Privacy Policy

Art. 1 — Data controller

The controller responsible for personal data collected on lezaart.com is Leza Art, a French sole trader (auto-entrepreneur), 5115 route des Hauts du Camp, 83330 Le Castellet, France, reachable at contact@lezaart.com.

Art. 2 — Data collected

We collect the following data, depending on your use of the site:

• Customer account: identity (first and last name), email address, postal address, phone number;
• Orders: order history, products purchased, amounts, delivery method, pickup point where applicable;
• Payment: no banking data is collected or stored by Leza Art — payment is processed directly by our provider, Stripe (see article 5).

Art. 3 — Purposes and legal bases

Art. 4 — Retention period

Data related to invoices is kept for 5 years, in accordance with our accounting and tax obligations. Data from the customer account is kept for as long as the account remains active; in the event of prolonged inactivity or a deletion request, it is deleted or archived in a form limited to legal retention obligations only.

Art. 5 — Data recipients

Your data is neither sold nor rented. It is shared only with the providers strictly necessary to fulfil your order:

• Stripe (online payment), acting as a data processor, for secure payment processing;
• Colissimo and Mondial Relay (carriers), solely for generating the shipping label (name, address, phone number).

These providers operate within the European Union; no data is transferred outside the European Union as part of this processing.

Art. 6 — Your rights

In accordance with the General Data Protection Regulation (GDPR, articles 15 to 22) and the French Data Protection Act, you have the following rights over your personal data:

• right of access;
• right to rectification;
• right to erasure ("right to be forgotten");
• right to data portability;
• right to object and to restrict processing.

To exercise any of these rights, contact us at contact@lezaart.com. If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the CNIL (French Data Protection Authority) — cnil.fr.

Art. 7 — Cookies and audience measurement

The Site only uses cookies that are strictly necessary for your session to work (authentication and keeping you signed in to your account, via our technical provider Supabase) and for processing payment (Stripe). These cookies do not require prior consent under article 82 of the French Data Protection Act.

For audience measurement, the Site uses Umami Cloud and Vercel Analytics. Both tools are configured without any cookie and without a tracking identifier: visits are counted in an anonymised and aggregated way (pages viewed, approximate origin, device type), with no advertising, no profiling, no cross-referencing with other processing, and no tracking of your browsing on other sites. In accordance with the CNIL's recommendation on cookies and other trackers, this consent-exempt audience measurement does not require a consent banner. You may object to this audience measurement at any time by writing to us at contact@lezaart.com.

The Site uses no advertising cookies and no third-party trackers for marketing purposes.

Art. 8 — Security

Leza Art implements reasonable technical and organisational measures to protect your data against unauthorised access, loss, or alteration: secure hosting, restricted access, encryption of exchanges (HTTPS), and the use of recognised providers (Stripe for payment, Supabase for hosting account data).