Last updated: 2 July 2026

ABOUT THIS PRIVACY POLICY

This Privacy Policy explains how CHAMBRE DE FAN SAS collects, uses, stores and protects your personal data when you:

• Visit or use chambredefan.com;
• Create or use a customer account;
• Place or manage an order;
• Contact us;
• Subscribe to our newsletter;
• Interact with our advertisements or social media services;
• Communicate with us through a third party platform such as WhatsApp.

“CHAMBRE DE FAN”, “we”, “us” and “our” refer to CHAMBRE DE FAN SAS.

 

DATA CONTROLLER

The data controller is:

CHAMBRE DE FAN SAS

Registered office: 13 Bis Avenue de la Motte-Picquet, 75007 Paris, France

Registered with the Paris Trade and Companies Register: 850 609 652 RCS Paris

SIRET: 850 609 652 00019

Intra-Community VAT number: FR13 850 609 652

Email: [email protected]

CHAMBRE DE FAN has not appointed a Data Protection Officer.

Questions concerning this Privacy Policy and requests to exercise data protection rights should be sent to: [email protected].

 

PERSONAL DATA WE COLLECT

Depending on how you interact with us, we may collect the following categories of personal data.

Identity and contact information

This may include:

• Title;
• First and last names;
• Email address;
• Telephone number;
• Billing and delivery addresses;
• Country or region;
• Delivery postcode;
• Any other contact information you choose to provide.

Customer account information

This may include:

• Customer account identifier;
• Login and account information;
• Saved billing and delivery addresses;
• Language preference;
• Products saved to a wishlist;
• Order history;
• Saved payment method tokens;
• Limited payment method information supplied by the relevant payment provider.

Passwords are stored in an encrypted or hashed form. We cannot view your password.

A customer account is required to place an order on our website.

Order and transaction information

This may include:

• Order number;
• Products ordered;
• Prices, taxes, delivery charges and discounts;
• Order status;
• Payment method and payment status;
• Transaction reference;
• Delivery and tracking information;
• Returns, exchanges and refunds;
• Invoices and credit notes;
• Customs information;
• Communications relating to your order.

Payment information

Payments are processed by Stripe or PayPal.

Depending on the payment method, we may receive limited transaction information such as:

• Payment method;
• Card type or card brand;
• The last digits of a payment card, where supplied by the provider;
• Payment status;
• Transaction identifier;
• Payment processing fees;
• The net amount received.

CHAMBRE DE FAN does not receive or store full payment card numbers or card security codes.

Where you ask to save a payment method, the payment provider stores the payment credentials and provides us with a secure token that can be associated with your customer account.

Delivery and customs information

We may process and share:

• Recipient name;
• Email address;
• Telephone number;
• Delivery address;
• Delivery postcode;
• Order contents;
• Product value;
• Invoice information;
• Information required for customs clearance.

Customer service and contact information

When you contact us through our contact form, email or WhatsApp, we may collect:

• Your contact details;
• The reason for your enquiry;
• Your order number;
• Your delivery postcode;
• The contents of your message;
• Subsequent correspondence.

Contact form submissions are stored in our WordPress database and sent to our customer service email address.

Newsletter and marketing information

When you subscribe to our newsletter, we collect:

• Your email address;
• The language version of the website through which you subscribed;
• Subscription date and consent information;
• Technical subscription information made available by MailerLite.

Subscribers are assigned to an English or French language mailing group solely according to the language version of the website through which they subscribe.

We do not synchronise WooCommerce orders, purchase history or website browsing history with MailerLite.

Where you have separately consented to email engagement measurement, MailerLite may also record:

• Whether a newsletter was opened;
• Which links were clicked.

We do not use this information to determine prices, payment methods, discounts or eligibility for services.

Technical, device and security information

When you use our website, we may collect:

• IP address;
• Date and time of access;
• Browser and device type;
• Operating system;
• Language and time zone settings;
• Requested pages and URLs;
• Referring page;
• Server request information;
• Login attempts;
• Firewall and security events;
• Approximate location derived from an IP address;
• Cookie identifiers;
• Cookie consent choices.

Website analytics and advertising information

With your consent, we may collect information concerning:

• Pages and products viewed;
• Products added to a basket;
• Checkout activity;
• Purchases;
• Referring sources;
• Campaign interactions;
• Browser and device information;
• Advertising conversion events.

Where advertising measurement services are enabled and you have given the relevant consent, certain customer information may be standardised, securely hashed and transmitted to Google, Meta or Pinterest for conversion measurement and matching purposes.

This may include an email address, name, postal address or telephone number, depending on the service and the information available.

We do not currently use customer data to create lookalike audiences, Customer Match audiences or personalised dynamic pricing.

Backup information

Website backups may contain copies of customer accounts, orders, contact form submissions, website settings and other information stored in the website database.

 

HOW WE COLLECT PERSONAL DATA

We collect personal data:

• Directly from you when you create an account, place an order, complete a form, contact us or subscribe to our newsletter;
• Automatically when you use our website, subject to your cookie choices;
• From payment providers, delivery providers and other service providers involved in fulfilling your order;
• From advertising, analytics or social media providers where you have consented to the relevant processing.

 

WHY WE PROCESS PERSONAL DATA

Creating and managing customer accounts

We process account information to:

• Create and secure your account;
• Allow you to place orders;
• Save addresses and payment preferences;
• Provide access to order history;
• Maintain your wishlist.

Legal basis: performance of the account service and of our contract with you, or steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

Processing orders and payments

We process identity, contact, order and payment information to:

• Accept and process orders;
• Collect payment;
• Issue order confirmations and invoices;
• Manage saved payment methods;
• Manage cancellations, returns, exchanges and refunds;
• Provide after sales assistance.

Legal basis: performance of our contract with you (Article 6(1)(b) GDPR). Where processing is required for invoicing, accounting, tax or other statutory record keeping purposes, it is based on compliance with a legal obligation (Article 6(1)(c) GDPR).

Delivering orders and completing customs formalities

We process and share delivery information to:

• Prepare and dispatch orders;
• Provide tracking and delivery notifications;
• Complete international customs formalities;
• Deal with delivery problems.

Legal basis: performance of our contract with you (Article 6(1)(b) GDPR). Where processing is required by customs or other applicable laws, it is based on compliance with a legal obligation (Article 6(1)(c) GDPR).

Providing customer service

We process information contained in enquiries and correspondence to:

• Answer questions;
• Provide product or order assistance;
• Handle complaints;
• Manage returns and warranty matters;
• Defend or exercise legal rights.

Legal basis: steps taken at your request before entering into a contract or performance of our contract with you, as applicable (Article 6(1)(b) GDPR). For general enquiries, dispute management and the establishment, exercise or defence of legal claims, we rely on our legitimate interests in providing customer service and protecting our legal rights (Article 6(1)(f) GDPR).

Sending newsletters

We use your email address to send:

• Newsletters;
• Collection and product updates;
• Offers and promotions;
• An automated welcome email.

Legal basis: your consent (Article 6(1)(a) GDPR).

You may unsubscribe at any time through the unsubscribe link contained in each marketing email.

Measuring newsletter engagement

Where you have consented to email engagement measurement, we may measure email opens and link clicks to assess the technical delivery and overall performance of our newsletters.

Legal basis: your consent (Article 6(1)(a) GDPR).

You may withdraw this consent at any time.

Analysing website use

With your consent, we use Google Analytics 4 to understand how visitors use our website, including product views, basket activity, checkout activity and purchases.

Google Signals, advertising personalisation and Google Analytics User ID are not currently enabled.

Legal basis: your consent (Article 6(1)(a) GDPR), collected through our cookie consent tool.

Advertising measurement

With your consent, we may use:

• Google Ads Enhanced Conversions;
• Meta Pixel and Advanced Matching;
• Pinterest Tag and Enhanced Match.

These tools help us measure whether an advertisement led to a website visit, product interaction or purchase.

We do not currently use Meta Conversions API or Pinterest Conversions API.

Legal basis: your consent (Article 6(1)(a) GDPR), collected through our cookie consent tool.

Operating and securing the website

We process technical, server and security information to:

• Operate the website;
• Prevent unauthorised access;
• Identify malicious activity;
• Prevent fraud and abuse;
• Maintain website availability;
• Diagnose technical problems;
• Protect customers and our business.

Legal basis: our legitimate interests in operating, protecting and maintaining a secure and reliable website (Article 6(1)(f) GDPR).

Preventing payment fraud

Stripe, PayPal and their fraud prevention services may analyse transaction and technical information to detect suspicious or unauthorised payments.

CHAMBRE DE FAN does not itself make decisions based solely on automated processing that produce legal or similarly significant effects.

Payment providers may perform independent fraud prevention and payment security checks in accordance with their own privacy policies.

Legal basis: our legitimate interests in preventing fraud and securing transactions (Article 6(1)(f) GDPR). Processing necessary to submit and complete your chosen payment method is based on performance of our contract with you (Article 6(1)(b) GDPR). Stripe and PayPal determine their own legal bases for the processing they carry out independently.

Complying with legal obligations

We process and retain certain information to comply with:

• Accounting and tax obligations;
• Consumer protection rules;
• Customs requirements;
• Legal requests;
• Court orders;
• Regulatory obligations.

Legal basis: compliance with legal obligations to which CHAMBRE DE FAN is subject (Article 6(1)(c) GDPR).

 

COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies for website operation, security, functionality, analytics, external content and advertising measurement.

Functional cookies are used without consent where they are necessary to provide the website or a service you have requested.

Preferences, Analytics and Advertising cookies are used only after you have given the relevant consent through our Complianz consent tool.

You can accept all cookies, reject non-essential cookies or manage your preferences. You can change or withdraw your choice at any time through the Cookie Settings control available on the website.

Further information is available in our Cookie Policy.

 

WHO RECEIVES YOUR PERSONAL DATA?

Only persons who require access for the purposes described in this Privacy Policy may process your personal data.

Depending on the service concerned, recipients may act as processors, sub-processors or independent data controllers.

Website hosting, infrastructure and security

We use:

• O2switch for website and email hosting, server infrastructure, server logs and hosting backups;
• Cloudflare for domain name services, DNS, proxy services, content delivery, caching, firewall protection, bot protection, DDoS protection, Turnstile and website traffic information;
• Wordfence for website firewall and security monitoring;
• Complianz for cookie consent collection and consent records;
• Google Drive to store one current manual website backup created through UpdraftPlus.

Our O2switch website server is located in Clermont-Ferrand, France.

Payment providers

We use:

• Stripe;
• Stripe Radar;
• PayPal;
• Apple Pay through Stripe;
• Google Pay through Stripe;
• Alipay through Stripe;
• WeChat Pay through Stripe;
• UnionPay through Stripe;
• Cartes Bancaires and major payment card networks.

Payment providers process payment credentials and may retain transaction information under their own legal and regulatory obligations.

Delivery providers

We share the information needed to deliver orders with:

• Colissimo;
• UPS.

For international deliveries, information may also be provided to customs authorities, customs agents and other authorities involved in import or export formalities.

Newsletter provider

We use MailerLite to:

• Host the embedded newsletter form;
• Manage subscriptions;
• Divide subscribers into English and French language group;
• Send newsletters;
• Send the welcome email;
• Measure email engagement where the subscriber has separately consented.

Google services

We may use:

• Google Analytics 4;
• Google Merchant Center;
• Google free product listings;
• Google Ads and Enhanced Conversions;
• Google Search Console;
• YouTube;
• Google Drive.

YouTube content is not loaded until the relevant cookie consent has been given.

Meta services

We use Meta services to:

• Synchronise our product catalogue;
• Operate Facebook and Instagram Shop features;
• Measure advertising activity through Meta Pixel;
• Use Advanced Matching where the relevant consent has been given.

Pinterest services

We use Pinterest services to:

• Synchronise our product catalogue;
• Measure product views, basket activity and purchases through Pinterest Tag;
• Use Enhanced Match where the relevant consent has been given.

Email and customer service tools

Our domain email accounts are hosted by O2switch.

We use Spark by Readdle as an email client to access and manage customer service correspondence.

When you choose to contact us through WhatsApp, WhatsApp and Meta may independently process your account, device and message information in accordance with their own privacy policies.

Professional advisers and authorities

We may disclose personal data where necessary to:

• Accountants;
• Auditors;
• Insurers;
• Lawyers;
• Courts;
• Law enforcement authorities;
• Tax or customs authorities;
• Other public or regulatory bodies.

 

INTERNATIONAL DATA TRANSFERS

Some service providers or their sub-processors may process personal data outside the European Economic Area.

Where required, international transfers are protected by one or more of the following safeguards:

• An adequacy decision adopted by the European Commission;
• Participation in an approved data transfer framework where applicable;
• The European Commission’s Standard Contractual Clauses;
• Contractual, organisational and technical safeguards;
• Supplementary security measures where necessary.

You may contact us for further information about the safeguards applied to a particular transfer.

 

HOW LONG WE KEEP PERSONAL DATA

We retain personal data only for as long as necessary for the relevant purpose, subject to legal retention obligations.

Customer accounts, saved addresses and wishlists

Customer account information is retained while the account remains active and may be deleted or anonymised after five years of inactivity.

Saved payment methods

Saved payment tokens are retained until you remove the payment method, close your account or the relevant payment provider deletes the payment method, subject to its legal obligations.

Pending orders

Personal data connected with pending orders is retained for 14 days.

Failed and cancelled orders

Personal data connected with failed or cancelled orders is generally retained for seven days, unless it is required for customer service, fraud prevention or a legal claim.

Completed and refunded orders

Order, payment, delivery, return and refund records are retained for up to five years after the completion or closure of the transaction where necessary for customer service, contractual matters or legal claims.

Invoices and accounting records

Invoices, credit notes and supporting accounting records are retained for ten years where required by French law.

Contact forms and general enquiries

Contact form submissions and general customer service correspondence are normally retained for one year after the last contact.

Information connected with a complaint, dispute, warranty matter or legal claim may be retained for the applicable limitation period or until the matter has been fully resolved.

Newsletter subscriptions

Newsletter subscription information is retained until you unsubscribe, withdraw your consent or request deletion.

After unsubscribing, your active subscriber profile is removed. A minimal record may be retained where necessary to honour the opt-out request or demonstrate compliance with our legal obligations.

Newsletter engagement data

Where email engagement measurement has been authorised, open and click information is retained for no longer than the associated newsletter subscription, unless it is aggregated or anonymised earlier.

Google Analytics

Under our current Google Analytics settings:

• Certain event level data is retained for two months;
• User level data is retained for up to 14 months.

The user data retention period is reset when new activity is recorded.

Wordfence security logs

Wordfence Live Traffic and security event logs are retained for 30 days.

Information connected with a specific security incident may be retained for longer where necessary to investigate or document that incident.

Local payment metadata

Limited Stripe payment information stored locally by WooCommerce is retained for up to one year.

Stripe and PayPal independently retain payment information in accordance with their own legal and regulatory obligations.

Server, Cloudflare and technical logs

Server, proxy and infrastructure logs are retained for the shortest period reasonably necessary for website security, troubleshooting, service operation and compliance with legal obligations, according to the relevant provider’s configured or contractual retention schedule.

Website backups

We currently retain one manual UpdraftPlus website backup in Google Drive.

The backup is replaced or deleted when a newer backup is created. Personal data may remain in the current backup until it is replaced or securely deleted.

Cookie and consent information

Cookie lifespans are stated in the Cookie List contained in our Cookie Policy.

Consent records are retained for the period necessary to remember your choice and demonstrate that valid consent was obtained or withdrawn.

When the applicable period expires, personal data is deleted, anonymised or placed in a restricted archive where continued retention is legally required.

 

HOW WE PROTECT PERSONAL DATA

We use appropriate technical and organisational measures designed to protect personal data against:

• Accidental or unlawful destruction;
• Loss;
• Alteration;
• Unauthorised disclosure;
• Unauthorised access;
• Other unlawful processing.

These measures include, where appropriate:

• Encrypted HTTPS communications;
• Restricted administrative access;
• Account authentication;
• Firewall protection;
• Bot and DDoS protection;
• Malware and security monitoring;
• Payment tokenisation;
• Access controlled backups;
• Regular software and security updates.

No internet transmission or electronic storage system can be guaranteed to be completely secure.

 

AUTOMATED DECISION MAKING

CHAMBRE DE FAN does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.

Our payment providers may independently carry out automated fraud prevention and payment security checks in accordance with their own privacy policies.

 

CHILDREN

The website may be browsed by minors, but orders may only be placed by persons aged 18 or over.

Our products, customer accounts and marketing communications are not directed at children, and we do not knowingly collect children’s personal data for marketing purposes.

If you believe that a child has provided personal data to us without appropriate authorisation, please contact us.

 

YOUR DATA PROTECTION RIGHTS

Subject to the conditions and limitations established by applicable law, you may have the following rights.

Right of access

You may ask whether we process your personal data and request a copy of the data we hold about you.

Right to rectification

You may ask us to correct inaccurate information or complete incomplete information.

Right to erasure

You may ask us to delete personal data where the legal conditions for erasure are met.

This right does not apply where continued retention is required by law or necessary to establish, exercise or defend legal claims.

Right to restriction

You may ask us to restrict the processing of personal data in certain circumstances.

Right to data portability

Where processing is based on consent or a contract and is carried out by automated means, you may request the personal data you provided in a structured, commonly used and machine-readable format.

Right to object

You may object to processing based on our legitimate interests for reasons relating to your particular situation.

You may object to the use of your personal data for direct marketing at any time and without providing a reason.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights concerning post mortem data

In accordance with French law, you may provide general or specific instructions concerning the storage, deletion and communication of your personal data after your death.

Right to lodge a complaint

You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL).

You may also contact the data protection authority in the European Union or European Economic Area country in which you live or work.

 

HOW TO EXERCISE YOUR RIGHTS

To exercise your rights, email at: [email protected].

Please describe your request clearly and provide sufficient information to allow us to identify the relevant data.

We may request additional information to verify your identity only where we have reasonable doubts about the identity of the person making the request.

We will respond within the period required by applicable law.

 

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes to:

• Our website;
• Our services;
• The technologies we use;
• Our processing activities;
• Applicable legal requirements.

The latest version will be published on this page with its effective date.

Where a change materially affects how we process personal data, we will provide additional notice where required.

 

CONTACT US

For questions about this Privacy Policy or the processing of your personal data, contact:

CHAMBRE DE FAN SAS

13 Bis Avenue de la Motte-Picquet, 75007 Paris, France

Email: [email protected]