Purpose of processing (purpose and legal basis)

DPAP, whose head office is located in St Barthélémy d'Anjou (49124), ZI Romanerie Sud, 24 Rue de la Gibaudière, has an online sales website. This site makes it possible to receive orders from our customers and the data collected on this occasion is recorded and processed in a customer file.

This file is used to:

• Manage orders, payment and delivery.
• Carry out marketing operations (loyalty, promotions) and send advertisements by email to our customers who have not objected to it or who have accepted it:
• On products similar to those they ordered.
• On other products offered by the company.

Legal basis for processing

• Order management: the legal basis for processing is the execution of a contract (see article 6.1.b) of the European Data Protection Regulation).
• Sending commercial solicitations by email on products similar to those ordered by customers: the legal basis for processing is the legitimate interest of the company (Cf. article 6.1.f) of the European Data Protection Regulation), namely promote our products to our customers.
• Sending commercial solicitations by email on other products offered by the company DPAP: the legal basis for processing is consent (Cf. article 6.1.a) of the European Data Protection Regulation), as required by article L. 34-5 of the Post and Electronic Communications Code.

Data categories

• Identity: title, surname, first name, address, delivery address, telephone number, e-mail address, internal processing code allowing identification of the customer, data relating to registration on opposition lists.
• Data relating to orders: transaction number, details of purchases, amount of purchases, data relating to payment of invoices (payments, unpaid bills, discounts), product returns.
• Data relating to means of payment: bank card number, expiry date of the bank card, visual cryptogram (which is immediately deleted).
• Data necessary for carrying out loyalty and prospecting actions: purchase history.

Data recipients

• The customer services and invoicing of the company DPAP are recipients of all categories of data.
• Its subcontractors, responsible for the delivery of its orders, are recipients of the identity, address and telephone number of our customers.
• The email addresses of customers who have accepted it are made available to our business partners (list of partners, regularly updated):
• Stripe, payment provider,
• K'Liveo,, delivery provider,
• any police or administrative authority in the context of judicial requisitions concerning the fight against fraud,

Data retention period

• Data necessary for order management and invoicing: throughout the duration of the commercial relationship and ten (10) years for accounting obligations.
• Data necessary for carrying out loyalty actions and prospecting: throughout the duration of the commercial relationship and three (3) years from the last purchase.
• Data relating to means of payment: this data is not kept by the company DPAP; they are collected during the transaction and are immediately deleted upon payment of the purchase.
• Data concerning the opposition lists to be received from prospecting: three (3) years.

Your rights

If you no longer wish to receive advertising from the company DPAP (exercise of the right of opposition or withdrawal of a consent already given), contact us by informing the unsubscribe form.

If, after having consented to your data being transmitted to nyour business partners, you wish to change this choice and no longer receive advertising from them, contact us on form for exercising computer rights and freedoms.

You can access, rectify or delete data concerning you. You also have a right to portability and a right to limit the processing of your data (See the cnil.fr site for more information on your rights).

To exercise these rights or for any questions about the processing of your data in this device, you can contact our data protection officer.

• Contact our data protection officer electronically: nbanse@ epiocean.fr
• Contact our data protection officer by post:

The data protection officer

DPAP Company

ZI Romanerie Sud

24 rue de la Gibaudière

49124 St Barthélémy d'Anjou

If you consider, after having contacted the company DPAP, that your “Computing and Freedoms” rights have not been respected, you can send a complaint online to the CNIL.