1. Data controller
The controller is Carla Coto, entrepreneur individuel (EI) under the French micro-enterprise regime, trading as The Never Ending Chapter, at 10 rue du Puits, 77185 Lognes, France. No Data Protection Officer has been appointed. Privacy requests are handled at theneverendingchapter@protonmail.com.
2. Data, purposes and legal bases
| Activity and data | Purpose | Legal basis |
|---|---|---|
| Orders: identity, contact, delivery and billing details, products, options, order and transaction data | Take payment, prepare, deliver and support the order; manage returns, refunds and guarantees | Performance of the sales contract; legal accounting, tax and consumer obligations |
| Payments, device and risk signals | Process payment, secure transactions and prevent fraud | Contract; legal obligations; legitimate interest in protecting the store and customers |
| Customer account and saved preferences | Operate the account and requested store functions | Performance of the requested service |
| Contact and customer-service messages | Answer requests, manage complaints and document responses | Steps requested by the person; contract; legitimate interest in handling and proving requests |
| Product choices and personalisation text | Produce and fulfil the selected item | Contract |
| Email and consent record for newsletters | Send launches, restocks and studio news | Consent, except where a valid legal exception separately applies |
| Review content, display name, order reference and verification data | Collect, verify, display and answer product reviews | Consent or legitimate interest, depending on the feature and law |
| Browser, device, IP address, cookie identifiers and browsing events | Operate and secure the site; remember basket, language and market; measure audiences or advertising where enabled | Requested service and legitimate interest for strictly necessary functions; consent for non-essential analytics or advertising where required |
3. Required and optional information
Required fields are needed to process the relevant order or request. Without them, we may be unable to complete checkout, deliver an order or answer. Newsletter registration, public reviews and non-essential cookies are optional.
4. Data sources
Most data comes directly from the customer. Technical data can be collected by the store, Shopify and enabled applications. Carriers and payment providers may return delivery, payment-status or fraud-prevention information.
5. Recipients and processors
Only people and providers needing data for a stated purpose receive it. Depending on the feature used, these include:
- Shopify: hosting, ecommerce, checkout, accounts, security and administration;
- payment providers shown at checkout: payment and fraud prevention;
- Sendcloud and selected carriers: labels, delivery and tracking;
- Judge.me: review widgets, management and enabled review invitations;
- Easify Options: product options and personalisation choices;
- Instafeed: Instagram content displayed on the store;
- Shopify Translate & Adapt: translated store content;
- Shopify Messaging: customer conversations and support;
- store-administration tools operated for The Never Ending Chapter;
- professional advisers, authorities or courts where legally required or needed for legal claims.
The installed service list is reviewed when an app or store feature is enabled, disabled or replaced. A provider receives only the data needed for the feature in which it is used.
6. International transfers
Shopify initially processes EEA customer data through Shopify International Limited in Ireland. Shopify affiliates and some enabled providers may also process data outside France or the EEA. Where required, transfers rely on an adequacy decision, approved standard contractual clauses or another safeguard recognised by applicable data-protection law. Information on Shopify transfers and subprocessors is available in Shopify's privacy and data-processing documentation.
7. Retention
| Data | Planned retention |
|---|---|
| Order, invoice and accounting records | For fulfilment and support, then in restricted archive; accounting records and invoices are normally retained for 10 years from the end of the relevant financial year. |
| Customer-service and commercial correspondence | For the time needed to manage the request, then where relevant in restricted archive for up to five years or the longer period tied to an accounting record or claim. |
| Customer account | While the account is used, then deleted or anonymised after three years without meaningful activity or earlier on a valid request, except for data retained in restricted legal archives. |
| Newsletter and marketing data | Until consent is withdrawn, or up to three years from the last meaningful contact or end of the customer relationship, then renew consent or remove from active marketing. |
| Marketing opt-out record | The minimum data needed to respect an objection may be kept for at least three years. |
| Cookie choices | Generally six months before asking again, subject to consent-tool settings. |
| Published reviews | While the review remains relevant and published. If removed, the minimum data needed to document moderation, consent or a dispute may be kept in restricted form for the applicable limitation period. |
Data is deleted or anonymised when no longer required unless law or a claim requires restricted retention.
8. Rights
Subject to legal conditions, individuals may request access, correction, deletion, restriction, portability or objection. Consent can be withdrawn without affecting prior lawful processing. Marketing emails include unsubscribe. Cookie consent can be changed through Cookie preferences in the footer.
To exercise a right, email theneverendingchapter@protonmail.com. We may request information needed to confirm identity. A complaint may be made to the CNIL or local authority.
9. Automated decisions
The Never Ending Chapter does not itself make a decision producing legal or similarly significant effects solely through automated processing. Shopify and payment providers may use automated risk signals to block, delay or request review of a suspected fraudulent transaction. A customer may contact us to request human review or further information where applicable.
10. Security and updates
Reasonable technical and organisational security measures are used. This policy will be updated when practices, providers or legal obligations change.
Last updated: 24 September 2026.