Privacy Policy

This English version is provided for convenience. In the event of any discrepancy, the French version prevails.

1. Purpose of this policy

This Privacy Policy explains how Hexeli collects, uses, stores and protects the personal data of visitors to and Customers of the website https://hexeli.com.

It also sets out the rights users have under the General Data Protection Regulation ("GDPR") and applicable French legislation.

2. Data controller

The controller of the personal data collected on Hexeli.com is:

OZALO
Single-shareholder simplified joint-stock company (SASU)
Registered under number 989 435 904 RCS Paris

  • Registered office: 60 rue François 1er, 75008 Paris, France

  • Email: support@hexeli.com

  • Phone: +33 1 84 16 45 42

Hexeli is the trade name under which the website and its services are operated.

3. Personal data collected

Depending on how the user browses the website or uses our services, Hexeli may collect the following categories of data.

Identification and contact data

  • first and last name;

  • email address;

  • phone number;

  • billing address;

  • delivery address.

Order data

  • products ordered;

  • variants, quantities and amounts;

  • order date and number;

  • payment method used;

  • payment status;

  • delivery information;

  • history of orders, returns, refunds and warranty claims.

Payment data

Payments are processed by specialized payment providers.

Hexeli does not directly store complete banking details. Certain limited information may nevertheless be received, such as the card type, its last digits, the transaction status or a payment identifier.

Customer service data

  • content of messages and requests;

  • photographs or documents submitted;

  • history of exchanges;

  • information required to process a complaint, return or warranty claim.

Technical and browsing data

  • IP address;

  • device and browser type;

  • operating system;

  • pages viewed;

  • date, time and duration of browsing;

  • source of the visit;

  • interactions with the website;

  • cookie or tracker identifiers;

  • data relating to the cart and purchase journey.

Commercial communications data

  • newsletter subscription;

  • consents and preferences;

  • opening or viewing of communications;

  • link clicks;

  • unsubscribe or objection requests.

Content submitted voluntarily

Hexeli may collect reviews, comments, photographs, videos or other content that the user voluntarily chooses to submit.

4. How data is collected

Data may be collected:

  • directly from the user when they place an order, complete a form, contact customer service or sign up for a communication;

  • automatically while browsing, by means of cookies and similar technologies;

  • from providers involved in payment, delivery, fraud prevention or the operation of the website;

  • from advertising platforms or partners, where the user has consented or where regulations allow.

Mandatory fields are identified at the time of collection. The absence of certain information may prevent an order or request from being processed.

5. Purposes and legal bases

Data is processed only where a legal basis allows it.

Purpose Legal basis
Creating and managing orders Performance of the contract
Payment and invoicing Performance of the contract and legal obligations
Preparing, shipping and tracking orders Performance of the contract
Managing returns, refunds and warranty claims Performance of the contract and legal obligations
Customer service and complaint handling Performance of the contract and legitimate interest
Bookkeeping Legal obligation
Fraud prevention and website security Legitimate interest and legal obligations
Improving the website and services Legitimate interest or consent, depending on the processing
Audience measurement that is not strictly necessary Consent
Advertising personalization Consent
Marketing to people who have never ordered Consent where required
Presenting similar products to existing Customers Legitimate interest, with the option to object at any time
Handling requests relating to personal data Legal obligation
Defending Hexeli's rights in the event of a dispute Legitimate interest

Where processing is based on consent, consent may be withdrawn at any time, without affecting processing carried out before its withdrawal.

6. Commercial communications

Hexeli may send offers, news or commercial information where the recipient has consented or where regulations allow such communication.

Each commercial email contains a link allowing the recipient to unsubscribe simply and free of charge.

An unsubscribe request may also be sent to support@hexeli.com.

Refusing or withdrawing consent to commercial communications does not prevent receipt of messages essential to the performance of an order, such as confirmations, invoices, delivery information or customer service replies.

7. Cookies and trackers

Hexeli.com uses cookies and similar technologies to ensure its operation and, subject to the user's choices, to measure its audience, personalize the user experience or evaluate the performance of advertising campaigns.

Strictly necessary cookies

These cookies are essential for the operation of the website, securing payments, keeping the cart and accessing the requested features.

They do not require consent where they are strictly necessary for the service.

Cookies subject to consent

Non-essential analytics, personalization, advertising or social media cookies are only placed after obtaining the user's consent.

The user may accept, refuse or customize these cookies from the banner displayed on their first visit.

They may change or withdraw their consent at any time using the preference management tool available on the website.

Refusing non-essential cookies does not prevent placing an order.

Further information is available in Hexeli's Cookie Policy.

8. Data recipients

Data is accessible only to the persons and providers who need it to carry out their tasks.

It may in particular be transmitted to:

  • authorized members of the customer service team;

  • Shopify, which provides the e-commerce platform;

  • payment providers;

  • carriers and logistics partners;

  • technical, IT and hosting providers;

  • customer relationship management tools;

  • audience measurement and marketing providers, subject to the required consent;

  • advisers, insurers, accountants or providers involved in defending our rights;

  • administrative or judicial authorities where required by a legal obligation.

Carriers receive only the information necessary for delivery, in particular the recipient's identity, address and phone number.

Hexeli does not sell the personal data of its Customers or users.

9. Shopify

The Hexeli.com website is operated using the Shopify platform.

For users located in the European Economic Area, the services are mainly provided by:

Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland

Shopify processes certain data necessary for hosting, operating the store, securing the website and processing orders.

Shopify may also transfer certain data to other companies in its group or to providers located outside the European Economic Area, in particular in Canada and the United States, in compliance with the applicable legal mechanisms.

Further information is available in Shopify's privacy policy:
https://www.shopify.com/legal/privacy

10. Transfers outside the European Economic Area

Certain technical, advertising, logistics or payment providers may process data outside the European Economic Area.

Where the recipient country does not benefit from an adequacy decision of the European Commission, the transfer is governed by appropriate safeguards, such as:

  • standard contractual clauses approved by the European Commission;

  • binding corporate rules;

  • or any other mechanism recognized by applicable regulations.

Additional measures may be implemented where necessary to ensure an appropriate level of protection.

Users may request information on the applicable safeguards by writing to support@hexeli.com.

11. Retention periods

Data is not kept longer than necessary for the purposes for which it was collected.

Data category Indicative retention period
Data required to manage orders For the duration of the commercial relationship, then archived for the applicable statutory periods
Invoices and accounting documents 10 years from the end of the relevant financial year
Data used for marketing to Customers For the duration of the commercial relationship, then 3 years from the last purchase or last contact
Prospect data 3 years from collection or from the last contact initiated by the prospect
Requests sent to customer service Time required for processing, then archived according to the nature of the request and the limitation periods
Data relating to the exercise of rights Time required to process the request, then archived to evidence its handling
Information kept to honor a marketing objection At least 3 years
Data relating to disputes Until the final settlement of the dispute and the expiry of appeal periods
Cookies and trackers Period indicated in the cookie management tool, within the applicable regulatory limits

At the end of these periods, data is deleted, anonymized or placed in intermediate archiving where a legal obligation or the defense of a right justifies it.

12. Data security

Hexeli implements appropriate technical and organizational measures to protect personal data against:

  • unauthorized access;

  • loss;

  • alteration;

  • destruction;

  • disclosure;

  • or fraudulent use.

Access to data is limited to the persons and providers who need to know it in the course of their duties.

Despite these measures, no electronic transmission or storage can guarantee absolute security.

13. Users' rights

Depending on the nature of the processing and the applicable legal basis, the user may exercise the following rights:

  • the right to access their data;

  • the right to request its rectification;

  • the right to request its erasure;

  • the right to object to certain processing;

  • the right to temporarily restrict processing;

  • the right to data portability;

  • the right to withdraw consent at any time;

  • the right to set out instructions regarding the fate of their data after their death;

  • the right not to be subject to a decision producing legal effects based solely on automated processing, under the conditions provided for by the GDPR.

These rights are not absolute. Certain data may be retained where its processing is necessary to comply with a legal obligation, to perform a contract or to defend legal rights.

14. Exercising your rights

Any request may be sent:

By email: support@hexeli.com

By post:
Hexeli
60 rue François 1er
75008 Paris
France

The request must make it possible to identify its author and specify the right they wish to exercise.

Proof of identity may be requested only where necessary to verify the identity of the requester, in particular in the event of reasonable doubt.

Hexeli responds within a maximum of one month from receipt of the request. This period may be extended by two months where the request is complex or the number of requests is high. The requester will then be informed of this extension.

15. Complaint to the CNIL

If the user considers that their personal data is not being processed in accordance with regulations, they may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés:

CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France

Website: https://www.cnil.fr

The user is invited to contact Hexeli first at support@hexeli.com so that their request can be reviewed.

16. Data relating to minors

Hexeli's products and services are not specifically intended for minors.

A minor must not submit personal data or place an order without the authorization of their legal representative.

Where data collection concerning a minor is identified, Hexeli may request the information needed to verify the legal representative's authorization or delete the data concerned.

17. Changes to this policy

Hexeli may amend this Privacy Policy to take into account legal, regulatory, technical or commercial developments.

The date of the last update is indicated at the beginning of the document.

In the event of a significant change affecting users' rights, appropriate information may be displayed on the website or sent by email where necessary.

18. Contact

For any question regarding this Privacy Policy or the use of personal data:

Email: support@hexeli.com
Phone: +33 1 84 16 45 42

Customer service is available Monday to Friday, 9 a.m. to 6 p.m. (Paris time), excluding public holidays.