1 Identity of the data controller

The data controller for the personal data collected on mesdessous.fr is:

This site uses SSL/TLS encryption to secure the transmission of your personal data (contact details, orders, payments). You can verify this by the presence of "https://" and the padlock icon in your browser's address bar.

2 Data collected during navigation

During a simple visit to our store, without registering or ordering, we only collect data automatically transmitted by your browser:

• Browser type and operating system used
• Date, time, and name of the page visited
• IP address
• Volume of data exchanged
• Website, newsletter, or other source that led to our store

This processing is carried out in accordance with the GDPR.

3 Customer account and orders

Your personal data is collected via the registration or order form. You can consult and modify this data at any time from your customer account. To request the deletion of your account, please write to: serviceclients@mesdessous.fr

Your data (name, address, telephone) is used for the processing and delivery of your orders. They are kept in accordance with legal tax and accounting retention periods (10 years). With your consent, they may be kept beyond these periods.

4 LIA Virtual Assistant — Specific Information

4.1 Nature of the service

LIA is a conversational assistant based on artificial intelligence. LIA is not a human being. In accordance with Article 52 of Regulation (EU) 2024/1689 on artificial intelligence (AI Act), you are informed of this at the beginning of each conversation.

4.2 Architecture and data access

LIA is designed to provide you with personalized assistance. Its operation is based on the following architecture:

• LIA does not store your personal data itself. It accesses, in read-only mode, the data in your customer account on our store (name, order history, delivery status, etc.), solely for the purpose of answering your questions.
• This data is what you already provided during your registration or order, and accepted under our General Terms and Conditions of Sale.
• LIA does not write, modify, or delete any data in your customer account.

4.3 Data processed in conversations

During your exchanges with LIA, the following data is collected and recorded:

4.4 Recording of conversations

Conversations with LIA are recorded in a secure database for the following purposes:

• Improving the quality of service and LIA's responses
• Handling potential disputes or claims
• Compliance with legal obligations if applicable

Conversations are kept for a period of 6 months, then deleted or anonymized.

You may request access to or deletion of your conversations at any time by writing to: serviceclients@mesdessous.fr

4.5 Technology provider — Anthropic

LIA is powered by artificial intelligence models from Anthropic, PBC (548 Market St, San Francisco, CA 94104, USA), acting as a data processor within the meaning of Article 28 of the GDPR.

A Data Processing Agreement is in place with Anthropic, guaranteeing GDPR compliance for this processing.

Data exchanged within LIA may be transferred to the United States. This transfer is governed by the Standard Contractual Clauses (SCCs) approved by the European Commission.

4.6 No binding automated decision-making

LIA makes no decisions producing legal or significant effects concerning you within the meaning of Article 22 of the GDPR. It cannot validate, modify, or cancel an order autonomously. All its answers are indicative and non-contractual.

4.7 Human contact

At any time, you can contact our team:

• Via our contact form
• By email: serviceclients@mesdessous.fr

5 Newsletter and commercial prospecting

If you subscribe to our newsletter, your email address will be used to send you our offers and news. Upon registration, we record the IP address, date, and time of registration for traceability purposes.

You can unsubscribe at any time via the link present in each email or by writing to serviceclients@mesdessous.fr. Your address will be immediately removed from our mailing list, unless expressly consented to or authorized by law for further use.

6 Service providers and subcontractors

To process your orders and operate the site, we collaborate with the following service providers:

Logistics

La Poste Colissimo — data strictly necessary for the delivery of your order.

Chronopost — data strictly necessary for the delivery of your order.

Payment

PayPal (Europe) S.à r.l. et Cie, S.C.A. — 22-24 Boulevard Royal, L-2449 Luxembourg.
Payment data is transmitted to the extent strictly necessary for the execution of the transaction (Art. 6.1.b GDPR). PayPal may carry out credit checks based on its legitimate interest (Art. 6.1.f GDPR). For more information, please consult the PayPal privacy policy.

SOGECOMMERCE — Sogecommerce is the online payment solution offered by Société Générale.

ALMA Payment in 3/4 installments :

Alma's credit service is offered for the payment of purchases and the execution of the payment, provided that the person purchasing the goods or services via Alma ("Buyer") accepts the installment or deferred payment contract.

Fees may be charged by Alma.

Any refusal by Alma to grant installment or deferred payment may lead to the cancellation of the purchase contract for goods or services ("GTC"), unless the Buyer agrees to pay the purchase amount in full.

In the event of termination of the GTC, the installment or deferred payment contract will be automatically terminated.

In case of withdrawal from the installment or deferred payment solution used for your payment, the GTC will be automatically terminated, unless you pay the amount of your purchase in full through Alma. If the product has already been shipped to you, you must return it within the maximum period stipulated in these GTC.

IT Development

• Aliasys — 97 Avenue de la Division Leclerc, 92160 Antony, France

Artificial Intelligence

Anthropic, PBC — 548 Market St, San Francisco, CA 94104, USA (see section 4.5).
DATILAB — Carrera 18A # 112-04 , Bogotá - Colombia (development and technical integration of the LIA virtual assistant)

Hosting

• Aliasys — 97 Avenue de la Division Leclerc, 92160 Antony, France

7 Reviews — Trustpilot

With your consent, your email address may be transmitted to Trustpilot (Pilestraede 58, 5th floor, DK-1112 Copenhagen K, Denmark) in order to invite you to review our service after an order.

8 Cookies

Cookies improve your browsing experience. These are text files saved by your browser. Some are deleted when you close the browser, others are kept for a specific period.

You can manage your preferences via our cookie manager available on the site, or directly in your browser settings. Disabling certain cookies may limit the site's functionality.

9 Audience analysis — Google Analytics

This site uses Google Analytics, a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses cookies to analyze site usage. The IP address is anonymized via the _anonymizeIp() extension, preventing any direct link with your identity.

Processing is carried out in our legitimate interest in statistical analysis and site optimization (Art. 6.1.f GDPR). Data may be transferred to the United States under the EU-US Data Privacy Framework.

This site also uses Google Analytics for cross-device analysis of visitor flows via a user ID. You can disable this feature in your customer account, under "My Data" then "Personal Data".

To disable Google Analytics across all sites: https://tools.google.com/dlpage/gaoptout?hl=en

10 Digital marketing and retargeting

Google Ads / Remarketing

We use Google Ads to display targeted advertisements based on your browsing (Art. 6.1.f GDPR). Conversion tracking cookies expire after 30 days. You can disable these cookies in your browser settings.

Bing Ads — Microsoft Corporation

Advertising conversion tracking via Microsoft (One Microsoft Way, Redmond, WA 98052, USA). Cookies expire after 180 days (Art. 6.1.f GDPR). To disable: EU consumers opt-out page on the Microsoft website.

Criteo SA

Personalized advertising recommendations via Criteo (32 Rue Blanche, 75009 Paris, France). Data is processed pseudonymously (Art. 6.1.f GDPR). Personal identification is not possible.
To opt out: https://www.criteo.com/privacy/

Facebook Pixel — Meta

Advertising conversion tracking with your prior and explicit consent (Art. 6.1.a GDPR). Data is processed by Meta Platforms Ireland Ltd. This processing can only take place with your agreement. You can withdraw your consent at any time via our cookie manager. This processing is reserved for users over 13 years of age.

11 Transfers outside the European Union

Some of our service providers are established outside the European Union. These transfers are governed according to the destination country:

12 Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights:

• ✓ Right of access (Art. 15)Obtain a copy of your personal data
• ✓ Right to rectification (Art. 16)Correct inaccurate or incomplete data
• ✓ Right to erasure (Art. 17)Request the deletion of your data
• ✓ Right to restriction (Art. 18)Suspend a contested processing
• ✓ Right to data portability (Art. 20)Receive your data in a structured and readable format
• ✓ Right to object (Art. 21)Object to processing based on legitimate interest
• ✓ Withdrawal of consent (Art. 7.3)At any time, without retroactive effect on past processing
• ✓ Against automated decision-makingRequest human intervention for any automated decision concerning you

13 Data security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction, or disclosure, including: encryption of data in transit (HTTPS/TLS), internal access control, regular backups, and restricted access to production data.

In the event of a data breach likely to pose a risk to your rights and freedoms, we will notify the CNIL within 72 hours and inform you as soon as possible if the risk is high.

14 Changes to this policy

This policy may be updated to reflect legal, technical, or operational developments. The date of the last update is indicated at the top of the document.

In the event of a substantial change affecting your rights, you will be informed by email or via a visible banner on the site.