Privacy Policy

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR) and Law No. 78-17 of January 6, 1978, as amended, on information technology, data files, and civil liberties.

1. Data Controller

The data controller for personal data collected on the johya.com website is:

JOHYA, SAS, 44 Rue Rennequin, 75017 Paris

Contact: administratif@johya.com

2. Data Collected

In connection with your use of the website and any purchases you make, JOHYA may collect the following categories of data:

• Identification information: last name, first name, date of birth (if applicable)
• Contact information: mailing address, email address, phone number
• Order details: products purchased, amounts, order history
• Payment information: processed directly by the payment provider (JOHYA does not store credit card numbers)
• Connection data: IP address, logs, browsing data
• AML/CFT Data: For transactions subject to due diligence requirements, a copy of identification, proof of address, and proof of the source of funds

3. Purposes of the Processing

Data is collected for the following purposes:

• Order Management, Delivery, and Customer Service
• Customer Account Management
• Billing and Bookkeeping
• Compliance with legal obligations (accounting, anti-money laundering and counter-terrorism financing, taxation)
• Sending marketing information and the newsletter (subject to consent)
• Site Improvements and Usage Statistics
• Fighting Fraud

4. Legal Basis

The processing is based on the following legal grounds:

• Performance of the sales contract (Article 6.1.b of the GDPR) for order management
• Legal obligation (Article 6.1.c of the GDPR) regarding accounting, tax, and AML/CFT obligations
• Consent (Article 6.1.a of the GDPR) for the newsletter and certain non-essential cookies
• Legitimate interest (Article 6.1.f of the GDPR) for fraud prevention and website improvement

5. Recipients of the Data

The data collected is intended for JOHYA and may be shared with:

• Shopify International Limited, the website's hosting provider and e-commerce service provider
• Payment providers (Shopify Payments service providers)
• The carriers responsible for delivery
• JOHYA Accounting Firm
• The competent authorities in cases of legal obligation (TRACFIN, tax authorities, judicial authorities)

JOHYA does not transfer or sell personal data to third parties for commercial purposes.

6. Transfers Outside the European Union

Some service providers (notably Shopify) may need to process data outside the European Union. These transfers are subject to appropriate safeguards in accordance with Articles 44 et seq. of the GDPR (standard contractual clauses, adequacy decisions).

7. Shelf Life

Data is retained for the following periods:

• Order and billing data: 10 years from the end of the fiscal year (accounting requirement)
• Data for inactive customer accounts: 3 years from the last contact
• AML/CFT data: 5 years from the end of the business relationship
• Cookies: variable duration; see the Cookie Policy
• Prospecting data: 3 years from the prospect's last contact

8. Rights of Data Subjects

In accordance with Articles 15 through 22 of the GDPR, the Customer has the following rights:

• Right to Access One's Data
• Right to Correction
• Right to erasure (“right to be forgotten”), subject to legal retention obligations
• Right to Restriction of Processing
• Right to Data Portability
• Right to object, particularly to unsolicited sales calls
• The right to withdraw consent at any time when processing is based on consent
• The right to establish guidelines regarding the handling of one's data after death

These rights may be exercised by sending an email to administratif@johya.com, along with a copy of a valid ID if there is any doubt regarding the requester’s identity.

The Customer also has the right to file a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or via the website www.cnil.fr

9. Safety

JOHYA implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, disclosure, or unauthorized access.