1. Data Controller
Elyra SAS
Email : bonjour@elyra.fr
Website : elyra.fr
Elyra is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and applicable data protection law.
2. Data Collected
Elyra collects the following data depending on the context:
Order
First name, last name, email address, delivery address, payment data (processed by Stripe — not stored by Elyra).
Customer account
Email, order history.
Newsletter & Quiz
Email, quiz answers (skin type, concerns) — collected with your explicit consent.
Browsing
Anonymous visitor, session and cart identifiers, pages visited, traffic source and shopping events. Names and emails are never stored in audience-measurement events.
3. Purposes of Processing
Order processing and tracking, delivery, customer support
Invoicing, accounting, tax obligations
Fraud prevention, site security
Newsletter, marketing emails, personalised quiz
4. Retention Periods
- Order data: 10 years (accounting obligation)
- Customer account: duration of account activity + 3 years
- Newsletter data: until unsubscription
- Connection logs: 12 months
- Audience measurement events: 13 months
5. Data Sharing
Elyra never sells your data. It may be shared with:
- Stripe — secure payment (PCI-DSS)
- Brevo — transactional and marketing emails
- Vercel / Supabase — secure hosting (EU)
- Carriers — delivery address only
All our sub-processors are GDPR-compliant and have adequate contractual safeguards in place.
6. Your Rights
Under GDPR, you have the following rights:
- Access — obtain a copy of your data
- Rectification — correct inaccurate data
- Erasure — “right to be forgotten”
- Portability — receive your data in a standard format
- Objection — object to processing for marketing purposes
- Restriction — restrict ongoing processing
To exercise these rights, contact bonjour@elyra.fr. Response guaranteed within 30 days. You may also file a complaint with the relevant supervisory authority (e.g. ICO in the UK, CNIL in France — cnil.fr).
7. Cookies
Elyra uses essential cookies by default (session, cart, authentication). Audience-measurement and advertising trackers are only activated with your prior consent.
8. Security
Elyra applies technical and organisational measures to protect your data: TLS encryption in transit, encryption at rest, restricted data access, regular audits. As no method is infallible, we commit to notifying you within 72 hours in the event of a breach affecting your data.
9. Updates
This policy may be updated. Any material change will be notified by email to customers who have an account. The current version is always available on this page.