Privacy policy

1. Controller

The controller of the personal data collected on this website, within the meaning of article 4(7) of the General Data Protection Regulation (GDPR, RGPD in French), is Laura Pouyadou EI (Entreprise Individuelle - sole proprietorship, micro-entrepreneur, SIRET 931 874 952 00019), operator of the website geteverwear.com. Her address is given on the legal notice page. For any question about the protection of your data, contact us at contact@geteverwear.com.

2. Data collected

We collect the following data:

• Identification data: surname, first name, email address, postal address, telephone number (when placing an order or creating an account).
• Transaction data: order history, amounts, payment method (bank card details never pass through our servers; they are handled by our provider Stripe).
• Browsing data: pages viewed with their timestamp, reading time and share of the page scrolled, the site you came from, campaign markers present in the address (see section 9 ter), approximate city, device type, as well as the browser and languages your browser spontaneously announces on every page. This measurement sets no cookie, reads nothing on your device and does not keep your IP address: it is used only, for the duration of the request, to compute a non-reversible technical signature, and is then discarded.
• Data read from your device (screen resolution and pixel density, time zone, installed languages) and full IP address: only if you consent, and only in the two cases described in sections 9 bis (paper flyers) and 9 ter (audience measurement). Refusing changes nothing about your browsing.

3. Purposes of processing

Your data is used to:

• Process and ship your orders
• Manage your customer account
• Send you our newsletters (if you have consented)
• Improve our website and services
• Comply with our legal obligations (invoicing, accounting)
• Measure the effectiveness of our paper flyer campaigns (see section 9 bis)

4. Legal basis

Each processing operation described on this page relies on one of these four bases:

• Performance of the contract (GDPR art. 6(1)(b)): your orders, their shipping, their tracking, returns and the related customer service.
• A legal obligation (art. 6(1)(c)): keeping invoices for ten years, and keeping proof of your choice regarding trackers, which article 7(1) GDPR requires us to be able to demonstrate.
• Your consent (art. 6(1)(a), and article 82 of the French Data Protection Act, loi Informatique et Libertés, where something is read on your device): the newsletter, non-essential cookies, third-party audience measurement, the location and fingerprint when a flyer is scanned (section 9 bis), and the extended layer of audience measurement described in section 9 ter.
• Our legitimate interest (art. 6(1)(f)): website security and fraud prevention, as well as measuring traffic to our own shop — knowing which pages are read, whether a person comes back, and through which link they arrived (section 9 ter). This interest has been the subject of a written balancing test against your rights, which we keep available to the CNIL (the French data protection authority) and send to you on simple request at contact@geteverwear.com. You may object to it at any time, at the same address.

5. Retention period

6. Recipients and processors

We do not sell, rent or disclose your data to anyone for commercial purposes. This is ruled out, without exception and whatever the consideration offered. We use it exclusively for our own analyses: understanding how our website is browsed, improving its search ranking, its product pages, how it works and our sales. The only third parties who receive anything are the technical providers listed below, each for a specific task we could not carry out alone (hosting the website, taking a payment, shipping a parcel).

Your data is strictly reserved to GetEverwear and its technical processors listed below. We do not sell or rent your data to third parties.

7. Transfers outside the European Union

Our providers are based in the European Union. Where data is transferred outside the EU (for example for certain analytics tools), we ensure that the transfer is governed by the standard contractual clauses approved by the European Commission.

8. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access to your data
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw your consent at any time

To exercise these rights, write to us at contact@geteverwear.com with a copy of an identity document. You may also lodge a complaint with the CNIL (www.cnil.fr).

9. Third-party cookies and trackers

In addition to our own session cookies, we load third-party scripts which may set their own cookies:

• Stripe, to secure payments and detect fraud (cookies __stripe_mid, __stripe_sid). Essential to checkout.
• Cloudflare Turnstile, anti-bot protection on the sign-up and login forms (temporary validation token, no persistent cookie). Essential to the website's security.
• GetEverwear customer service chat: chat_session_id cookie (HMAC-signed, 30 days, Strict). Used only to find your conversation again between two visits if you are not logged in. No sharing with any third party - the messaging is hosted on our own servers (Netcup, Germany). Messages are kept for 90 days, then automatically purged. Essential to the chat working (therefore set without specific consent, article 82 of the French Data Protection Act, loi Informatique & Libertés — purpose strictly necessary for the service requested by the user).

After your explicit consent, we load Google Analytics 4 (cookies _ga, _ga_*) to cross-reference browsing data with Google Search Console and optimise organic search ranking. Configuration: IP anonymisation, no advertising signals (allow_google_signals: false), no Ads personalisation (allow_ad_personalization_signals: false). The categories are independent: you can accept anonymous audience measurement and refuse GA4, or vice versa.

When you choose a pickup point, the map displayed loads its background from the servers of the OpenStreetMap Foundation. This request transmits your IP address, with no cookie or identifier, and only takes place if you open that step of the order.

Only after your explicit consent, we load the Google Ads tag, which sets Google conversion and remarketing cookies (_gcl_au, _gcl_aw, _gcl_dc, NID) in order to measure sales generated by our Google ads. When a purchase is made, it transmits the amount, the currency, the order number and your hashed email address (SHA-256, never in clear text). Consent Mode v2 is enabled: as long as you have not consented to the “Advertising” category, none of these cookies is set and no advertising data is sent to Google.

Full details are available on the Cookie management page.

9 bis. Paper flyer campaigns

We distribute printed flyers bearing a short address such as geteverwear.com/fr/f1, sometimes as a QR code. This address lets us know whether a flyer has been of any use. Here is exactly what happens when you open it.

What we record in all cases

When the page loads, and without asking for your consent, we record: the flyer code, the date and time, your truncated IP address (the last block is replaced with zero, so it can no longer identify you), the country, the device type, the browser, the operating system and the language announced by your browser. We also set a random identifier in a cookie named _ge_flyer, kept for 13 months, which is used only to count how many times the same device has scanned our flyers.

This collection falls under audience measurement and is exempt from consent (CNIL recommendation of 17 September 2020, adopted under article 82 of the French Data Protection Act, loi Informatique et Libertés): it is used exclusively to measure our campaigns, is not cross-referenced with any other processing, and is disclosed to no one.

What we record only with your consent

The page offers you an explicit choice. If — and only if — you click “I accept”, we additionally record:

• your geographical location, as your browser provides it to us after asking you for a second permission (you can still refuse at that stage);
• a technical fingerprint of your device: screen size and resolution, installed languages, time zone, number of processor cores, memory, detected fonts, graphics card, graphics and audio rendering. Combined, these elements form a signature that makes it possible to recognise your device even without a cookie;
• your full IP address.

Legal basis: your consent (GDPR art. 6(1)(a) and art. 82 of the French Data Protection Act, loi Informatique et Libertés). Purpose: knowing where and when our flyers are scanned, in order to decide where to distribute them next. Recipients: no one. This data stays on our servers (Netcup, Germany) and is neither sold, rented nor passed on to an advertising network. Our third-party measurement tools (Google Analytics 4) receive only the flyer code and the scan rank: neither your location, nor your fingerprint, nor your full IP address is passed on to them.

If you refuse, you access the shop in exactly the same way. We then keep only the count described in the previous paragraph, as well as a record of your refusal — this is what allows us not to ask you again and to prove that we respected it.

Period: 13 months. After this period, an automatic process erases every night the location, the fingerprint, the IP address and the measurement identifier. All that remains is an anonymous count line, itself deleted at 25 months.

How to change your mind: delete the _ge_flyer cookie in your browser settings, and withdraw the geolocation permission granted to our website (site settings, “Location” section). To request the deletion of scans already recorded, write to us at the address given in section 13, providing the value of this cookie: it is the only element that allows us to find your records, as we hold neither your name nor your email address in this processing.

9 ter. Visit recognition

To know whether a person comes back to the website and which pages they go through, we compute a technical fingerprint from three elements: your IP address reduced to its network (the last digits are removed), the family of your browser and operating system — without their version —, and your language. These elements are mixed with a secret key known only to us, then turned into a signature that cannot be traced back to the original address.

This signature is given a nickname drawn at random in a reproducible way — “Only Turquoise Flyingfish” — which lets us talk about a visit without ever handling an identifier. We keep the number of visits, the date of the last one, the pages viewed with their timestamp, the time spent on each and the share of the page scrolled, the city, the device type, as well as the browser and languages your browser spontaneously announces with every request — we keep them as they are, without truncating them.

What the landing address also tells us. When you arrive through an advertising link or a campaign, this address contains markers that we keep: the parameters utm_source, utm_medium, utm_campaign, utm_content, utm_term, ref and the click identifiers fbclid (Meta), gclid (Google Ads), ttclid (TikTok) and msclkid (Microsoft Ads). They tell us which post or which advertisement brought you here, which the name of the referring site alone never does. The list above is closed: any other parameter present in the address is discarded without being read. These markers follow the retention period of the browsing journey, that is, 5 years.

What it is not: a customer file. The visit register contains no name, no email address, no order number, and we never use it to recognise a customer. One reservation, because it can be checked: when you respond to the consent banner while logged in, the proof of that choice records your technical signature and your email address side by side (see section 5). Linking the two is therefore technically possible there. It serves only to prove your choice, never to analyse your browsing. Legal basis: our legitimate interest in measuring traffic to our own shop (GDPR art. 6(1)(f)), for the layer described so far. Recipients: no one. This data stays on our servers and is neither sold nor passed on to an advertising network.

City and country are derived from your IP address using a database installed on our own server, DB-IP Lite (CC BY 4.0 licence). No request is sent to anyone: your address does not leave our servers. No external geolocation service is used any more. As long as this database is not installed on a given server, we simply do not determine your city; only the country remains known, as our security provider transmits it with the request.

An additional layer, only if you accept it

Everything above happens without asking anything of your device. If you tick the “audience measurement” box in our banner, we additionally record, on every page:

• your full IP address, as it is — whereas without your consent, only a non-reversible signature is derived from it;
• characteristics read from your device: your screen resolution, pixel density, window size, time zone, installed languages, number of processor cores and available memory;
• a device fingerprint computed from these elements, which makes it possible to recognise your device even if you change network.

Why. These elements answer questions that the default layer leaves open: is it the same person coming back from their phone and then from their computer, do our product pages display correctly on the screens actually used, at what local time do our visitors browse the website. We draw no decision about you from them: no different price, no personalised content, no follow-up.

Why five years, and why your address. We are a small second-hand shop, and our business follows the seasons. Comparing one August with the previous year's is not enough: a single comparison does not tell us whether we are making progress or were simply lucky. Five years give four winters and four summers to compare — the first scale at which one can say that the website is improving, or that a decision was a bad one. As for your address, it gives us your approximate city: it shows us which regions are interested in our pieces, and therefore what we should be sourcing for them. This is what helps us keep the shop going — and we would rather tell you than keep quiet about it.

Legal basis: your consent (GDPR art. 6(1)(a) and art. 82 of the French Data Protection Act, loi Informatique et Libertés — reading anything on your device requires consent, with no possible exception, even for audience measurement). Period: 5 years, the same as the rest of the browsing journey, then automatic erasure. Recipients: no one. None of this leaves our servers, is sold, or is passed on to an advertising network.

If you refuse, or if you do not respond to the banner, nothing on this list is read or kept — we do not merely refrain from recording it, we do not query it. The website works in exactly the same way: no page, no item, no feature is reserved for those who accept, and we will not ask you again on every visit. You can change your choice at any time through the “Cookie management” link in the footer; from that moment on, nothing more is read.

To object to the whole of section 9 ter, default layer included, write to contact@geteverwear.com: we delete the corresponding signature and the associated browsing journey. You can also browse in a private window or change network, which produces a different signature.

10. Security measures

We implement the following technical and organisational measures:

• TLS 1.3 encryption across the entire website (Let's Encrypt certificates renewed automatically)
• Passwords stored hashed (bcrypt / argon2), never in clear text
• No bank data passes through our servers (Stripe tokenisation)
• Daily encrypted backups in Europe with 30-day rotation
• Restricted, logged and MFA-protected access to the administration
• Security updates applied within 7 days for critical vulnerabilities

11. Personal data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, GetEverwear will notify the CNIL within 72 hours in accordance with article 33 of the GDPR, and will inform you as soon as possible if the breach is likely to result in a high risk to your rights.

12. Data concerning minors

Our website is not intended for persons under 16. If you are under 16, ask a parent or guardian to place the order for you. Should we become aware that data concerning a minor under 16 has been collected without parental consent, we would delete it without delay.

13. Contact / Data protection officer (DPO)

No data protection officer has been appointed, and this is not an oversight. Such an appointment is mandatory (article 37 of the GDPR) only for public bodies, organisations whose core activity consists of monitoring individuals on a large scale, and those processing sensitive data. GetEverwear falls into none of these cases. Your requests are therefore handled directly by the controller:

• General email: contact@geteverwear.com
• Post: for the attention of the DPO, at the address given in our legal notice

You also have the right to lodge a complaint with the CNIL: www.cnil.fr.

14. Changes to this policy

This policy may be updated to reflect regulatory or technical changes. The date of the last update appears at the top of the page. For substantial changes, we will inform you by email if you are subscribed to our newsletter.

This policy is provided for information purposes. Have it reviewed by a DPO or a legal professional for full compliance.