This privacy policy describes how the company ALTO (hereinafter "we", "our"), publisher of the site www.altowatches.com  , collects, uses, and protects users’ personal data, whether while browsing the showcase Site or when making a purchase on the online store powered by Shopify.

This policy is established in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Law No. 78-17 of 6 January 1978, as amended (“Informatique et Libertés”).

1. Data Controller

The controller of the personal data collected on the Site is:

• Company name: ALTO
• Legal form: SARL (French limited liability company) with share capital of €1,000
• Registered office: 53 Avenue Montaigne – 75008 Paris
• SIREN: 922 379 433 R.C.S. Paris
• Contact email: contact@altowatches.fr

2. Data Collected

2.1 On the showcase site

While browsing the non-commercial pages of the Site (presentation, blog, contact form, newsletter), we may collect:

Type of data	Examples	Origin
Identification data	Last name, first name, e-mail, phone number, as well as any other information provided by the user in free-text comment fields	Contact form, newsletter sign-up
Connection data	IP address, connection logs, browser type	Automatic (cookies/trackers)
Browsing data	Pages visited, time spent, referral source	Analytics cookies

2.2 On the merchant section (Shopify store)

The online store is hosted and operated via the Shopify Inc. platform (“Shopify”). When placing an order, creating a customer account, or browsing the store, the following data may be collected and processed, directly by us and/or by Shopify as a data processor:

Identity and contact: last name, first name, e-mail address, phone number nom, prénom, adresse e-mail, numéro de téléphone

Addresses: billing address, delivery address(es) adresse de facturation, adresse(s) de livraison

Order data: purchase history, shopping cart, products viewed historique des achats, panier, produits consultés

Payment data: data required to process payment (truncated card number, payment provider used) — full banking details are never stored by us; they are transmitted directly via PCI-DSS certified payment providers integrated into Shopify (e.g., Shopify Payments, Stripe, PayPal, etc.)

Customer account: login credentials if a Shopify customer account is created identifiants de connexion si un compte client Shopify est créé

Shopify technical cookies: necessary for the operation of the cart, session, and security (anti-fraud protection)

3. Protection of Minors

The Site and the online store are intended for adult users. Minors under the age of 18 are not permitted to use the Site, to create a customer account, or to place an order, except under the supervision and with the express authorization of a parent or legal guardian.

We do not knowingly collect data concerning minors, nor any sensitive data within the meaning of Article 9 of the GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, genetic or biometric data, sex life or sexual orientation).

If you become aware that a minor has provided us with personal data without the consent of a parent or legal guardian, please contact us at the address indicated in Article 1 so that we can delete it as soon as possible.

4. Purposes of Processing

Your data is collected for the following purposes:

• Management and processing of orders (preparation, shipping, invoicing, after-sales service)
• Management of the customer relationship and responses to requests via the contact form
• Creation and management of the customer account on the store
• Fraud prevention and transaction security
• Sending the newsletter and marketing communications, subject to your consent
• Improvement of the Site and store (traffic statistics, audience measurement)
• Compliance with our legal and accounting obligations (invoicing, retention of accounting records)

5. Legal Basis for Processing

Purpose	Legal basis (Art. 6 GDPR)
Order processing, customer account management	Performance of a contract
Invoicing, accounting obligations	Legal obligation
Fraud prevention	Legitimate interest
Newsletter, marketing outreach	Consent
Non-essential analytics and advertising cookies	Consent
Strictly necessary cookies (cart, security)	Legitimate interest / technical necessity

6. Data Recipients

Your data may be shared with the following recipients, strictly limited to their needs:

• Our authorized internal departments (sales, accounting, customer support)
• Shopify Inc., as data processor, for the hosting and technical operation of the online store
• Online payment providers (e.g., Shopify Payments, Stripe, PayPal, or others depending on the payment methods offered)
• Carriers and logistics providers responsible for order delivery
• Any audience measurement and e-mailing tools used (e.g., Google Analytics, Mailchimp, Klaviyo — to be specified according to your actual tools)
• Administrative or judicial authorities, where required by law

We do not sell or rent your personal data to third parties for commercial purposes.

7. Data Transfers Outside the European Union

As Shopify Inc. is a Canadian company with a global infrastructure, certain data may be processed or stored outside the European Union (in particular in Canada and the United States).

These transfers are governed by the appropriate safeguards provided for under the GDPR, in particular:

• The Standard Contractual Clauses (SCCs) of the European Commission, incorporated into Shopify’s Data Processing Addendum;
• Where applicable, recognition of an adequate level of protection by the European Commission.

For more information, you can consult Shopify’s privacy policy: shopify.com/legal/privacy

8. Data Retention Period

Data category	Retention period
Customer account data	Duration of the business relationship + [2 years] from the last contact
Order / invoicing data	[10 years] (legal accounting and tax obligation)
Marketing data (newsletter)	[2 years] from the last contact, or until consent is withdrawn
Cookies	Maximum 13 months
Payment data	Not retained by us; retained in accordance with the payment provider’s policy and PCI-DSS obligations

9. Cookies and Trackers

The Site (showcase and store) uses cookies to:

• Ensure the technical operation of the Site and the shopping cart (strictly necessary cookies);
• Measure audience and improve the user experience (analytics cookies, subject to consent);
• Where applicable, offer personalized advertising content (marketing cookies, subject to consent).

A consent banner allows you to accept, refuse, or configure non-essential cookies on your first visit. You may change your preferences at any time via [the cookie management link/button] or your browser settings.

The Shopify store also places certain essential technical cookies (session identification, cart, anti-fraud security) that cannot be disabled without compromising the operation of the service.

10. Data Security

We implement appropriate technical and organizational measures to protect your data against any unauthorized access, loss, alteration, or disclosure, in particular:

• Encryption of connections (HTTPS/SSL protocol);
• Shopify infrastructure certified PCI-DSS Level 1 for payment processing;
• Restricted access to data by our authorized staff;
• Regular backups and secure hosting.

111. Your Rights

In accordance with the GDPR, you have the following rights over your personal data:

• Right of access: to obtain a copy of your data and information about its processing
• Right of rectification: to correct inaccurate or incomplete data
• Right to erasure: to request deletion of your data, subject to legal retention obligations
• Right to restriction of processing
• Right to object: in particular to marketing outreach
• Right to data portability
• Right to withdraw your consent: at any time, where processing is based on it

You may exercise these rights at any time, either by e-mail at: contact@altowatches.fror by post at the following address:

ALTO

GDPR Department

53 avenue Montaigne

75008 Paris

For security reasons and to prevent fraudulent requests, this request must be accompanied by proof of identity. This proof will be destroyed once the request has been processed.

If, after contacting us, you believe that your Informatique et Libertés rights are not being respected, you may file a complaint with the relevant supervisory authority.

12. Changes to the Privacy Policy

We reserve the right to modify this privacy policy at any time, in particular to comply with any regulatory, technical, or case-law developments.