Privacy Policy

Last updated: 29/07/2026

1. Data controller

Lanouar Farhat, sole trader (entreprise individuelle), trading as Vitebaz, operating the online store Cosavia 14 Place Carnot, 93110 Rosny-sous-Bois, France SIREN 881 611 180 — RCS Bobigny support@cosavia.com — +33 6 52 59 79 53

We are the controller of the personal data described in this policy, within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. What data we collect

You provide directly:

  • identity: first and last name
  • contact: email address, telephone number
  • addresses: billing and delivery address
  • order content and history
  • messages you send us

Collected automatically:

  • IP address, browser type, device type, operating system
  • pages viewed, time on site, referring source
  • cookie identifiers (see our Cookie Policy)

We do not collect or store your full payment card details. Card data is captured directly by our payment provider.

3. Why we use it, and on what legal basis

Purpose Legal basis
Processing and delivering your order Performance of the contract (art. 6.1.b)
Customer service and handling complaints Performance of the contract (art. 6.1.b)
Accounting, invoicing, tax records Legal obligation (art. 6.1.c)
Fraud prevention and site security Legitimate interest (art. 6.1.f)
Marketing emails and newsletters Consent (art. 6.1.a)
Analytics and advertising cookies Consent (art. 6.1.a)

You may withdraw consent at any time, without affecting processing carried out before withdrawal.

4. Who we share it with

We share personal data only where necessary, with:

  • Shopify Inc. — e-commerce platform and hosting (Canada)
  • Payment providers — payment processing and fraud prevention
  • Fulfilment partners and carriers — to prepare and deliver your order. This includes partners located in China, who receive your name, delivery address, telephone number, and order contents solely to ship your order.
  • Email and analytics providers — where you have consented

We do not sell your personal data.

5. International transfers

Some of our providers are located outside the European Economic Area, including in Canada and China.

Canada benefits from an adequacy decision of the European Commission for commercial organisations.

For transfers to China, which is not covered by an adequacy decision, we rely on the Standard Contractual Clauses adopted by the European Commission, together with appropriate supplementary measures, in accordance with article 46 GDPR. Only the data strictly necessary to ship your order is transferred.

You may request a copy of the safeguards in place by writing to support@cosavia.com.

6. How long we keep it

Data Retention
Order and customer account data 3 years from the last contact, then archived
Invoices and accounting records 10 years (legal obligation)
Marketing consent and newsletter data 3 years from the last contact, or until you unsubscribe
Cookie identifiers Maximum 13 months
Customer service correspondence 3 years

7. Your rights

Under the GDPR you have the right to:

  • access your personal data
  • rectify inaccurate or incomplete data
  • erase your data ("right to be forgotten")
  • restrict processing
  • object to processing based on legitimate interest, and to direct marketing at any time
  • data portability
  • withdraw consent at any time
  • give instructions on the fate of your data after your death

To exercise these rights, email support@cosavia.com. We reply within one month. We may ask for proof of identity where there is reasonable doubt.

If you believe your rights have not been respected, you may lodge a complaint with the French supervisory authority:

CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — https://www.cnil.fr

8. Security

We implement appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), restricted access, and providers who contractually commit to equivalent standards.

No transmission over the internet is completely secure, and we cannot guarantee absolute security.

9. Children

Our store is not directed at children under 15. We do not knowingly collect their data. If you believe a child has provided us data, contact support@cosavia.com and we will delete it.

10. Cookies

Cookies are described in our separate Cookie Policy.

11. Changes

We may update this policy. The version in force is the one published on this page, with its date at the top. Material changes will be communicated by email or by a notice on the site.

12. Contact

Cosavia — (trading as Vitebaz) 14 Place Carnot, 93110 Rosny-sous-Bois, France support@cosavia.com — +33 6 52 59 79 53