Document issued by Sandbox ShoppyCrush
Privacy Policy — Sandbox ShoppyCrush
Version: confidentialite-2026-07-01-v3 — Last updated: July 1, 2026
Preamble
This Privacy Policy describes how the personal data of Buyers is collected, processed, stored, and protected in the context of using the Sandbox ShoppyCrush shop hosted on the ShoppyCrush Platform operated by QIANOV.
It complies with Regulation (EU) 2016/679 of 27 April 2016 (« GDPR ») and French Law No. 78-17 of 6 January 1978 as amended (« Data Protection Act »).
Marketplace architecture: the ShoppyCrush Platform provides independent Sellers with the technical environment enabling them to operate their shop. In this capacity, certain processing of personal data falls under joint controllership between QIANOV and the Seller (article 26 of the GDPR), while other processing falls exclusively under one or the other of the parties. This allocation is set out in article 4 below.
1. Identification of the Joint Controllers
1.1 Platform Joint Controller — QIANOV
- Name: QIANOV
- Legal form: SAS
- SIREN: 940 207 012
- Registered office: 4 allée des informaticiens, 13290 Aix-en-Provence
- Data Protection Officer (DPO): dpo@qianov.fr
- Single point of contact for exercising rights:
dpo@qianov.fr
1.2 Seller Joint Controller
- Trade name: Sandbox ShoppyCrush
- Legal name: [Legal name not provided]
- SIREN: [SIREN not provided]
- Address: [Legal address not provided]
- Contact details: see the shop's Legal Notice
2. Pursuant to article 26 of the GDPR — joint controllership agreement
QIANOV and the Seller have concluded, through the signing of the Seller Charter (in Annex 1), an agreement formalising the allocation of their responsibilities pursuant to article 26 of the GDPR for jointly implemented processing.
The main lines of this agreement are reproduced in article 4 below. The full version is available on request from the single point of contact referred to in 1.1.
In accordance with article 26.1 of the GDPR, and notwithstanding the operational allocation, data subjects may exercise all their rights with either Joint Controller. To facilitate the exercise of these rights, QIANOV is designated as the single point of contact.
3. Data collected and purposes
3.1 Customer account identification data
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address | Registration, order form | Account creation, transactional communication, identity verification | Contract performance (art. 6.1.b GDPR) |
| Password (hashed) | Registration | Secure authentication | Contract performance |
| Title, first name, last name | Registration, order form | Personalisation, invoicing | Contract performance |
| Phone number | Order form, profile | Delivery tracking, post-sale contact | Contract performance |
| Preferred language | User choice, navigation | Interface personalisation, communication language | Legitimate interest (UX) |
3.2 Order data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Delivery address, billing address | Order fulfilment, delivery | Contract performance | 10 years (accounting obligations) |
| Details of items ordered | Fulfilment, invoicing, after-sales, statutory warranties | Contract performance | 10 years |
| Amount, currency, transaction date | Accounting, taxation | Legal obligation (art. L123-22 French Commercial Code) | 10 years |
| Stripe transaction identifier | Payment tracking, refund | Contract performance | 10 years |
| Order status, status history | Order tracking, dispute traceability | Contract performance | 10 years |
3.3 Payment data
Banking data (card number, security code) is entered directly in the secure environment of the payment service provider Stripe and is never accessible to QIANOV or the Seller. Stripe is solely responsible for processing this data, in accordance with its own terms and privacy policy (https://stripe.com/privacy).
QIANOV receives only the token or identifier of the Stripe transaction, which contains no usable banking data.
3.4 Technical browsing data
| Data | Purpose | Legal basis |
|---|---|---|
| IP address | Security, fraud prevention, logging | Legitimate interest (security) |
| User-Agent, browser type | Technical compatibility | Legitimate interest |
| Authentication logs, pages visited (technical) | Security, incident traceability | Legitimate interest / legal obligation |
| Essential cookies | See Cookie Policy | Article 82-II French Data Protection Act |
3.5 Downloaded digital product data
| Data | Purpose | Legal basis |
|---|---|---|
| Signed download links, timestamps | Secure file delivery | Contract performance |
| Access logs (successful/refused downloads) | Security, fraud prevention, audit | Legitimate interest / contract |
| Reports (disputes, reason, comment) | Complaint handling | Contract performance |
3.6 Data from transactional communications
Transactional emails (order confirmation, shipping notification, magic link, email verification, password reset, reports) generate a dispatch log (EmailLog) retaining a record of the sending for reliability purposes (anti-duplication, audit).
3.7 Newsletter data (subscription to Seller's mailing list)
Buyers may subscribe to the Seller's newsletter from the store. This processing is based on the Buyer's explicit consent (art. 6.1.a GDPR) and on applicable rules governing electronic marketing.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Sending commercial newsletters on behalf of the Seller | Consent (art. 6.1.a GDPR) | Until unsubscription, then 2 years maximum |
| Consent text (snapshot) | Proof of consent obtained, GDPR compliance | Legal obligation (art. 7.1 GDPR) | 2 years after unsubscription |
| Subscription date and time | Consent traceability | Legal obligation | 2 years after unsubscription |
| Subscription status (PENDING, CONFIRMED, UNSUBSCRIBED) | Subscription lifecycle management | Legitimate interest (list management) | See retention periods below |
| Confirmation token (SHA-256 hashed) | Email address ownership verification (double opt-in) | Consent | 48 hours, then automatic deletion |
Double opt-in: every subscription triggers a confirmation email. The subscription is only activated after clicking the confirmation link. Unconfirmed accounts after 48 hours are automatically deleted.
Right to unsubscribe: each newsletter includes a single-use unsubscribe link (HMAC token). Unsubscription is effective immediately. Unsubscribed Buyer data is retained for 2 years for evidentiary purposes (proof of prior consent), then deleted.
Automatic purge:
- Subscription confirmations pending for more than 30 days → automatic deletion.
- Unsubscribed subscriptions older than 2 years (730 days) → automatic deletion.
3.8 Promotional code data (use of a discount code)
When a Buyer uses a promotional code at checkout, Sandbox ShoppyCrush collects and processes the following data.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Promotional code used (snapshot) | Traceability of the discount granted, compliance with accounting requirements (mandatory mention on invoice) | Legal obligation and performance of contract (art. 6.1.b GDPR) | Statutory accounting retention period (10 years) |
| Discount amount applied | Accurate VAT-inclusive pricing, invoice generation | Legal obligation | 10 years (accounting document) |
| Associated order ID | Anti-fraud audit trail, verification of per-order usage limits | Legitimate interest (fraud prevention) | Order retention period |
| Date and time of use | Verification of validity conditions (dates, usage limits) | Performance of contract | Order retention period |
Promotional codes do not give rise to any behavioural profiling. Usage history is used strictly for accounting and fraud-prevention purposes.
3.9 Audience measurement data (subject to your consent)
Where you consent via the cookie banner, Sandbox ShoppyCrush measures store traffic using a self-hosted audience measurement tool (Umami). This measurement is anonymous: no IP address is retained (it is used transiently then discarded), the visit identifier relies on a digest renewed daily (irreversible, not allowing day-to-day tracking) and no tracking cookie is placed for this purpose.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Aggregated traffic data (page views, sessions, source, device type, country) | Audience measurement, store improvement | Consent (art. 6.1.a GDPR) | 25 months maximum (CNIL recommendation), periodic automatic purge |
| Journey events (product view, add to cart, checkout started, purchase) | Conversion funnel analysis | Consent (art. 6.1.a GDPR) | 25 months maximum, periodic automatic purge |
This 25-month period applies to audience data and is distinct from the retention of your consent choice (technical cookie, 13 months — see Cookie Policy). Beyond 25 months, audience data is irreversibly deleted by an automatic purge. Withdrawing your consent, at any time via the cookie banner, immediately stops any new collection.
3.10 Crush AI conversational assistant (when the shop offers it)
When the shop Sandbox ShoppyCrush makes the Crush AI conversational assistant available, the shop is the data controller for your interactions with the assistant. QIANOV SAS acts as the shop's processor (provision and operation of the technology, on behalf of and according to the shop's instructions).
To generate answers, the content of your messages is transmitted to a technical AI provider acting as a sub-processor: by default Mistral AI (a French/EU provider), with processing carried out within the European Union. Your messages are not used to train the provider's models. Any change of provider involving a material modification of the safeguards, the location or the sub-processing conditions is subject to prior information of the shop.
Your conversations are kept not linked to an identified account, for a maximum duration of 6 months, then deleted. QIANOV does not reuse the identifiable or pseudonymized content of conversations for its own purposes; only aggregated statistics (no raw text, not allowing the identification of a person) may be retained beyond.
You have, over these exchanges, the rights of access, rectification, erasure, restriction, objection and, where applicable, portability, under the conditions described in article 8 above. As conversations are not linked to an identified account, exercising certain rights may require information enabling the relevant exchange to be located.
The detailed terms of use of the assistant are available here.
4. Allocation of operational responsibilities (article 26 GDPR)
| Processing category | Operational joint controller | Notes |
|---|---|---|
| Customer account creation | QIANOV (auth infrastructure) + Seller (per-shop specific data) | Account linked to email + per-shop specific data (firstName, lastName, addresses, phone) isolated |
| Order placement | Seller (primarily responsible for the transaction) + QIANOV (technical infrastructure) | Seller is responsible for contractual processing; QIANOV operates the infrastructure |
| Payment | Stripe (autonomous controller) — QIANOV technical intermediary | No usable banking data is retained by QIANOV or the Seller |
| Transactional communication (emails) | QIANOV (sending infrastructure, EmailLog, anti-duplication) |
Seller defines commercial content via Seller Variables |
| Digital product downloads | QIANOV (signed token infrastructure, access log, reports) | Seller provides the files; QIANOV handles security |
| Security (encryption, access, logging) | QIANOV | Infrastructural technical measures |
| Technical sub-processing | QIANOV (sub-processors: hosting provider, Stripe, email provider, CDN) | Seller does not introduce additional sub-processors |
| Data breach notification | QIANOV (detection, qualification, notification to CNIL and data subjects) | Seller reports any breach brought to their attention |
| Handling data subject rights requests | QIANOV as single point of contact, Seller for per-shop specific elements | Coordination managed by QIANOV |
| Records of processing activities | Each Joint Controller maintains their own records | For their respective scopes |
| Accounting, taxation, legal archiving | Seller (autonomous controller, outside joint controllership) | Seller acts on their own behalf |
Important: processing for accounting, tax, or fraud prevention purposes carried out by QIANOV on its own behalf (marketplace commission invoicing, QIANOV VAT declarations) does not fall within the joint controllership; QIANOV acts in this case as an autonomous data controller.
5. Recipients of data
Personal data is shared with:
- The Seller ([Legal name not provided]) for data necessary for order fulfilment (name, address, items, amount);
- QIANOV for data necessary for infrastructure provision;
- QIANOV's sub-processors, strictly within the scope of their missions:
- Stripe Payments Europe Limited (Ireland) — payment service provider
- Hosting provider (OVH SAS) — hosting infrastructure
- Email provider (configured by the Seller or the Platform: SMTP / Resend) — transactional email delivery
- La Poste / Colissimo — for delivery of physical products
- Mondial Relay — for pickup-point delivery, when enabled by the Seller (recipient name, address and phone shared to fulfil the shipment)
- Public authorities on legal requisition or court order.
No personal data is sold to third parties for commercial or advertising purposes.
6. Transfers outside the European Union
Personal data is, to the extent possible, hosted and processed within the European Union.
Certain technical sub-processors (in particular CDN or monitoring providers) may occasionally carry out transfers outside the European Union. In such cases, these transfers are governed by the appropriate safeguards provided for in articles 44 to 49 of the GDPR:
- Adequacy decisions by the European Commission;
- Standard contractual clauses adopted by the Commission (SCC 2021/914);
- Supplementary technical measures (encryption, pseudonymisation).
7. Retention periods
| Category | Period |
|---|---|
| Active customer account | Duration of use + 3 years from last active contact |
| Order data | 10 years from the order (accounting and tax obligations) |
| Accounting data (invoices, credit notes) | 10 years (article L123-22 French Commercial Code) |
| Technical security logs | Maximum 12 months (CNIL recommendation) |
| Cookies and consent choices | Maximum 13 months |
| Audience measurement data (Umami, with consent) | Maximum 25 months (CNIL recommendation), periodic automatic purge |
| Contractual snapshots (order, T&Cs, Charter) | Legal contract retention period (5 years, extended to 10 years for tax audit) |
Email dispatch logs (EmailLog) |
3 years (security, audit, anti-duplication) |
| Password reset and email verification tokens | 24 hours to 30 minutes depending on type, then automatic deletion |
| Prospect data (unconfirmed account, abandoned cart) | 3 years from creation |
| CONFIRMED newsletter subscribers | Until unsubscription + 2 years (730 days), then automatic deletion |
| PENDING newsletter subscribers (unconfirmed) | 48 hours (token expiry), then automatic purge after 30 additional days |
| Newsletter consent snapshot | 2 years after unsubscription (proof of prior consent) |
Promotional code usage history (PromoCodeUsage) |
10 years (accounting document — statutory obligation) |
At the end of the applicable periods, data is deleted or irreversibly anonymised, subject to legal obligations.
8. Rights of data subjects
In accordance with articles 15 to 22 of the GDPR, the Buyer has the following rights over their personal data:
- Right of access (art. 15): obtain confirmation that data concerning them is being processed and receive a copy;
- Right to rectification (art. 16): have inaccurate or incomplete data corrected;
- Right to erasure (art. 17): obtain deletion of data in the cases provided for by law;
- Right to restriction of processing (art. 18): temporarily suspend a contested processing operation;
- Right to object (art. 21): object to processing based on legitimate interest;
- Right to data portability (art. 20): receive data in a structured, commonly used and machine-readable format;
- Right to define posthumous directives (art. 85 French Data Protection Act): organise the fate of data after death;
- Right to withdraw consent at any time, where processing is based on consent.
8.1 Exercising rights — single point of contact
To exercise these rights, the Buyer contacts the single point of contact:
📧 Email: dpo@qianov.fr
📬 Post: QIANOV — Data Protection Officer — 4 allée des informaticiens, 13290 Aix-en-Provence
The Buyer may be required to provide proof of identity so that the request can be processed securely. The Platform undertakes to respond within one month of receiving the request, extendable by two months in cases of complexity (article 12.3 GDPR).
8.2 Complaint to the supervisory authority
If the Buyer considers that their rights are not being respected, they may lodge a complaint with the relevant supervisory authority. In France:
- Commission Nationale de l'Informatique et des Libertés (CNIL)
- 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
- Website:
www.cnil.fr
9. Data security
QIANOV implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk (article 32 GDPR), in particular:
- Encryption of data in transit (TLS 1.2+) and at rest on infrastructure disks;
- Secure hashing of passwords (bcrypt);
- Strong authentication of the seller backoffice and super-admin;
- Strict access control (multi-tenant, isolation by subdomain);
- Logging (Pino logs) with masking of sensitive data (masked emails);
- Regular backups and business continuity plan;
- Incident management: CNIL notification procedure within 72 hours (art. 33) and data subject notification in cases of high risk (art. 34);
- Awareness and training of personnel with access to data.
10. Cookies
The use of cookies on the shop is governed by the Cookie Policy accessible from the footer. The user's consent is obtained, where required, in accordance with applicable CNIL recommendations.
The Buyer may at any time modify their cookie preferences via the "Cookie Preferences" link in the footer.
11. Profiling and automated decisions
The Platform does not implement purely automated decision-making producing legal effects concerning Buyers or similarly significantly affecting them (article 22 GDPR).
No automated behavioural segmentation is implemented. Commercial communications that may be sent to the Buyer by the Seller (e.g. personal promotional coupons) are described in section 11bis below and rely on the legal framework of the "similar customer" exemption (article L34-5 of the French Posts and Electronic Communications Code).
If profiling processing were to be implemented in the future (e.g. product recommendations by scoring), dedicated information would be provided to Buyers and their consent would be obtained where required.
11bis. Shop commercial communications ("similar customer" – Art. L34-5 CCE)
The Shop's Seller may send to the Buyer, at the email address associated with their account, commercial communications relating to products or services analogous to those the Buyer has already ordered or viewed on the same shop (e.g.: personal discount coupons, exclusive customer offers).
This processing relies on the "similar customer" legal framework set out in article L34-5 of the French Posts and Electronic Communications Code (LCEN) and article 21 GDPR:
- The communications are limited to persons who already qualify as customers of the shop (at least one order placed OR account created on the said shop).
- Their subject relates exclusively to analogous products/services sold by the same shop.
- No transfer of the email address to third parties for prospecting purposes is performed.
- The Buyer has at any time a simple and free right of opposition ("opt-out"):
- via a dedicated marketing unsubscribe link present in every commercial communication;
- or via a request addressed to QIANOV (cf. "Buyer rights" and "Contact" sections).
Refusing to receive these communications has no impact on the provision of the Service or on the execution of orders. Strictly transactional emails (order confirmation, shipping tracking, invoices, support) continue to be sent regardless of this opt-out.
The legal basis for this processing is the Seller's legitimate interest in informing their own customers (article 6.1.f GDPR) within the L34-5 derogation framework, the simple opt-out being the required compensatory safeguard.
12. Minors
The Platform does not specifically target minors. Any minor accessing the Platform must do so with the agreement and under the responsibility of their legal representative.
No personal identification data is knowingly collected from minors without parental consent. If the Platform were to find that data concerning a minor had been collected without parental consent, it would proceed with its deletion.
13. Updates to the Privacy Policy
This Policy may be amended at any time, in particular to reflect changes in regulation, recommendations from supervisory authorities, or Platform features.
Any substantial amendment will be notified to the Buyer via their personal account or by email, with reasonable advance notice before taking effect. Continued use of the Platform after the amendment takes effect will constitute acceptance of the new version.
14. Contact
For any questions relating to this Privacy Policy or the processing of their personal data, the Buyer may contact:
- Data Protection Officer (single point of contact):
dpo@qianov.fr - Seller: see the shop's Legal Notice
- Supervisory authority:
www.cnil.fr(France) or the authority of your country of residence
Privacy Policy for the Sandbox ShoppyCrush shop — version confidentialite-2026-07-01-v3 — July 1, 2026