Privacy policy

1. Who controls your data

Flashmarques, operated by DigiScale — Mathieu Azam (sole trader), Chemin de Puech Redon, 81000 Albi, France. Contact: contact@flashmarques.com

2. What we collect

Order data — name, email, delivery address, phone number, order history.
Payment data — handled by our payment providers. We never see or store your card number.
Browsing data — pages viewed, device, approximate location, through cookies and similar technologies.
Correspondence — anything you send us, including photographs of your door.

3. Our legal basis

Performing our contract — processing and delivering your order, handling returns.
Legal obligation — accounting and tax records.
Legitimate interests — fraud prevention and improving the store.
Consent — marketing emails and non-essential cookies, withdrawable at any time.

4. Who receives it

Shopify (store platform), our payment providers, carriers and fulfilment partners including our Bangkok warehouse, and our email and analytics providers. We do not sell your personal data.

5. How long we keep it

Order data for 10 years for accounting purposes. Marketing consent until withdrawn. Browsing data for up to 13 months.

6. Your rights

You may request access, correction, deletion, restriction or portability of your data, and object to processing. Email contact@flashmarques.com; we respond within one month.

If you are not satisfied you may complain to the supervisory authority where you live — the CNIL (cnil.fr) in France, where we are established, the ICO (ico.org.uk) in the United Kingdom, or the OAIC (oaic.gov.au) in Australia.

7. Cookies

Essential cookies run the store. Analytics and advertising cookies are used only with your consent, which you manage through the cookie banner or the Cookie Preferences page.

8. Security

The store runs over HTTPS on Shopify's infrastructure and access to order data is restricted. No system is perfectly secure, and we will tell you promptly if a breach affects your data.

9. International transfers

Your data is processed in France and by providers in Canada, the United States, Thailand, the United Kingdom and Australia. Transfers rely on the European Commission's standard contractual clauses or an adequacy decision.