Privacy policy
At NORPHE, respecting your privacy and protecting your personal data are our priority.
This privacy policy (hereinafter the “Privacy Policy”) aims to inform you about how your personal data is processed when you use the website www.norphe.com (the “Site”), in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties, as amended (together, the “ Applicable Regulations”).
This Privacy Policy does not describe how your data is collected and processed through cookies and other trackers (“Cookies”) on the Site. To find out more, please see our Cookie Policy.
1 - Who is the data controller?
When you browse and/or register on our Site, or more generally in the context of managing our contractual relationship with you, the data controller is NORPHE (“We”), a French simplified joint-stock company (société par actions simplifiée) registered with the Paris Trade and Companies Register (RCS) under number 891 332 421, whose place of business and registered office are located at 2, rue Constance – 75018 Paris, France.
2 - What data do we collect?
Personal data is any data that makes it possible to identify an individual, either directly or by cross-referencing it with other data.
We collect personal data falling into the following categories:
- Identification data (last name, first name, email and postal address, phone number);
- Data relating to your product orders;
- Connection data (connection logs, encrypted passwords);
- Browsing data (IP address, pages viewed, date and time of connection, browser used, operating system, user ID, MAID);
- Data from emails between you and our customer service (email content, dates, etc.);
- Economic and financial data (bank details, payment card data);
- Any information you choose to send us as part of your contact request.
The data you are required to provide on our Site is indicated when you provide your data. It is flagged by any appropriate means.
3 - How do we collect your personal data?
We collect your personal data directly when you provide it to us, for example by filling in a contact form on our Site or by creating an account on our Site.
4 - What are the purposes of processing and the associated legal bases?
1 - Providing the services available on our Site through your account, on the basis of the performance of the sales contract that you or your company have entered into with Us (i.e. our General Terms and Conditions of Sale);
2 - Carrying out customer management operations relating to orders, deliveries and loyalty programs, and monitoring our contractual relationship with our customers, on the basis of the performance of the sales contract that you or your company have entered into with Us (i.e. our General Terms and Conditions of Sale);
3 - Analyzing your use of the services, understanding your expectations and improving the features offered (in particular by analyzing exchanges or compiling browsing and audience statistics for the Site), on the basis of our legitimate interest in improving our services;
4 - Building a prospect database, on the basis of our legitimate interest in promoting and developing our business;
5 - Sending newsletters, solicitations and promotional messages by email, on the basis of our legitimate interest in building loyalty among our customers and prospects and informing them of our latest news;
6 - Responding to your requests for information, contact and/or demonstrations, on the basis of pre-contractual measures taken at your request;
7 - Retaining information and administrative documents relating to our business, on the basis of our legal and regulatory compliance obligations;
8 - Organizing contests, on the basis of the performance of the contract (i.e. the contest rules accepted before taking part);
9 - Responding to requests from data subjects to exercise their rights, on the basis of our legal and regulatory compliance obligations.
5 - How long do we keep your data?
We only keep your personal data for as long as necessary to fulfill the purposes pursued, subject to legal archiving options and obligations to retain certain data (in particular in the event of litigation or pre-litigation, or to respond to requests from authorized authorities), and/or the anonymization of personal data.
The data retention period may vary depending on the purpose pursued.
In particular, we apply the retention periods set out below (without prejudice to the archiving periods and retention obligations mentioned above):
- Providing the services available on our Site through your account : your data is kept for as long as your account exists. Your connection logs are kept for 1 year. If your account is inactive for 2 years, your personal data will be deleted if you do not respond to our reactivation email. In addition, your data may be archived for evidential purposes for 5 years.
- Carrying out customer management operations relating to orders, deliveries and loyalty programs, and monitoring our contractual relationship with our customers : Personal data is kept for the entire duration of the contractual relationship. In addition, your data (except your bank details) is archived for evidential purposes for 5 years. Data relating to your payment card is kept by our payment service provider until receipt of the product plus your withdrawal period (if applicable). Data relating to the card verification code (CVV2) printed on your payment card is not stored.
- Analyzing your use of the services, understanding your expectations and improving the features offered : Your choices regarding Cookies and emails are kept for 6 months from the date they are collected. Documents analyzing the content of emails are kept for 1 year from their receipt by our customer service. Once anonymized, your data is no longer considered personal data, as re-identification is no longer possible. It is kept for as long as necessary.
- Building a prospect database : Your data is kept for 3 years from your last contact with us.
- Sending newsletters, solicitations and promotional messages by email : Data is kept for 3 years, or until you withdraw your consent.
- Responding to your requests for information, contact and/or demonstrations : Data is kept for 3 years from your last contact.
- Retaining information and administrative documents relating to our business : Invoices are archived for 10 years. Data relating to your transactions (except bank details) is kept for 5 years. Customer data relating to the accepted General Terms and Conditions of Sale, and records of your acceptance of them, are kept for 5 years.
- Organizing contests : Data is kept for the duration of the contests or promotional operations and may be archived for 5 years for evidential purposes.
- Responding to requests from data subjects to exercise their rights : If we ask you for proof of identity, we only keep it for as long as necessary to verify your identity. Once the verification is complete, the proof is deleted.
6 - Who receives your data?
Your personal data will be accessible to:
(i) Our company’s staff;
(ii) Our processors: hosting provider, marketing provider, secure payment provider, sales management tools (CRM, invoicing, etc.), cookie management tool, logistics provider;
(iii) Our partners acting as independent data controllers. We accept no liability for the processing of personal data carried out by our partners, and we invite you to consult their terms of use and privacy policies;
(iv) Any authority legally entitled to access it, in particular judicial, police or administrative authorities, upon request.
Your data is kept and stored for the entire duration of processing on the servers of Shopify Inc, located in Canada.
7 - What are your rights over your data?
You have the following rights regarding your personal data:
- Right to information : this is precisely why we have written this Privacy Policy. This right is provided for by Articles 13 and 14 of the GDPR.
- Right of access : you have the right to access all of your personal data at any time, under Article 15 of the GDPR.
- Right to rectification : you have the right to rectify your inaccurate, incomplete or outdated personal data at any time, in accordance with Article 16 of the GDPR.
- Right to restriction : you have the right to obtain the restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
- Right to erasure : you have the right to request that your personal data be erased and to prohibit any future collection on the grounds set out in Article 17 of the GDPR.
- Right to give instructions regarding the retention, erasure and communication of your personal data after your death.
- Right to withdraw your consent at any time : for purposes based on consent, Article 7 of the GDPR states that you may withdraw your consent at any time. Such withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
- Right to data portability : under certain conditions set out in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to request its transfer to the recipient of your choice.
- Right to object : under Article 21 of the GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue processing despite your objection on legitimate grounds or for the establishment or defense of legal claims.
You can exercise these rights by writing to us at the following address: dpo@norphe.com
If we have reasonable doubts, we may ask you to provide additional information or, if doubts persist, any document proving your identity.
If any question or request remains unresolved, you have the right to lodge a complaint with the competent supervisory authority, which in France is the Commission Nationale de l'Informatique et des Libertés (“CNIL”), located at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07, France.
8 - Changes
We may amend this Privacy Policy at any time, in particular to comply with any regulatory, case-law, editorial or technical developments. Changes will apply from the effective date of the amended version. We therefore invite you to regularly consult the latest version of this policy. However, we will inform you of any significant changes to this privacy policy.
Effective date: April 15, 2026.