GDPR Policy

GDPR Policy

At Ellaun, we are committed to protecting your personal data and complying with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and the UK GDPR. This policy describes how we collect, use and protect your personal information.

1. Data Controller

The data controller for your personal data is: Ellaun (Groupe NKH)

Contact email: contact@ellaun.com

Address: 5 Rue des 50 Arpents, 77680 Roissy-en-Brie, France

2. Types of Data Collected

We collect the following information:

• Identification data: First name, last name, email address, phone number.
• Delivery data: Delivery address.
• Payment data: Information relating to your payment method (processed via secure payment providers — we do not store your card details directly).
• Browsing data: Information about your use of our site (cookies, IP address, pages visited, etc.).

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Processing and managing your orders.
• Communicating the status of your orders.
• Improving our services and your user experience.
• Sending promotional offers and newsletters (only if you have given your consent).
• Fraud prevention and security.
• Compliance with our legal obligations.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Performance of a contract — Art. 6(1)(b) GDPR: Processing your orders and providing our services.
• Consent — Art. 6(1)(a) GDPR: Sending newsletters and promotional offers.
• Legitimate interests — Art. 6(1)(f) GDPR: Improving our services, fraud prevention and security.
• Legal obligation — Art. 6(1)(c) GDPR: Compliance with applicable legal requirements.

5. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, or to comply with our legal obligations. In general:

• Order and transaction data: Retained for up to 10 years for accounting and legal compliance purposes.
• Account data: Retained for the duration of your account and up to 3 years after your last activity.
• Marketing data: Retained until you withdraw your consent or opt out.

6. Your Rights

In accordance with the GDPR, you have the following rights:

• Right of access: You may request access to your personal data that we hold.
• Right of rectification: You may request the correction of inaccurate or incomplete data.
• Right of erasure (right to be forgotten): You may request the deletion of your data under certain conditions.
• Right to restriction of processing: You may request the limitation of how we process your data.
• Right to data portability: You may request to receive your data in a structured, commonly used and machine-readable format.
• Right to object: You may object to the processing of your data for direct marketing purposes at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at: contact@ellaun.com

We will respond to your request within 30 days as required by the GDPR. We may need to verify your identity before processing your request.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against any unauthorised access, loss, alteration or disclosure. These measures include:

• SSL/TLS encryption for all data transmitted on our site.
• Restricted access to personal data within our organisation.
• Use of secure, GDPR-compliant third-party services (Shopify, payment processors).

Please be aware that no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

8. Data Transfers

We do not transfer your personal data outside the European Economic Area (EEA) or the United Kingdom, except where necessary for processing your order (for example, delivery services or our e-commerce platform provider Shopify).

Any such transfers are made with appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses or equivalent mechanisms recognised under UK law, to ensure your data receives an adequate level of protection.

9. Cookies

We use cookies to improve your experience on our site. Cookies are small text files stored on your device. We use the following types of cookies:

• Essential cookies: Necessary for the site to function properly (e.g. shopping cart, secure login).
• Analytics cookies: Help us understand how visitors interact with our site (e.g. Google Analytics).
• Marketing cookies: Used to deliver relevant advertisements (e.g. Meta Pixel, Google Ads).

You can manage your cookie preferences in your browser settings or via our consent banner when you first visit our site. Disabling certain cookies may affect the functionality of our site.

10. Sharing Your Data with Third Parties

We may share your personal data with trusted third parties strictly for the purposes described in this policy, including:

• Shopify Inc. — our e-commerce platform provider.
• Payment processors (e.g. Stripe, PayPal) — for secure payment processing.
• Delivery carriers — to fulfil and track your orders.
• Marketing platforms (e.g. Google, Meta) — for advertising purposes (with your consent).

We do not sell your personal data to third parties. All third parties are contractually bound to process your data securely and in accordance with applicable data protection law.

11. Complaints

If you have a complaint about how we handle your personal data, please contact us first at the address below. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority:

• France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr
• United Kingdom: Information Commissioner's Office (ICO) — www.ico.org.uk
• European Union: Your national supervisory authority — https://edpb.europa.eu/about-edpb/about-edpb/members_en

12. Changes to This Policy

We reserve the right to modify this policy at any time. Any changes will be published on this page with an updated date. We encourage you to review this policy periodically to stay informed of how we protect your data.

13. Contact

We respond to all enquiries within 24 hours.

Contact Information

Trade name: Ellaun

Legal name: Groupe NKH

Legal representative: Hassan Nordine Kharachi

Legal form: Sole trader (Entreprise individuelle)

Phone: +33 7 49 01 43 63

Email: contact@ellaun.com

Physical address: 5 Rue des 50 Arpents, 77680 Roissy-en-Brie, France

SIREN: 934 980 814

SIRET: 934 980 814 00024

VAT number: FR50934980814

APE/NAF code: 4791B

Activity: Online retail sale via distance selling

Customer service hours: Monday to Friday, 9am – 6pm CET. Closed weekends and public holidays.

Contact us: https://ellaun.com/pages/contact

FAQ: https://ellaun.com/pages/faq

Order tracking: https://ellaun.com/pages/track-my-order