Privacy policy
English version. Last updated: 14 October 2026
This policy explains what data we collect when you visit marquoir.com or place an order, why, who we share it with and what your rights are (Regulation (EU) 2016/679 "GDPR" and the French Data Protection Act).
1. Data controller
Adem Nasri — Marquoir, entrepreneur individuel (EI), micro-entreprise, 12 rue d'Orchampt, 75018 Paris, France — SIREN 889 817 383 (SIRET 889 817 383 00025). Contact for any question about your data: contact@marquoir.com.
2. Data we collect
- Order: first and last name, shipping and billing address, email, phone number, chosen personalisation (two letters, finish, length), order content and amount.
- Payment: payment is processed by our provider; we only receive the payment status and limited information (card type, last 4 digits). We never have access to your full card number.
- Communications: your messages to customer service.
- Browsing: IP address, device and browser type, pages viewed, cookie data (see section 9).
Required data. The order data marked as required at checkout (name, shipping address, email, phone, personalisation) is needed to enter into and perform the contract: without it, we cannot prepare or deliver your necklace. Other data is optional.
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Processing your order: preparing the necklace, shipping, tracking, invoicing | Performance of the contract |
| Customer service, legal guarantees, "we remake it" commercial guarantee | Performance of the contract; legal obligation |
| Accounting and tax obligations | Legal obligation |
| Fraud prevention and website security | Legitimate interest (protecting the store and its customers) |
| Audience statistics, personalised advertising | Consent (cookie banner) |
| Email offers on similar products, sent to our customers | Legitimate interest, which you can refuse when ordering and in every email (art. L34-5 of the French Postal and Electronic Communications Code) |
Automated fraud analysis. Shopify and our payment provider automatically analyse each order (address, IP address, payment data) to assess a fraud risk. A payment may be declined automatically by the payment provider. If this happens to you, you can write to us to obtain human intervention, express your point of view and contest the decision (art. 22 GDPR).
4. Who receives your data
Only the people and companies who need it for the purposes above:
- Shopify (hosting of the store and order system) — Shopify International Limited, Dublin, Ireland, and its affiliates;
- Cloudflare, Inc. (United States) — technical service that forwards your order to AliExpress and keeps it for the time of that transfer: your address is deleted from it as soon as the order is placed with the manufacturer; if the order has to be handled manually or fails, at the latest 30 days after the last operation on the order;
- AliExpress and our partner manufacturer — receive your name, shipping address, phone number and personalisation to prepare and ship your necklace. AliExpress (Alibaba.com Singapore E-Commerce Private Limited, Singapore) processes this data as a separate data controller, under its own privacy policy: https://terms.alicdn.com/legal-agreement/terms/suit_bu1_aliexpress/suit_bu1_aliexpress201909171350_82407.html;
- carriers (postal services and delivery companies in transit and destination countries) — receive the data needed for delivery;
- the parcel tracking service the tracking link points to (17TRACK) — receives only the tracking number, when you open that link;
- payment providers — Shopify Payments, whose payment processor is Stripe Payments Europe, Limited (Ireland); if you choose PayPal or Klarna, those companies receive the data needed for payment and process it under their own privacy policies;
- Google (Google Ireland Limited, Dublin, Ireland) — audience measurement with Google Analytics and free listing of our products on Google (Merchant Center), through Shopify's Google & YouTube app, only if you accept measurement cookies (Google consent mode). Event data is kept for 14 months in Google Analytics. We use no Meta or TikTok pixel;
- authorities, only where required by law.
We never sell your data.
5. Transfers outside the European Union
Some recipients are located outside the European Union:
- Singapore and China — to prepare and ship your necklace, we send your name, shipping address, phone number and personalisation to AliExpress (an entity located in Singapore), which forwards them to our partner manufacturer in China. Neither Singapore nor China is covered by a European Commission adequacy decision: the level of protection of your data there is not recognised as equivalent to that of the European Union, and your rights may be harder to exercise there. This transfer relies on its necessity to perform your order (article 49(1)(b) and (c) GDPR). We limit the data sent to what is strictly necessary.
- United States — Cloudflare, Google (Google LLC) and, where applicable, Shopify and its sub-processors. These transfers rely on the EU–US Data Privacy Framework (Commission adequacy decision of 10 July 2023) for certified companies, or on the European Commission's standard contractual clauses (article 46 GDPR).
- Canada — Shopify, covered by a European Commission adequacy decision.
- Destination countries — for deliveries outside the EU, the destination carrier receives the data needed for delivery, at your request (article 49(1)(b) GDPR).
You can obtain information about these safeguards, and a copy of the applicable clauses, by emailing contact@marquoir.com.
6. Retention periods
| Data | Period |
|---|---|
| Orders and customer relationship | Duration of the order and guarantees, then 5 years (limitation period) |
| Invoices and accounting records | 10 years (article L123-22 of the French Commercial Code) |
| Technical copy of the order at Cloudflare | Address deleted once forwarded to the manufacturer; order handled manually or failed: at the latest 30 days after the last operation |
| Customer service messages | 3 years after the last exchange |
| Email marketing (customers) | 3 years after your last contact, or until you unsubscribe |
| Cookies requiring consent | 13 months maximum for the cookies themselves; your choice (consent or refusal) is kept for 6 months, then asked again |
Data sent to AliExpress, the manufacturer and carriers is kept by them under their own policies. AliExpress states that it keeps data for as long as it has an ongoing legitimate need, and longer where the law requires or to resolve disputes (see its privacy policy).
7. Your rights
You may at any time request access to your data, its rectification or erasure, restriction of processing, object to processing (including marketing, without giving a reason), request portability, withdraw your consent, and set instructions for what happens to your data after your death.
Email contact@marquoir.com. We reply within one month. We may ask you to prove your identity if there is reasonable doubt.
If you believe your rights have not been respected, you may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr) or with the data protection authority of your country of residence.
8. Security
The website uses HTTPS. Order data is hosted by Shopify, which complies with the PCI DSS payment security standard. Access to data is limited to those who need it.
9. Cookies
The website uses cookies needed for it to work (cart, checkout, security, remembering your language and cookie choice), which do not require consent. It uses no advertising cookies. Audience measurement cookies (Shopify analytics and Google Analytics) are set only with your consent, collected through the cookie banner shown on your first visit. You can change your choice at any time via the "Cookie preferences" link in the footer.
10. Children
The store is not intended for children. We do not knowingly collect data about people under 15 without the consent of their legal guardian.
11. Changes
We may update this policy. The date of the last update appears at the top of the page.