Privacy Policy & Data Protection Contract

1. Atelier Data Collection Overview

At Bouquetberets.com ("Bouquetberets", "our Atelier"), we respect the confidentiality of our international patrons. To process purchases of our hand-embroidered merino wool berets and manage custom embroidery commissions, we collect necessary personal details under strict European Union General Data Protection Regulation (GDPR) standards.

Information collected includes:

• Contact & Shipping Data: Full name, shipping/billing address, email address, and phone number required for international parcel delivery and customs declarations.
• Bespoke Customization Details: Head circumference measurements, floral pattern requests, silk thread preferences, and personalized gift notes.
• Payment Tokens: Transactions are processed via end-to-end 256-bit SSL encrypted payment gateways. Bouquetberets never stores full credit card numbers or raw banking credentials on our servers.

2. Purpose & Lawful Basis of Processing

We process your personal data solely for the following legitimate business purposes:

1. Fulfilling orders for hand-embroidered headwear and managing bespoke artisan commissions.
2. Communicating design proofs, shipping updates, and tracking details.
3. Complying with French tax regulations and international export documentation.
4. Improving atelier website navigation and cart persistence (with explicit consent).

3. Data Retention & Non-Sharing Policy

We do not sell, rent, or trade customer data to third-party data brokers.

Your details are shared strictly with trusted operational partners performing essential logistics services:

• Postal and Courier carriers (La Poste Colissimo, DHL Express, FedEx) for package dispatch.
• PCI-DSS Level 1 compliant payment processors (Stripe, PayPal, Apple Pay).
• Secure cloud hosting infrastructure with encrypted data centers in Western Europe.

4. Your Rights Under GDPR & CCPA

Patrons in the European Union and California possess specific rights regarding their personal data:

• Right of Access & Portability: Request a copy of all personal and commission data held by our atelier.
• Right to Rectification: Request instant updates to incorrect sizing or shipping information.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of personal records after order completion, subject to French legal tax retention windows.

To exercise any of these rights, email our Privacy Officer directly at [email protected].

5. Security & Encryption Standards

All data transmissions across bouquetberets.com are protected using Transport Layer Security (TLS 1.3) with 256-bit SSL encryption. Physical access to customer commission records within our Paris atelier at 14 Rue des Rosiers is strictly restricted to authorized staff.