PERSONAL DATA PROTECTION POLICY

SOFOLK attaches great importance to protecting your personal data. This policy explains what data we collect on the website www.renovation-du-cuir.fr, why, how long we keep it, to whom it may be passed on and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act no. 78-17 of 6 January 1978.

1. Data controller

The data controller is SOFOLK, a simplified joint-stock company (SASU) with share capital of €1,000, registered with the Bordeaux Trade and Companies Register under no. 828 401 950, whose registered office is at 13 route de Bordeaux, 7 lotissement Les Vignes, 33360 Cénac, France. For any question about your data: rgpd [at] sofolk.fr, or by post to the registered office.

2. Data collected, purposes and retention periods

We only collect the data needed for each purpose. Mandatory fields are indicated in the forms.

Purpose	Data	Legal basis	Retention period
Customer account (private or professional)	Identity, addresses, e-mail, telephone, password; for professionals: company, SIRET number, VAT number	Performance of the contract	Until the account is deleted, or 3 years after your last order or login
Orders, delivery, invoicing, returns	Identity, addresses, products ordered, history, exchanges with customer service	Performance of the contract; legal obligations	Duration of the business relationship, then 5 years (10 years for an order of €120 or more); invoices and accounting records: 10 years
Payment and fraud prevention	Transaction data (SOFOLK never has access to your full card number)	Performance of the contract; legitimate interest	13 months after payment, the period for disputes; beyond that, according to the payment provider’s rules
Custom shades and samples	Contact details, shade information, samples sent	Performance of the contract	Duration of the business relationship; shade recipes may be kept for your future orders
Customer service: contact form, telephone, online chat	Identity, contact details, content of the exchanges	Legitimate interest (answering your requests); performance of the contract	3 years after the last exchange; for a customer, the duration of the business relationship
Online chat assistant	Messages exchanged with the assistant and any ratings	Legitimate interest (answering your questions, improving our answers)	3 years after the conversation
Customer reviews	Name or pseudonym, rating, comment, product purchased	Legitimate interest; your consent to the publication of the review	For as long as the review is published
Forum	Pseudonym, e-mail, messages and photos posted	Legitimate interest; acceptance of the forum rules	For as long as they are published, or until you ask for them to be deleted
Offers and commercial information by e-mail, basket reminders	E-mail, first name, purchase history	Customers: legitimate interest, for products similar to those already purchased; other people: consent	3 years after the last contact or the last purchase; until you unsubscribe
Audience measurement, advertising, social networks	Cookies and online identifiers, pages viewed	Consent (see section 5)	13 months at most

3. Recipients of the data

Your data is intended for SOFOLK’s departments. It is passed on to our service providers, strictly within the limits of their task and in accordance with our instructions:

Website hosting: SYNTIS, on servers located in France;
Online payment: Stripe;
Delivery: La Poste (Colissimo) and UPS;
Sending e-mails: Brevo;
Customer reviews: Société des Avis Garantis;
Online chat assistant: Anthropic;
Accounting: our accounting software and our chartered accountant;
Audience measurement and advertising, only with your consent: Google, Microsoft, Meta, TikTok, OpenAI, Tradedoubler; your consent is managed by Sirdata.

It may also be disclosed to authorities that request it within the legal framework. SOFOLK never sells your data.

4. Transfers outside the European Union

Some service providers, in particular for payment, audience measurement, advertising or the chat assistant, may process data outside the European Union, notably in the United States. These transfers are governed by an adequacy decision of the European Commission (Data Privacy Framework) or by standard contractual clauses approved by the Commission.

5. Cookies and other trackers

A cookie is a small file placed on your device when you visit a website. We use:

cookies needed for the website to work (basket, login to your account, security, remembering your choices): they do not require your consent;
audience measurement cookies, to understand how the website is used and improve it;
advertising and social network cookies, to measure the effectiveness of our advertising and offer you suitable offers;
affiliate cookies, to pay the partner websites that recommend us.

These last three categories are only placed with your consent, obtained through the consent window shown on your first visit. You can accept, refuse or choose purpose by purpose, just as easily one way as the other. Your choice is kept for 13 months at most and you can change it at any time: manage my cookies.

SOFOLK complies with the specifications and policies of the IAB Europe Transparency & Consent Framework, through Consent Management Platform no. 92.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time and to give instructions on what happens to your data after your death.

To exercise them: write to rgpd [at] sofolk.fr or by post to the registered office. We will reply within one month. Proof of identity may be requested if there is reasonable doubt about your identity.
To stop receiving our e-mails: click on the unsubscribe link in each of them.
Telephone marketing: if you live in France, you can register free of charge on the Bloctel opt-out list (www.bloctel.gouv.fr).
Complaint: if you consider that your rights are not respected, you can contact the French data protection authority, the CNIL (www.cnil.fr), or the supervisory authority of your country.

7. Security

The website can only be accessed through an encrypted connection (HTTPS). Access to your data is restricted to the people who need it to process your orders and requests. Online payments are processed by a certified provider: SOFOLK never has access to your full bank card details.

8. Minors

The website is intended for adults. It is not intended for children under 15, whose data we do not knowingly collect.

9. Changes to this policy

This policy may be changed to reflect changes to the website or to the regulations. The online version is the version in force. Last updated: 5 November 2026.