Powered by Smartsupp

Privacy Policy

Privacy Policy

ELECTRO PO SASU attaches particular importance to respecting your privacy and protecting your personal data. This Privacy Policy describes the processing of personal data carried out on the website www.electropo.fr, in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR") and Law No. 78-17 of 6 January 1978 as amended on data processing, files and individual liberties ("French Data Protection Act").

1. Identity and Contact Details of the Data Controller

  • Data controller: ELECTRO PO SASU
  • Represented by: Jean-Baptiste Paul Joseph Benet, president
  • Registered office: Centre Commercial Frunshopping ZAC Creu Blanca A l'Angle du Chemin Rural, 6, 66450 Pollestres, France
  • SIREN: 917 769 085 — RCS Perpignan
  • Email: info@electropo.fr
  • Phone: +33 (0)6 33 32 81 46

2. Data Protection Officer (DPO)

Given the nature, context and purposes of the processing carried out, ELECTRO PO SASU is not required to designate a data protection officer within the meaning of Article 37 of the GDPR. An internal GDPR contact is nevertheless available for any enquiries at info@electropo.fr.

3. Purposes of Processing and Legal Bases

Your personal data is collected and processed for the following purposes, each founded on a specific legal basis within the meaning of Article 6 of the GDPR:

  • Order management and performance of the contract of sale — delivery, invoicing, after-sales service. Legal basis: performance of a contract to which the data subject is a party (Art. 6.1.b GDPR).
  • Customer account management — purchase history, preferences, delivery addresses. Legal basis: performance of a contract (Art. 6.1.b GDPR).
  • Compliance with legal, accounting and tax obligations — retention of invoices, traceability obligations, fraud prevention. Legal basis: legal obligation (Art. 6.1.c GDPR).
  • Sending commercial communications by email (newsletter, offers, new products). Legal basis: consent (Art. 6.1.a GDPR), withdrawable at any time.
  • Audience measurement and traffic analysis — analytical cookies. Legal basis: consent (Art. 6.1.a GDPR) for non-essential cookies.
  • Website security, prevention of attacks and payment fraud. Legal basis: legitimate interest of the data controller (Art. 6.1.f GDPR).
  • Handling of complaints and disputes. Legal basis: legitimate interest (Art. 6.1.f GDPR).

4. Categories of Data Collected

We collect only the data strictly necessary for the purposes pursued (minimisation principle, Art. 5.1.c GDPR):

  • Identification data: title, surname, first name.
  • Contact data: postal delivery and billing address, email address, telephone number.
  • Transaction data: products ordered, quantities, amount, order history.
  • Payment data: IBAN for SEPA transfers (provided by you). For card payments, no banking data is stored by ELECTRO PO SASU: it is transmitted directly to the secure payment service provider and processed in accordance with the PCI-DSS standard.
  • Connection and browsing data: IP address, browser type, pages visited, dates and times of visits — collected only in cases of consent to analytical cookies or for website security purposes.

No data falling within the special categories referred to in Article 9 of the GDPR (sensitive data) is processed by ELECTRO PO SASU.

5. Origin of Data

Personal data is collected exclusively from you, at the time of account creation, when placing an order, when subscribing to the newsletter, or during an exchange with our customer service. We do not collect data from third parties.

6. Recipients of Data

Your data may be communicated, strictly to the extent necessary for their mission, to the following categories of recipients:

  • Authorised personnel of ELECTRO PO SASU (order department, customer service, accounting).
  • Payment service provider for the processing of card payments, in accordance with PCI-DSS rules.
  • Transactional email service provider (Hostinger SMTP) — for sending order confirmations and invoices.
  • Accounting firm — for bookkeeping and preparation of tax returns.
  • Administrative, fiscal and judicial authorities — upon legal requisition.

No data is sold, rented or transferred to third parties for commercial purposes.

7. Transfers Outside the European Union

Personal data is hosted and processed primarily within the European Economic Area. Certain technical service providers may be established outside the EU. In such cases, any transfer is governed by the mechanisms provided for in Chapter V of the GDPR (European Commission adequacy decisions, standard contractual clauses adopted on 4 June 2021, or appropriate additional measures).

8. Retention Periods

Data is retained only for the period necessary for the purposes pursued:

  • Order and invoicing data: 10 years from the close of the financial year, in accordance with Article L123-22 of the Commercial Code.
  • Customer account data: for the duration of the contractual relationship, then 3 years from the last active contact with the Customer for commercial prospecting purposes (CNIL deliberation No. 2016-264).
  • Newsletter data: until consent is withdrawn, or 3 years after the last active contact.
  • Cookies: in accordance with the periods specified in the Cookie Policy, within a limit of 13 months for cookies placed on the visitor's device, in accordance with CNIL recommendations.
  • Security logs: 12 months from collection.

9. Your Rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR) — to obtain confirmation that your data is being processed and to receive a copy.
  • Right to rectification (Art. 16 GDPR) — to have inaccurate or incomplete data corrected.
  • Right to erasure (Art. 17 GDPR) — also known as the "right to be forgotten", in the cases provided for by law.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR) — to receive your data in a structured, commonly used format.
  • Right to object (Art. 21 GDPR) — to object to processing on grounds relating to your particular situation, in particular to commercial prospecting.
  • Right to withdraw consent at any time (Art. 7.3 GDPR), without affecting the lawfulness of processing carried out prior to withdrawal.
  • Right to define instructions regarding the fate of your data after your death, in accordance with Article 40-1 of the French Data Protection Act.
  • Right not to be subject to a decision based solely on automated processing producing legal effects (Art. 22 GDPR) — no automated decision of this type is implemented by ELECTRO PO SASU.

These rights may be exercised free of charge by email at info@electropo.fr or by post to: ELECTRO PO SASU, Centre Commercial Frunshopping ZAC Creu Blanca A l'Angle du Chemin Rural, 6, 66450 Pollestres, France. Proof of identity may be requested in the event of reasonable doubt as to the identity of the applicant. We undertake to respond within a maximum period of one month from receipt of the request, extendable by two months given the complexity or number of requests.

10. Right to Lodge a Complaint

In the event of persistent disagreement regarding the processing of your data, you have the right to lodge a complaint with the competent French supervisory authority:

  • Commission Nationale de l'Informatique et des Libertés (CNIL)
  • 3 place de Fontenoy — TSA 80715 — 75334 PARIS CEDEX 07
  • Phone: +33 1 53 73 22 22
  • Website: https://www.cnil.fr/

Residents of other EU Member States: you may also contact the supervisory authority of your habitual place of residence, in accordance with Article 56 of the GDPR (one-stop-shop mechanism).

11. Data Security

ELECTRO PO SASU implements appropriate technical and organisational measures to ensure a level of security commensurate with the risk, in accordance with Article 32 of the GDPR: TLS/SSL encryption of communications, access compartmentalisation, regular backups, logging of administrator access, passwords stored in hashed form (bcrypt/argon2 algorithms).

In the event of a data breach likely to result in a high risk to the rights and freedoms of data subjects, ELECTRO PO SASU notifies the CNIL within 72 hours and informs the data subjects concerned, in accordance with Articles 33 and 34 of the GDPR.

12. Minors

The products sold on the website are intended for adult customers. No account may be opened by a person under the age of fifteen (15) without the consent of those holding parental authority, in accordance with Article 7.1 of the French Data Protection Act.

13. Amendments to this Policy

This Privacy Policy may be amended at any time to reflect legislative, regulatory or functional developments. The version in force is the one published on the website at the time of consultation.

Last updated: 27 August 2026.