Privacy policy

The controller of personal data collected through this site is the operator of the Niko Toka brand. For questions about your data, contact contact@nikotoka.com.

• Order data: identity, contact details, delivery and billing addresses.
• Payment data: processed directly by Stripe; Niko Toka does not store complete payment-card details.
• Account data: email address and credentials when an account is created.
• Newsletter data: email address, language and form source.
• With your permission: random visitor and session identifiers, pages viewed, active time, reading depth, sections viewed, clicks and relative coordinates, device category, browser, operating system, Web Vitals, traffic source, UTM parameters, time zone and approximate location when supplied by the infrastructure.
• The raw IP address, form contents and a unique device fingerprint are not stored in analytics. An irreversible monthly-rotating HMAC of the IP, never displayed in the dashboard, is used only to detect abnormal volumes.

• Processing, delivering and tracking orders to perform the contract.
• Managing customer service, returns and accounting duties on the relevant contractual and legal bases.
• Preventing fraud and protecting the site on the basis of our legitimate interest.
• Sending the newsletter when consent has been given; that consent can be withdrawn at any time.
• Measuring journeys, usability, performance and the purchase funnel to improve the site and sales, solely with consent for detailed collection.

Data is available to authorised personnel and the providers needed to operate the service, including Stripe for payments, Brevo for the newsletter, hosting providers and shipping providers.

Those providers act within the scope of their assignment. Niko Toka does not sell personal data.

Detailed audience measurement is first-party: it is stored in Niko Toka’s MongoDB database, is not sent to an advertising platform and is not used to follow browsing across other sites.

Order data is kept for the time needed to process the order and then archived for the applicable statutory period. Account data is kept while the account remains active. Newsletter data is kept until consent is withdrawn or the applicable retention period expires.

The analytics choice is remembered for six months. Detailed events are automatically deleted after no more than thirteen months. Minimal records proving the choice are kept for no more than twenty-five months, unless erasure is requested sooner.

The site uses mechanisms that are strictly necessary for operation, including the cart, language preference and security. The detailed analytics tracker and its identifiers are created only after an explicit click on the permission button.

You may refuse without losing access to the site, change your choice through the “Privacy” button at the bottom of the page, or withdraw consent and immediately delete your analytics history from that same panel.

Under the GDPR and other applicable rules, you may request access, correction, erasure, restriction, objection or portability in relation to your data.

To exercise these rights, contact contact@nikotoka.com. You may also lodge a complaint with the French data protection authority at cnil.fr.