Privacy policy

1. Data controller

The data controller is Lily-Rose CHEVROT – Lama's Nails, 40 Rue Georges Bizot, 44000 Nantes, France. For questions or to exercise your rights, contact contact@lamasnails.com.

2. Personal data collected

Lama's Nails collects only data required to provide its services: first and last name, contact details, country, language, enquiry or order information and exchanged messages.

Photographs of your hands may be requested to make or check the measurements needed for a suitable press-on nail set. They are used solely to prepare your order, are not subject to biometric identification processing, and are not published, used for promotion or disclosed for that purpose without your separate prior consent.

For a customer account, we also process your first name, email address and authentication information for login, cart management and order history. Authentication is provided by Supabase; passwords are not stored in plain text and are cryptographically hashed by the authentication service. Necessary technical and security data, including logs, browser or device information and, where needed, IP address, may also be processed.

3. Purposes and legal bases

Data is used to answer enquiries, prepare and personalise products, manage and track orders, provide customer service, manage accounts and order history, send necessary order notifications, operate and secure the website, and comply with legal, accounting and tax obligations.

Enquiries and orders are processed on the basis of pre-contractual steps or performance of a contract; accounting and billing on legal obligations; and security and abuse prevention on Lama's Nails’ legitimate interests. Processing requiring consent, including promotional use, takes place only after consent and may be withdrawn for the future.

4. Recipients, transfers and retention

Data is available to Lama's Nails and necessary providers: Supabase (database, accounts and storage), Cloudflare (hosting, availability, performance and security), and, when enabled, Brevo (transactional communications). Authorities may receive data when required by law or a binding decision. Transfers outside the EEA use a GDPR-recognised mechanism, such as an adequacy decision, applicable framework, standard contractual clauses or another appropriate safeguard.

Order data is retained during the business relationship, and data needed to defend rights for up to 5 years. Accounting records are retained for the legal period, notably 10 years where required. Enquiries without an order are retained for up to 3 years after last contact. Sizing photographs are deleted no later than 3 months after the order closes, unless justified exceptionally or required by law. Account data is deleted or anonymised after 3 years of inactivity, except order data that must be archived.

5. Security, rights and changes

Lama's Nails applies appropriate technical and organisational measures and limits access to persons and providers who need it. You may request access, rectification, erasure, restriction, objection to legitimate-interest processing and, where applicable, portability: contact@lamasnails.com. Strictly necessary identity verification may be requested. You may also complain to the French data protection authority, the CNIL: www.cnil.fr.

This policy may be updated as services, providers or rules change. The update date is shown above and affected users will be informed of material changes where legally required.