Privacy policy

Last Updated: July 17, 2026
This Privacy Policy complies with the French RGPD (Règlement Général sur la Protection des Données) and the French Informatique et Libertés Act of 6 January 1978, supervised by the CNIL (Commission nationale de l’informatique et des libertés). It explains how Xyrelis (“we”, “us”, “our”) collects, stores, processes and shares your personal data when you browse or order via www.Xyrelis.shop  We act as the official Data Controller for all personal information you submit to our website. This policy applies to all site visitors, account holders and customers based in France or the EU.

1. Personal Data We Collect
We only gather data strictly necessary to operate our store:
- Order & Contact Data: Full name, billing address, delivery address, French postal code, email address, phone number, full order history
- Account Data: Username, encrypted password, saved delivery addresses linked to your account
- Payment Data: Billing information required to process payments. We never store full debit/credit card numbers; all payment processing is handled by Shopify and ACPR-regulated payment providers.
- Automatically Collected Data: IP address, browser type, device info, site navigation records, cookie and analytics tracking data
- Marketing Data: Newsletter subscription status, product reviews, customer support messages you send

2. Legal Bases for Data Processing (RGPD Compliance)
We process personal data only under lawful grounds defined by RGPD:
- Performance of a Contract: Process orders, arrange delivery, handle returns, refunds and all post-purchase customer service
- Legitimate Interest: Secure website operation, prevent payment fraud, send order-related transaction notifications, optimise site experience by analysing visitor behaviour
- Consent: Send marketing newsletters and targeted ads only after your explicit opt-in; you may withdraw consent at any time
- Legal Obligation: Retain accounting records to meet French tax and commercial law requirements, respond to official judicial or CNIL requests

3. Cookies & Tracking Technologies (CNIL Cookie Rules)
Our website uses functional, analytical and marketing cookies:
- Necessary cookies: Mandatory for shopping cart, checkout and account login; cannot be disabled
- Analytical & performance cookies: Used to measure website traffic and user experience (opt-out available)
- Marketing cookies: Activated only with your explicit consent via the site cookie banner
You may manage or reject non-essential cookies via browser settings. Disabling cookies may break partial website functions.

4. Who We Share Your Data With
We never sell your personal data for commercial marketing. Data is shared only with trusted third parties with binding RGPD protection clauses:
- Shopify: E-commerce platform for store hosting, order management and checkout
- ACPR-regulated payment service providers: Complete payment transactions
- French couriers (Colissimo, Chronopost, DPD France): Deliver your parcels
- Analytics & advertising tools (Google, Pinterest, Meta): Only if you agreed to marketing cookies
- Official regulatory authorities: CNIL, tax office, courts, when legally required

5. International Data Transfers Outside EU
If service providers store data outside the EEA, we apply RGPD Standard Contractual Clauses to guarantee equivalent data protection as required by CNIL guidance.

6. Personal Data Retention Periods
- Order transaction data: Retained for 6 full years to comply with French tax and accounting legal requirements
- Active customer account data: Kept until you submit a formal deletion request (tax records will still be stored for 6 years)
- Marketing contact information: Saved until you unsubscribe or withdraw marketing consent

7. Your RGPD Data Subject Rights
All users in France/EU hold the following rights. Submit requests via hello@Xyrelis.shop; we reply within 1 calendar month as RGPD required:
1. Right to access: Request a full copy of all personal data we store about you
2. Right to rectification: Correct outdated, wrong or incomplete personal information
3. Right to erasure (“right to be forgotten”): Request deletion of your personal records (excluding mandatory tax archives)
4. Right to restriction of processing: Suspend data processing under specific legal conditions
5. Right to data portability: Receive your data in machine-readable format or request transfer to another data controller
6. Right to object: Refuse processing based on legitimate interests or direct marketing
7. Right to withdraw consent: Revoke any previously agreed marketing tracking permission
If you believe we breach RGPD rules, you may file a complaint directly with the CNIL.

8. Data Security
We deploy industry-standard encrypted checkout, access control and secure servers to protect personal data. No online transmission is 100% secure, but we follow all CNIL-recommended security standards.

9. Children’s Privacy
Our website is intended for users aged 18 and above (French age of majority). We do not knowingly collect personal data from minors under 18. If we discover minor data without parental consent, we will erase all related records immediately upon notification.

10. Changes to This Privacy Policy
We may update this policy to match new French laws or business adjustments. Revised versions will be published with an updated Last Updated date. Continued site use after updates means you accept revised terms.

11. Contact Information
Brand Name: Xyrelis
Website: www.Xyrelis.shop
Email: hello@Xyrelis.shop
Business Address: 44 Avenue du Prado, Marseille Provence-Alpes-Côte d'Azur 57459，France
Phone: +33 772067263
Support Hours (CET / CEST French Local Time):
Monday – Saturday: 09:00 – 18:00
Sunday & French Public Holidays: Closed
We aim to respond to all privacy enquiries and data requests within 24–48 working days.