Privacy policy

BOUDET S.A.S. (hereinafter "C-Création" or "we") attaches particular importance to the protection of your personal data. This privacy policy aims to inform you, in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and the French "Informatique et Libertés" Act (Law No. 78-17 of 6 January 1978 as amended), about how we collect, use and protect your data.

This policy applies to data collected on the website www.c-creation.fr as well as in the context of our commercial relationships (orders, customer service, direct marketing).

Last updated: May 2026

1. Data Controller

The controller for the processing of your personal data is:

BOUDET S.A.S.
Simplified joint-stock company with share capital of 76 225 €
Registered office: 2 route de Guenroc, 22350 Caulnes, France
RCS Saint-Malo 379 128 143
SIRET: 379 128 143 00011
Intracommunity VAT number: FR 77 379 128 143

Contact for any question relating to your personal data:
Email: contact@c-creation.fr
Mail: BOUDET S.A.S., 2 route de Guenroc, 22350 Caulnes, France

BOUDET S.A.S. has not designated a Data Protection Officer (DPO), as designation is not mandatory given the nature and volume of the processing carried out. All requests are processed directly by the company's Management.

2. Personal Data We Collect

We collect different categories of data depending on the context:

Identification and Contact Data

• Surname, first name;
• Postal address (billing and delivery);
• Email address;
• Telephone number;
• Customer account creation date.

Professional Data (Professional Accounts Only)

• Corporate or trade name;
• SIRET or SIREN number;
• Intracommunity VAT number (where applicable);
• Type of professional activity;
• Professional contact details.

Order and Payment Data

• Order history;
• Invoices;
• Payment methods used (never the full bank card number, which is processed directly by the payment provider);
• Delivery addresses.

Browsing Data and Cookies

• IP address;
• Session identifiers;
• Browsing data (pages visited, duration, traffic source);
• Type of browser, operating system, device used.

Data From Interactions

• History of exchanges with customer service (emails, calls);
• Customer reviews left on products (via Société des Avis Garantis);
• Responses to any surveys or polls.

3. Purposes and Legal Bases of Processing

In accordance with Article 13 of the GDPR, we inform you precisely of the purposes for which we process your data and the associated legal basis (Article 6 of the GDPR).

Purpose	Legal basis	Retention period
Order management, delivery, invoicing, after-sales service	Performance of the contract (Art. 6.1.b GDPR)	Duration of the commercial relationship + 10 years in accounting archives
Creation and management of the customer account	Performance of the contract (Art. 6.1.b GDPR)	Duration of the commercial relationship, or deletion on request
Management of professional accounts (validation of SIRET or EU intracommunity VAT number, automatic tier discounts)	Performance of the contract (Art. 6.1.b GDPR)	Duration of the commercial relationship, or termination of the account
Direct marketing by email (newsletters and offers)	Consent (Art. 6.1.a GDPR) for prospects / Legitimate interest for existing customers	3 years from the last contact from the prospect (CNIL recommendation)
Compliance with legal obligations (accounting, invoicing, anti-fraud)	Legal obligation (Art. 6.1.c GDPR)	10 years (Art. L123-22 French Commercial Code, Art. L213-1 French Consumer Code)
Management of complaints, disputes and litigation	Legitimate interest (Art. 6.1.f GDPR)	Legal limitation period (generally 5 years)
Audience measurement and improvement of the site	Consent (Art. 6.1.a GDPR) via cookie banner	13 months maximum (CNIL recommendation)
Collection of customer reviews after purchase	Legitimate interest (Art. 6.1.f GDPR)	5 years after publication of the review
Site security, fraud prevention, technical logs	Legitimate interest (Art. 6.1.f GDPR)	1 year maximum

4. Recipients and Processors

Your personal data is strictly reserved for BOUDET S.A.S. and its processors, who act on behalf of BOUDET S.A.S. in the provision of services. We do not sell or rent your data to third parties for commercial purposes.

List of main processors and recipients:

E-commerce Platform and Hosting

• Shopify International Limited (Ireland, with servers possibly in the United States): site hosting, catalogue management, customer account and order management. Transfers outside the EU are governed by the European Commission’s Standard Contractual Clauses and Data Privacy Framework certification.

Carriers

• DPD France : France and EU delivery;
• Mondial Relay : pick-up point delivery France and EU.

Payment

• Shopify Payments (Stripe) : processing of bank card payments;
• PayPal : processing of payments via PayPal.

Bank card data never transits through the servers of BOUDET S.A.S. and is processed exclusively by these PCI-DSS certified providers.

Commercial and Accounting Management

• Sage : internal commercial and accounting management software (ERP);
• Shoppingfeed : management of product feeds to marketplaces.

Partner Marketplaces

• Faire (B2B marketplace, USA): transfers governed by standard contractual clauses;
• Ankorstore (B2B marketplace, France);
• La Redoute Marketplace, Maisons du Monde, Leroy Merlin : when your orders are placed via these platforms, each platform processes your data according to its own privacy policy.

Customer Reviews

• Société des Avis Garantis : collection and management of certified customer reviews.

Marketing, Analytics and Advertising (Subject to Your Consent)

• Google LLC (Google Analytics, Google Ads, Google Merchant Center, Google Tag Manager): United States, transfers framed by the Data Privacy Framework;
• Pinterest : targeted advertising, United States, Data Privacy Framework;
• Meta (Facebook, Instagram) : if applicable, United States, Data Privacy Framework.

Authorities and Authorised Third Parties

Your data may be disclosed, within the strict limits of the law, to tax authorities, to police or judicial authorities upon a formal request, to mediators and to legal advisers in the event of a dispute.

5. Data Transfers Outside the European Union

Some of our processors may process your data outside the European Union, particularly in the United States (Shopify, Faire, Google, Pinterest, Meta).

These transfers are covered by the appropriate safeguards provided for by the GDPR:

• Data Privacy Framework : USA-EU adequacy certification for Google, Meta, Microsoft, Pinterest (new adequacy decision of 10 July 2023);
• Standard contractual clauses approved by the European Commission for non-certified providers;
• Additional impact assessments where necessary.

You can obtain a copy of these guarantees by contacting us at contact@c-creation.fr.

6. Your Rights

In accordance with the GDPR and the Informatique et Libertés Act, you have the following rights regarding your personal data:

Right of Access (Art. 15 GDPR)

Obtain confirmation as to whether your data is being processed and receive a copy of the data held.

Right of Rectification (Art. 16 GDPR)

Have inaccurate data corrected or complete incomplete data.

Right to Erasure or "Right to Be Forgotten" (Art. 17 GDPR)

Request the erasure of your data, subject to legal retention obligations (particularly accounting and tax).

Right to Restriction of Processing (Art. 18 GDPR)

Request the temporary suspension of the processing of your data (for example, during the verification of a rectification request).

Right to Object (Art. 21 GDPR)

Object at any time to the processing of your data on grounds relating to your particular situation, or to direct marketing without having to justify your decision.

Right to Portability (Art. 20 GDPR)

Receive your data in a structured, commonly used and machine-readable format, and transmit it to another data controller.

Right to Withdraw Your Consent

When processing is based on your consent (newsletter, non-essential cookies), you can withdraw it at any time, without affecting the lawfulness of the processing carried out before this withdrawal.

Instructions Concerning Your Data After Death

In accordance with Article 85 of the Informatique et Libertés Act, you may define instructions concerning what happens to your data after your death.

How to Exercise Your Rights

You can exercise these rights at any time by:

• Email: contact@c-creation.fr (subject: "GDPR – Exercise of my rights");
• Post: BOUDET S.A.S., Service RGPD, 2 route de Guenroc, 22350 Caulnes, France.

To verify your identity, we may ask you to attach a copy of an identity document. We will respond within a maximum of 1 month, possibly extended by 2 months for complex or numerous requests (with information within the initial deadline).

The exercise of these rights is free of charge, except in the event of a manifestly unfounded or excessive request.

7. Right to Lodge a Complaint With the CNIL

If, after contacting us, you consider that your data protection rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):

CNIL
3 Place de Fontenoy, TSA 80715
75334 Paris Cedex 07
Telephone: 01 53 73 22 22
Website: www.cnil.fr

8. Data Security

BOUDET S.A.S. implements appropriate technical and organisational measures to guarantee the security and confidentiality of your personal data, including:

• HTTPS encryption of all communications on the sites;
• Shopify hosting certified PCI-DSS, ISO 27001;
• Access control with enhanced authentication for administrators;
• Regular backups and business continuity plan;
• Awareness of data protection among our employees;
• Confidentiality clauses with our processors, compliant with Article 28 of the GDPR.

In the event of a personal data breach presenting a risk to your rights and freedoms, we undertake to notify the CNIL within 72 hours and, where applicable, to inform you as soon as possible, in accordance with Articles 33 and 34 of the GDPR.

9. Cookies and Trackers

Our sites use cookies and trackers to ensure their proper functioning and improve your experience. You are informed of their use on your first visit via a cookie banner allowing you to accept, refuse or personalise your choices.

Strictly Necessary Cookies (Exempt From Consent)

These cookies are essential for the operation of the site and do not require your consent:

• Session and authentication cookies;
• Shopping basket cookies;
• Security and fraud prevention cookies;
• Cookies for managing consent preferences.

Audience Measurement Cookies (Subject to Consent)

• Google Analytics 4 : statistical analysis of visits and user behaviour;
• Internal Shopify cookies : site performance statistics.

Advertising and Social Media Cookies (Subject to Consent)

• Google Ads : conversion measurement and retargeting advertising;
• Pinterest Tag : conversion measurement and retargeting;
• Meta Pixel (where applicable): measurement and targeted advertising on Facebook/Instagram.

The lifetime of cookies is limited to 13 months maximum, in accordance with CNIL recommendations. You can modify your preferences at any time via the cookie banner accessible from the footer of the site.

You can also configure your browser to refuse cookies. However, since some cookies are necessary for the proper functioning of the site, blocking them may impair your user experience.

10. Automated Decision-making and Profiling

BOUDET S.A.S. does not implement fully automated decision-making producing significant legal effects on you, within the meaning of Article 22 of the GDPR.

However, some processing may include light profiling for marketing purposes (product recommendations based on browsing history, segmentation for personalised email campaigns). This processing is based on our legitimate interest or your consent when required.

11. Minors' Data

Our services are intended for adults. We do not knowingly collect personal data concerning minors under 15. If you believe that a minor has communicated data to us without the consent of their legal representatives, contact us at contact@c-creation.fr so that we can delete it.

12. Changes to This Policy

We may modify this privacy policy to reflect legal, technical or organisational developments. The date of the last update appears at the top of this policy. In the event of substantial modification, we will inform you by appropriate means (banner on the site, email to concerned customers).

We encourage you to consult this page regularly to stay informed of our data protection practices.

13. Contact

For any question relating to this privacy policy or the processing of your personal data:

BOUDET S.A.S.
Email: contact@c-creation.fr
Telephone: 02 96 83 92 89 (non-premium-rate, Monday to Friday, 9h-17h)
Mail: 2 route de Guenroc, 22350 Caulnes, France