PRIVACY POLICY
Last updated: August 2026
1. Introduction and Identity of the Data Controller
This Privacy Policy is established by the company PARISINOVA HERITAGE, operating the brand ALOELIS® Cosmetics (hereinafter "ALOELIS®", "we", or "our").
-
Identity: PARISINOVA HERITAGE • ALOELIS® Cosmetics (Société par Actions Simplifiée)
-
Share Capital: €1,000
-
Registered Office: 1 Rue Marguerin, 75014 Paris, France
-
SIRET: 100 631 993 00019
-
Intra-community VAT: FR78100631993
-
Email: boutique@aloelis.com
ALOELIS® Cosmetics is an online store powered by Shopify Inc., which provides us with the technical infrastructure necessary to manage our Services.
This Privacy Policy transparently and accurately describes how we collect, use, store, and disclose your personal data when you visit https://aloelis.com/, create an account, make a purchase, or interact with us by any other means (hereinafter the "Services").
By accessing our Services, you acknowledge that you have read this Privacy Policy. In the event of a contradiction between our General Terms and Conditions of Sale (GTCS) and this Policy, the latter prevails with regard to personal data protection.
2. Personal Data Collected
We define "personal data" as any information that allows you to be identified directly or indirectly, in accordance with the General Data Protection Regulation (GDPR / EU Regulation 2016/679) and the amended French Data Protection Act of January 6, 1978.
Depending on the nature of your interaction with our Services, we may collect the following categories of data:
-
Identity and contact data: surname, first name, postal address, billing address, delivery address, telephone number, email address.
-
Financial data: information relating to your payment methods (credit card number, account data, payment confirmation). This data is processed via secure PCI-DSS certified payment providers. ALOELIS® Cosmetics never directly stores your complete banking data.
-
Account data: username, encrypted password, security questions, personal preferences, and settings.
-
Transaction data: products viewed, added to cart or wish list, purchased, returned or canceled, as well as your order history.
-
Communication data: messages exchanged with our customer service, responses to our satisfaction surveys, product reviews published.
-
Technical data: IP address, browser type and version, device identifiers, network connection data.
-
Navigation data: pages visited, visit duration, interactions with the site, traffic source, purchasing behavior.
We never collect so-called sensitive data within the meaning of Article 9 of the GDPR (ethnic origin, health data, religious beliefs, etc.).
3. Sources of Personal Data
We collect your personal data from the following sources:
-
Directly from you: when you create an account, place an order, fill out a form, contact our customer service, or interact with our Services in any other way.
-
Automatically via our Services: through cookies, tracking pixels, and similar technologies when you browse https://aloelis.com/.
-
From our service providers: including Shopify, our logistics, payment, or analytics partners, who collect certain data on our behalf.
-
From third-party partners: in the context of advertising campaigns or social media integrations, within the limits of your consents.
4. Purposes and Legal Bases for Processing
In accordance with Article 13 of the GDPR, each processing of your data is based on an explicit legal basis:
-
Contract performance (Article 6.1.b of the GDPR): processing your orders, managing payments, organizing shipments, managing returns and exchanges, creating and administering your customer account, sending notifications related to your order.
-
Legitimate interest (Article 6.1.f of the GDPR): improving our Services, personalizing your shopping experience, recommending products related to your past purchases, fraud prevention, securing our infrastructure, statistical analysis of browsing.
-
Consent (Article 6.1.a of the GDPR): sending marketing communications by email or SMS, depositing non-essential cookies, personalized advertising based on your online behavior. You can withdraw your consent at any time without affecting the legality of processing carried out prior to this withdrawal.
-
Legal obligation (Article 6.1.c of the GDPR): retention of invoices and accounting data, responding to judicial or administrative requisitions, compliance with tax and customs obligations.
5. Cookies and Tracking Technologies
We use cookies and similar technologies (pixels, web beacons, session IDs) to ensure the proper functioning of our Services, measure their audience and, with your consent, personalize your experience and display targeted advertisements.
-
Essential cookies: indispensable for the site's operation (cart, session, authentication). They do not require your consent.
-
Analytical cookies: allow us to measure traffic and browsing behavior (e.g., Google Analytics). Subject to your consent.
-
Marketing cookies: allow us to offer you personalized advertisements on our Services and on third-party sites. Subject to your consent.
You can manage your cookie preferences at any time via the consent banner on our site, or via your browser settings. Refusing non-essential cookies does not affect your access to the Services.
6. Sharing and Disclosure of Personal Data
We never sell your personal data to third parties. However, we may share it in the following circumstances:
-
Shopify Inc.: as the platform hosting our Services, Shopify processes some of your data as a subcontractor or joint data controller depending on the functionalities used. To learn more: https://www.shopify.com/legal/privacy/app-users
-
Service providers: hosting (Google LLC), payment processing, logistics and shipping (PARCELWILL and partner carriers), customer service, analytical tools. These providers act as subcontractors and are contractually bound to protect your data.
-
Marketing and advertising partners: within the limits of your consents, we may share certain data with advertising partners to offer you personalized advertisements on our Services or on third-party sites.
-
Legal obligations: we may disclose your data to competent authorities (judicial, tax, customs) when required by law or in response to a valid request.
-
Company sale or restructuring: in the event of a merger, acquisition, sale, or collective procedure, your data may be transferred to the acquirer or the entities concerned, in compliance with applicable regulations.
We contractually require all our subcontractors and partners to process your data in accordance with the GDPR and this Policy.
7. International Data Transfers
Some of our providers (notably Shopify Inc. in Canada and Google LLC in the United States) may process your data outside the European Economic Area (EEA). These transfers are governed by appropriate safeguards in accordance with Chapter V of the GDPR, including:
- Standard contractual clauses adopted by the European Commission (implementing decision 2021/914);
- The recognition of an adequate level of protection for Canada by the European Commission;
- Any other equivalent mechanism recognized by the competent authorities.
8. Data Retention Period
We retain your personal data for the period strictly necessary for the purposes for which it was collected, in compliance with current legal obligations:
-
Customer account data: retained for the entire duration of your business relationship with ALOELIS®, then 3 years from the last interaction for commercial prospecting purposes.
-
Transaction and billing data: retained for 10 years in accordance with French accounting and tax obligations (Article L.123-22 of the Commercial Code).
-
Navigation data and cookies: retained for a maximum of 13 months from their deposit, in accordance with CNIL recommendations.
-
Communication data (customer service): retained for 3 years from the closing of the request.
-
Data relating to return and refund requests: retained for 5 years for dispute management purposes.
Beyond these periods, your data is deleted or irreversibly anonymized.
9. Data Security
ALOELIS® Cosmetics implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, alteration, or disclosure, in accordance with Article 32 of the GDPR.
These measures include encryption of sensitive data (SSL/TLS protocol), the use of PCI-DSS certified payment providers, strict management of internal access, and regular security audits.
No security measure is absolute. In the event of a data breach likely to pose a risk to your rights and freedoms, we undertake to notify the incident to the CNIL within 72 hours in accordance with Article 33 of the GDPR, and to inform you if the risk is high.
We recommend that you do not share your login credentials and contact us immediately in case of suspicious access to your account.
10. Protection of Minors' Data
Our Services and the possibility to place orders on our site are exclusively reserved for adults (18 years and older) with the legal capacity to contract.
ALOELIS® products intended for infants, children, and minors must be purchased exclusively by their parents or legal guardians.
We do not knowingly collect personal data from minors. If you are the parent or legal guardian of a minor child and you notice that they have provided us with personal data without your knowledge (for example, by creating an account or attempting an order), contact us immediately at boutique@aloelis.com so that we can promptly delete this information.
11. Your Rights Regarding Your Personal Data
In accordance with the GDPR and the Data Protection Act, you have the following rights regarding your personal data:
-
Right of access (Art. 15 GDPR): you can obtain confirmation that we are processing your data and receive a copy of it.
-
Right to rectification (Art. 16 GDPR): you can request the correction of inaccurate or incomplete data.
-
Right to erasure (Art. 17 GDPR): you can request the deletion of your data, subject to our legal retention obligations.
-
Right to restriction of processing (Art. 18 GDPR): you can request the temporary suspension of the processing of your data in certain circumstances.
-
Right to data portability (Art. 20 GDPR): you can receive your data in a structured, machine-readable format and transmit it to another data controller.
-
Right to object (Art. 21 GDPR): you can object at any time to the processing of your data for commercial prospecting purposes or when the processing is based on our legitimate interest.
-
Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time without affecting the legality of prior processing.
-
Right concerning automated decision-making (Art. 22 GDPR): you can request not to be subject to a decision based solely on automated processing producing legal effects concerning you.
To exercise any of these rights, you can:
- Use the dedicated features of your customer account on https://aloelis.com/;
- Contact us by email at: boutique@aloelis.com;
- Consult Shopify's privacy portal: https://privacy.shopify.com/fr
We will respond to you within one month of receiving your request, in accordance with Article 12 of the GDPR. This period may be extended by two additional months in case of complex or multiple requests, after informing you.
We may need to verify your identity before processing your request. We will never penalize you for exercising your rights.
12. Right to Lodge a Complaint
If you believe that the processing of your personal data does not comply with applicable regulations, you have the right to lodge a complaint with the competent supervisory authority.
In France, the competent authority is the Commission Nationale de l'Informatique et des Libertés (CNIL):
- Address: CNIL - 3 Place de Fontenoy — TSA 80715 - 75334 Paris Cedex 07
- Website: https://www.cnil.fr
- Telephone: +33 1 53 73 22 22
If you reside in another Member State of the European Union, you can also contact the data protection authority of your country of residence. The list of competent authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_fr
13. Links to Third-Party Sites
Our Services may contain links to websites or platforms operated by third parties (social networks, partners, press). ALOELIS® Cosmetics is not responsible for the privacy practices of these third-party sites. We invite you to consult their own privacy policies before providing them with personal information.
14. Changes to This Policy
We reserve the right to modify this Privacy Policy at any time, particularly to comply with changes in applicable regulations or to reflect changes in our practices.
In the event of substantial changes, we will notify you by email or via a visible notice on our site, prior to the changes taking effect. The "Last updated" date at the top of this document will be systematically updated. We encourage you to consult this page regularly.
15. Contact - Data Protection Officer
For any questions regarding this Privacy Policy, the exercise of your rights, or our data processing practices:
-
Data Controller: Alexis Jean-Marc LADIRAY
-
Founder's Email: direction@aloelis.fr
-
Address: PARISINOVA HERITAGE • ALOELIS® Cosmetics, 1 Rue Marguerin, 75014 Paris, France