Privacy policy

Version of [date of update].

Data controller

POITOUT & CO (Maskeo), EURL, SIREN 978 615 433, 312 rue Jules Guesde, 59650 Villeneuve-d’Ascq, France, represented by Léo POITOUT, manager. Contact for any question about your data: contact@maskeo.com. Maskeo has not appointed a data protection officer (DPO); the manager is your contact.

Data collected

• When you order: email address, billing name and country, amount and content of the order, transaction ID. Card details are entered only on Stripe’s page: Maskeo never has access to them.
• When you contact customer service: your email address, your name if you give it, and the content of your messages.
• When you browse: technical data recorded by the host in its logs (IP address, date and time, page requested, browser), for security and proper operation of the website.

Maskeo does not create customer accounts and does not send newsletters.

Purposes and legal bases

• Performing the order (payment, sending and resending download links, guarantees): performance of the contract (GDPR article 6(1)(b)).
• Bookkeeping and tax obligations: legal obligation (article 6(1)(c)).
• Answering questions and complaints: performance of the contract or pre-contractual steps, and legitimate interest in good customer service (articles 6(1)(b) and 6(1)(f)).
• Preventing fraud and securing the website: legitimate interest (article 6(1)(f)).

Recipients

Your data is intended for POITOUT & CO and its service providers, each for its own task:

• Stripe Payments Europe, Limited (Ireland), for payment and fraud prevention. Stripe may process some data outside the European Union with the safeguards required by the GDPR (standard contractual clauses). See Stripe’s privacy policy.
• OVH SAS (France), for hosting the website and sending delivery emails.
• [Email provider used for contact@maskeo.com, if different from OVH].
• Administrative or judicial authorities, only where required by law.

Your data is never sold or rented.

Retention periods

• Order data and accounting records: 10 years from the end of the financial year (article L123-22 of the French Commercial Code).
• Customer service exchanges: [3 years] after the last exchange.
• Host’s technical logs: [12 months maximum].

Your rights

You have the right of access, rectification, erasure, restriction and objection, and the right to data portability, under the conditions of the GDPR. You may also give instructions on what happens to your data after your death.

To exercise these rights, write to contact@maskeo.com or by post to POITOUT & CO, 312 rue Jules Guesde, 59650 Villeneuve-d’Ascq, France. You will receive a reply within one month. Proof of identity may be requested if there is reasonable doubt about your identity.

If you believe your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the authority of your country of residence.

Cookies and local storage

maskeo.com does not set any advertising or analytics cookies and uses no tracking tools. It only stores in your browser (local storage), for the website to work:

• the content of your cart;
• your choice of light or dark display.

This information stays on your device and is not sent to Maskeo. It is strictly necessary for the service you request and therefore does not require consent. You can delete it at any time in your browser settings.

The payment page is hosted by Stripe (checkout.stripe.com), which uses its own cookies there, needed for payment and fraud prevention.

Security

The whole website is served over HTTPS. Download links are signed and only generated after payment has been verified with Stripe.