Privacy Policy

This privacy policy describes how ORALIVA collects, uses, stores, and protects users' personal data when they visit the [SITE URL] website, create an account, place an order, or communicate with customer service.

1. Data Controller

The data controller for personal data is:

Name or Company Name: [COMPANY OR SOLE PROPRIETOR NAME]
Trade Name: ORALIVA
Legal Form: [LEGAL FORM]
Registered Office Address: [FULL ADDRESS]
SIREN/SIRET number or registration number: [NUMBER]
Email address: [CONTACT EMAIL ADDRESS]
Phone: [PHONE NUMBER]

If applicable, the Data Protection Officer can be contacted at the following address:

[DPO EMAIL ADDRESS]

Delete this last mention if no Data Protection Officer has been appointed.

2. Personal Data Collected

Depending on how the site is used, ORALIVA may collect the following categories of data.

Identification Data

• First and last name
• Postal address
• Billing address
• Delivery address
• Email address
• Phone number
• Customer account ID

Order-related data

• Products ordered
• Order amount
• Promotions used
• Order date and number
• Payment status
• Delivery status and tracking number
• Order history
• Return or refund requests

Payment data

Payments are processed by [SHOPIFY PAYMENTS / STRIPE / PAYPAL / OTHER PROVIDER].

ORALIVA generally does not receive the full credit card number or its security code. The data necessary for payment is processed directly by the payment provider, in accordance with its own terms and privacy policies.

This section must be verified according to the payment system actually used.

Browsing and Technical Data

• IP address
• Device type
• Browser used
• Operating system
• Pages viewed
• Date and time of visits
• Source of visit
• Actions performed on the site
• Cookie identifiers or similar technologies

Communication Data

ORALIVA may retain information communicated during:

• a request addressed to customer service;
• an exchange by email or form;
• a complaint;
• a return request;
• the publication of a review;
• newsletter subscription.

ORALIVA does not ask customers to provide medical information or health data. Users are asked not to transmit such information in forms or messages addressed to customer service.

3. Data Sources

Data is primarily collected:

• directly from the user;
• when creating an account;
• when placing an order;
• when subscribing to commercial communications;
• during an exchange with customer service;
• automatically during browsing, through cookies or similar technologies;
• from providers involved in payment, delivery, or fraud prevention.

4. Purposes and Legal Bases

Data may be processed for the following purposes.

Order Management

Data is used to:

• record and confirm orders;
• collect payments;
• prepare and ship products;
• transmit tracking information;
• manage returns, refunds, and warranties;
• communicate with the customer about their order.

Legal basis: performance of the contract concluded with the customer.

Customer Account Management

Data is used to create, secure, and administer the customer account, display order history, and facilitate future purchases.

Legal basis: performance of the contract or implementation of pre-contractual measures.

Customer Service

Data is used to answer questions, process requests, resolve issues, and manage complaints.

Legal basis: performance of the contract or ORALIVA's legitimate interest in providing quality customer service.

Invoicing and Accounting Obligations

Data is used to issue invoices, maintain accounting records, and comply with tax, administrative, and legal obligations.

Legal basis: compliance with a legal obligation.

Security and Fraud Prevention

Data may be used to:

• secure the site;
• detect unusual activities;
• prevent fraud and abuse;
• protect customer accounts;
• establish, exercise, or defend ORALIVA's rights.

Legal basis: ORALIVA's legitimate interest in protecting its business, customers, and website.

Newsletter and Commercial Communications

Subject to applicable rules, ORALIVA may use the customer's email address or phone number to send:

• news;
• commercial offers;
• advice related to the ORALIVA routine;
• information on new products.

Legal basis: consent of the person or, where regulations allow, legitimate interest regarding similar products offered to existing customers.

Each electronic communication contains a simple means to unsubscribe. When consent is used as a legal basis, it must result from a free, specific, informed, and unambiguous action, for example, a dedicated unchecked box.

Customer Reviews and Satisfaction Surveys

Data may be used to solicit, verify, publish, and manage reviews left after an order.

Legal basis: ORALIVA's legitimate interest in collecting customer feedback or the person's consent, depending on the system used.

Website Analysis and Improvement

Browsing data may be used to measure audience, understand website usage, correct technical problems, and improve content and user experience.

Legal basis: consent when necessary or legitimate interest when the tool used legally benefits from an exemption.

5. Mandatory Nature of Data

Certain information is necessary to process an order, including:

• name;
• delivery address;
• email address;
• information necessary for payment.

If this data is not provided, ORALIVA may be unable to validate, deliver, or track the order.

Mandatory fields must be clearly identified on forms.

6. Data Recipients

Data may be transmitted, only when necessary, to the following categories of recipients:

• authorized ORALIVA personnel;
• e-commerce platform, notably Shopify;
• payment provider;
• bank or financial institution;
• carriers and logistics providers;
• hosting provider;
• email and newsletter sending service;
• customer service solution;
• review management provider;
• audience analysis provider;
• advertising platforms, subject to required consent;
• security and fraud prevention providers;
• legal, accounting, or administrative advisors;
• public authorities when required by law.

List of main providers used:

• E-commerce platform: [SHOPIFY / OTHER]
• Payment: [NAME]
• Delivery: [CARRIER NAMES]
• Email and newsletter: [NAME]
• Audience analysis: [NAME]
• Advertising: [META / GOOGLE / TIKTOK / OTHER]
• Customer reviews: [NAME]
• Customer service: [NAME]

ORALIVA requires its providers to process data in accordance with agreed instructions and applicable confidentiality and security requirements.

To be kept only if accurate: ORALIVA does not sell or rent its customers' personal data to third parties.

7. International Transfers

Certain providers may process or host data outside France or the European Economic Area.

When such transfers occur, ORALIVA ensures that they are based on a mechanism recognized by applicable regulations, including:

• an adequacy decision;
• standard contractual clauses approved by the European Commission;
• or any other valid guarantee.

The data subject can request additional information on these guarantees by contacting [EMAIL ADDRESS].

8. Retention periods

Data is kept only for the period necessary for the purpose for which it was collected, and then may be archived when required by law or to manage any claims. The data controller must define a retention period or criteria for each category of data.

For information:

The CNIL notably cites a ten-year retention period for data necessary for accounting and generally recommends three years after the business relationship or the last contact for prospecting. These durations must be adapted to the company's actual activities and obligations.

9. Cookies and similar technologies

The site may use cookies and similar technologies to:

• ensure the shopping cart's functionality;
• remember user choices;
• secure the connection;
• measure audience;
• personalize the experience;
• analyze site performance;
• offer personalized advertisements.

Cookies strictly necessary for the site's operation can be placed without consent when they are essential for the expressly requested service.

Measurement, personalization, or advertising cookies that do not benefit from an exemption are only placed after user consent. Refusal must be as accessible as acceptance, and the user must be able to change their choice later.

Preferences can be changed at any time from:

[LINK OR "MANAGE MY COOKIES" BUTTON]

The CNIL generally considers a six-month period to be appropriate for remembering the choice to accept or refuse cookies.

10. Data security

ORALIVA implements appropriate technical and organizational measures to protect personal data against:

• unauthorized access;
• loss;
• alteration;
• disclosure;
• destruction;
• fraudulent use.

These measures may include limited access, secure passwords, communication encryption, access monitoring, and the use of specialized service providers.

Since no computer system can guarantee absolute security, users are advised to protect their identifiers and never communicate their password to a third party.

11. Data subjects' rights

Under the conditions provided for by regulations, each person notably has:

• a right of access to their data;
• a right to rectification;
• a right to erasure;
• a right to restriction of processing;
• a right to object;
• a right to data portability;
• the right to withdraw their consent at any time;
• the right to define directives concerning the fate of their data after their death, where French law applies;
• the right to lodge a complaint with the competent supervisory authority.

The withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. Articles 13 to 22 of the GDPR notably govern the information and rights of data subjects.

12. Exercise of rights

To exercise their rights, the person can send a request to:

Email address: [EMAIL ADDRESS]
Postal address: [FULL ADDRESS]

The request must sufficiently specify its purpose to allow it to be processed.

When necessary to avoid identity theft, ORALIVA may request additional information to verify the applicant's identity. Only information strictly necessary for this verification will be requested.

13. Complaint to the CNIL

When the data controller is subject to French or European law, the person may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (French Data Protection Authority) if they believe their rights are not being respected.

Before taking this step, they are invited to contact ORALIVA to seek a solution to their request.

14. Automated decisions

Choose one of the following two versions:

Version A — no automated decisions

ORALIVA does not make any decisions producing legal effects or significantly affecting a person based solely on automated processing.

Version B — use of an automated system

ORALIVA may use an automated system for [SPECIFY THE PURPOSE: FRAUD PREVENTION, ORDER ANALYSIS, ETC.].

The general logic, possible consequences, and means of requesting human intervention are as follows:

[TO BE COMPLETED]

15. Data relating to minors

The site does not knowingly aim to collect personal data from minors without the authorization required by applicable regulations.

If a parent or legal guardian believes that a minor has submitted data without authorization, they can request its deletion at the following address:

[EMAIL ADDRESS]

16. Links to third-party sites

The site may contain links to sites, applications or services operated by third parties.

ORALIVA is not responsible for the privacy practices of these third parties. Users are invited to consult their privacy policy before providing them with personal data.

17. Policy modification

ORALIVA may modify this policy to take into account:

• regulatory developments;
• service modifications;
• the addition of a new service provider;
• the installation of new tools or cookies;
• a change in the processing carried out.

The date of the last update is indicated at the bottom of the page.

In the event of significant changes, information may be displayed on the site or sent to the persons concerned.

18. Contact

For any questions regarding this policy or the use of personal data:

ORALIVA
Email: [EMAIL ADDRESS]
Address: [POSTAL ADDRESS]
Phone: [PHONE NUMBER]