Privacy Policy

Last updated: 31 October 2026

Preamble

Chamini operates an online shop accessible via its website, through which it offers products and services for sale (hereinafter the “Services”).

Chamini is a limited liability company (SARL) acting as data controller within the meaning of Regulation (EU) 2016/679 on the protection of personal data (hereinafter the “GDPR”).

Chamini has not appointed a Data Protection Officer (DPO), as it is not legally required to do so given the nature of its activities and of the personal data processing it carries out.

The website is hosted by Shopify Inc., which provides the technical infrastructure needed to operate the Services, including hosting of the shop, order management and secure payment processing.

The purpose of this Privacy Policy is to inform, clearly and transparently, anyone accessing the website or using the Services anywhere in the world (hereinafter the “Users”) of how their personal data is collected, used, stored and protected. This Policy applies to all Users; data processing is carried out under French and European law, in accordance with the GDPR and applicable French legislation.

1. Data controller and contact details

The controller of the personal data collected through the use of the website and the Services is:

Chamini Group,

a limited liability company (SARL),

whose registered office is at 231 rue Saint-Honoré, 75001 Paris, France,

registered with the Trade and Companies Register under number 990 594 806.

Chamini determines the purposes and means of the processing of personal data carried out on the website, in accordance with Regulation (EU) 2016/679 (GDPR) and current French legislation.

For any question about this Privacy Policy, or to exercise their data protection rights, Users may contact Chamini Group:

  • by post: 231 rue Saint-Honoré, 75001 Paris, France

2. Personal data collected

The terms “personal data” or “personal information” refer to any information that directly or indirectly identifies a natural person, or that can reasonably be linked to that person, in connection with the use of the website and the Services.

Data collected anonymously, or irreversibly rendered non-identifiable so that it cannot identify a User, is not personal data.

In connection with the use of the website and the Services, Chamini may collect the following categories of personal data, depending on how the User interacts with the Services and in accordance with applicable law:

2.1. Identification and contact details

Surname, first name, postal address, billing address, delivery address, telephone number and email address.

2.2. Payment data

Information needed to process payments, such as the payment method used, payment confirmation and transaction details.

Payments are processed securely by third-party payment providers. Chamini never stores full card numbers or sensitive banking data.

2.3. Customer account data (where applicable)

Login credentials, password, preferences and account settings when the User chooses to create a customer account.

2.4. Transaction and order data

Products viewed, added to the basket or to a wishlist, purchased, returned, exchanged or cancelled, order and transaction history, and any message entered in the basket (for example for the card accompanying gift wrapping).

2.5. Communications with Chamini

Information provided by the User when communicating with Chamini, in particular via contact forms, emails or social networks.

2.6. Browsing and technical data

Information about the device, browser, network connection and IP address, and about the User’s interactions with the website (pages viewed, date and time of browsing), in particular via cookies.

2.7. Newsletter and offers data

When the User subscribes to the newsletter or to text messages: email address, telephone number (for text messages), first name where provided, subscription preferences, purchase history, and opens and clicks on our emails. The telephone number is used to send marketing text messages only with separate consent (unticked box). The User may unsubscribe at any time using the unsubscribe link in every email or by replying “STOP” to a text message.

2.8. Cookies and trackers

The website uses cookies that are strictly necessary for it to function and, only with the User’s consent, preference, analytics and marketing cookies and trackers (in particular the Meta pixel and the Klaviyo tracker). Details are given in the Cookie Policy. The User may change their choices at any time using the “Manage cookies” link at the bottom of every page of the website.

Personal data is collected either directly from the User when using the Services, or automatically when browsing the website.

The website and the Services are not intended for minors. Chamini does not knowingly collect personal data relating to minors.

Chamini does not collect any special category data within the meaning of the GDPR, in particular no data relating to health, political opinions, religious beliefs or Users’ private lives.

3. Sources of personal data

The personal data collected by Chamini may come from the following sources:

  • directly from the User, in particular when they create a customer account, place an order, contact Chamini, sign up to the Services or voluntarily provide personal information
  • automatically when the Services are used, in particular via the User’s device, while browsing the website, and by means of cookies or similar technologies, in accordance with the preferences expressed by the User
  • from our service providers, when they act on our behalf to operate the website and provide the Services (for example hosting, technical solutions, payment, delivery)
  • from partners or third parties, only where necessary to process orders, deliver products, take payment or operate the website, or where the User has expressly consented, in accordance with applicable law.


4. Children’s data

The Services are not intended for children and Chamini does not knowingly collect personal data relating to minors.

If a parent or legal guardian believes that a child has provided personal data to Chamini without authorisation, they may contact Chamini using the contact details given in this Privacy Policy to request deletion of that data.

Chamini does not carry out any processing of personal data specifically aimed at children and is not aware of any intentional collection of data relating to persons under sixteen (16) years of age.


5. Purposes of processing

Depending on how the User interacts with the website and the Services, Chamini uses the personal data collected for the following purposes:

5.1. Providing and managing the Services

Personal data is used to perform the contract concluded with the User, in particular for:

  • processing and tracking orders and payments
  • managing deliveries, returns and exchanges
  • managing the customer account, where applicable
  • sending communications about orders, the account or customer service

5.2. Improving the operation of the website and the Services

Certain data may be used to analyse how the website works, maintain it, improve its performance, security and usability, and correct any malfunctions.

5.3. Security and fraud prevention

Personal data may be processed in order to:

  • ensure the security of the website and the Services
  • prevent, detect and combat fraud, misuse or malicious activity
  • protect the rights and safety of Chamini and its Users

5.4. Compliance with legal and regulatory obligations

Personal data may be processed to comply with the legal, accounting, tax and regulatory obligations to which Chamini is subject.

5.5. Newsletter, offers and welcome offer

With the User’s consent, their data is used for:

  • sending the newsletter and our offers by email and by text message
  • sending the welcome offer (10% off the first order, one use per customer)
  • personalising our emails according to purchases and products viewed

5.6. Audience measurement and advertising

With the User’s consent, obtained through the cookie banner, certain browsing data (cookie identifiers, pages viewed, items added to the basket, purchases) is used to measure the website’s audience, to show Chamini advertisements on Facebook and Instagram and to measure the effectiveness of those advertisements.


6. Legal bases for processing

Chamini processes Users’ personal data only on legal bases provided for by Regulation (EU) 2016/679 (GDPR):

6.1. Performance of a contract

Personal data is processed to perform the contract concluded with the User, in particular for:

  • processing orders and payments
  • managing deliveries, returns and exchanges
  • managing the customer account, where applicable
  • sending communications about orders or customer service

6.2. Compliance with a legal obligation

Certain data is processed to comply with the legal and regulatory obligations to which Chamini is subject, in particular tax, accounting and commercial obligations.

6.3. Legitimate interests

Personal data may be processed where necessary for Chamini’s legitimate interests, such as:

  • the security of the Services and the prevention of fraud or abuse
  • the protection of the rights and safety of Chamini and its Users

6.4. Consent

The following processing is based on the User’s consent, which may be withdrawn at any time:

  • the newsletter, offers by email and text message, and the welcome offer (unticked box; withdrawal via the unsubscribe link or by replying “STOP” to a text message)
  • preference, analytics and marketing cookies and trackers, including the Meta pixel (cookie banner; withdrawal via the “Manage cookies” link)


7. Sharing data with third parties / disclosure

Chamini does not sell or rent Users’ personal data to third parties. Personal data may, however, be shared in the following circumstances, only where necessary to provide the Services or to comply with applicable law:

7.1. Service providers

Chamini Group shares personal data with the following service providers, who act on its behalf:

  • Shopify (Shopify International Limited, Ireland): website hosting, order and payment management, forms, customer service messaging and automations, with transfers to Canada and the United States
  • Klaviyo (Klaviyo, Inc., United States): sending the newsletter and marketing emails and text messages
  • Meta Platforms Ireland Limited (Facebook and Instagram): advertising pixel, delivery and measurement of advertisements, with transfers to the United States
  • Swym (Wishlist Plus app): management of the wishlist
  • Chronopost and 37express: preparation of shipments, dispatch and delivery of products
  • Pennylane (France): accounting and invoicing

These service providers process the data solely to perform their services and in accordance with Chamini Group’s instructions. For advertising purposes, Meta also processes certain data as a controller, in accordance with its own privacy policy.

7.2. Social networks and third-party integrations

When the User interacts with Chamini via social media platforms (Instagram, Facebook, TikTok, Pinterest) or uses integrated third-party features, certain data may be transmitted to those platforms as part of the use of their services. Those platforms process the data in accordance with their own privacy policies.

7.3. Affiliates and internal partners (where applicable)

Chamini may share certain data with its subsidiaries or partners solely for operational, administrative or legal reasons, in strict compliance with applicable law.

7.4. Legal obligations and protection of rights

Personal data may be shared in order to:

  • comply with legal or regulatory obligations;
  • enforce the terms and conditions and protect the rights, safety and interests of Chamini, its Users or third parties;
  • carry out legal transactions such as a merger, acquisition or transfer of assets.

7.5. Transfers outside the European Union

Some service providers are located outside the European Union or transfer data outside it: Shopify (Canada, United States), Klaviyo (United States) and Meta (United States). These transfers are covered by an adequacy decision of the European Commission (Canada; United States for companies certified under the EU–US Data Privacy Framework) or by standard contractual clauses approved by the European Commission. Users may obtain a copy of these safeguards by writing to serviceclient@chaminiparis.com.

8. Third-party websites and links

The Services may contain links to websites or online platforms operated by third parties. Those third-party sites have their own privacy policies and terms of use, over which Chamini has no control.

Chamini cannot be held responsible for the privacy, security, content or operating practices of those third-party sites or platforms, nor for the accuracy, completeness or reliability of the information they provide.

Information that Users choose to share in public or semi-public spaces, in particular on third-party social media platforms, may be visible to other users and used by those platforms in accordance with their own policies. Chamini has no control over the use of such information by third parties.

Links to third-party sites or platforms do not constitute an endorsement by Chamini of their content, services or practices, unless expressly stated otherwise. Users are invited to read the privacy and security policies of those third-party sites when interacting with them, in order to understand how their information may be used.


9. Retention periods

CHAMINI keeps Users’ personal data only for as long as necessary for the purposes for which it was collected, in accordance with applicable law and legal obligations.

9.1. Order and payment data

Information needed to perform an order and for invoicing is kept for 10 years, in accordance with French legal and tax obligations.

9.2. Customer account data

Customer account information is kept for as long as the account is active.

In the event of prolonged inactivity, the account and associated data are deleted or anonymised 3 years after the last login.

9.3. Communications with customer service

Information exchanged with customer service is kept for 2 years after the request has been resolved, and is then deleted or anonymised.

9.4. Browsing and technical data

Information collected automatically via the website (cookies, IP address, browsing information) is kept for a maximum of 13 months, in accordance with the recommendations of the CNIL. The choice expressed in the cookie banner is kept for 6 months, after which the banner is shown again.

9.5. Data kept for legal obligations or the protection of rights

Certain data may be kept for longer solely to comply with legal, regulatory or accounting obligations, or to protect CHAMINI’s rights in the event of a dispute.

9.6. Newsletter and offers

Data used for the newsletter and text messages is kept until the User withdraws their consent and for no longer than 3 years after their last contact with Chamini (for example a purchase, a click in an email or a request).

9.7. Wishlist

The wishlist is kept until the User deletes it and for no longer than 3 years after it was last used.


10. Users’ rights

In accordance with Regulation (EU) 2016/679 (GDPR) and applicable French law, Users have the following rights regarding their personal data.

10.1. Right of access

You have the right to ask Chamini for access to the personal data concerning you and to receive a copy of it.

10.2. Right to rectification

You may request the correction or updating of your personal data where it is inaccurate or incomplete.

10.3. Right to erasure (right to be forgotten)

You may request the deletion of your personal data where:

  • it is no longer necessary for the purposes for which it was collected
  • you withdraw your consent and no other legal basis justifies the processing
  • you object to the processing and no legal obligation prevents erasure

10.4. Right to restriction of processing

You may request the restriction of the processing of your personal data in certain cases, in particular:

  • where you contest the accuracy of the data
  • where you have objected to the processing, while your request is being examined
  • where Chamini no longer needs the data, except for the establishment, exercise or defence of legal claims.

10.5. Right to data portability

Where processing is based on your consent or on the performance of a contract and is carried out by automated means, you may ask to receive your data in a structured, commonly used and machine-readable format, or to have it transmitted to another controller where technically feasible.

10.6. Right to object

You may object at any time to the processing of your personal data based on Chamini’s legitimate interests, except where the processing is justified by a legal or contractual obligation.

10.7. Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

10.8. Exercising your rights

To exercise your rights, you may contact Chamini:

Chamini undertakes to respond to any request relating to the exercise of data subjects’ rights within one (1) month of receipt of the request.

This period may be extended by two (2) further months where a request is complex or requests are numerous, in accordance with applicable regulations. In that case, the User will be informed of the extension and the reasons for it.

10.9. Right to lodge a complaint

If you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL) or with the competent data protection authority in your country of residence.


11. Security of personal data

Chamini implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of Regulation (EU) 2016/679 (GDPR).

Personal data collected through the Services is hosted by third-party technical providers selected for their security and regulatory compliance guarantees, in particular through the use of the Shopify platform and the services associated with operating the website (hosting, domain name, network infrastructure).

Chamini ensures that access to personal data is strictly limited to authorised persons and to service providers, and only to the extent necessary to provide the Services. Appropriate security measures (such as encryption, access control and system protection) are implemented by the technical providers concerned to protect personal data against loss, alteration, unauthorised access or unlawful disclosure.

No electronic transmission or storage system is completely secure. Chamini therefore cannot guarantee absolute security, but undertakes to act diligently and in accordance with legal requirements in the event of a personal data breach.

Security measures are applied in accordance with French and European law, including for Users located outside the European Union.


12. Changes to this Privacy Policy

Chamini reserves the right to amend or update this Privacy Policy at any time, in particular to reflect:

  • legal or regulatory changes
  • changes in its practices or Services
  • the introduction of new features or tools (for example marketing or advertising campaigns)

The version in force is the one published on the website at the time of consultation.

In the event of a substantial change, Chamini may inform Users by any appropriate means.

Users are advised to consult this Privacy Policy regularly in order to keep informed of any updates.