Privacy Policy — Valiplia

Privacy Policy — Valiplia
Version of November 6, 2026

This policy explains how the personal data of visitors, prospects, and customers is processed in connection with the Valiplia online store. It is based on Regulation (EU) 2016/679 (GDPR), the French Data Protection Act, and French rules applicable to electronic communications and trackers. It applies to browsing the site, making purchases, using contact forms, tracking orders, and related services.

Personal data is information that allows a natural person to be identified directly or indirectly. This policy does not mean that all the features or tools mentioned are systematically activated: processing depends on the features and service providers actually used.

1. Who processes your data?

Data controller for store sales and management operations: the sole proprietorship operating the Valiplia brand, SIRET 853 889 392 00033, located at 117 avenue Henri Barbusse, 93150 Le Blanc-Mesnil, France. The legal identity of the owner of this sole proprietorship must be confirmed in the legal notices.

Person designated as the data contact: Selim Ammari.
Email to exercise your rights: contact@valiplia.fr.
Mail: Valiplia, 117 avenue Henri Barbusse, 93150 Le Blanc-Mesnil, France.

Selim Ammari is listed here as the contact person for data-related requests; this does not mean that a data protection officer (DPO) has been officially appointed. Some service providers, notably Shopify, may also act as separate data controllers for their own services: their specific notices then apply in addition.

2. What information may be collected?

Identity and contact details: name, first name, delivery and billing address, email, phone number, and information necessary for the business relationship.
Order and customer service: order number, products and variants purchased, price, discounts, order history, delivery, returns, refunds, messages, warranty claims, and exchanges with customer service.
Payment: amount, currency, payment method, payment status, transaction reference, and fraud prevention information received from the service provider. Complete card data is normally processed by secure payment providers and is not directly retained by Valiplia.
Customer account, if used: account credentials, preferences, saved addresses, and customer-accessible history. Passwords and authentication methods are managed according to the mechanism actually offered by Shopify.
Forms and support: name, email, subject of the request, free-text, product concerned, and voluntarily provided information. You are asked not to submit passwords, full bank details, or unnecessary sensitive data.
Newsletter and communication: email address, proof and date of consent when required, preferences, unsubscribe requests, and any interactions necessary for managing mailings.
Technical data: IP address, device and browser type, requested pages, times, security logs, session data, cookies, and tracker identifiers, when the corresponding features are used.
Browsing and audience measurement, if applicable: pages viewed, source of visits, interactions, and information relating to the user journey on the site, subject to the required privacy choices.

No systematic collection of sensitive data (health, opinions, religion, etc.) is necessary for the sale of travel accessories. If such data is voluntarily provided, it is not intended to be used beyond what is strictly necessary to process the request, in accordance with the law.

3. Where does the data come from?

Information is obtained primarily from you when you place an order, create an account, complete a form, subscribe to communications, or contact the store. It may also come from your browsing and authorized technical tools, as well as service providers involved in a transaction (payment, delivery, fraud control, request management), only to the strict extent necessary and authorized. Data sources other than those described should not be presumed to be used.

4. Why is the data processed and on what legal bases?

The purposes below are distinct. The same data may fall under several purposes and legal bases depending on the processing involved.

Purpose	Main legal basis
Prepare, conclude, and execute the sale; confirm the order; manage payments, deliveries, returns, warranties, and refunds.	Performance of a contract or pre-contractual measures, GDPR Article 6(1)(b).
Issue and retain invoices and accounting documents; meet tax obligations and legally founded requests.	Legal obligation, Article 6(1)(c).
Answer questions, product advice requests, and support messages.	Pre-contractual measures, performance of a contract, or legitimate interest in responding to a non-contractual request, as the case may be, Article 6(1)(b) or (f).
Secure the store, prevent abuse, manage incidents, and defend the rights of the company and its customers.	Proportionate legitimate interest, Article 6(1)(f), and any legal obligations.
Send a newsletter or commercial offers to individual prospects.	Prior free, specific, and revocable consent, Article 6(1)(a), and Article L. 34-5 of the French Consumer Code.
Inform an existing customer about offers concerning similar products or services offered by Valiplia, when the legal conditions for the exception are met.	Legitimate interest, with information and an easy right to object at the time of collection and in every message, in accordance with applicable law.
Use advertising trackers or certain non-exempt analysis tools.	Prior consent when required by Article 82 of the French Data Protection Act; appropriate GDPR basis for the subsequent processing.
Ensure essential functions: cart, session, security, and payment.	Performance of the requested service and/or legitimate interest or legal obligation depending on the processing; strictly necessary trackers exempt from consent under legal conditions.
Process access, rectification, deletion, or objection requests.	Legal obligation, Article 6(1)(c).

When legitimate interest is invoked, it notably concerns the operation, security, and reasonable management of the customer relationship, subject to balancing it against the rights and freedoms of individuals. Consent, when used, can be withdrawn at any time without affecting the lawfulness of the processing carried out prior to withdrawal.

5. What information is necessary or optional?

Information necessary for the order (notably contact details, delivery address, and data essential for payment) is required to process and execute the purchase: without it, the order may not be able to be finalized. Optional fields are marked as such. Signing up for commercial communications must not be imposed as a condition of purchase. Refusing non-essential cookies must not prevent access to sales functions that do not depend on them.

6. Who may receive the data?

Within the scope of their missions and relevant authorizations, the data may be accessed by the operator of Valiplia and persons actually authorized to act on its behalf. It may be disclosed to the following categories of recipients when they actually participate in the requested service:

Shopify and its infrastructure: store hosting, order processing, accounts, sales services, and technical functions related to the site.
Payment service providers and financial institutions: authorization, collection, refunds, fraud prevention, and regulatory obligations.
Carriers, logistics services, and occasional shipping suppliers: preparation, transit, tracking, and return processing, only to the extent of the data necessary.
DSers-AliExpress Dropshipping (installed app): when this solution is used to process or transmit an order to a supplier, it may have access to certain data relating to the order, the customer, and the delivery, depending on its authorizations and the actual configuration. The actual recipient suppliers, their countries, their roles, and any transfers outside the European Economic Area should be verified. The fact that the app is installed does not mean that all orders are automatically transmitted to it.
Communication and customer relationship tools: messaging, form reception, responses to requests, and, when activated, newsletter mailings.
Security, IT, analysis, or advertising service providers: only if the tools are actually used and according to the applicable settings and consents.
Advisors, accountants, authorities, and courts: to satisfy legal obligations, process a dispute, or defend a right, when conditions permit.

Service providers acting as processors must be subject to the commitments required by the GDPR. Their precise identities, the installed apps, and the transmissions actually carried out must be verified in the current Shopify configuration. Valiplia does not claim an absolute absence of transmission to service providers.

7. Shopify, independent service providers, and international transfers

The store uses Shopify, which may process certain data as Valiplia's processor and other data as an independent controller depending on the service provided. Shopify states that, for individuals located in the European Economic Area, data may be received by its Irish entity and transferred to other entities and service providers, notably in Canada and the United States. See its privacy policy.

When data is transferred outside the European Economic Area, the transfers must be based on an appropriate mechanism: an adequacy decision applicable to the recipient, European Commission standard contractual clauses accompanied, if necessary, by additional safeguards, or another mechanism authorized by the GDPR. The mere international location of a service provider does not automatically mean that all protections are absent; safeguards must be verified for each actual transfer.

Any third-party apps added to Shopify may involve their own processing. Their list and transfers must be checked before making any exhaustive statement about recipients.

8. Cookies, trackers, and privacy choices

Trackers may be used to maintain a session, retain a cart, secure payment, remember a choice, or, if corresponding tools are activated, measure audience and personalize advertising campaigns.

Strictly necessary trackers for the expressly requested service or electronic communication may be used without prior consent within legal limits. Advertising and audience trackers that do not meet the exemption conditions generally require prior consent. They must not be placed until this consent has been obtained.

The visitor must be able to accept, refuse, and change their choices through a suitable interface when consent is required; refusal must be as accessible as acceptance, and withdrawal as simple as the initial agreement. Continued browsing, silence, or a pre-checked box do not constitute valid consent.

The CNIL presents a duration of six months as an indicative best practice for retaining the acceptance or refusal choice, to be adjusted according to the context; this is not a mandatory duration applicable to all cookies. The duration and the list of trackers actually used depend on the activated tools and must be viewable in dedicated information and/or in the consent management module actually installed.

Point of vigilance: the presence of this policy does not in itself constitute proof that a banner, a consent platform, or a mechanism blocking non-essential trackers is technically operational. These settings must be checked on the store.

9. Prospecting and newsletter

The store may offer voluntary registration for Valiplia information or promotions. For individuals who are not already customers under the conditions of the legal exception, electronic prospecting generally requires prior consent. The mere act of creating an account or requesting information does not constitute agreement to receive advertising.

In the case of an existing business relationship, messages concerning similar products may, under the precise conditions of Article L. 34-5 of the French Postal and Electronic Communications Code, be sent if the person has been informed and has had the opportunity to object at the time of collection and in every communication.

Each promotional communication must allow for easy unsubscription. The request can also be sent to contact@valiplia.fr. Messages essential for tracking an order (confirmation, delivery, refund) are distinct from commercial communications.

10. How long is the data retained?

Data is retained only for the duration necessary for the pursued purpose, and then, when justified by a legal obligation or legal interest, in intermediate archiving with restricted access. The criteria below guide the durations; the store must check its technical settings and the durations specific to each service provider.

Orders and sales execution: during order management, customer tracking, the exercise of warranties, and, if necessary, in archiving, during the applicable limitation and proof periods.
Invoices and accounting documents: generally required to be retained for ten years under the conditions of the French Commercial Code.
Customer accounts: as long as the account is used and necessary for the service; at the end of the active relationship, deletion, anonymization, or archiving of only the data essential for a legal obligation or the defense of a right.
Forms and after-sales exchanges: during the processing of the request and then, when justified, during the period necessary to prove the relationship and manage any potential dispute.
Prospects and newsletters: until the withdrawal of consent or objection, with limited retention of traces necessary to prove consent or respect the objection. As a reference, the CNIL generally retains a period of three years from the last active contact for prospecting data, to be assessed according to the situation.
Security logs and trackers: durations proportionate to their purpose, to be defined according to the actually active tools, security needs, and applicable recommendations; the validity of the cookie choice is not confused with the lifespan of each tracker.

The durations of service providers acting in their own name may differ. A deletion request does not lead to the deletion of information that the law still requires to be retained, but this information must not be reused for other incompatible purposes.

11. What are your rights?

According to the conditions provided by the GDPR and the French Data Protection Act, you can exercise the following rights:

access the data concerning you and obtain a copy;
have inaccurate information rectified or incomplete information completed;
obtain the deletion of data when the conditions are met;
request the limitation of certain processing;
object to processing based on legitimate interest for reasons relating to your situation, and object without justification to direct marketing;
withdraw your consent at any time when processing is based on this ground;
receive certain data in a structured format and transmit it to another organization (data portability), in cases provided by law;
not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects concerning you, subject to legal exceptions;
set instructions regarding the fate of your data after your death under the conditions provided by French law.

To exercise a right, write to contact@valiplia.fr or by mail to the address indicated in section 1, stating your request. A proportionate verification of identity may be carried out in case of reasonable doubt, without systematically requesting a copy of an identity document.

A response is provided as soon as possible and, in principle, within one month of receipt of the request. This period may be extended by two additional months due to complexity or the number of requests; the person must then be informed within the first month, along with the reasons for the extension. Requests are in principle free of charge, except for exceptions provided by law.

12. Security and data breaches

Valiplia must implement technical and organizational measures appropriate to the risks, including limited access by authorized persons, the use of secure services, the management of authorizations, and vigilance against fraud attempts. No transmission or infrastructure can guarantee zero risk.

In the event of a personal data breach, the obligations of documentation and, if the legal criteria are met, notification to the CNIL and informing the data subjects apply, in accordance with Articles 33 and 34 of the GDPR.

13. Minors, profiling and automated decisions

The store aims to sell travel accessories and is not specifically intended for children. Persons having the required legal capacity must make the purchases; parents or legal representatives may contact Valiplia regarding a minor's data. Processing based on the consent of minors is subject to the special rules applicable, notably in France for information society services.

The product suggestions displayed by the Valiplia choice advisor are based on voluntary answers to a few questions and pre-established recommendation rules. This feature, taken in isolation, does not constitute a decision based solely on automated processing producing a significant legal or similar effect within the meaning of Article 22 of the GDPR. Payment verification or fraud prevention operations may be carried out by the relevant service providers according to their own information; they must respect the applicable protections and remedies if they take the form of relevant decisions within the meaning of this article.

14. Complaints to the CNIL

You can contact us first for any question regarding your data. You also have the right to lodge a complaint with the French Data Protection Authority (CNIL), notably if you believe your rights are not respected. You can also refer the matter to another competent data protection authority under the conditions provided by the GDPR.

15. Updates and related documents

This policy may be updated in the event of changes to the services, service providers, processing, or regulations. The version date appears at the top of the document. When the law requires specific information or new consent, it will be collected according to the applicable conditions.

For aspects relating to purchases and complaints: General Terms and Conditions of Sale, Return and Refund Policy and Legal Notices.

Reference texts and recommendations: GDPR; CNIL — informing individuals; CNIL — data retention; CNIL — electronic direct marketing (June 2026); CNIL — cookies and trackers (April 2026).