Privacy policy

Updated on 30 September 2026.

This page explains what data we collect when you visit or place an order on canecaraz.com, why we collect it, who we share it with, how long we keep it and how to exercise your rights. We only collect what we need and we never sell your data.

Who is responsible for your data

SAS Cane Caraz, 38 rue de Berri, 75008 Paris, France (RCS Paris 989 139 548), is the controller of your data. For any questions: holla@canecaraz.com.

The data we collect

When you place an order: first name, surname, delivery and billing addresses, email, phone number if you provide it (useful for the carrier), items ordered and your order history.
When you pay: payment is handled directly by our payment providers. We never see your card number; we only receive confirmation of the payment and the method used.
When you sign up for drops: your email address and the date you signed up.
When you write to us: the content of your messages and any information you attach.
When you browse: technical information (device type, browser, pages viewed, IP address) and, only if you accept them, analytics and advertising cookies.

Why we use it

To process and deliver your order, handle returns, exchanges and refunds, and keep you updated on its progress. Legal basis: performance of the sales contract.
To keep our accounts and meet our legal obligations (invoices, tax obligations). Legal basis: legal obligation.
To send you our drops and your welcome code if you have signed up. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in every email.
To remind you about a basket you left behind with a single email. Legal basis: our legitimate interest; you can object at any time.
To measure site traffic and show you relevant ads on other websites and social networks. Legal basis: your consent, given or refused in the cookie banner.
To keep the site secure and prevent fraud. Legal basis: our legitimate interest.
To reply to your messages. Legal basis: performance of the contract or our legitimate interest.

Who we share it with

Only with the service providers that help us run the shop, and only what they need:

Shopify, which hosts the site and the shop;
our payment providers (Shopify Payments, PayPal, Klarna, Apple Pay, Shop Pay);
our carriers (La Poste – Colissimo, and where applicable our shipping platform), which receive your name, address and delivery details;
our tool for managing pre-orders and back-in-stock alerts;
Meta (Facebook, Instagram) and Google, only if you have accepted analytics or advertising cookies;
the authorities, if required by law.

Some of these providers are located outside the European Union, notably in Canada and the United States. These transfers are covered by the safeguards provided for by the GDPR: adequacy decisions of the European Commission (including the Data Privacy Framework for the United States) or standard contractual clauses.

How long we keep it

Orders and invoices: 10 years, as required by the French Commercial Code.
Customer account: until it is deleted, or 3 years after your last activity.
Drops sign-up: until you unsubscribe, or 3 years after your last contact with us.
Messages to customer service: 3 years after our last exchange.
Your cookie choices: 12 months, after which we ask you again.

Cookies

Some cookies are essential for the site to work (basket, payment, security, remembering your language and your choices): they do not require your consent. Analytics and advertising cookies are only set if you accept them. Refusing is as easy as accepting, and you can change your mind at any time using the “Cookies” link at the bottom of every page.

Your rights

At any time, you can:

access your data and get a copy of it;
have it corrected or deleted;
restrict its use or object to it, in particular for any marketing;
receive it in a readable format so you can pass it on to another service;
withdraw your consent, without affecting what was done before;
give instructions on what should happen to your data after your death.

Write to us at holla@canecaraz.com. We will reply within one month and may ask you to confirm your identity. If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the data protection authority in your country.

Minors

Our shop is intended for adults. A minor may only place an order with their parents’ consent. If you believe a minor has sent us their data without this consent, write to us and we will delete it.

Security

The site is fully secure (HTTPS), payments are encrypted and handled by certified providers, and only the people who need it have access to your data.

Changes

We may update this policy, for example if we add a new service. The update date at the top of this page is the one that applies. If there is a significant change, we will let you know.