At NORPHE, respecting your privacy and protecting your personal data are our top priorities. 

This Privacy Policy (hereinafter the “Privacy Policy ”) is intended to inform you about how your personal data is processed in connection with your use of the website www.norphe.com (the “Site” ) in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR” ) and Law No. 78-17 of January 6, 1978, on Information Technology, Data Files, and Civil Liberties, in its latest version in force (collectively, the“Applicable Regulations” ).

This Privacy Policy does not describe how we collect and process your data through cookies and other tracking technologies (“Cookies”) on the Site. For more information, please see our Cookie Policy.

1 - Who is the data controller?

When you browse and/or register on our Site, or more generally in the context of managing our contractual relationship with you, the data controller is NORPHE ( “We” ), a simplified joint-stock company registered with the Paris Trade and Companies Register under No. 891 332 421, with its place of business located at 2, rue Constance – 75018 Paris, which is also the location of its corporate headquarters.

2 - What data do we collect?

Personal data is data that can be used to identify an individual either directly or by cross-referencing it with other data. 

We collect personal data that falls into the following categories:

  • Identification information (last name, first name, email and mailing addresses, phone number);
  • Information related to your product orders;
  • Login data (login logs, encrypted passwords);
  • Browsing data (IP address, pages viewed, date and time of connection, browser used, operating system, user ID, MAID);
  • Data from emails between you and our customer service team (email content, dates, etc.);
  • Economic and financial data (bank account information, credit card details);
  • Any information you would like to provide us in connection with your contact request.

The information that must be provided on our Website is indicated when you submit your information. It is clearly marked in all relevant places.

3 - How do we collect your personal data?

We collect your personal data directly from you when you provide it to us. For example, when you fill out a contact request form on our Site, or when you create an account on our Site.

4 - What are the purposes and legal bases for this processing?

1 - To provide the services available on our Site through your account, based on the performance of the sales contract that you or your company has entered into with us (i.e., our Terms and Conditions of Sale);

2 - To carry out operations related to customer management regarding orders, deliveries, and loyalty programs, and to ensure the ongoing management of the contractual relationship with our customers, based on the performance of the sales contract that you or your company has entered into with us (i.e., our General Terms and Conditions of Sale);

3 - Analyze your use of our services, understand your expectations, and improve the features we offer (in particular by analyzing interactions or compiling statistics on website traffic and audience) based on our legitimate interest in improving our services;

4 - Create a list of prospective customers, based on our legitimate interest in promoting and growing our business;

5 - Send newsletters, solicitations, and promotional messages via email, based on our legitimate interest in building customer loyalty and keeping our customers or prospects informed of our latest news;

6 - Responding to your requests for information, contact, and/or a demonstration, based on the performance of pre-contractual measures taken at your request;

7 - Retain information and administrative documents related to our business, in accordance with our legal and regulatory compliance obligations;

8 - Organize contests based on the performance of the contract (i.e., the contest rules must be accepted prior to participation);

9 - Respond to requests from data subjects to exercise their rights, in accordance with our legal and regulatory compliance obligations.

5 - How long is your data retained?

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, subject to legal archiving requirements and obligations to retain certain data (in particular, in the event of litigation or pre-litigation proceedings, or to respond to requests from authorized authorities), and/or to anonymize personal data. 

The retention period for data may vary depending on the purpose for which it is collected. 

In particular, we adhere to the retention periods listed below (without prejudice to the aforementioned archiving periods and retention obligations):

  • To provide the services available on our Site through your account : Your data is retained for the duration of your account. Your login logs are retained for 1 year. If your account remains inactive for 2 years, your personal data will be deleted if you do not respond to our reactivation email. In addition, your data may be archived for evidentiary purposes for a period of 5 years.
  • To carry out operations related to customer management regarding orders, deliveries, and loyalty programs, and to ensure the proper management of our contractual relationship with our customers : Personal data is retained for the duration of the contractual relationship. In addition, your data (with the exception of your bank details) is archived for evidentiary purposes for a period of 5 years. Regarding your credit card information, it is retained by our payment service provider until the product is received, plus the length of your withdrawal period (if applicable). The security code (CVV2) printed on your credit card is not stored.
  • Analyze your use of our services, understand your expectations, and improve the features we offer : The selections you make regarding cookies and emails are retained for 6 months from the date of collection. Documents analyzing email content are retained for 1 year from the date our customer service department receives them. Once your data has been anonymized, it is no longer considered personal data because re-identification is not possible. It is retained for as long as necessary.
  • Building a prospect database : Your data is retained for a period of 3 years from the date of your last contact with us.
  • Sending newsletters, solicitations, and promotional messages via email : Data is retained for 3 years until you withdraw your consent.
  • Responding to your requests for information, contact, and/or a demonstration : Data is retained for a period of 3 years from your last contact.
  • Retaining information and administrative documents related to our business : Invoices are archived for a period of 10 years. Data related to your transactions (with the exception of banking information) is retained for 5 years. Customer data regarding accepted Terms and Conditions and information related to your acceptance of the Terms and Conditions is retained for 5 years.
  • Organizing contests : Data is retained for the duration of the contests or promotional campaigns and may be archived for up to 5 years for evidentiary purposes.
  • Responding to requests from data subjects to exercise their rights : If we ask you to provide proof of identity, we will retain it only for as long as necessary to verify your identity. Once verification is complete, the proof of identity will be deleted.

6 - Who receives your data?

The following will have access to your personal data:

(i) Our company’s employees;
(ii) Our subcontractors: hosting provider, marketing provider, secure payment provider, business management tools (CRM, invoicing, etc.), cookie management tool, logistics providers;
(iii) Our partners acting as independent data controllers. We disclaim all liability regarding the processing of personal data carried out by our partners and invite you to review their terms of use and privacy policy;
(iv) Any authority legally authorized to access such information, in particular judicial, police, or administrative authorities, if they so request.

Your data is retained and stored on the servers of Shopify Inc., located in Canada, for the entire duration of the processing.

7 - What are your rights regarding your data?

You have the following rights regarding your personal data:

  • Right to information : this is precisely why we have drafted this Privacy Policy. This right is provided for in Articles 13 and 14 of the GDPR.
  • Right of access : You have the right to access all of your personal data at any time, pursuant to Article 15 of the GDPR.
  • Right to Rectification : You have the right to have your inaccurate, incomplete, or outdated personal data rectified at any time in accordance with Article 16 of the GDPR.
  • Right to restriction : You have the right to obtain the restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
  • Right to erasure : You have the right to request that your personal data be erased and to prohibit any future collection of such data for the reasons set forth in Article 17 of the GDPR.
  • The right to establish guidelines regarding the retention, erasure, and disclosure of your personal data after your death.
  • Right to withdraw your consent at any time : For purposes based on consent, Article 7 of the GDPR states that you may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.
  • Right to data portability : Subject to certain conditions specified in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a standard, machine-readable format and to request that it be transferred to the recipient of your choice.
  • Right to object : Under Article 21 of the GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue to process your data despite this objection for legitimate reasons or to defend our legal rights.

You can exercise these rights by writing to us at the following address: dpo@norphe.com 

In such cases, we may ask you to provide additional information if we have reasonable grounds for doubt, or even any documents that can verify your identity if the doubt persists.

If you have any questions or concerns that have not been resolved, you have the right to file a complaint with the competent supervisory authority, which in France is the Commission Nationale de l'Informatique et des Libertés (“CNIL”), located at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

8 - Changes

We may amend this Privacy Policy at any time, in particular to comply with any regulatory, legal, editorial, or technical changes. These amendments will take effect on the date the revised version becomes effective. We therefore encourage you to review the latest version of this policy regularly. However, we will notify you of any significant changes to this Privacy Policy.

Effective date: April 15, 2026.