Privacy policy
Translation provided for convenience — the French version prevails.
Data controller: Mr Thomas Verdier, sole trader (MyPALbox), 73 rue Victor Hugo, 59160 Lomme, France, contact@mypalbox.com.
Data collected and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, delivery and billing address, e-mail, phone (optional), chosen pick-up point | Process the order, ship, track delivery, customer service | Performance of the contract | Duration of the relationship, then 3 years |
| Orders, invoices | Accounting and tax obligations | Legal obligation | 10 years |
| Customer account (if created), history | Make future orders easier | Consent / contract | Until the account is deleted, or 3 years of inactivity |
| Payment data | Payment | Performance of the contract | Not stored by MyPALbox (handled by Stripe) |
| Browsing data (cookies) | Basket, language, security; audience measurement only with your consent | Legitimate interest / consent | See the cookie policy |
| Email, first name (for an order), language, date and wording of consent | Newsletter: MyPALbox news and deals (1–2 emails a month) and welcome code | Consent (unticked box at checkout or sign-up form) | Until you unsubscribe, then deleted |
Newsletter
If you tick the “Get MyPALbox news and deals” box at checkout, or sign up with the form on the site, we use your email address (and your first name for an order) only to send you our news and deals, at most 1–2 emails a month, plus a welcome code. Emails are sent from our host (o2switch, France) with the MailPoet plugin, without open-tracking pixels or click tracking. Every email contains a one-click unsubscribe link; you can also write to contact@mypalbox.com. Not ticking the box has no effect on your order.
Recipients
Only what is necessary, to: the host o2switch (France); Stripe (payment); Sendcloud, Mondial Relay, Chronopost, La Poste / Colissimo (delivery; data sent to customs for shipments outside the EU); the invoicing tool Indy; Google (order tracking spreadsheet, Google Workspace). Some providers may process data outside the European Union with the safeguards provided by the GDPR (standard contractual clauses, EU–US Data Privacy Framework).
Your data is never sold.
Your rights
Access, rectification, erasure, restriction, objection, portability, withdrawal of consent at any time, and instructions on what happens to your data after your death: write to contact@mypalbox.com. Answer within one month. You may also contact the French data protection authority, the CNIL (www.cnil.fr).
Security
HTTPS website, administrator access protected by a strong password and two-factor authentication, regular backups at the host.
Site messenger
When you write to us with the site messenger (bubble at the bottom of the screen, Contact page or My account > Messages), we store your e-mail address, your name if known, your messages, the page or order concerned, the language and the date. This data is only used to reply to you, in the chat window and by e-mail from contact@mypalbox.com; it is never sold or used for advertising, and no third-party service is involved. It is kept for 3 years after the last message of the conversation, then deleted automatically. To find your conversation again, a first-party cookie “mpb_msg” (secret identifier, 90 days) and a cookie “mpb_msg_on” (no personal data) are set after your first message: they are strictly necessary for this service. You can ask at any time for access to, a copy of, or the deletion of your messages at contact@mypalbox.com.
Customers: when you place an order, we may send you emails about products similar to the ones you bought (new products, customer-only offers). You can refuse this free of charge when ordering (« I don't want to receive them » box) and at any time using the unsubscribe link included in every email.