Politique de Confidentialité

1. PURPOSE

This Privacy Policy describes how Umaplace collects, uses, protects and processes personal data in accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés). The French version prevails.

2. DATA CONTROLLER

Umaplace, SAS – 49 rue de Ponthieu, 75008 Paris, France. Email: contact@uma-place.com

3. DATA COLLECTED

We collect the following categories of data: - Identity: last name, first name, email, phone number (optional) - Account: login details, purchase history - Payment: data processed by Stripe (Umaplace stores no bank card data) - Seller data: company registration (Kbis), legal documents, tax information - Technical data: IP address, logs, cookies, device - User-generated content: reviews, messages - Ad measurement: email address and, where applicable, first name, last name and phone number, sent in irreversibly encrypted form (hashing), ad click identifier, browser used; with your cookie consent: Meta pixel identifiers and IP address

4. LEGAL BASES

- Performance of a contract (purchases, sales, account) - Legal obligation (invoicing, fraud prevention) - Legitimate interest (security, service improvement) - Legitimate interest: measuring the effectiveness of our ads when you enter your contact details on the « Créer ma vitrine » page, then when you pay for your subscription, before you have answered the cookie banner - Consent (newsletter, cookies)

5. PURPOSES OF PROCESSING

Data is used to: - manage user accounts - fulfil orders - process payments with Stripe - enable sellers to sell - provide customer support - secure the platform - analyse site performance - send notifications (opt-in) - measure the effectiveness of our advertising campaigns on Facebook and Instagram

6. RECIPIENTS

Data may be shared with: - Stripe (payments) - Netlify & Supabase (hosting) - Logistics providers (delivery), including Boxtal - Public authorities where required by law - Meta Platforms Ireland Ltd (ad measurement: Meta Pixel and Conversions API)

7. TRANSFERS OUTSIDE THE EU

Netlify, Stripe and Supabase are located in the United States. These transfers are governed by: - Standard Contractual Clauses (SCCs) - Enhanced security measures. Meta may transfer this data to the United States under the EU–US Data Privacy Framework and the Standard Contractual Clauses.

8. RETENTION PERIODS

- Account: as long as the user is active - Orders: 6 years (accounting obligation) - Cookies: 6 to 13 months - Seller data: duration of the contract + 5 years - Customer support: 3 years

9. COOKIES

Types of cookies used: - technical (operation) - statistics (analytics) - security - marketing (opt-in required). Details are set out in the Cookie Policy.

10. SECURITY

Umaplace implements: - TLS encryption - strict access control - access logging - secure hosting with Netlify / Supabase - secure Stripe payments (PCI-DSS)

11. USERS' RIGHTS

Under the GDPR, you have the right of: - access - rectification - erasure - objection - restriction - portability - withdrawal of consent. Requests: contact@uma-place.com. You can object to ad measurement at any time: « Tout refuser » (Reject all) in the cookie banner, « Gérer mes cookies » (Manage my cookies) at the bottom of the page, or by email to contact@uma-place.com. After a refusal, nothing more is sent to Meta.

12. PROFILING / AUTOMATED DECISIONS

No automated profiling is used for decisions with legal or similarly significant effects.

13. MINORS

The site is not intended for children under 15 without parental consent.

14. CHANGES

Umaplace may update this policy. The current version is available on the site.

15. COMPLAINTS

If you believe your rights are not respected, you may contact the CNIL – https://www.cnil.fr