Privacy and cookie policy

Last update: September 24, 2026

This policy explains how ARAKOW processes your personal data when you visit arakow.com, place an order, or contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act No. 78-17 of January 6, 1978, as amended ("Informatique et Libertés").

1. Data Controller

ARAKOW – Jhanell KATUMBA DIBALA, sole trader (EI), 24 avenue de la République, 37170 Chambray-lès-Tours, France – SIRET 130 137 094 00012.
Contact: arakow.contact@gmail.com – 06 95 35 55 76.
No Data Protection Officer (DPO) has been appointed: for any questions, please use the contact details above.

2. Processed Data

  • Identity and contact details: last name, first name, shipping and billing address, email, phone number.
  • Orders: ordered products, amounts, discounts, history, returns, correspondence with customer service.
  • Payment: transaction information (status, method used, amount). Full bank card details are processed by payment providers and are not accessible to ARAKOW.
  • Customer account (if you create one): login credentials and preferences.
  • Technical and navigation data: IP address, device, browser, pages visited, cookies (see section 9).
  • Newsletter (only if you subscribe voluntarily): email address and history of your consent.

3. Purposes and Legal Bases

  • Management of orders, payment, delivery, tracking, customer service, returns, withdrawals, and guarantees – legal basis: performance of the contract and pre-contractual measures (Art. 6.1.b GDPR).
  • Accounting, tax, and legal obligations (invoices, record-keeping of contracts, responses to authorities) – legal basis: legal obligation (Art. 6.1.c).
  • Fraud prevention and security of payments and the website – legal basis: legitimate interest in protecting the store and its customers (Art. 6.1.f).
  • Management of complaints and disputes, defense of our rights – legal basis: legitimate interest (Art. 6.1.f).
  • Technical functioning of the site (cart, payment, storing your cookie choices) – legal basis: legitimate interest; these strictly necessary cookies are exempt from consent.
  • Audience measurement and marketing via non-essential cookies – legal basis: your consent (Art. 6.1.a), collected via the cookie banner.
  • Sending promotional emails / newsletter – legal basis: your consent. We do not send commercial communications solely because you placed an order. We do not currently use email marketing; if we do, it will be only to people who have given their consent (voluntary subscription, box not pre-checked), with an unsubscribe link in every message.

We do not make any decisions producing legal effects regarding you based solely on automated processing. The payment platform's anti-fraud tools may flag a suspicious transaction; in this case, you may contact us for human intervention.

4. Recipients and Processors

Your data is intended for ARAKOW and, to the extent necessary, for:

  • Shopify International Limited (Ireland): store hosting, order, payment, and transactional email management. For certain features, Shopify acts as a separate data controller: see its privacy policy for customers and its privacy portal.
  • Payment providers offered at checkout.
  • Order management application (DSers) and product shipping supplier: name, address, phone number, and order content, only to prepare and ship your package.
  • Carriers responsible for delivery: name, address, phone number, email if necessary for tracking.
  • Google (Gmail service): hosting of our contact email, for email exchanges.
  • If applicable, our accountant, or administrative or judicial authorities upon legal request.

We do not sell your personal data.

5. Transfers outside the European Union

Some of our providers may process data outside the European Economic Area (notably Shopify, whose group is established in Canada, Google, as well as the supplier and shipping services, which may be located outside the EU). These transfers are made to countries recognized as offering an adequate level of protection by the European Commission, or are governed by appropriate safeguards (notably the European Commission's standard contractual clauses), or are based, for the shipment of your order, on their necessity for the performance of the contract (Art. 49.1.b GDPR). You may ask us for information regarding these safeguards.

6. Retention Periods

  • Order and customer relationship data: for the duration of the commercial relationship, then 5 years (common law prescription) for evidence purposes; contracts with a value of €120 or more are kept for 10 years from delivery (Article L. 213-1 of the French Consumer Code).
  • Accounting records and invoices: 10 years (Article L. 123-22 of the French Commercial Code).
  • Customer account: until it is deleted at your request, or after 3 years of inactivity.
  • Customer service exchanges: for the time required to process your request, then for the applicable limitation period in the event of a dispute.
  • Newsletter: until you unsubscribe, or 3 years after our last contact without any reaction from you.
  • Cookies: see section 9; cookies subject to consent have a maximum lifespan of 13 months.

7. Your Rights

You have the following rights, under the conditions provided by the GDPR: access, rectification, erasure, restriction, objection (in particular, at any time and without reason, to commercial prospecting), portability (for data processed based on the contract or consent), withdrawal of your consent at any time (without calling into question the lawfulness of previous processing), as well as the right to set directives regarding the fate of your data after your death.

To exercise them: arakow.contact@gmail.com or by mail to ARAKOW, 24 avenue de la République, 37170 Chambray-lès-Tours, France. We respond within one month (extendable in cases provided for by the GDPR). Proof of identity may be requested in case of reasonable doubt.

If you believe that your rights are not respected, you may file a complaint with the CNIL: www.cnil.fr/fr/plaintes – 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

8. Security

We implement reasonable measures to protect your data (restricted access to the merchant account, payments processed by secure providers, HTTPS encrypted connection).

9. Cookies and Trackers

A cookie is a small file placed on your device during your visit. Strictly necessary cookies are placed without consent. Others are placed only with your agreement, collected via the banner displayed during your first visit. Refusing non-essential cookies is as simple as accepting them and does not prevent you from ordering.

Strictly necessary cookies (placed by Shopify)

  • _shopify_essential – essential information for the shop's operation (session, payment, security) – 1 year
  • _tracking_consent – stores your cookie choices – 1 year
  • cart – contents of your cart – 2 weeks
  • cart_currency – cart currency after an order – 2 weeks
  • localization – shop country – 1 year
  • discount_code – discount code transmitted via a link – session
  • shopify_pay, login_with_shop_finalize, __Host-Http-shop_binding – connection to Shop Pay accelerated payment if you use it – from a few minutes to 1 year
  • _shopify_test – checks if your browser accepts cookies – 1 minute

Audience measurement cookies (Shopify) – subject to your consent

Native statistics of the Shopify platform, used to understand shop traffic: _shopify_y (1 year), _shopify_s (30 minutes), _shopify_analytics (1 year), shop_analytics (1 year), _landing_page and _orig_referrer (2 weeks).

Marketing cookies – subject to your consent

_shopify_marketing (Shopify, 1 year): platform marketing data.

No third-party advertising trackers are currently used on the shop: Meta Pixel, TikTok Pixel, and Google Analytics are not connected. This policy will be updated before activating any such services, which will only be placed with your consent.

Managing your choices

You can modify or withdraw your consent at any time via the "Manage my cookies" link at the bottom of the page, or by deleting cookies from your browser settings.

10. Modification of this policy

This policy may be updated, particularly in the event of the activation of new services (email marketing, measurement or advertising tools). The date of the last update appears at the top of the page.