Privacy Policy

1. Data controller

The controller of personal data is MortierBière, a micro-enterprise whose details appear in the legal notice. Contact for any question relating to data protection: contact@mortierbiere.fr.

2. Data collected

MortierBière collects the following categories of data, for strictly defined purposes:

• Identification data: surname, first name — provided when ordering.
• Contact details: email address, postal delivery address, phone number (optional).
• Order data: product, quantity, amount, date, order number.
• Payment data: handled exclusively by our provider Stripe; no banking data (card number, security code) is retained by MortierBière.
• Browsing data: for visitors who have accepted analytics cookies, aggregated audience data (page views, duration, traffic source) is collected via Google Analytics. For visitors who decline, an anonymised audience measurement (hashed IP, no cookie) is retained for 13 months in accordance with CNIL decision no. 2020-091.

3. Purposes and legal bases

• Performance of the contract (Article 6.1.b GDPR): order processing, delivery, after-sales service, returns management, customer relationship follow-up.
• Legal obligation (Article 6.1.c GDPR): retention of accounting and tax data (invoices) for 10 years, in accordance with the French Commercial Code.
• Legitimate interest (Article 6.1.f GDPR): anonymised audience measurement to understand site usage, fraud prevention, securing of administrator access.
• Consent (Article 6.1.a GDPR): placing of Google Analytics cookies, and marketing cookies where applicable. Consent is obtained via the cookie banner and may be withdrawn at any time.

4. Retention period

• Customer data (identification, delivery): 3 years from the last contact, for the purposes of the commercial relationship.
• Order and invoicing data: 10 years (accounting and tax obligation, Article L.123-22 of the French Commercial Code).
• Analytics browsing data: 13 months maximum.
• Administrator connection logs: 1 year (Article L.34-1 of the French Postal and Electronic Communications Code).

5. Recipients and processors

Data is accessible only to authorised personnel of MortierBière and to its processors, strictly within the limits of their assignment:

• Stripe Payments Europe Ltd (Ireland) — payment processing; PCI-DSS Level 1 certified.
• Railway Corp. (United States) — hosting of the website and database; safeguards via the European Commission's standard contractual clauses.
• Brevo (France) — sending of transactional emails (confirmation, dispatch).
• OVH (France) — management of the domain name and professional mailbox.
• Carriers (La Poste, Mondial Relay or equivalent) — physical delivery of the product.
• Google Ireland Ltd — only if you have accepted analytics cookies.

No data is transferred outside the European Union without an appropriate legal framework (adequacy decision or standard contractual clauses).

6. Cookies

The site uses only the cookies that are strictly necessary for its operation (session, basket, consent). Audience measurement cookies (Google Analytics) are placed only with your consent, given via the banner. You can withdraw your consent at any time by deleting themb_cookie_consent_v1 entry from your local storage, which will display the banner again.

7. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:

• Right of access: obtain a copy of the data concerning you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): except where retention is required by law.
• Right to restriction of processing.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: in particular to profiling or commercial prospecting.
• Right to withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, write to contact@mortierbiere.frspecifying the subject of your request. A response will be sent to you within a maximum of 30 days.

8. Security

MortierBière implements reasonable technical and organisational measures to protect data: end-to-end TLS encryption (HTTPS), encrypted storage at rest, administrator access protected by password and attempt limiting, logging of sensitive access. In the event of a data breach likely to result in a risk to your rights, you will be informed as soon as possible in accordance with Article 34 GDPR.

9. Complaint to the CNIL

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr/fr/plaintes.

10. Changes to the policy

This policy may evolve to reflect legal or operational changes. Any substantial modification will be flagged by a visible notice on the site, and the update date shown at the top of this page will be revised.