Privacy policy

1. Preamble

Young & Eco protects your personal data with the same care as your skin.

Our data processing complies strictly with:

The General Data Protection Regulation (GDPR) — EU Regulation 2016/679
The French Data Protection Act as amended (Law No. 78-17 of January 6, 1978)
The ePrivacy Directive (Directive 2002/58/EC)
Applicable international standards: PIPEDA (Canada), CCPA (California), UK GDPR (United Kingdom)

Our principles: data minimization, transparency, security and user control.

2. Data Controller

JOIE DE VIVRE (trading name: YOUNG & ECO)

Legal form: Simplified Joint Stock Company (SAS)

Company registration: Nanterre 991 273 772

Registered office: 138 Avenue Victor Hugo 75016 Paris, France

VAT number: FR48991273772

Data Protection Contact:

📧 privacy@young-eco.com

3. Data Collected and Purposes

We collect only the necessary data to provide our services.

Types of Data Collected

Identity data:

Last name, first name, title

Contact data:

Email address
Phone number
Complete postal address

Connection and browsing data:

IP address
Cookies and session identifiers
Pages viewed, visit duration
Browser type and device used

Order data:

Purchase history
Shopping cart content
Product preferences

Payment data:

Bank details (managed by PCI-DSS certified provider)
Important: Young & Eco never stores your bank details

Customer service data:

Email exchanges and support tickets
Complaints and requests
Information provided for assistance

Processing Purposes

Contractual purposes:

Processing and tracking your orders
Product delivery
Invoicing and payment
Managing your customer account
After-sales service and complaint management
Returns and refunds management

Legal purposes:

Invoice retention (accounting obligation)
Fraud and money laundering prevention
Response to legal requests

Marketing purposes (with consent):

Sending newsletters and personalized offers
Product recommendations
Loyalty program

Technical purposes:

Website security and fraud prevention
User experience improvement
Anonymized traffic statistics

4. Legal Basis and Retention

Legal Basis for Processing

In accordance with Article 6 of the GDPR, our processing is based on:

Contract performance (art. 6.1.b): Orders, delivery, invoicing
Consent (art. 6.1.a): Marketing, non-essential cookies
Legitimate interest (art. 6.1.f): Security, fraud prevention, service improvement
Legal obligation (art. 6.1.c): Invoice retention, anti-money laundering

Retention Periods

Data Type	Duration	Legal Basis
Invoicing data	10 years	French Commercial Code art. L123-22
Order data	5 years	Legal guarantee of conformity
Customer service data	2 years after last interaction	CNIL best practices
Active customer account	Relationship duration + 3 years	Commercial limitation period
Inactive customer account	3 years without login → deletion	CNIL recommendation
Cookies	13 months maximum	CNIL deliberation 2020
Server logs (IP)	12 months maximum	LCEN
Newsletter (prospect)	3 years after last contact	CNIL recommendation

After these periods: Data is permanently deleted or anonymized.

5. Sharing and International Transfers

Data Recipients

Your data may be shared with GDPR processors (trusted service providers):

Categories of providers:

Secure payment (Stripe, PayPal)
Logistics and delivery (carriers)
Web hosting (Shopify)
Email marketing
Analytics and statistics

Guarantees: All our providers are bound by a Data Processing Agreement (DPA) compliant with Article 28 of the GDPR.

Transfers Outside the European Union

Principle: Your data is hosted and processed primarily within the European Union.

Transfers outside the EU: Some providers may transfer data to:

United States: Google (Analytics), Meta (Facebook/Instagram ads), Stripe (payment)
Other countries: Depending on the providers used

Safeguards in place:

Standard Contractual Clauses (SCC) from the European Commission (decision 2021/914)
Adequacy decisions: United Kingdom, Switzerland, Canada, Japan
Additional security measures: Encryption, pseudonymization, IP anonymization

Information: You can obtain a copy of these safeguards by writing to privacy@young-eco.com

6. Your Rights

In accordance with the GDPR (articles 15 to 22) and the French Data Protection Act, you have the following rights:

List of Your Rights

Right of access (art. 15): Obtain a copy of your personal data
Right to rectification (art. 16): Correct inaccurate or incomplete information
Right to erasure (art. 17): Request deletion of your data (except legal obligations)
Right to object (art. 21): Refuse processing (especially marketing)
Right to restriction (art. 18): Temporarily block processing
Right to data portability (art. 20): Retrieve your data in a structured format (CSV, JSON)
Right to withdraw consent (art. 7.3): Withdraw your agreement at any time

How to Exercise Your Rights

By email (recommended):

📧 privacy@young-eco.com

Subject: "Exercise of my GDPR rights"

Attach: Copy of ID (for verification)

By postal mail:

JOIE DE VIVRE (YOUNG & ECO)

Data Protection Department

138 Avenue Victor Hugo 75016 Paris, France

Response time: 1 month maximum (art. 12.3 GDPR)

Free of charge: Exercising your rights is free.

Right to Lodge a Complaint

With the CNIL (supervisory authority):

If you believe your rights are not being respected:

🌐 Online: www.cnil.fr

📮 By mail:

CNIL

3 Place de Fontenoy, TSA 80715

75334 Paris Cedex 07, France

Legal remedy:

In accordance with Article 79 of the GDPR, you have the right to an effective judicial remedy before competent courts, in addition to your right to lodge a complaint with the CNIL.

7. Processing Register

In accordance with Article 30 of the GDPR, JOIE DE VIVRE (YOUNG & ECO) maintains a register of processing activities documenting:

The nature of data processed
The purposes of each processing
Retention periods
Data recipients
Transfers outside the EU (if applicable)

Available upon motivated request: privacy@young-eco.com

8. Server Logs and Connection Data

Server logs (IP addresses, connection date/time, pages viewed) are kept for a maximum period of 12 months, in accordance with the French Law on Confidence in the Digital Economy (LCEN).

Purposes: Website security, fraud prevention, legal obligations (judicial requests).

9. Data Security

In accordance with Article 32 of the GDPR, we implement appropriate technical and organizational measures to protect your data:

Technical measures:

SSL/TLS encryption (HTTPS) on all pages
Secure servers: European hosting, ISO 27001 certified datacenters
Strict access control: Strong authentication, limited access
Encrypted daily backups
Firewall and intrusion prevention: Protection against cyberattacks

Organizational measures:

GDPR training for employees
Incident alert procedures
CNIL notification within 72 hours in case of data breach (art. 33 GDPR)
Notification to data subjects if high risk (art. 34 GDPR)

Secure payments:

We never store your bank details. Transactions are handled by PCI-DSS certified providers (Stripe, PayPal). Your bank details are tokenized and never transmitted to Young & Eco.

10. Cookies and Similar Technologies

In accordance with the ePrivacy Directive and CNIL deliberation No. 2020-091, we use cookies.

Types of Cookies

Category	Purpose	Duration	Consent
Essential	Website functionality (cart, login, security)	Session or 12 months	❌ Not required
Analytics	Anonymized traffic statistics (Google Analytics)	13 months	✅ Required
Marketing	Personalized advertising (Meta, Google Ads)	13 months	✅ Required

Managing Your Preferences

Accept or refuse: Via the cookie banner on your first visit

Change your choices: Cookie settings (footer) or browser settings

Refuse cookies: Refusing essential cookies may affect website functionality.

11. Automated Assistance Service

Our online assistance service collects only the information necessary to handle your request.

Data collected:

Messages exchanged
Conversation context (products viewed)
Timestamps

Guarantees:

Confidential and secure exchanges
Storage Europe only
No commercial profiling
Human contact available at any time

Retention: 12 months for service improvement

Legal basis: Legitimate interest (customer service improvement)

12. Protection of Minors

The website is not intended for persons under 15 years of age (in accordance with Article 8 of the GDPR).

In case of accidental collection, parents can request immediate deletion via privacy@young-eco.com (deletion within 48 hours).

13. Policy Updates

The current version is the one published online. Substantial changes will be notified by email and dated.

Current version: v2.0 — March 18, 2026

Previous versions: Available upon request

14. Contact

For any questions regarding this policy or exercising your rights:

📧 Email: privacy@young-eco.com

📮 Mail: JOIE DE VIVRE (YOUNG & ECO), Data Protection Department, 138 Avenue Victor Hugo 75016 Paris, France

Response time: 48 business hours (except GDPR rights exercise: 1 month maximum)

15. Summary of Your Rights (Quick Reference)

You want to...	Your right	How to do it
Know what data we have about you	Right of access	privacy@young-eco.com
Correct information	Right to rectification	Customer account or email
Delete your data	Right to erasure	privacy@young-eco.com
Stop receiving marketing emails	Right to object	Unsubscribe link or email
Retrieve your data	Right to data portability	privacy@young-eco.com
Manage cookies	Consent management	Cookie settings
File a complaint	CNIL complaint	www.cnil.fr

Last updated: March 18, 2026