Contract
Account, basket, order, payment, delivery, after-sales service and requested services.
The personal data processed by Burgundy Paris, their purposes, legal bases, retention periods, recipients and the rights you have.
This policy describes the processing of personal data carried out in connection with the Burgundy Paris website, the online shop and the services offered by the Maison.
Burgundy Paris has not appointed a data protection officer. Requests concerning personal data are handled directly by the controller.
The data processed depend on how you use the website. Mandatory information is indicated on the forms concerned.
| Data | Purpose | Legal basis |
|---|---|---|
| Identity, email, telephone, address, country, language and account information | Creating and managing the account, logging in, basket and customer relations. | Contract or pre-contractual measures |
| Delivery and billing address, contact details, order contents | Sale, payment, preparation, delivery and after-sales service. | Contract |
| Order data and accounting records | Commercial and accounting management, and retention of supporting documents. | Legal obligation and contract |
| Name, email, message, telephone and city where provided | Responding to requests sent to Burgundy Paris and following up the exchange. | Legitimate interest |
| Email and newsletter preference | Sending the newsletter. | Consent |
| Email, telephone and email/text/telephone preferences | Commercial contact through the channel expressly chosen. | Consent |
| Date, time slot, identity, contact details, guests and information provided for an appointment | Organising and following up an appointment or video call. | Pre-contractual measures or legitimate interest, depending on the nature of the appointment |
| Prize draw participation data | Participation, checking conditions, the draw, informing the winner and handing over the prize. | Performance of the rules |
| Technical, browsing and security data | Operation, security, abuse prevention and internal measurement. | Technical necessity or legitimate interest |
| Data sent to Google Analytics | Audience measurement. | Consent |
Burgundy Paris has an internal measurement of how the website operates. When used with your account, this measurement allows Burgundy Paris to analyse your browsing for the purposes described in this policy. This internal data is not exported to Google, Meta or any other advertising network as a customer audience.
Google Analytics is a separate processing operation. Its audience measurement is activated after your consent. Where an analytics identifier is associated with your account, it does not directly correspond to your email address, telephone number or postal address.
Subscribing to the newsletter and authorising commercial contact are independent of audience measurement. Authorisations for commercial contact are recorded separately for email, text message and telephone. Withdrawing one does not withdraw the others.
Each processing operation relies on the legal basis corresponding to its purpose.
Account, basket, order, payment, delivery, after-sales service and requested services.
Retention of information and documents where regulations require it.
Audience measurement subject to consent, newsletter and commercial contacts where consent is required. The purposes are distinct.
Security, abuse prevention, handling of certain requests and operation of the internal measurement, subject to the rights of individuals.
Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before it.
Data are accessible to the people and service providers who need them for their tasks. Some providers may act as independent controllers for the services they provide directly.
| Provider | Involvement | Data concerned | Role in the service |
|---|---|---|---|
| Hostinger | Hosting of the website and database. | Data needed for the hosted services. | Hosting of Burgundy Paris’s infrastructure. |
| Cloudflare | Website security and bot protection (Turnstile). | IP address and technical connection data. | Traffic filtering and form verification. |
| Stripe | Payment and related services. | Identity, contact details, address, order, amount and data needed for payment. | Processing of payments and related payment services. |
| Amazon Pay | Payment when chosen. | Information needed for payment and the order. | Payment service offered via Stripe. |
| PayPal | Payment when chosen. | Information needed for payment and the order. | Payment service offered via Stripe. |
| Revolut Pay | Payment when chosen. | Information needed for payment and the order. | Payment service offered via Stripe. |
| TWINT | Payment when chosen. | Information needed for payment and the order. | Payment service offered via Stripe. |
| Alipay / WeChat Pay | Payment when chosen. | Information needed for payment and the order. | Payment service offered via Stripe. |
| Kakao Pay / Naver Pay / PAYCO / Samsung Pay | Payment when chosen. | Information needed for payment and the order. | Payment service offered via Stripe. |
| Apple Pay / Google Pay | Digital wallet payment when available and chosen. | Information needed for payment. | Payment services offered via Stripe. |
| Brevo | Sending messages relating to Burgundy Paris’s services and, when the newsletter is sent through this service, communications you have chosen to subscribe to. | Contact details needed for sending. | Service sending the communications entrusted to Brevo. |
| Google Calendar / Meet | Appointments and video calls. | Name, email, time slot, guests and necessary information. | Used when the service is requested. |
| Google Analytics | Audience measurement. | Browsing data and analytics identifiers. | Audience measurement after consent. |
| Carrier | Delivery. | Name, address, telephone and necessary information. | Transmission of the information needed for delivery. |
| Authorities, advisers and accounting providers | Legal, accounting, tax or judicial obligations. | Information needed for their involvement. | Only where the law or their assignment justifies it. |
Periods are defined by purpose. A piece of data may therefore disappear from one processing operation while being retained in another where a separate obligation requires it.
| Processing | Period | What happens to the data |
|---|---|---|
| Sessions | 30 days | Automatic deletion. |
| Internal website measurement | 400 days | Automatic deletion according to the retention mechanism. |
| Google Analytics | 14 months | According to the property’s retention settings. |
| _ga cookie | 13 months | Expiry or deletion in the browser. |
| Order attempts and technical baskets | 90 days | Automatic deletion. |
| Contact requests | 3 years from creation | Automatic deletion. |
| Appointments | 3 years after the appointment | Deletion according to the planned mechanism. |
| Proof of marketing consents | 3 years after the last withdrawal of the consent concerned | Deletion of expired proof. |
| Cookie consent choices | 400 days | Deletion according to the retention mechanism. |
| Newsletter | Until unsubscription | The subscription status is removed upon unsubscription. |
| Prize draw | 3 months after closing | Deletion according to the planned mechanism. |
| Orders and accounting records | According to the applicable legal obligations, in particular 10 years where accounting retention applies. | Orders and accounting records are kept for the period required by the applicable legal obligations. |
| Account closure file | 3 years for an account with no order, including one with an after-sales case not linked to an order; 10 years for an account with an order, including an after-sales case linked to that order. In the event of a dispute, deletion of the file is suspended until the dispute is resolved, then the original expiry date applies. | The file is deleted when this period expires, unless a dispute is ongoing. |
| Inactive accounts | The account is kept as long as it is active, unless deletion is requested or a legal retention obligation applies. | You may request the deletion of your account, subject to the applicable retention obligations. |
| Requests to exercise rights | Period needed to handle the request and prove the response. | The information needed to handle a request is kept for the period needed to follow it up and prove the response. |
Backups and technical logs may be kept for the periods needed for security, maintenance and restoration of the service.
The website distinguishes technologies needed for its operation from trackers used to measure audience. Trackers subject to consent are not used for audience measurement before you make your choice.
| Technology | Purpose | Consent | Period |
|---|---|---|---|
| Session cookie | Login, basket and website operation. | No, where strictly necessary. | For the session. |
| Consent preferences | Remembering your choice regarding cookie categories. | No, necessary to respect your choice. | 400 days. |
| Security token (burgundy_csrf) | Form security (protection token). | No, necessary. | 12 hours. |
| Language, zone and currency preferences (burgundy_locale, burgundy_zone, burgundy_currency) | Remembering your language, delivery zone and currency. | No, necessary for the service you requested. | 400 days. |
| Zone suggestion (burgundy_zone_suggestion) | Remembering that you closed the zone suggestion. | No, necessary to respect your choice. | 24 hours. |
| Display theme (browser storage: burgundy-theme) | Remembering your choice of day or night display. | No, a preference you chose. | Until you clear it. |
| Browser session storage | Keeping the scroll position when you change language and showing a message only once per session. | No, necessary for the website to work. | Until the tab is closed. |
| _ga, _ga_* | Google Analytics audience measurement. | Yes. | 13 months. |
| Visit identifier (burgundy_visit) | Counting visits to the website, anonymously without your consent. | No for anonymous counting; linking visits to a person requires your consent. | 30 minutes. |
| Internal measurement identifiers | Measuring how the website operates. | Depending on the processing concerned. | 400 days for the measurement data concerned. |
| Stripe (__stripe_mid, __stripe_sid) | Fraud prevention and payment security, on the payment page. | No, necessary for payment. | Up to 1 year. |
The banner lets you accept, refuse or customise the categories concerned. Your choice can be changed later from the cookie management link on the website.
Consent to audience measurement does not imply consent to personalised advertising, the newsletter or commercial contacts. These purposes are separate.
When you withdraw your consent to measurement, the analytics identifiers concerned are deleted from the browser where the technical mechanism allows, and no further collection requiring that consent is carried out.
Burgundy Paris implements technical and organisational measures suited to the processing carried out on the website.
Rate-limiting mechanisms may temporarily process an IP address. Technical logs are used for the period needed for the security and proper operation of the service.
In the event of a personal data breach, Burgundy Paris applies the obligations laid down by the GDPR, in particular notification to the competent authority when the conditions are met and informing the persons concerned when the level of risk requires it.
Some service providers used by Burgundy Paris may process data outside the European Union. The location depends on the service, the contracting entity and the infrastructure used.
| Provider | Known situation | Safeguards |
|---|---|---|
| Stripe | Stripe Payments Europe Ltd. is established in Ireland; some processing may involve entities or infrastructure outside the EU. | Transfer safeguards provided by Stripe where a transfer outside the EU is necessary. |
| Cloudflare | Cloudflare, Inc. is established in the United States; website traffic may pass through its infrastructure. | Transfer safeguards provided by Cloudflare where a transfer outside the EU is necessary. |
| Google Ireland Ltd. acts for European services; some processing may involve Google LLC or infrastructure outside the EU. | Transfer safeguards provided by Google where a transfer outside the EU is necessary. | |
| Amazon Pay | Amazon Payments Europe is established in Luxembourg; the group may involve other entities. | Transfer safeguards provided by the provider where a transfer outside the EU is necessary. |
| PayPal | PayPal (Europe) S.à r.l. et Cie, S.C.A. is established in Luxembourg; the PayPal group may involve other entities, including in the United States. | Transfer safeguards provided by the provider where a transfer outside the EU is necessary. |
| Revolut Pay | Revolut Payments UAB is established in Lithuania for customers in the European Economic Area; Revolut Ltd. acts for the United Kingdom. | The European Commission has recognised the United Kingdom as providing an adequate level of protection; for any other transfer outside the EU, safeguards provided by Revolut. |
| TWINT | TWINT AG is established in Switzerland, outside the European Union. | The European Commission has recognised Switzerland as providing an adequate level of protection. |
| Alipay | Alipay (Europe) Limited S.A. is established in Luxembourg; the Ant group may involve entities located in China. | China is not covered by an adequacy decision: where a transfer outside the EU is necessary, it relies on safeguards provided by the provider, such as standard contractual clauses. |
| WeChat Pay | WeChat Pay is operated by companies of the Tencent group; processing may take place in China. | China is not covered by an adequacy decision: where a transfer outside the EU is necessary, it relies on safeguards provided by the provider, such as standard contractual clauses. |
| Kakao Pay, Naver Pay, PAYCO, Samsung Pay | Kakao Pay, Naver Pay, PAYCO, Samsung Pay and Korean cards are operated by companies established in the Republic of Korea. | The European Commission has recognised the Republic of Korea as providing an adequate level of protection (2021 decision). |
| Brevo | Used for transactional messages. | Processing is governed by the safeguards provided for by the applicable regulations and by the provider’s commitments. |
Where the GDPR requires it, transfers are governed by an adequacy decision or by appropriate safeguards, such as standard contractual clauses, with the additional measures needed depending on the context.
You may request further information about the safeguards applicable to a transfer by writing to [email protected].
Under the conditions laid down by the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability. Where processing is based on your consent, you may withdraw it at any time.
| Right | Purpose | How to exercise it |
|---|---|---|
| Access | Obtain confirmation of the processing and a copy of the data. | [email protected] |
| Rectification | Correct inaccurate or incomplete data. | From the account where the function exists, or on request. |
| Erasure | Request deletion where the conditions are met. | From the account or on request. |
| Restriction | Request the suspension of certain processing. | On request. |
| Objection | Object to processing based on legitimate interest and, under the applicable conditions, to direct marketing. | On request. |
| Portability | Receive certain data in a structured format where the conditions are met. | On request. |
| Withdrawal of consent | Withdraw an authorisation without affecting earlier processing. | From the cookie settings or the marketing preferences concerned. |
Proof of identity may be requested where necessary to protect your data. You may also lodge a complaint with the CNIL (the French data protection authority).
You can delete your account from your personal area, except in situations where Burgundy Paris must keep certain information to fulfil an order in progress or comply with a legal obligation.
Deletion entails in particular the deletion of account data and associated sessions. Orders subject to a retention obligation are dissociated from the account; the information needed for their legal retention may remain archived for the applicable period.
Marketing data are dissociated from the account according to the rules of the consent log. The data needed to prove consent may be kept for the period provided for that purpose.
Deleting an account cannot erase data that a legal obligation requires to be kept, nor data held directly by a provider acting under its own responsibility.
When you request the deletion of your account and the request can be processed, Burgundy Paris draws up a closure file: a summary of the relationship (identity, orders, after-sales cases, exchanges, consents, deletion requests) kept to prove what happened, keep its accounts and handle any disputes. It is not used for any other purpose and contains no password, payment data, phone number or billing address. It is kept for 3 years if the account had no order (including with an after-sales case not linked to an order) and 10 years if it had an order (including with an after-sales case linked to that order). In the event of a dispute, its deletion is suspended until the dispute is resolved, then the original expiry date applies: the period does not restart on resolution.
Burgundy Paris’s services are not intended for persons who do not have the legal capacity required to enter into a contract.
Where the law requires the involvement of a holder of parental responsibility for processing based on consent, Burgundy Paris applies the corresponding rules.
If you believe that a minor has sent us data in circumstances that should not allow it, contact [email protected].
Each prize draw has its own rules. The necessary data are used to manage entries, check conditions, carry out the draw, contact the winners and arrange delivery of the prize.
Entering the prize draw is not conditional on subscribing to the newsletter. The newsletter is a separate, optional and independent choice: it is offered by an unticked box in the entry form and, failing that, by email after the entry, where the address is not already subscribed, and takes effect only once the person has confirmed it.
To enter a prize draw organised on the website, a customer account is required: the draw process creates that account (first name, last name, email address, password) or uses the existing one. That account follows the rules applicable to accounts. Data specific to the entry are kept for three months after closing, unless there is a particular need related to the rules or a legal obligation.
The dates, conditions, prizes and other terms are set out in the rules of the prize draw concerned.
When an appointment is requested, Burgundy Paris processes the information needed to prepare and follow it up: identity, contact details, time slot, invited guests and information you choose to share.
When the appointment includes a video call, Google Calendar and Google Meet may be used. The information needed to organise the event is then sent to the service concerned.
Booking an appointment does not, by itself, mean subscribing to a newsletter or authorising commercial contact.
Requests concerning your data are centralised at [email protected].
The elements needed to handle a request and prove the response may be kept for the period needed for that purpose. The information needed to handle a request is kept for the period needed to follow it up and prove the response.
You may also refer the matter to the Commission nationale de l’informatique et des libertés (CNIL).
This policy changes when the website, services, providers or data processing change. The version published on this page is the applicable version from the date it goes online.
This version is identified as v.01102026 and dated 1 October 2026.
Where a substantial change affects your rights or introduces processing requiring specific information, Burgundy Paris updates the information at the appropriate time and collects new consent where regulations require it.
The contractual terms applicable to orders are set out in the general terms and conditions of sale.
Legal
…
It’s late, and you’re still here. That’s a good sign.