Données personnelles
Personal data
Written to be read rather than to be got past. It covers what we collect, what for, on what legal basis, how long we keep it, who else sees it, and what you can require of us. It follows Regulation (EU) 2016/679 and the French Data Protection Act.
Who is responsible
- Controller
- CHANA MOD, 41 Rue Sedaine, 75011 Paris, France
- Contact for data questions
- support@chanamod.space
- Data protection officer
- None appointed. The company’s size and the nature of its processing do not require one under article 37 GDPR. Write to the address above and a person, not a queue, will answer.
The principle we work to
We ask for the minimum needed to do the thing you asked for, and nothing beyond it. We do not build profiles, we do not score customers, we take no automated decision that produces legal effects, and we do not sell or rent data to anyone, ever.
What we collect, why, and for how long
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Taking and delivering an order | Name, email, telephone, delivery address, order contents and amount | Performance of the contract (art. 6.1.b GDPR) | Order records are kept for 10 years, as French commercial law requires for accounting documents |
| Customer service and after-sales | Name, email, telephone, order reference, the content of your message | Performance of the contract and our legitimate interest in answering you (art. 6.1.b and 6.1.f) | 3 years from our last exchange |
| Size advice | Height, bust, waist, hip, the size you usually wear, how you like things to sit, email | Your consent, given when you send the form (art. 6.1.a) | 6 months, then deleted. Erased sooner on request |
| Release notifications | Email address only | Your consent, withdrawable from any message (art. 6.1.a) | Until you unsubscribe, and for 3 years after the last interaction |
| Meeting accounting and tax obligations | Invoice details | Legal obligation (art. 6.1.c) | 10 years |
| Preventing fraud on orders | Order and delivery details, technical connection data | Our legitimate interest in not being defrauded (art. 6.1.f) | 13 months |
A word about the size advice form
Height, bust, waist and hip are personal data about your body, and we treat them as the most sensitive thing on this list. They are used to answer one question — which size we would cut for you — and for nothing else. They are never attached to your order record, never used for any kind of segmentation, and are deleted after six months whether or not you buy anything. You can have them erased immediately by asking.
Payment data
We never see, receive or store your card number, expiry date or security code. Those are entered on the secured page of our payment service provider, which is subject to the PCI DSS standard. What reaches us is the outcome of the transaction and the last four digits for reconciliation.
Who else sees your data
- The carrier, for the delivery address and telephone number, so the parcel can be delivered.
- Our payment service provider, for the transaction. Configured at deployment and bound by a data processing agreement.
- Our hosting provider, Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States, which operates the servers this site runs on.
- Our accountant, for invoices, under a professional duty of confidentiality.
- A public authority, where the law requires us to disclose something.
Each processor acts on our instructions only, under a contract meeting article 28 GDPR. Where a processor operates outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses; you can ask us for a copy.
Your rights
Under articles 15 to 22 GDPR you may ask us at any time to:
- Access the data we hold about you, and receive a copy of it.
- Correct anything inaccurate or incomplete.
- Erase it, where we no longer need it for the purpose it was collected for and no legal retention period applies.
- Restrict our use of it while a dispute about its accuracy or our basis is resolved.
- Receive it in a portable form, in a structured, commonly used, machine-readable format, or have it sent directly to another controller.
- Object to processing based on our legitimate interest, on grounds relating to your particular situation.
- Withdraw consent at any time, where consent is the basis. Withdrawing it does not affect what we did lawfully beforehand.
- Give directions about what happens to your data after your death, under article 85 of the French Data Protection Act.
Write to support@chanamod.space or to 41 Rue Sedaine, 75011 Paris, France. We reply within one month. If a request is unusually complex we may extend that by two months and will tell you why within the first month. There is no charge. We may ask for proof of identity only where we have real doubt about who is asking.
Complaining to the regulator
If you are not satisfied with how we have handled your data or your request, you have the right to lodge a complaint with the supervisory authority. In France that is the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — https://www.cnil.fr. You may also complain to the authority in the EU country where you live or work. You do not need our agreement, and you do not have to contact us first.
Security
The site is served over HTTPS throughout. Access to order data is limited to the people who need it to prepare and deliver orders. Where a personal data breach is likely to result in a risk to your rights, we notify the CNIL within 72 hours and inform you directly where the risk is high.
Cookies
Cookies and similar technologies are covered separately on the cookies page, where refusing is exactly as easy as accepting and nothing beyond the strictly necessary is set before you choose.
Children
This shop is intended for adults. We do not knowingly collect data from anyone under 15, and orders must be placed by a person with the capacity to contract.
Changes
If this policy changes materially we will say so on this page and, where the change affects processing based on your consent, ask you again.
Last updated 12 August 2026.