Privacy Policy

Last updated: July 2026

This is a translation of the French original. In the event of a dispute, the French version prevails.

Data controller

SAS WORLD SHAPES
4, Porte de Laubian, 40510 Seignosse, France
Email: [email protected]

Data collected

We collect the following data as part of our business:

When placing an order

  • First and last name
  • Email address
  • Phone number (optional)
  • Delivery and billing address
  • Payment information (processed by Stripe, never stored on our servers)
  • For custom boards: weight, height, surfing level

When contacting us or signing up

  • First and last name
  • Email address
  • Phone number (optional)
  • Message content

Browsing the website

  • Anonymised browsing data via Google Analytics (GA4)
  • IP address (anonymised)
  • Browser type, device, operating system

Purposes of processing

  • Processing and tracking orders
  • Communication about orders (confirmations, delivery tracking)
  • Responding to enquiries
  • Information about shaping courses (waiting list)
  • Statistical analysis of site traffic (Google Analytics)
  • Improving the user experience

Legal basis

  • Performance of a contract: processing orders and deliveries
  • Consent: analytics cookies (Google Analytics), waiting list sign-up
  • Legitimate interest: improving the site, fraud prevention
  • Legal obligation: retention of invoices and accounting records

Data recipients

Your data may be shared with the following providers, strictly for the purposes described:

  • Stripe (secure payment): United States, certified under the EU-US Data Privacy Framework
  • Cloudflare (hosting): United States, certified under the EU-US Data Privacy Framework
  • Google Analytics (audience measurement): United States, certified under the EU-US Data Privacy Framework

No data is sold or transferred to third parties for commercial purposes.

Retention periods

  • Order data: 5 years (accounting obligation)
  • Contact data: 3 years after the last exchange
  • Browsing data (analytics): 14 months

Cookies

The website uses the following cookies:

  • Google Analytics (_ga, _ga_*): audience measurement, 14-month lifetime, subject to consent
  • Stripe: technical cookies required for secure payment, exempt from consent

Your rights

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

  • Right of access to your personal data
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing
  • Right to withdraw your consent at any time

To exercise these rights, contact us at: [email protected]

You may also lodge a complaint with the CNIL, the French data protection authority.

Security

We implement appropriate technical and organisational measures to protect your data: HTTPS encryption (TLS 1.3), secure payments via Stripe (PCI DSS certified), hosting on Cloudflare infrastructure with DDoS protection.