Privacy policy
XLouLou · Privacy policy · Last updated: 16/10/2026
Data controller
XLouLou EI, sole trader trading as XLouLou, 15 rue Geneviève de Gaulle-Anthonioz, 92500 Rueil-Malmaison, France, is responsible for the processing described here.
For any question about your personal data or to exercise your rights: contact@xloulou.com.
Data processed
Depending on your interactions with us: identity, contact details, delivery and billing addresses, order contents, payment references and statuses (never your full card number), customer-care messages, communication preferences and technical or browsing data. Required order fields are indicated when collected; without them we may be unable to fulfil your order.
Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Orders, delivery, returns and tracking | Performance of the contract | During the contractual relationship, then archived with restricted access for 5 years (10 years for electronic contracts of €120 or more) |
| Invoices and accounting records | Legal obligation | 10 years |
| Customer care (email, WhatsApp) | Contract, pre-contractual steps or legitimate interest in responding | 3 years from the last exchange |
| Optional customer account | Providing the requested service | Until you delete it, or 3 years after your last activity |
| Security and fraud prevention | Legitimate interest in protecting the store, payments and customers | Up to 12 months, longer only if needed for a dispute |
| Newsletter | Consent (or, for existing customers, similar products with an easy opt-out) | Customers: during the relationship and 3 years after; prospects: 3 years after collection or last active contact, unless you unsubscribe earlier |
| Analytics and advertising | Consent | Cookies: 13 months maximum; collected data: 25 months maximum |
| Consent records and rights requests | Legal obligation and legitimate interest in demonstrating compliance | For as long as the related processing lasts, and up to 5 years for evidence |
At the end of these periods, data is deleted or anonymised.
Recipients and providers
Only the data necessary for their role is shared with:
- Shopify, to operate the store, checkout and customer accounts;
- our fulfilment partner, to prepare and ship orders and handle returns;
- carriers, including FedEx and DHL, for delivery and returns;
- payment providers (Shopify Payments and its partners, PayPal, Klarna, Apple Pay) for transactions and fraud prevention;
- Shopify Email, for newsletters;
- Shopify Analytics and Meta (Facebook, Instagram), for analytics and advertising, only according to your cookie choices;
- Shopify’s cookie banner, to record those choices.
If you contact us on WhatsApp, Meta processes those communications under WhatsApp’s own terms. Authorities may receive information where the law requires it. Each provider’s privacy notice is available on its website, including Shopify and Meta.
International transfers
Some providers may process or access data outside the European Economic Area, notably Shopify (Canada and the United States) and Meta (United States). These transfers rely on European Commission adequacy decisions (Canada; the EU-US Data Privacy Framework for certified companies) or on Standard Contractual Clauses. You can request information on these safeguards at contact@xloulou.com.
Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability of your data, and object to processing based on legitimate interest and to direct marketing. You can withdraw consent at any time, without affecting processing carried out before. Statutory retention obligations may limit erasure. French law also lets you give instructions concerning your data after death.
Write to contact@xloulou.com. Proof of identity may be requested if there is reasonable doubt. We reply within one month, extendable where the law permits. You may also lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.
Newsletter and cookies
Every marketing email includes an unsubscribe link. Your tracking choices can be changed at any time through the Cookie preferences link in the footer; see that page for categories and tools used.
Security and automated decisions
The store runs over an encrypted (HTTPS) connection. Card payments are handled by PCI-DSS certified payment providers: we never see or store your full card number. Access to the store’s back office is restricted and protected by two-factor authentication.
With your consent, advertising tools may use your browsing to show you more relevant ads; this has no legal or similarly significant effect on you. We do not make solely automated decisions with legal or similarly significant effects. Payment providers may run automated fraud checks that decline a payment; if this happens, contact us and we will review your order.
Policy updates
We may update this policy to reflect our actual processing. The date of the latest update appears at the top of this page, and significant changes will be clearly notified.