Last updated: 12 August 2026.
This policy explains what personal data Constant Hardware collects, why, how long we keep it, and what you can do about it. It covers the shop and everything that runs behind it — payments, delivery, support and marketing.
We are the data controller. We do not sell personal data and we do not run automated decision-making that produces legal effects.
Who we are
Controller: CONSTANT HARDWARE, registered at 3 Rue de l'est, 75020,, Paris, France
Privacy contact: [email protected] ·
We have not appointed a statutory data protection officer, as our processing does not meet the threshold. Privacy queries go to the contact above and are answered within one month.
At a glance
| Purpose | Legal basis | Kept for |
|---|---|---|
| Taking and fulfilling your order | Contract | 10 years (accounting) |
| Payment processing and fraud checks | Contract / legitimate interest | 13 months, or as the provider retains |
| Delivery and customs paperwork | Contract / legal obligation | Duration of carriage, then 10 years |
| Customer account | Contract | Account life + 3 years |
| Support and returns handling | Contract / legitimate interest | 3 years from last contact |
| Newsletter | Consent | 3 years from last engagement |
| Site analytics | Consent | 25 months max |
| Anti-spam and security | Legitimate interest | 12 months |
What we collect
We only collect what an order or a request actually needs.
- Identity and contact — name, delivery and billing address, email, phone
- Order data — items, sizes and configurations, prices, VAT status, VAT number where you give one
- Payment data — card brand, last four digits and expiry, or your PayPal identifier. Full card numbers never reach our server
- Delivery data — carrier, tracking number, delivery notes, signature and, for freight, the access details you give us
- Correspondence — emails, support tickets, return requests, photographs you send
- Account data — login, order history, saved addresses
- Technical data — IP address, browser and device type, pages viewed, referring URL, approximate location from IP
- Marketing preferences — newsletter subscription state, engagement history
We do not ask for and do not need special category data. If you volunteer it in a support email, we handle it for that purpose only.
How and why we use it
Contract. To process your order, take payment, arrange delivery, handle returns and provide the warranty. Without this data there is no contract.
Legal obligation. To issue invoices, keep accounting records for 10 years, handle VAT and customs declarations, and respond to lawful requests from authorities.
Legitimate interest. To screen orders for fraud, keep the site secure, defend legal claims, and improve the catalogue based on aggregate sales patterns. We have weighed these against your rights and they do not override them; you may object (see below).
Consent. For the newsletter and for non-essential cookies. Consent is freely given, granular and withdrawable at any time without affecting your order.
Payment
Card payments run through WooPayments, backed by Stripe. PayPal payments run through PayPal. Both are independent controllers for their own fraud and compliance processing and apply their own privacy terms. We receive only a transaction result and the last four digits.
Our checkout is encrypted end to end by TLS. Card data is tokenised in the browser, so it passes through our server without being stored.
Cookies and similar technologies
Cookies fall into two groups.
Strictly necessary — no consent needed. Cart contents, session, checkout progress, login state, load balancing, Cloudflare's bot and security cookies. Without these the shop cannot work.
Everything else — consent needed. Analytics, order-attribution cookies that record which channel brought you in, and any embedded media. These only fire after you accept.
Consent lasts up to 13 months, then we ask again. Refusing is as easy as accepting and does not restrict checkout. You can change your choice at any time via the cookie link in the footer, and you can clear cookies in your browser whenever you like.
Comment cookies, where you leave a product review, may store your name, email and site for one year for convenience. Login cookies last two days, or two weeks with "remember me". Screen preference cookies last a year.
Who we share with
Only where needed, and only the minimum. All processors are bound by written data processing agreements.
- Payment providers — WooPayments/Stripe, PayPal
- Carriers and freight forwarders — name, address, phone and order contents, so the parcel can be delivered
- Customs brokers and authorities — for non-EU shipments, as legally required
- Hosting and infrastructure — , Cloudflare for CDN and bot protection
- Email and support tooling — , for transactional mail and support
- Analytics — Jetpack/WordPress.com statistics
- Accounting and tax advisers — where required by law
- Professional advisers and courts — in a dispute
We also share with manufacturers and their authorised service partners where a warranty repair needs it. We never pass your data to a third party for that party's own marketing.
Transfers outside the EEA
Some providers are established in the United States: Cloudflare, Automattic (Jetpack statistics and WordPress.com), Stripe, PayPal, and Google for web fonts. These transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
Outside the EU, we also send the minimum needed to carriers and customs in the destination country so your order can clear. Copies of the safeguards are available on request.
Security
TLS on every page, hashed passwords, least-privilege admin access, Cloudflare in front of the origin, and a firewall at host level. Backups are encrypted. Card data is tokenised and never stored locally.
If a breach occurs that is likely to put you at high risk, we notify you and the CNIL as required. No system is perfect, so treat your account password as confidential.
Your rights
Under the GDPR you may:
- Access the data we hold about you, and get a copy
- Correct anything inaccurate
- Erase it, where no legal retention applies
- Restrict processing while a dispute is resolved
- Object to processing based on legitimate interest, including profiling
- Port the data you gave us to another provider
- Withdraw consent at any time, for the future
- Set directives on what happens to your data after death
Email [email protected]. We reply within one month, extendable by two for complex requests, and we tell you if we extend. Access and erasure are free. We may ask for proof of identity to prevent disclosure to the wrong person.
Erasure is limited by what we must keep — invoices and order records stay 10 years regardless, and we cannot erase data a payment provider holds under its own obligations.
Unsubscribing from the newsletter takes one click and does not touch order emails, which are part of the contract.
Automated decisions
Fraud screening may automatically decline an order. It produces no legal effect on its own and is always reviewable by a human on request. We do not run behavioural profiling for pricing.
Children
The shop is aimed at adults. In France, digital consent is set at 15, so an under-15 needs a parent's agreement to subscribe or open an account. We do not knowingly collect data on under-15s beyond what an order requires.
Other sites
Embedded video, maps and manufacturer pages are served by third parties who may set their own cookies and see your IP. Once you follow a link off our site, their policy governs. Embedded content behaves as if you had visited the source directly.
Images and EXIF
Uploaded images can carry embedded GPS coordinates. Anyone can extract them. Strip EXIF before upload if the location matters to you.
Complaints
Tell us first and we will try to fix it. You may also complain to the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 · cnil.fr. If you live elsewhere in the EU, you may complain to your own supervisory authority.
Changes
We update this policy when processing changes. The version date sits at the top, and material changes are announced on the site. The version in force when you ordered governs that order.
