Privacy policy

Data controller: MALO HOUDAYER — 60 RUE FRANCOIS IER, 75008 PARIS, FRANCE. Registration: SIREN 988 201 539 / SIRET 988 201 539 00018. Data protection contact: [email protected].

• Order data: identity, contact details, delivery and billing addresses.
• Payment data: processed directly by Stripe; Niko Toka does not store complete payment-card details.
• Account data: email address and credentials when an account is created.
• Newsletter and welcome-offer data: email address, language, form source, personal 10% off code, and technical issue and delivery timestamps.
• Review data: display name, private email address, rating, review text, optional photos, language and moderation status. Only the display name, rating, text and photos of an approved review are published.
• With your permission: random visitor and session identifiers, pages viewed, active time, reading depth, sections viewed, clicks and relative coordinates, device category, browser, operating system, Web Vitals, traffic source, UTM parameters, time zone and approximate location when supplied by the infrastructure.
• With the same advertising permission: fbclid and ttclid click identifiers, product, value, currency, quantity and a random event_id. The event_id lets Meta and TikTok deduplicate the same event received from the Pixel and server API.
• The raw IP address, form contents and a unique device fingerprint are not stored in analytics. An irreversible monthly-rotating HMAC of the IP, never displayed in the dashboard, is used only to detect abnormal volumes.
• After advertising consent, the IP address and user agent may be processed in memory and sent to Meta and TikTok as matching data; Niko Toka does not retain them in clear text in its analytics database.

• Processing, delivering and tracking orders to perform the contract.
• Managing customer service, returns and accounting duties on the relevant contractual and legal bases.
• Preventing fraud and protecting the site on the basis of our legitimate interest.
• Sending the newsletter and personal 10% off code when consent has been given; that consent can be withdrawn at any time.
• Receiving, moderating and then publishing, with your permission, a review, rating and any photos you voluntarily submitted. The email address is never published.
• Measuring journeys, usability, performance and the purchase funnel to improve the site and sales, solely with consent for detailed collection.
• Measuring, attributing and optimising Meta and TikTok campaigns by sending conversion events only after consent.

Data is available to authorised personnel and the providers needed to operate the service, including Stripe for payments, Brevo for the newsletter, hosting providers and shipping providers.

Those providers act within the scope of their assignment. Niko Toka does not sell personal data.

The detailed analytics log remains in Niko Toka’s MongoDB database. After permission, a subset of commerce events and matching data is nevertheless sent to Meta Platforms Ireland Limited and TikTok Technology Limited through their Pixels and server APIs.

Order data is kept for the time needed to process the order and then archived for the applicable statutory period. Account data is kept while the account remains active. Newsletter data is kept until consent is withdrawn or the applicable retention period expires; data strictly needed to enforce single use of the code may be kept until it is used or disabled.

Pending or rejected reviews and photos are automatically deleted after no more than 90 days. Approved reviews, any attached photos and their private email address are kept while they remain published, unless removal or erasure is requested.

The analytics choice is remembered for six months. Detailed events are automatically deleted after no more than thirteen months. Minimal records proving the choice are kept for no more than twenty-five months, unless erasure is requested sooner.

The site uses mechanisms that are strictly necessary for operation, including the cart, language preference and security. The detailed tracker, Meta/TikTok Pixels and their identifiers are created only after an explicit click on the permission button.

You may refuse without losing access or change your choice through the “Privacy” button. Withdrawal stops new collection and transmission and erases first-party history associated with the browser identifier; data already received by Meta or TikTok is then governed by their policies and your rights with those recipients.

Under the GDPR and other applicable rules, you may request access, correction, erasure, restriction, objection or portability in relation to your data.

To exercise these rights, contact [email protected]. You may also lodge a complaint with the French data protection authority at cnil.fr.

Independently from analytics and your cookie choice, our server keeps a technical log containing the connection IP address, date and time, requested method and path without query parameters, HTTP status and response duration. HTTP headers, cookies, form contents and request bodies are not recorded in this log.

This log is processed on the basis of our legitimate interest to secure the site, prevent abuse and fraud, investigate incidents and, where necessary, establish, exercise or defend legal claims. It is not used for advertising, profiling or marketing measurement and is not displayed in the analytics dashboard.

The records are available only to people authorised to administer the hosting infrastructure and may be disclosed to legal advisers or competent authorities where necessary or required by law. They are automatically deleted after a maximum rolling period of twelve months. A record connected to an identified incident or dispute may be isolated for longer, solely for the time needed to handle that matter. You may exercise your rights, including the right to object, at [email protected].