Privacy policy
Compliant with the General Data Protection Regulation (GDPR — EU 2016/679) and the amended French Data Protection Act.
1. Data controller
The controller of your data is RGL SARL (Nonna Luisa Food Service), 2 rue Massena 06000 Nice, SIRET 808 745 152 00021. Contact: info@lanonnaluisa.com.
2. Data collected
We only collect the data strictly necessary to deliver our services:
- Company identity : company name, SIRET, intra-EU VAT, activity type, address
- Contact : email, phone, contact name
- Authentication : email + hashed password
- Order history : ordered products, amounts, dates, delivery addresses
- Payment : card data does not transit through our servers, it is processed directly by Stripe (PCI-DSS Level 1)
- Browsing : strictly necessary technical cookies (cart, session)
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and client management | Performance of the contract |
| Order processing and deliveries | Performance of the contract |
| Invoicing and accounting | Legal obligation |
| SIRET and VAT verification (data.gouv, VIES) | Legal obligation + legitimate interest |
| Commercial information (email) | Consent / B2B legitimate interest |
| Fraud prevention | Legitimate interest |
4. Recipients and processors
Your data is shared only with the strictly necessary recipients:
- Partner workshop (Cortemilia, Piemonte) (Italy): shipping address and order contents, solely for shipment
- Stripe Payments Europe: payment data (Ireland)
- Brevo (formerly Sendinblue): email + name for transactional emails (France)
- Supabase: database hosting (EU)
- Vercel & Railway: application hosting (USA, DPF framework)
- Accountant: invoicing data (France)
All our processors are contractually bound to comply with the GDPR.
5. Retention period
- Account data: duration of the commercial relationship + 3 years after inactivity
- Invoices and accounting: 10 years (legal obligation)
- Commercial prospecting: 3 years after last contact
- Technical logs: 12 months maximum
6. Your rights
Under the GDPR, you have the following rights on your data:
Obtain a copy of your data
Correct inaccurate data
Right to be forgotten (subject to legal limits)
Freeze a contested processing
Recover your data in a standard format
Refuse a processing based on legitimate interest
To exercise these rights, write to info@lanonnaluisa.com with proof of identity. We reply within 30 days.
You may also file a complaint with the French CNIL (www.cnil.fr).
7. Cookies
Before your agreement, we only use strictly necessary cookies for the site to work (user session, cart). Visit measurement and session recording require Analytics & performance consent; campaign attribution also requires Marketing consent. Use the Cookie preferences button on this page to change or withdraw these choices at any time.
When enabled, Google Ads / Meta measurement requires separate Advertising consent, off by default. It uses click identifiers, provider cookies and browser technical data (including IP address). A paid purchase can send a transaction identifier, its value including tax, delivery and redeemed credits, and its currency. We do not send names, emails or order contents for advanced matching. Click identifiers stored by this site expire after 24 hours in this tab. Withdrawal stops future measurement; it cannot undo data providers have already received. Their policies explain retention and possible international transfers. Cookie preferences lets you change this choice.
8. Security
We implement appropriate technical and organisational measures to protect your data: TLS encryption for all communications, hashed passwords (bcrypt), strict access control, regular backups, environment separation, active monitoring.
9. Changes
This policy may be updated to reflect regulatory or technical evolutions. The last update date is shown at the bottom. In case of substantial change, we will inform you by email.