Please consult our privacy policy below. For any further requests, write to us at bonjour@gris-haircare.com
At GRIS, the protection of your personal data matters just as much as the care we put into our products.
This policy explains what data we collect, why, how long we keep it, who we share it with, and what your rights are. It applies to any browsing or purchasing on the site www.gris-haircare.com (hereinafter the "Site").
1. DATA CONTROLLER
The controller of your personal data is the company GRIS, a Simplified Joint Stock Company (Société par actions simplifiée) with a capital of €100, registered with the Créteil Trade and Companies Register under number 935 350 520, whose registered office is located at 14 avenue du Général de Gaulle, 94160 Saint-Mandé.
For any questions regarding your data or to exercise your rights, you can write to us at: bonjour@gris-haircare.com.
2. DATA WE COLLECT
We collect only the data necessary for the purposes described below. Depending on your interaction with GRIS, this may include:
• Identification and contact data: last name, first name, email address, postal address, phone number.
• Order data: items ordered, purchase history, delivery and billing address.
• Payment data: processed directly by our payment service provider; GRIS does not store any banking details.
• Hair diagnostic data: responses to the questionnaire and, where applicable, date of birth, for the purpose of personalized recommendations.
• Browsing data: IP address, pages visited, connection data, and information from cookies (subject to your consent).
Some data is mandatory to process your order or create your account; this is indicated as such at the time of collection. Otherwise, we will not be able to provide the requested service.
3. PURPOSES AND LEGAL BASES
We process your data for the following purposes, each based on a legal basis provided for by the GDPR:
Purpose - Legal basis - Retention period - Management of orders and customer relations (processing, delivery, billing, customer service)
Performance of the contract Duration of the commercial relationship, then legal archiving (accounting documents: 10 years)
Customer account management Performance of the contract: until the account is deleted at the Customer's request Sending the newsletter and marketing communications
Consent: Until withdrawal of consent, and at most 3 years after the last contact
Hair diagnostic and personalized recommendations
Referral and loyalty program
Consent / legitimate interest
Duration of the program, then deletion
Audience measurement, improvement and personalization of the Site Consent (cookies): 13 months for cookies
Management of customer reviews Duration of review display Fraud prevention and compliance with legal obligations Legal obligation / legitimate interest According to applicable legal obligations
4. RECIPIENTS AND SUB-PROCESSORS
Your data is accessible to authorized GRIS teams and to service providers (sub-processors) who act on our behalf, solely within the scope of their missions and in compliance with the GDPR. These include in particular: • Hosting and e-commerce platform: Shopify. • Payment: Shopify Payments and Apple Pay • Delivery: UPS and Chronopost. • Emailing and customer relationship management: Klaviyo. • Waitlist and referral program: Klaviyo • Audience measurement and advertising: Google and Meta (Facebook / Instagram), subject to your consent. GRIS does not sell or rent your personal data. It may only be transmitted to third parties in the event of a legal obligation or for the defense of our rights.
5. TRANSFERS OUTSIDE THE EUROPEAN UNION
Some of our service providers are established outside the European Union, particularly in the United States. In this case, transfers are governed by appropriate safeguards within the meaning of the GDPR: adherence to the "EU-U.S. Data Privacy Framework" where the provider is certified, and/or the signing of standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to us at bonjour@gris-haircare.com.
6. RETENTION PERIODS Your data is kept for the period strictly necessary for the purposes pursued, as specified in the table above, and then archived or deleted in accordance with legal obligations. For information: prospecting data is kept for up to 3 years after your last contact; accounting documents related to orders are kept for 10 years; account data is kept until the account is deleted.
7. YOUR RIGHTS
In accordance with Act No. 78-17 of January 6, 1978, as amended, and Regulation (EU) 2016/679 (GDPR), you have the following rights regarding your data:
• right of access and rectification;
• right to erasure ("right to be forgotten");
• right to restriction of and right to object to processing;
• right to data portability;
• right to withdraw your consent at any time, without calling into question the lawfulness of previous processing;
• right to define directives regarding the fate of your data after your death.
We may ask you for proof of identity in case of reasonable doubt. You can also unsubscribe from our marketing communications at any time via the unsubscribe link present in every email.
If you believe, after contacting us, that your rights are not being respected, you may file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.
8. COOKIES
The Site uses cookies and trackers necessary for its operation, as well as, subject to your consent, audience measurement, personalization, and advertising cookies. During your first visit, a banner allows you to accept, refuse, or configure non-essential cookies. You can modify your choices at any time via the Site's cookie management link or your browser settings. Cookies subject to consent are kept for a maximum period of 13 months.
9. DATA SECURITY GRIS implements appropriate technical and organizational measures to protect your data against loss, alteration, or unauthorized access. In the event of a data breach likely to pose a risk to your rights, we will inform you and notify the CNIL under the conditions provided by law.
10. MODIFICATIONS TO THIS POLICY
This policy may be updated to reflect legal, regulatory, or technical changes. The applicable version is the one published on the Site. In the event of a substantial change, we will inform you by any appropriate means.
11. CONTACT
For any questions regarding this policy or your personal data, contact us at: bonjour@gris-haircare.com.
