Privacy Policy — UFA Official Store

Who processes your data

The data controller is Gozulting, publisher of the shop.ufa.gg store.

Data controller

GOZULTING, simplified joint-stock company (SAS), share capital €100,000

Registered office

18 rue Soleillet, 75020 Paris, France

SIREN

830 489 902 — Paris Trade Register

Contact

store@ufa.gg

What we collect, and why

• Your account (name, email address, hashed password): so you can order and track your orders. Legal basis: performance of the contract.
• Your orders (items, amounts, delivery and billing addresses): to ship, invoice and handle returns. Legal basis: the contract, then the legal obligation to keep accounting records.
• Your payment: card details never pass through our servers. They are handled directly by Stripe, which acts as a joint controller for fraud prevention.
• Forms (contact, sign-up, password reset) are protected by Cloudflare Turnstile, which checks that a human is behind them. Legal basis: our legitimate interest in not being swamped by bots.
• Audience measurement (pages seen, products viewed, purchases, truncated IP address): to understand what works and improve the shop, with Google Analytics — only if you accept it in the banner. Legal basis: your consent, which you can withdraw at any time on the Cookies and trackers page. This data is processed by Google Ireland Ltd and may be transferred to the United States under the EU–US Data Privacy Framework; statistics are kept 14 months. If you decline, nothing is loaded.
• Trackers stored on your device are listed one by one, with their lifetime and who sets them, on the Cookies and trackers page.

How long we keep them

• Customer account: as long as the account exists, then three years after the last contact.
• Orders and invoices: ten years, as accounting law requires.
• Tracker choices: six months for the choice itself; the proof of that choice is kept as long as needed to demonstrate it.

Who else has access

Our providers, each for what they do and nothing more: Stripe (payment), Cloudflare (form security), Google Ireland (audience measurement, only if you accepted it), our host, and the carrier who delivers to you. The list of companies that may set trackers is published on the cookies page and kept up to date.

Your rights

You can request access to your data, its correction or erasure, restriction of processing, portability, and object to processing based on legitimate interest. From your account, under “My personal data”, you can download a copy or request deletion in two clicks. You can also use the contact page.

If our answer does not satisfy you, you may refer the matter to the CNIL: cnil.fr.