Privacy policy

Last updated: 3 October 2026

This policy explains what personal data we collect when you visit magnoliayarns.com (the “Site”) or order from it, why we collect it, how long we keep it, who we share it with and how to exercise your rights. It applies the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Who is responsible for your data

The data controller is Loïc Sonniez, sole trader (entrepreneur individuel, EI), trading as SLMS Trading for the Magnolia Yarns shop, 170 chemin Oratoire Sainte Victoire, 13126 Vauvenargues, France.

For any question about your data, or to exercise your rights, email magnoliayarns98@gmail.com.

2. The data we collect

  • When you order: first and last name, delivery and billing addresses, email address, phone number if you give it (the carrier uses it), products ordered, amounts, and the history of your orders and of our exchanges. Your card details are entered directly with our payment provider: we never have access to them.
  • If you create a customer account: your email address, which you use to sign in, your name, saved addresses and past orders.
  • If you sign up for our newsletter: your email address, and the date and proof of your consent.
  • If you ask for a back-in-stock alert: your email address, or your phone number if you prefer, and the shade you are waiting for.
  • If you write to us: your name, email address and the content of your message.
  • When you browse the Site: IP address, device and browser type, pages viewed, cart contents and referring site, collected by cookies and similar technologies (see section 7).

3. Why we use it, and for how long

What we do Legal basis How long we keep it
Process, ship and track your orders; handle returns, withdrawals and refunds Performance of the contract For the order and its follow-up, then 5 years (statutory limitation period)
Issue invoices and keep our accounts Legal obligation 10 years (article L123-22 of the French Commercial Code)
Manage your customer account Performance of the contract Until you ask us to delete it, and no more than 3 years after your last order or sign-in
Answer your messages and complaints; apply the statutory guarantees Performance of the contract and legitimate interest While we handle your request, then 5 years (statutory limitation period)
Send you our newsletter Consent Until you unsubscribe, or 3 years without any interaction from you
Tell you when a shade is back in stock Consent Until the alert is sent or you cancel your request
Secure the Site and payments; prevent fraud Legitimate interest As long as needed, and no more than 13 months after the transaction concerned
Measure visits to the Site Consent Cookies: 13 months at most; statistics: 25 months at most
Measure our ads and show you ads on Facebook, Instagram and Pinterest Consent Cookies: 13 months at most
Respond to requests from the authorities Legal obligation As long as the law requires

At the end of these periods, the data is deleted or anonymised. We make no automated decisions that have legal effects on you.

4. Who receives your data

Your data is processed by Magnolia Yarns and only by the service providers we need, each for its own part:

  • Shopify, which hosts the Site and our shop, processes payments through Shopify Payments and its banking partners, and sends the emails about your orders. If you pay with Shop Pay or use the Shop app, Shopify also processes your data on its own behalf, under its privacy policy.
  • Apple, PayPal or Klarna, if you pay through them. Each then processes your data under its own privacy policy; Klarna may in particular check your creditworthiness before accepting a payment in instalments or later.
  • The carrier delivering your parcel: name, address, phone and email, for delivery and tracking.
  • Kbite (DevSquat Solutions), which runs the back-in-stock alerts.
  • Meta (Facebook, Instagram) and Pinterest, only if you accept marketing cookies. They receive information about your visit (pages viewed, items added to cart, purchases) and, when you buy, possibly your email address or phone number in encrypted form, to measure our ads and show you ads. We are jointly responsible with them for this collection and transfer; they alone are responsible for how they then use it, under their own policies.
  • Administrative or judicial authorities, where the law requires it.

We do not sell your data to third parties for money.

5. Transfers outside the European Union

Some of these providers, or their own subcontractors, are based outside the European Union, in particular in Canada and the United States. These transfers are covered by an adequacy decision of the European Commission (for Canada, and for US companies certified under the Data Privacy Framework) or, failing that, by the standard contractual clauses adopted by the European Commission. You can ask us for more information about these safeguards.

6. Security

The Site is served entirely over HTTPS. Payments are processed by a PCI DSS–certified provider, and access to our shop’s administration is protected. Only people who need your data to handle your orders have access to it.

7. Cookies and trackers

On your first visit, a banner lets you accept, refuse or choose the cookies that are not essential. Refusing is as easy as accepting, and does not affect your purchases.

  • Essential cookies, always on: cart, checkout, security, language and currency, and remembering your cookie choice. They do not require your consent.
  • Preferences: remembering your settings from one visit to the next.
  • Statistics: measuring visits to the Site to improve it, with Shopify’s tools.
  • Marketing: the Meta (Facebook, Instagram) and Pinterest pixels described in section 4.

You can change your choice at any time with the “Cookie preferences” link at the bottom of the page, or delete cookies in your browser settings. Your choice is kept for 12 months at most, after which we ask you again. Cookies last 13 months at most.

8. Your rights

You have the following rights over your data:

  • to access it and get a copy;
  • to have it corrected if it is inaccurate or incomplete;
  • to have it erased, unless we must keep it to meet a legal obligation, such as our invoices;
  • to restrict its use;
  • to object to its use based on our legitimate interest and, at any time and without giving a reason, to its use for marketing;
  • to receive it in a common format to pass it on to another provider (portability);
  • to withdraw your consent at any time, without affecting what was done before;
  • to give instructions on what should happen to your data after your death.

To exercise them, email magnoliayarns98@gmail.com. We reply within one month, which may be extended by two months for a complex request; we would let you know. We will only ask for proof of identity if we have reasonable doubts about who you are. Every newsletter includes an unsubscribe link.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or with the data protection authority of your country of residence.

If you live outside the European Union, for example in the United States, you have the rights your local law gives you. Sharing browsing data with our advertising partners may count there as a “sale” or “sharing” of data: you can opt out on the Your Privacy Choices page.

9. Children

The Site is not intended for children. If you are under 15, ask a parent before creating an account or signing up for our newsletter.

10. Changes

We may update this policy; the date at the top shows its latest version. If we make an important change, we will let you know on the Site or by email.