Privacy policy

Who is responsible

The controller of the site's data is the publisher named in the legal notice. For an order, the shop concerned also processes the data needed for delivery, for its own purposes.

Data we collect

• Account: name, email, phone. The password is stored in a protected form, never in plain text.
• Order: name, delivery address, phone, order content, chosen payment method.
• My Mall: shops and products you looked at, only if you accept.
• Location: only if you accept, to suggest the nearest town.
• Consent: the date of your choice and the version of the text shown, to keep proof of your agreement.
• Operation: sign-in session, basket, language and light or dark theme.

Why we use your data

• To run your account and session: needed for the service.
• To process your orders and delivery: needed to perform the sale contract.
• To keep My Mall history and use your location: only with your consent.
• To keep the site secure and prevent fraud: our legitimate interest, respecting your rights.

Who receives your data

• The shops concerned by your order.
• Our technical providers: hosting, image storage, messages, payment. They only access what they need and must protect it.
• The authorities, when the law requires it.

We do not sell your data.

Where your data is stored

Data is hosted on servers chosen by the platform. If a provider is outside your country, the transfer is governed by the applicable law. [Hosting countries to be stated.]

How long we keep data

• Account: as long as the account is active. Data is deleted after closure. [Period to be set.]
• Orders: the period required by accounting and legal obligations. [Period to be set.]
• My Mall: until you withdraw your consent or delete your account.
• Proof of consent: for the duration of the relationship, then as the law requires. [Period to be set.]

Your rights

You can ask for:

• access to your data;
• its correction;
• its deletion;
• a copy in a machine-readable format;
• to object to some processing.

You can withdraw your consent at any time from "Manage cookies". Withdrawal does not affect processing done before.

How to exercise your rights

Write to the contact address given in the legal notice. We verify your identity before replying, and reply within the time limits set by the law.

Complaints

You can contact the data protection authority of your country. In Tunisia, this is the Instance nationale de protection des données personnelles (INPDP).

Security

We protect data with technical measures: secure connection, protected passwords, access limited to those who need it. No system is completely safe. In case of a serious breach, we inform you as the law requires.

Minors

The site is not intended for people under 18 without the consent of their parents or legal guardian.

Legal framework

In Tunisia, data is processed in line with organic law 2004-63 on the protection of personal data. For other countries, local rules apply. [To be set after legal review.]

Changes

We may update this policy. For a significant change, we ask for your consent again where the law requires it.