Privacy policy

PRIVACY POLICY (SWITZERLAND)

French Bloom SAS, www.frenchbloom.com (Swiss site)

Effective: 2 November 2026

This Privacy Policy explains how French Bloom SAS, a French simplified joint-stock company (société par actions simplifiée) whose registered office is at 32 rue Washington, 75008 Paris, France, registered with the Paris Trade and Companies Register (RCS Paris) under number 884 108 119, VAT number FR19884108119 (“French Bloom”, “we”, “us”), collects, uses and discloses your personal data when you visit our website, make a purchase, join our loyalty program “The Club”, or otherwise communicate with us (together, the “Services”).

This Policy applies to customers and visitors in Switzerland. We process your personal data in accordance with the Swiss Federal Act on Data Protection (“FADP”) and, where it applies to us, the EU General Data Protection Regulation (“GDPR”). It should be read together with our Terms of Sale and our Terms of Use.

Please read this Policy carefully. By using our Services, you acknowledge that you have read it.

1. Controller and contact

French Bloom SAS is the controller of your personal data for the purposes of the FADP.

French Bloom SAS
32 rue Washington, 75008 Paris, France
Email: ordersupport@french-bloom.com
RCS Paris 884 108 119, VAT number FR19884108119

For any question about this Policy or to exercise your rights, contact us at the details above.

2. Personal data we collect

“Personal data” means any information relating to an identified or identifiable person. Depending on how you interact with the Services, we may collect:

Contact details: name, billing and delivery address, phone number, email address.
Order and transaction data: items viewed, added to your cart, purchased, returned or exchanged; order history; delivery details; gift card and discount code use.
Payment data: payment method and payment confirmation. Card details are processed by our payment providers and are not stored on our own servers.
Account data: username, password, preferences and settings.
Loyalty program data: points earned and redeemed, discount codes, activity in The Club.
Date of birth: where our website asks you to confirm your age.
Communications: messages and information you send to our customer service, survey responses, and your marketing preferences.
Device and usage data: IP address, approximate location derived from your IP address, browser and device type, pages visited, date and time of visits, and similar technical data collected through cookies and similar technologies.
Business contact data: where you deal with us on behalf of a business, such as your name, role, business address, email and phone number.

We do not intentionally collect sensitive personal data (such as health data, racial or ethnic origin, or religious beliefs). Please do not send us such data.

3. How we collect personal data

We collect personal data:

directly from you, when you create an account, place an order, join The Club, subscribe to our emails, enter a promotion or survey, or contact us online, by phone, by email or on social media;
automatically, through your device, cookies, web beacons and similar technologies when you use our website or open our emails;
from third parties, such as our service providers, payment, delivery and analytics providers, advertising and social media partners, and publicly available sources.

If you choose not to give us certain data, we may not be able to provide some Services, such as processing your order.

4. Why we use your personal data

We use your personal data to:

provide the Services and perform our contract with you: process orders and payments, arrange delivery, handle returns, refunds and warranty claims, manage your account and gift cards;
run The Club: manage your points, rewards and discount codes;
communicate with you: answer your questions, send order confirmations and service messages;
market our products: send newsletters and promotions by email or SMS, and show you advertising, where you have agreed or where the law allows;
improve our Services: analyze how the website is used, personalize your experience, recommend products and understand our market;
ensure security and prevent fraud: authenticate accounts, secure payments, detect and investigate abuse;
comply with the law and protect our rights: meet legal, accounting and tax obligations, respond to valid legal requests, and establish, exercise or defend legal claims.

We process your data in line with the principles of the FADP: lawfulness, good faith, proportionality, purpose limitation and transparency. We rely on your consent where the law requires it. Where the GDPR applies to us, our legal bases are: performance of a contract, your consent (for example for marketing and non-essential cookies), our legitimate interests (for example security and improving the Services), and compliance with legal obligations.

5. Direct marketing

We may send you marketing messages by email, SMS or other channels, in accordance with Swiss law (including the Federal Act against Unfair Competition) and, where applicable, the GDPR. Every marketing message includes a simple way to unsubscribe, and you can also unsubscribe at any time by contacting us at ordersupport@french-bloom.com. If you unsubscribe, we may still send you non-promotional messages, such as order and account notifications. We do not sell your personal data to third parties for their own marketing.

6. Who we share your data with

We may share your personal data with:

Shopify, which hosts our online store and provides related technology;
payment providers (such as card networks, PayPal and Shop Pay);
delivery and logistics providers, including the carriers that deliver your orders;
IT, hosting, customer service, analytics and marketing providers, including the platform that operates The Club (Smile.io), Didomi (cookie consent), HubSpot, Google and Meta, and email or advertising tools;
professional advisers and auditors (legal, accounting, tax);
authorities, courts and law enforcement, where required by law or to protect our rights;
a buyer or successor, in the event of a merger, sale or restructuring of our business;
other third parties, where you instruct us or consent.

Our providers process your data on our behalf and under our instructions, or as independent controllers where they use data for their own purposes, in which case their own privacy notices apply. For example, Shopify may process certain data as an independent controller for its own purposes. You can read more in Shopify’s Consumer Privacy Policy and exercise certain rights through the Shopify privacy portal.

7. Transfers outside Switzerland

We are based in France, so your personal data is transferred from Switzerland to France and processed there. France is on the list of countries that the Swiss Federal Council recognizes as offering an adequate level of data protection.

Some of our service providers (including Shopify and its sub-processors) may process data in other countries, including the European Union, the United Kingdom and the United States. Where the destination country does not offer an adequate level of protection under Swiss law, we rely on appropriate safeguards, such as standard contractual clauses recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC), or the Swiss-U.S. Data Privacy Framework for certified recipients. You may ask us for information about these safeguards using the contact details above.

8. Cookies and similar technologies

We use cookies, web beacons and similar technologies to operate the website (for example your cart and session), remember your preferences (including your date of birth entry), measure audience and performance, and, with your consent where required, show you advertising.

Strictly necessary cookies enable you to navigate the website and use its features, such as your cart.
Performance cookies (for example Google Analytics, Meta Business, HubSpot and Shopify) tell us how visitors use the website, so we can improve it.
Functionality cookies remember choices you make.
Targeting and advertising cookies (for example set by Google, Meta, HubSpot and Shopify) help show you more relevant advertising and measure its effectiveness.

Most of our cookies expire within thirty (30) days, although analytics cookies may persist for two (2) to ten (10) years. We inform you about cookies on the website, and you can accept or refuse non-essential cookies through our cookie banner and change your choice at any time. You can also block cookies in your browser settings, but some features of the website, such as the shopping cart, may then not work. Third parties may set cookies on our website, and their own policies apply to their use of the data.

9. Security

We take appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, disclosure and alteration. These include encrypted transmission (SSL/TLS) of sensitive information and access controls. Card details are handled by payment providers that follow industry standards such as PCI-DSS. No method of transmission over the internet or of electronic storage is completely secure, so we cannot guarantee absolute security. If you have an account, please keep your login details confidential.

If a data security breach is likely to result in a high risk to your personality or fundamental rights, we will notify the FDPIC as soon as possible and, where required, inform you.

10. How long we keep your data

We keep your personal data only as long as needed for the purposes described above, and as required by law. In particular:

Order, invoice and accounting data: for the period required by Swiss and French accounting and tax law (generally ten years);
Customer account data: for as long as your account is active, and then for a limited period afterwards;
Marketing data: until you unsubscribe or withdraw your consent, or after a period of inactivity;
Loyalty program data: for as long as you are a member; points expire after twelve months of account inactivity, as set out in our Terms of Sale;
Customer service communications: for the time needed to handle your request and any follow-up or dispute;
Cookies and technical data: for the duration stated in our cookie settings.

When data is no longer needed, we delete or anonymize it.

11. Your rights

Under the FADP, and under the GDPR where it applies, you may have the right to:

access the personal data we hold about you and obtain information about how we process it;
have inaccurate data rectified;
have your data deleted, subject to our legal retention obligations;
object to certain processing, in particular to direct marketing;
restrict the processing of your data in certain cases (GDPR);
receive your data in a commonly used electronic format, or have it transferred to another controller (data portability);
withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal;
request a human review of any decision based solely on automated processing that has legal effects on you or significantly affects you. We do not currently make such decisions.

To exercise your rights, contact us at ordersupport@french-bloom.com. We may need to verify your identity first, and we will respond within a reasonable time, generally within thirty (30) days. These rights are not absolute and may be limited as permitted by law. You may unsubscribe from marketing emails at any time using the link in each email.

12. Complaints

If you are not satisfied with how we handle your personal data, please contact us first at ordersupport@french-bloom.comor by post at the address above, so that we can try to resolve the matter. We will acknowledge your complaint and aim to respond within thirty (30) days.

You also have the right to report the matter to the Swiss Federal Data Protection and Information Commissioner (FDPIC):

Website: www.edoeb.admin.ch
Post: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, 3003 Bern

Where the GDPR applies, you may also lodge a complaint with the French data protection authority (CNIL) or the authority of your place of residence in the EU.

13. Children

Our Services are intended for adults and are not directed at children. We do not knowingly collect personal data from persons under 18. If you believe that a child has provided us with personal data, please contact us and we will delete it.

14. Third-party websites

Our Services may contain links to third-party websites, including social media platforms. We do not control them and are not responsible for their content or privacy practices. Information you share in public or semi-public spaces, such as on social media, may be visible to others. We recommend that you read the privacy policies of any website you visit.

15. Changes to this Policy

We may update this Policy from time to time, for example to reflect changes in our practices or in the law. The current version is always available on our website with its effective date, and we will give you notice of material changes where required by law.