates the site or uses our services, Hexeli may collect the following categories of data.

Identification and Contact Data

• first name and last name;

• email address;

• phone number;

• billing address;

• shipping address.

Order-Related Data

• products ordered;

• variants, quantities, and amounts;

• order date and number;

• payment method used;

• payment status;

• delivery information;

• order history, returns, refunds, and warranties.

Payment Data

Payments are processed by specialized payment providers.

Hexeli does not directly store full banking data. However, some limited information may be received, such as card type, its last digits, transaction status, or a payment identifier.

Customer Service Data

• content of messages and requests;

• photographs or documents transmitted;

• exchange history;

• information necessary for processing a complaint, return, or warranty.

Technical and Navigation Data

• IP address;

• device and browser type;

• operating system;

• pages viewed;

• date, time, and duration of navigation;

• origin of the visit;

• interactions with the site;

• cookie or tracker identifiers;

• data relating to the shopping cart and purchasing journey.

Commercial Communications Data

• newsletter subscription;

• consents and preferences;

• opening or viewing of communications;

• clicks on links;

• unsubscribe or objection requests.

Voluntarily Transmitted Content

Hexeli may collect reviews, comments, photographs, videos, or other content that the user voluntarily chooses to transmit.

4. Collection Method

Data may be collected:

• directly from the user when they place an order, fill out a form, contact customer service, or subscribe to a communication;

• automatically during navigation, using cookies and similar technologies;

• from providers involved in payment, delivery, fraud prevention, or site operation;

• from advertising platforms or partners, when the user has consented or when regulations allow.

Mandatory fields are identified at the time of collection. The absence of certain information may prevent the processing of an order or request.

5. Purposes and Legal Bases

Data is processed only when a legal basis permits it.

When processing is based on consent, it can be withdrawn at any time, without calling into question processing carried out before its withdrawal.

6. Commercial Communications

Hexeli may send offers, news, or commercial information when the recipient has consented or when regulations authorize such communication.

Each commercial email contains a link allowing simple and free unsubscription.

An unsubscribe request can also be sent to support@hexeli.com.

Refusal or withdrawal of consent to commercial communications does not prevent the receipt of messages essential for order fulfillment, such as confirmations, invoices, delivery information, or customer service responses.

7. Cookies and Trackers

Hexeli.com uses cookies and similar technologies to ensure its operation and, subject to user choices, measure its audience, personalize its experience, or evaluate the performance of advertising campaigns.

Strictly Necessary Cookies

These cookies are essential for the site's operation, payment security, shopping cart retention, and access to requested functionalities.

They do not require consent when strictly necessary for the service.

Cookies Subject to Consent

Non-essential analytics, personalization, advertising, or social media cookies are only placed after obtaining user consent.

Users can accept, refuse, or customize these cookies from the banner displayed during their first visit.

They can modify or withdraw their consent at any time using the preference management tool accessible on the site.

Refusal of non-essential cookies does not prevent placing an order.

Additional information is available in Hexeli's Cookie Policy.

8. Data Recipients

Data is accessible only to individuals and providers who need it to perform their duties.

They may be transmitted to:

• authorized customer service members;

• Shopify, which provides the e-commerce platform;

• payment providers;

• carriers and logistics partners;

• technical, IT, and hosting providers;

• customer relationship management tools;

• audience measurement and marketing providers, subject to required consent;

• counsels, insurers, accountants, or providers involved in defending our rights;

• administrative or judicial authorities when a legal obligation requires it.

Carriers only receive the information necessary for delivery, including the recipient's identity, address, and phone number.

Hexeli does not sell the personal data of its Customers or users.

9. Shopify

The Hexeli.com site is operated using the Shopify platform.

For users located in the European Economic Area, services are primarily provided by:

Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland

Shopify processes certain data necessary for hosting, operating the store, securing the site, and processing orders.

Shopify may also transfer certain data to other companies in its group or providers located outside the European Economic Area, particularly in Canada and the United States, in compliance with applicable legal mechanisms.

Further information is available in Shopify's privacy policy:
https://www.shopify.com/legal/privacy

10. Transfers Outside the European Economic Area

Certain technical, advertising, logistical, or payment providers may process data outside the European Economic Area.

When the recipient country does not benefit from an adequacy decision by the European Commission, the transfer is governed by appropriate safeguards, such as:

• standard contractual clauses approved by the European Commission;

• binding corporate rules;

• or any other mechanism recognized by applicable regulations.

Additional measures may be implemented when necessary to ensure an appropriate level of protection.

The user can request information on the applicable safeguards by writing to support@hexeli.com.

11. Retention Periods

Data is not retained longer than necessary for the purposes for which it was collected.

Upon expiration of these periods, data is deleted, anonymized, or placed in intermediate archiving when a legal obligation or the defense of a right justifies it.

12. Data Security

Hexeli implements appropriate technical and organizational measures to protect personal data against:

• unauthorized access;

• loss;

• alteration;

• destruction;

• disclosure;

• or fraudulent use.

Access to data is limited to individuals and providers who need to know it in the course of their duties.

Despite these measures, no transmission or computer storage can guarantee absolute security.

13. User Rights

Depending on the nature of the processing and the applicable legal basis, the user may exercise the following rights:

• right to access their data;

• right to request their rectification;

• right to request their erasure;

• right to object to certain processing;

• right to temporarily restrict processing;

• right to data portability;

• right to withdraw their consent at any time;

• right to define guidelines concerning the fate of their data after their death;

• right not to be subject to a decision producing legal effects based solely on automated processing, under the conditions provided by the GDPR.

These rights are not absolute. Certain data may be retained when their processing is necessary for compliance with a legal obligation, contract performance, or defense of legal rights.

14. Exercising Rights

Any request can be addressed:

By email: support@hexeli.com

By postal mail:
Hexeli
60 rue François 1er
75008 Paris
France

The request must allow identification of its author and specify the right they wish to exercise.

Proof of identity may be requested only when necessary to verify the applicant's identity, especially in case of reasonable doubt.

Hexeli responds within a maximum period of one month from receipt of the request. This period may be extended by two months when the request is complex or the number of requests is significant. The applicant will then be informed of this extension.

15. Complaint to the CNIL

If the user believes that their personal data is not processed in accordance with regulations, they can file a complaint with the Commission nationale de l'informatique et des libertés (National Commission for Information Technology and Liberties):

CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France

Website: https://www.cnil.fr

The user is invited to first contact Hexeli at support@hexeli.com so that their request can be reviewed.

16. Data Concerning Minors

Hexeli's products and services are not specifically intended for minors.

A minor must not transmit personal data or place an order without the authorization of their legal representative.

When a collection concerning a minor is identified, Hexeli may request the necessary elements to verify the authorization of the legal representative or delete the data concerned.

17. Policy Modifications

Hexeli may modify this Privacy Policy to reflect legal, regulatory, technical, or commercial developments.

The last updated date is indicated at the beginning of the document.

In the event of significant changes affecting user rights, appropriate information may be displayed on the site or sent by email when necessary.

18. Contact

For any questions regarding this Privacy Policy or the use of personal data:

Email: support@hexeli.com
Phone: 01 84 16 45 42

Customer service is available Monday to Friday, from 9 a.m. to 6 p.m., excluding public holidays.