1. Data controller
The Site https://sensorfactory.shop is reserved for business customers. The personal data it collects concerns the representatives, contacts and employees of customer or prospect companies and organisations (“you”). They are processed by SENSOR FACTORY SAS, a French simplified joint stock company with share capital of €10,000, registered with the Nantes Trade and Companies Register under number 810 061 499, whose registered office is located at Immeuble Asturia C, 4 rue Edith Piaf, 44800 Saint-Herblain, France (“we”).
For any question about your personal data or to exercise your rights: hello@sensorfactory.shop, or by post to the registered office address, for the attention of the data protection officer.
2. Data we collect
We collect only the data necessary for the purposes described below:
- Identification and contact data: title, surname, first name, position, email address, telephone number, and data of the organisation you represent (company name, intra-Community VAT number, SIRET number or national company number, EORI number).
- Order and delivery data: billing and delivery addresses, ordered products, order history, invoices, parcel tracking number, EORI number or tax identifier for deliveries outside the European Union where required by customs.
- Payment data: bank card data is entered directly on the secure page of our payment provider and never passes through our servers; we keep only the transaction reference, the last four digits and the expiry date of the card for evidential purposes.
- Account data: user ID, password (stored in hashed form), language and currency preferences.
- Communication data: content of messages sent via the contact form or by email, requests for quotations and support.
- Browsing data: IP address, browser type, pages viewed, date and time of connection, technical server logs, cookies (see clause 8).
Mandatory fields are indicated by an asterisk in the forms. If you do not provide them, we cannot process your order or request.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creation and management of your Customer account | Performance of the contract |
| Processing, payment, invoicing and delivery of orders | Performance of the contract |
| Management of returns, warranties and complaints | Performance of the contract and legal obligation |
| Issuing invoices and keeping accounts | Legal obligation (Code de commerce (French Commercial Code), Code général des impôts (French General Tax Code)) |
| Verification of business customer status and tax identifiers against public registers (VIES, national companies register, EORI database) | Legal obligation and legitimate interest |
| Customs formalities and export control | Legal obligation |
| Response to contact, quotation and support requests | Pre-contractual measures and legitimate interest |
| Sending commercial information about our products to professional contacts | Legitimate interest (business-to-business prospecting related to the person’s role, with right to object at any time) |
| Fraud and spam prevention, Site security | Legitimate interest |
| Site audience measurement | Consent |
| Handling of data subject rights requests | Legal obligation |
You may object at any time to receiving our commercial information by using the unsubscribe link in each message or by writing to us.
4. Recipients and processors
Your data is accessible only to authorised personnel of Sensor Factory. It is transmitted to the following providers, which act on our behalf and on our instructions, strictly within the limits of their task:
| Provider | Task | Country of processing |
|---|---|---|
| OVH SAS | Hosting of the Site and databases, content delivery network, hello@ email service | France (European Union) |
| PayPlug SAS | Bank card payment, fraud prevention | France (European Union) |
| Chronopost SAS | Parcel transport and delivery | France; country of destination of the parcel |
| DHL Express | Parcel transport, delivery and customs clearance, in particular outside the European Union | Germany; country of destination of the parcel |
| Brevo (Sendinblue SAS) | Sending transactional emails and commercial information | France (European Union) |
| Cloudflare, Inc. | Protection of forms against bots (Turnstile service) | European Union and United States |
| Pennylane SAS | Invoicing, accounting and electronic invoicing | France (European Union) |
| Google Ireland Ltd (Google Analytics) | Audience measurement, only with your consent | European Union and United States |
Your data may also be disclosed to customs and tax authorities where required by law, to product manufacturers for the implementation of their warranty (name, contact details, serial number and description of the defect only), and to our advisers or judicial authorities in the event of a dispute.
We do not sell or rent your personal data.
5. Transfers outside the European Union
Your data is hosted in France. However, certain providers may process data outside the European Union:
- Cloudflare, in the context of the Turnstile service, processes technical data (IP address, browser characteristics) on its global network. This transfer is governed by the European Commission’s standard contractual clauses and by Cloudflare’s certification under the EU–US Data Privacy Framework.
- DHL Express and Chronopost transmit the data necessary for delivery and customs clearance to the authorities and their correspondents in the destination country when you have goods delivered outside the European Union. This transfer is necessary for the performance of the contract concluded with you.
- Google, for audience measurement, may process data in the United States. This transfer is governed by the European Commission’s standard contractual clauses and by Google LLC’s certification under the EU–US Data Privacy Framework; IP addresses are truncated and measurement is only activated with your consent.
You can obtain a copy of the safeguards put in place by writing to us.
6. Retention periods
| Data | Retention period |
|---|---|
| Customer account and profile data | Duration of the commercial relationship, then 3 years from the last contact or last order; deletion on request at any time |
| Orders, invoices and accounting documents | 10 years from the end of the financial year (Article L123-22 of the Code de commerce) |
| Customs documents and end-use declarations | 5 years from export (customs and export control regulations) |
| Payment data (transaction reference) | 13 months from the debit, for evidential purposes in the event of a dispute; 15 months for deferred debit cards |
| Contact, quotation and support requests | 3 years from the last exchange |
| Prospecting data (non-customer prospects) | 3 years from your last contact |
| Connection and security logs | 12 months |
| Cookies and trackers | Maximum 13 months (see clause 8) |
| Data subject rights requests | 5 years from the response; 6 years for requests relating to health data or identity documents |
At the end of these periods, the data is deleted or anonymised. Certain data may be kept in intermediate archiving, with restricted access, for the applicable limitation period, for the defence of our rights in court.
7. Your rights
In accordance with Regulation (EU) 2016/679 (GDPR) and the Loi Informatique et Libertés (French Data Protection Act), you have the following rights over your personal data:
- right of access and right to obtain a copy of your data;
- right to rectification of inaccurate or incomplete data;
- right to erasure, within the limits of our legal retention obligations;
- right to restriction of processing;
- right to data portability of the data you have provided to us;
- right to object, on grounds relating to your particular situation, to processing based on our legitimate interest, and right to object without reason to commercial prospecting;
- right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal;
- right to define instructions concerning the fate of your data after your death.
To exercise these rights, write to us at hello@sensorfactory.shop or to the registered office address. We may ask you for proof of identity in the event of reasonable doubt as to your identity. We respond within one month, extendable by two months for complex requests. You can also manage most of your data directly from your Customer account.
If you consider, after contacting us, that your rights are not respected, you may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr, or with the supervisory authority of your country of habitual residence.
8. Cookies and trackers
A cookie is a small file placed on your device when you browse the Site. We use:
- cookies strictly necessary for the operation of the Site (session, basket, authentication, language, currency, bot protection), which do not require your consent and are kept for a maximum of 13 months;
- audience measurement cookies, placed only if you consent via the banner displayed on your first visit. You can change your choice at any time via the “Manage cookies” link at the bottom of each page.
Refusing audience measurement cookies has no impact on your browsing or your ability to order. You can also configure your browser to refuse cookies; in that case, certain Site functionalities (basket, login) may no longer work.
9. Security
We implement appropriate technical and organisational measures to protect your data against loss, alteration and unauthorised access: encryption of communications (HTTPS), password hashing, access segregation, logging, regular backups, component updates and security audits. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you under the conditions provided for by the GDPR.
10. Minors
The Site is intended exclusively for business customers. We do not knowingly collect data concerning minors.
11. Changes to this policy
We may amend this policy to reflect changes in regulations or our processing. The version in force is that published on the Site, with its update date. In the event of a material change, we will inform you by email or by a notice on the Site.