Informations légales
Privacy policy
Data controller
[[RAISON_SOCIALE]], [[FORME_JURIDIQUE]], [[ADRESSE_SIEGE]] — [[EMAIL_CONTACT]], [[TELEPHONE]]. The company is established in the United States and sells to consumers located in the European Union.
Regulation (EU) 2016/679 (GDPR) applies to this processing under its Article 3(2): we offer goods to people in the Union and we monitor their online behaviour when you consent to it.
Representative in the European Union
Article 27 GDPR requires the written designation of a representative established in the Union. The Article 27(2)(a) exemption, reserved for occasional processing, does not apply to a permanent store using analytics and e-mail marketing.
Representative: [[REPRESENTANT_UE_RGPD]]. The designation is in progress; the identity and contact details will appear here, in accordance with Article 13(1)(a). You will be able to contact the representative about any question regarding your data.
Data we process
On this storefront
The site currently has no form and collects no e-mail address. It only stores two items in your browser’s local storage, strictly necessary for the service you asked for:
- ultmx-lang: the language you selected.
- ultmx-cart: the contents of your cart.
This information stays in your browser and is not sent to us until you place an order.
Order and delivery
- First and last name, delivery and billing address, country.
- E-mail address and phone number, needed for tracking and for delivering a bulky appliance.
- Order details, amount, order-related correspondence, returns and refunds.
Payment
Payment is processed by Shopify (Shopify Payments) or PayPal. We neither receive nor store your full card number. We receive the transaction status and what is needed for invoicing and fraud prevention.
Server logs
IP address, date and time, pages requested, browser and device type. These logs are used for security, abuse detection and debugging.
Analytics
Google Analytics 4, only if you consent: page views, journeys, traffic source, cookie identifiers. Nothing is stored before your consent.
Chat, reviews and e-mails
- Chat: the content of your conversation and the contact details you provide in it.
- Customer reviews: the name or nickname you choose, the rating, the text and any images published.
- E-mail marketing: your e-mail address, only if you sign up, plus opens and clicks on our messages.
Purposes and legal bases
| Process, ship and track your order, handle returns | Performance of the contract — Art. 6(1)(b) |
|---|---|
| Remember your language and your cart | Performance of the contract or pre-contractual steps — Art. 6(1)(b) |
| Answer your requests (chat, e-mail) | Performance of the contract — Art. 6(1)(b) or legitimate interest — Art. 6(1)(f) |
| Analytics (Google Analytics 4) | Consent — Art. 6(1)(a) |
| Marketing e-mails | Consent — Art. 6(1)(a) |
| Publication of your customer reviews | Consent — Art. 6(1)(a) |
| Site security and fraud prevention | Legitimate interest — Art. 6(1)(f) |
| Accounting and tax obligations | Legal obligation — Art. 6(1)(c) |
Retention periods
| Order and invoicing data | As long as needed to perform the contract and honour the warranty, then for the period required by applicable accounting and tax obligations |
|---|---|
| Customer service correspondence, chat | As long as needed to handle the request and follow the warranty |
| Server logs | A short period, limited to security and debugging needs |
| Google Analytics 4 analytics cookies | 13 months maximum |
| Proof and storage of your cookie choice | 6 months |
| E-mail address for marketing | Until you withdraw your consent or unsubscribe |
| Published customer reviews | As long as the review is published, then deleted on request |
| Local storage ultmx-lang and ultmx-cart | Until you clear your browser data |
Recipients and processors
| Shopify | Store hosting, order management, payment (Shopify Payments) |
|---|---|
| PayPal | Payment, if you choose that method |
| Google Analytics 4, only with your consent | |
| Customer review app | Collection and publication of reviews — provider to be named before launch |
| Chat tool | Answering your questions — provider to be named before launch |
| E-mail marketing tool | Sending the messages you signed up for — provider to be named before launch |
| Carrier | Delivery and appointment scheduling |
| [[REPRESENTANT_UE_RGPD]] | Handling data subject requests in the Union |
We do not sell your personal data.
Transfers outside the European Union
The controller is established in the United States: your data is transferred there.
Implementing Decision (EU) 2023/1795 of 10 July 2023 established the EU–US Data Privacy Framework. It is in force; the action for annulment was dismissed by the General Court on 3 September 2025 (Case T-553/23, Latombe).
A US company may rely on that decision only if it is self-certified on the list kept by the U.S. Department of Commerce (dataprivacyframework.gov). Otherwise, the transfer must rely on the standard contractual clauses of Implementing Decision (EU) 2021/914.
Status of our certification: [[STATUT_CERTIFICATION_DPF]]. As long as that certification is not obtained, transfers rely on the standard contractual clauses of Decision (EU) 2021/914. You may request a copy at [[EMAIL_CONTACT]].
Your rights
- Access to your data — Art. 15.
- Rectification — Art. 16.
- Erasure — Art. 17.
- Restriction of processing — Art. 18.
- Portability — Art. 20.
- Objection — Art. 21.
- Withdrawal of consent at any time, without affecting the lawfulness of processing already carried out — Art. 7(3).
- Not to be subject to a decision based solely on automated processing — Art. 22. We take no such decisions.
To exercise these rights: [[EMAIL_CONTACT]] or [[REPRESENTANT_UE_RGPD]]. We may ask for an element allowing us to verify your identity.
Complaint
You may lodge a complaint with the supervisory authority of your Member State of residence, in accordance with Article 77 GDPR.
California residents
The CCPA, as amended by the CPRA, applies to businesses meeting one of these thresholds: $26,625,000 in annual revenue, or the data of 100,000 or more California consumers, or 50% of revenue derived from selling or sharing personal data.
As of today, the store meets none of these thresholds. We do not sell or share your personal data for targeted advertising, and we honour Global Privacy Control (GPC) signals sent by your browser. If a threshold were crossed, this policy would be updated before processing continued.
Do Not Track and Global Privacy Control
In accordance with CalOPPA, we state how we respond to do-not-track signals: a Do Not Track or Global Privacy Control signal is treated as a refusal of analytics and marketing cookies. Strictly necessary trackers remain active.
Third parties tracking users across other sites: if you consent, Google Analytics 4 sets its own cookies on this site. We authorise no other third party to collect information about your browsing on other sites from our store.
Marketing e-mails
Every marketing e-mail carries a valid physical postal address — [[ADRESSE_SIEGE]] — and an unsubscribe link. In accordance with the CAN-SPAM Act, any unsubscribe request is processed within 10 business days at most. In the Union, marketing e-mails are sent only after your consent.
Security
The site is served over HTTPS. Access to order data is limited to the people who need it and to the providers listed above.
Changes to this policy
Any change is published on this page, with a new update date at the bottom. If the categories of data or the purposes change materially, a notice is displayed on the site and, if you are subscribed to our e-mails, a message is sent to you.
Effective date: [[DATE_MAJ]]
Last updated: [[DATE_MAJ]]