Privacy policy

Data controller

The data controller is A. Saba, sole trader trading as HeadGrid, Rue du Lieutenant André, 71100 Chalon-sur-Saône, France — contact@headgrid.fr (SIREN 991 932 401).

Data collected and purposes

Orders: email address, name, delivery address, phone number and order contents. This data is required to perform the sales contract (order processing, production, delivery, status emails). Legal basis: performance of a contract.

Payment: card details are entered directly with Stripe and never pass through our servers. We only keep a transaction reference. Legal basis: performance of a contract and legal obligation (fraud prevention).

Custom quote requests: name, email address, desired configuration, notes and any reference images. Legal basis: pre-contractual steps taken at your request.

Invoicing and accounting: order records are kept to meet our legal obligations. Legal basis: legal obligation.

Recipients and processors

Data is processed by the following processors, strictly for the purposes described: Stripe Payments Europe Ltd (secure payment), Resend Inc. (transactional emails), Neon Inc. (database hosting) and o2switch SAS (site hosting, France). No data is sold or shared with third parties for advertising purposes.

Some of these providers may process data outside the European Union; such transfers are governed by the European Commission's standard contractual clauses.

Retention periods

Order data and accounting records: 10 years from the end of the financial year, as required by the French Commercial Code. Quote requests without follow-up: 3 years after last contact. Internal admin accounts: duration of the relationship.

Cookies and local storage

Strictly necessary cookies (no consent required): Stripe security cookies during payment (fraud prevention) and a session cookie for the internal admin area. Your cart is stored locally in your browser (localStorage) and is only sent to our servers at payment time.

Audience measurement (only with your consent): Google Analytics 4 (Google Ireland Ltd) helps us understand site traffic. These trackers are only set if you click “Accept” in the consent banner; you can withdraw your consent at any time via the “Cookies” link in the footer. No advertising cookies are used.

Your rights

Under the GDPR and French data protection law, you have the right to access, rectify, erase, restrict, port and object to the processing of your data. To exercise these rights, write to contact@headgrid.fr describing your request; we will respond within one month.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (www.cnil.fr), the French supervisory authority.