Privacy policy

Last updated: 9 September 2026.

Your data and how we use it

DRAPEUR, a French single-shareholder simplified joint-stock company (SASU), is responsible for the use of your data: 27 avenue de Migron, 64200 Biarritz, France — contact@drapeur.com — 05 64 72 31 80.

We use your contact, order, payment and delivery details to handle your purchases, returns and customer service requests. This processing is necessary to fulfil your order. Required information is identified when collected; without it, we cannot provide the requested service. We also retain certain data to meet our accounting obligations and, on the basis of our legitimate interest, to defend our rights in the event of a dispute.

With your consent, we use your email address to send our newsletter through Shopify Email. You can unsubscribe at any time using the link in each message.

If you request a back-in-stock alert, your contact details are used through Kbite to notify you when the item becomes available. This request does not subscribe you to our newsletter. You can withdraw your consent and cancel an alert by writing to us.

Cookies and advertising

We use Google Analytics to measure website traffic, and Google Ads and Meta (Facebook and Instagram) to measure our campaigns and personalise advertising. These tools may process technical identifiers and information about your browsing and interactions with the store, including purchases. The Meta integration also exchanges events from our servers.

The privacy banner lets you accept, reject or choose cookie categories. Advertising and analytics trackers that require consent need your agreement; cookies essential to the cart and requested services are separate. You can withdraw your consent at any time. If you have difficulty changing your choices, contact us at contact@drapeur.com.

Shopify Network Intelligence is enabled: Shopify uses interaction data from our store and other merchants for its personalisation and advertising services. Its processing and available choices are described in its privacy policy and privacy portal.

Who receives your data?

Authorised Drapeur staff and our service providers access the data needed for their tasks: Shopify for the store and newsletters; your chosen payment providers, including PayPal and Scalapay; Chronopost for delivery; Fastoche for returns; Kbite for alerts; and Google and Meta for analytics and advertising. Authorities may also receive information where required by law.

Some international service providers process data outside the European Economic Area. Depending on the recipient, the relevant transfers are covered by an adequacy decision, standard contractual clauses or binding corporate rules. You can ask us for further details and a copy of the applicable safeguards. Kbite states that it hosts and processes data in the European Union in its data processing agreement.

How long is your data retained?

Data is retained according to the service concerned and the applicable obligations:

• Orders and customer service: during processing and follow-up, then only for relevant legal obligations or disputes. Accounting records are retained for ten years.
• Newsletter: until you unsubscribe or after three years without active contact.
• Back-in-stock alerts: according to the needs of the active service; you can ask us to delete them. Kbite also provides for deletion on request through Shopify.
• Google Analytics: two months for event data, fourteen months for user data and key events. New activity resets the user data retention period. These periods do not cover aggregated reports.

A deletion request does not remove data still required to meet a legal obligation or defend legal rights.

Your rights

You can request access, rectification, erasure, restriction and, where the conditions are met, portability of your data. You can object to processing based on our legitimate interest on grounds relating to your situation, and to direct marketing at any time. Withdrawing consent does not affect processing carried out previously.

Write to contact@drapeur.com or to our postal address above. We normally respond within one month; if a lawful extension is necessary, we will inform you. You can also lodge a complaint with the CNIL.