Privacy Policy

Last updated: January 2025

1. Controller

Dukkan SAS is the data controller for personal data processed through this platform. Contact: privacy@dukkan.shop

2. Data We Collect

• Account data: name, email address, password (hashed), preferred language.
• Order data: shipping address, billing address, purchased items.
• Seller data: SIRET number, VAT number, bank account (via Stripe Connect).
• Usage data: pages visited, product views, search queries.
• Technical data: IP address, browser type, device information.

3. Legal Bases (GDPR)

• Contract performance — processing orders, payouts.
• Legitimate interest — fraud prevention, platform security.
• Legal obligation — tax records, SIRET verification.
• Consent — marketing emails, analytics cookies.

4. Data Sharing

We share data with: Stripe (payment processing), OVHcloud (EU hosting), Resend (transactional emails), Sentry (error monitoring). We do not sell your data.

5. Data Retention

Account data is retained while your account is active. Order data is retained for 7 years (French tax law). You may request deletion at any time.

6. Your Rights

Under GDPR you have the right to: access, rectify, erase, restrict, and port your data. To exercise these rights, email privacy@dukkan.shop or use the account settings page.

7. Cookies

We use necessary cookies for authentication and cart persistence. Analytics and marketing cookies require your consent, which you can manage at any time via the cookie banner.

8. International Transfers

All data is hosted on OVHcloud servers within the European Union (Gravelines, France). No international transfers outside the EEA.

9. Changes

We will notify you by email of material changes to this policy.