This site has limited support for your browser. We recommend switching to Edge, Chrome, Safari, or Firefox.

BLACK FRIDAY: Buy 2, Get 1 FREE · Code BLACK3

Privacy policy

Last modified: 8 July 2026

This Privacy Policy describes how your personal data is collected, used, stored and shared when you visit the website https://larbredeschakras.com (the "Site"), when you make a purchase on it, when you contact our customer service or when you interact with our marketing communications.

It has been drawn up in accordance with Regulation (EU) 2016/679 on the protection of personal data (the "GDPR"), French Law No. 78-17 of 6 January 1978 as amended (the "Informatique et Libertés" Act) and the applicable rules on cookies and direct marketing.

ARTICLE 1 – DATA CONTROLLER

The controller of the personal data collected on the Site is:
SARL KAMALIA
Registered with the Montpellier Trade and Companies Register (RCS) under number 888522786
20 route de Villeveyrac, 34140 Mèze
France
Email: info@larbredeschakras.com
Phone: 04 69 96 22 52

SARL KAMALIA has not appointed a Data Protection Officer (DPO). For any question about your personal data or to exercise your rights, you can contact us directly at the email address given above.

ARTICLE 2 – PERSONAL DATA COLLECTED

We collect only the data needed for the purposes described in this policy. Depending on how you use the Site, the following categories of data may be collected:

  • Identification and contact information: surname, first name, email address, phone number, billing address, delivery address.
  • Order information: products purchased, order amount, delivery address, billing address, order status, return or refund requests.
  • Payment information: payment method used, payment status, transaction references. Full bank card details are processed directly by our secure payment providers and are not accessible to us.
  • Delivery information: information needed to prepare, ship, track and deliver your package.
  • Customer service information: content of your requests, history of our exchanges by email, form, chat or any other support channel.
  • Reviews and user-generated content: reviews, ratings, comments, photos or videos that you choose to publish on the Site.
  • Marketing data: newsletter or SMS subscription status, consents, communication preferences, open or click history where this information is available.
  • Connection and browsing information: IP address, browser type, device used, pages viewed, date and time of connection, browsing path, cookie identifiers or similar trackers.
  • Security and fraud prevention data: technical signals, transaction information, any inconsistencies, risk score or alerts generated by our payment and security providers.

Data sources: this data is collected directly from you when you provide it, automatically while you browse through cookies or similar technologies, or from our providers where this is necessary for payment, delivery, fraud prevention or customer service.

Mandatory data: at the time of collection, mandatory data is marked with an asterisk (*) or is necessary for the requested processing. If you do not provide this information, we may not be able to process your order, deliver your products or respond to your request.

No customer account: our Site does not offer a customer account area specific to L'Arbre des Chakras. We therefore do not collect a customer account username or password to manage a customer area on our Site. If you use a service provided directly by Shopify, such as Shop or Shop Pay where available, the related processing is described in Article 6.

Protection of minors: our Site is not intended for minors under 18. We do not knowingly collect personal data from minors. If you believe that a minor has sent us personal data, you can contact us so that we can take the appropriate measures.

ARTICLE 3 – PURPOSES AND LEGAL BASES OF PROCESSING

We use your personal data for specific purposes, each based on a defined legal basis:

  • Order management: recording the order, payment, confirmation, invoicing, preparation, shipping, delivery, tracking, returns and refunds.
    Legal basis: performance of the contract concluded with you.
  • Payment and transaction security: processing of payment, verification of the transaction, prevention of non-payment and fraud.
    Legal basis: performance of the contract, our legitimate interest in securing our transactions and, where applicable, compliance with our legal obligations.
  • Fraud prevention and automated analysis: certain providers, in particular Shopify Payments, may automatically analyze transaction data in order to identify a risk of fraud. The criteria taken into account may include payment information, delivery address, IP address, transaction inconsistencies or technical signals associated with the order. A transaction presenting a very high risk may be declined or require additional verification.
    Legal basis: our legitimate interest in preventing fraud and, where a fully automated decision has a significant effect, the need to secure the conclusion or performance of the contract, with the safeguards described in Article 8.
  • Customer service and after-sales service: answering your questions, handling complaints, return requests, exchanges, legal guarantees and satisfaction follow-up.
    Legal basis: performance of the contract, pre-contractual measures or our legitimate interest in providing quality customer service.
  • Publication and moderation of customer reviews: collection, verification, moderation, publication and display of reviews, ratings, photos or videos voluntarily submitted by customers.
    Legal basis: your consent when submitting the review and our legitimate interest in verifying the authenticity and compliance of published reviews.
  • Marketing communications by email or SMS: sending offers, new products, news, promotions or product recommendations.
    Legal basis for prospects: your prior consent.
    Legal basis for customers: our legitimate interest in offering you products similar to those you have already purchased, provided that you can object simply and free of charge at any time.
  • Cart or browsing reminders: reminders about an abandoned cart, a product viewed or an unfinished order when the legal conditions are met.
    Legal basis: your consent when the reminder relies on cookies or on electronic marketing subject to consent, or our legitimate interest when the reminder is strictly linked to a purchase in progress and the law allows it.
  • Targeted advertising and campaign measurement: displaying personalized adverts on third-party platforms, creating audiences, measuring advertising performance, synchronizing encrypted or pseudonymized lists where applicable.
    Legal basis: your consent obtained through our cookie banner or our consent management tools.
  • Audience measurement, Site improvement and personalization: browsing analysis, statistics, usability improvements, testing, performance tracking, personalization of certain features.
    Legal basis: our legitimate interest for trackers that are strictly necessary or exempt from consent; your consent for non-essential cookies and trackers, in particular advertising cookies, advanced analytics, heatmaps or session recordings.
  • Site security: preventing abuse, detecting suspicious activity, protecting the Site, data and transactions.
    Legal basis: our legitimate interest in ensuring the security of our business and our users.
  • Compliance with our legal, accounting and tax obligations: keeping invoices, managing accounts, handling requests relating to individuals' rights, responding to the competent authorities where required by law.
    Legal basis: legal obligation.

ARTICLE 4 – RETENTION PERIODS

Your personal data is kept only for as long as necessary for the purposes for which it was collected, unless a legal obligation, the need for evidence or litigation requires otherwise. The main retention periods are as follows:

  • Order-related data: kept in our active database for the duration of the business relationship, then archived for 5 years for evidence purposes and complaint handling. Invoices and accounting documents are kept for 10 years in accordance with accounting obligations.
  • Prospect and marketing data: kept until you withdraw your consent or for 3 years from your last interaction with us, for example a click in a newsletter or a request for information.
  • Customer data used for direct marketing: kept for the duration of the business relationship and then, unless you object, for a maximum of 3 years from your last purchase or your last interaction.
  • Customer service requests: kept for as long as necessary to handle your request, then for up to 3 years from the last exchange, unless a dispute or legal obligation requires longer retention.
  • Customer reviews and published content: kept for as long as the product concerned is offered on the Site or until you ask for deletion, subject to evidence and moderation obligations.
  • Data relating to returns, refunds and guarantees: kept for as long as necessary to handle the request, then for the applicable legal limitation periods.
  • Proof of consent and objection: kept for as long as necessary to manage your preferences and to prove compliance with our obligations.
  • Cookies and trackers: retention periods vary depending on the cookies used and are set out in our Cookie Policy. Your choices to accept or refuse are kept for a limited period before you may be asked to choose again.
  • Technical logs and security data: kept for a limited period proportionate to the needs of security, abuse detection and fraud prevention.

ARTICLE 5 – RECIPIENTS AND SHARING OF DATA

We do not sell your personal data. We share it only with the recipients needed for the purposes described above, and only to the extent each of them needs it.

  • E-commerce platform and hosting: Shopify, which provides us with the online shop infrastructure, the cart, the checkout, certain management tools and, depending on the services enabled, certain analytics or personalization features.
  • Payment providers: Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay and the associated technical providers, in order to process and secure your payments. Depending on the case, these providers may act as processors or as independent controllers for certain payment-related processing.
  • Logistics partners, suppliers and carriers: providers responsible for preparing, shipping, tracking and delivering your packages, including our partner suppliers and tracking tools such as ParcelWILL where these are used.
  • Marketing, email, SMS and notifications: Klaviyo for sending marketing communications and, where applicable, notification or web push tools such as PushOwl if these features are enabled.
  • Advertising and performance measurement: Meta, Google, Bing/Microsoft and other advertising networks used to run, measure or optimize our campaigns, only where the legal conditions and your consent choices allow it.
  • Customer service: Gorgias or any other support tool used to manage your requests by email, chat or form.
  • Customer reviews: Loox, to collect, verify, moderate and display reviews, ratings, photos or videos relating to our products.
  • Analytics, performance and reporting: Elevar, BeProfit, audience measurement tools, heatmap or session analysis tools where these services are enabled and subject to your consent where it is required.
  • Backup, security and maintenance: Talon Backups and other technical providers needed for the security, backup, maintenance or proper functioning of the Site.
  • Third-party Shopify apps: certain apps installed on our shop may access only the data they need to function, for example for product recommendations, bundle offers or improving the shopping experience.
  • Advisers and authorities: accountants, legal advisers, government bodies, judicial or administrative authorities where required by law or where necessary to defend our rights.

Our providers are required to process the data only for the intended purposes, on our instructions where applicable, and to implement appropriate security measures. Some providers do, however, have their own obligations and privacy policies when they act as independent controllers, in particular payment providers.

ARTICLE 6 – RELATIONSHIP WITH SHOPIFY

Our shop is powered by Shopify, which provides us with the technical infrastructure needed to operate the Site, including hosting of the shop, the cart, the checkout, the processing of certain order data and the tools needed to provide e-commerce services.

For the processing needed to operate our shop, SARL KAMALIA remains the controller of your personal data, and Shopify generally acts as a service provider or processor on our instructions and under the applicable contractual terms.

Certain Shopify features may, however, involve Shopify processing personal data as an independent controller, in particular when you use services provided directly by Shopify or certain advanced features relating to analytics, personalization, advertising, Shop, Shop Pay or services involving interactions between our shop, other merchants and Shopify.

Where these features are enabled and applicable, Shopify may use certain information from your interactions with our shop, with Shopify or with other merchants using Shopify in order to provide, secure, develop or improve its services. Processing based on targeted advertising or on cookies and similar technologies subject to consent is carried out only with your consent where it is required.

To find out more about the processing Shopify carries out on its own behalf, you can read the Shopify Consumer Privacy Policy. You can also use the Shopify privacy portal to exercise certain rights relating to processing carried out by Shopify.

If your request concerns processing for which we are the controller, you can contact us at info@larbredeschakras.com. If your request concerns processing carried out by Shopify as an independent controller, Shopify may handle your request directly under its own procedures.

ARTICLE 7 – DATA TRANSFERS OUTSIDE THE EUROPEAN UNION

Some of our providers or partners may process personal data outside the European Union or the European Economic Area, in particular in Canada, the United States or certain countries in Asia, where this is necessary for hosting, payment, marketing, analytics, customer support, or the shipping or delivery of your orders.

We make sure to limit the data transferred to what is strictly necessary for the purpose concerned. Depending on the case, these transfers are governed by an adequacy decision of the European Commission, by the European Commission's Standard Contractual Clauses, by the provider's participation in the EU-U.S. Data Privacy Framework where applicable, or by any other safeguard provided for by the GDPR.

  • Shopify: our shop is provided by Shopify, a Canadian company. Canada benefits from an adequacy decision of the European Commission for covered commercial organizations. Where Shopify or its processors transfer data to other countries, these transfers may be governed by appropriate safeguards, in particular the Standard Contractual Clauses.
  • Providers based in the United States: certain marketing, advertising, payment, support or analytics providers may process data in the United States. Where applicable, these transfers rely on participation in the EU-U.S. Data Privacy Framework or on the Standard Contractual Clauses.
  • Suppliers and logistics partners outside the EU: in order to prepare, ship and track your orders, we may pass on the strictly necessary data, such as surname, first name, address, phone number, email address and order contents, to suppliers, warehouses or carriers located outside the EU. These transfers are limited to fulfilling your order and must be governed by appropriate safeguards where the country concerned does not benefit from an adequacy decision.

You can contact us at info@larbredeschakras.com for further information on the safeguards that apply to transfers of your data.

ARTICLE 8 – YOUR RIGHTS

In accordance with the applicable regulations, you have the following rights regarding your personal data:

  • Right of access: to obtain confirmation that data concerning you is being processed and to receive a copy of it.
  • Right to rectification: to ask for inaccurate or incomplete data to be corrected.
  • Right to erasure: to ask for your data to be deleted in the cases provided for by law.
  • Right to restriction of processing: to ask for the use of certain data to be temporarily suspended.
  • Right to data portability: to receive certain data in a structured, commonly used and machine-readable format, where this right applies.
  • Right to object: to object to certain processing based on our legitimate interest. You can object to direct marketing at any time.
  • Right to withdraw your consent: to withdraw at any time your consent for processing based on it, in particular the newsletter, marketing SMS or advertising cookies.
  • Right relating to automated decisions: where a fully automated decision produces legal effects or significantly affects you, you can request human intervention, express your point of view and contest the decision.
  • Post-mortem right: to set out instructions on what happens to your personal data after your death.

Telephone canvassing (Bloctel): in accordance with Article L. 223-2 of the French Consumer Code (Code de la consommation), since we may collect your phone number, you are hereby informed of your right to register free of charge on the Bloctel telephone canvassing opt-out list via the website www.bloctel.gouv.fr.

To exercise your rights, you can contact us at the following address: info@larbredeschakras.com. If there is reasonable doubt about your identity, we may ask you for proof of identity in order to protect your data from unauthorized access.

We undertake to respond to your request within one month of receiving it. This period may be extended by two further months for complex requests or a large number of requests, in accordance with the applicable regulations.

ARTICLE 9 – RIGHT TO LODGE A COMPLAINT

If, after contacting us, you consider that the processing of your personal data infringes your rights, you can lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority.

More information is available on the CNIL website: https://www.cnil.fr.

ARTICLE 10 – DATA SECURITY

We implement reasonable technical and organisational measures to protect your personal data against loss, unauthorized access, disclosure, alteration or destruction.

In particular, the Site uses encryption protocols such as TLS to secure exchanges. Access to data is limited to the people and providers who need it for the purposes described in this policy.

Payments are processed by our secure payment providers, which apply the security requirements that govern payment processing, in particular the PCI-DSS standards where these are required. We do not have access to your full bank card details.

Despite the measures in place, no system can guarantee absolute security. We ask you not to send us sensitive information through unsecured channels and to report to us any suspicious activity relating to an order.

ARTICLE 11 – COOKIES AND TRACKERS

Our Site uses cookies and similar technologies to ensure it works properly, remember your cart, secure browsing, measure audience, improve the user experience, personalize certain content and, subject to your consent, carry out targeted advertising or campaign measurement.

Some cookies are strictly necessary for the Site to work and do not require your consent. Non-essential cookies, in particular advertising cookies, social media pixels, certain audience measurement cookies, and heatmap or session recording tools, are placed only with your consent where it is required.

On your first visit, a cookie management banner lets you accept, refuse or customize cookies. You can withdraw or change your consent at any time through the cookie management tool available on the Site.

To find out more about the cookies used, their purposes, their retention periods and how to manage your preferences, please see our Cookie Policy.

ARTICLE 12 – MARKETING COMMUNICATIONS

If you sign up to our newsletter, our marketing SMS or any other commercial communication, we will use the contact details you provide to send you offers, news, tips, new products or product recommendations.

If you are a prospect, these communications are based on your prior consent. If you are already a customer, we may send you communications about products similar to those you have already purchased, provided that you can object simply and free of charge.

You can unsubscribe at any time by clicking the unsubscribe link in our emails, by following the instructions in our SMS messages or by contacting us at info@larbredeschakras.com.

We do not pass your contact details on to partners for their own direct marketing without your prior consent where it is required.

ARTICLE 13 – CHANGES TO THE PRIVACY POLICY

We may amend this Privacy Policy to reflect legal, regulatory, technical or operational changes to the Site.

The applicable version is the one published on the Site on the date you consult it. In the event of a substantial change, we may inform you by email, through a banner on the Site or by any other appropriate means.