Privacy Policy
Last updated: May 15, 2026
42HourVintage (www.42hourvintage.com), operated by Duc Nguyen, Paris, France, is committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679) and French data protection law (Loi Informatique et Libertés).
1. Data Controller
42HourVintage
Paris, France
Email: [email protected]
2. Data We Collect
We collect the following personal data when you interact with our site or make a purchase:
- Identity: first name, last name
- Contact: email address, phone number (optional)
- Delivery: shipping address
- Transactions: order history, purchase amounts
- Technical: IP address, browser type, pages visited (via analytics cookies)
- Communications: messages sent via email or our contact forms
We do not collect payment card details — these are handled entirely by Shopify's PCI-DSS compliant infrastructure.
3. Purpose and Legal Basis
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling orders | Performance of a contract |
| Order confirmations and updates | Performance of a contract |
| Customer service | Legitimate interest |
| Website improvement | Legitimate interest |
| Newsletter / marketing emails | Consent |
| Legal and tax obligations | Legal obligation |
4. Data Retention
| Data | Retention period |
|---|---|
| Order data | 5 years (tax and legal obligations) |
| Newsletter / marketing | Until consent is withdrawn |
| Analytics | 13 months rolling (per CNIL guidelines) |
| Support communications | 3 years |
5. Third-Party Services
| Provider | Purpose | Privacy policy |
|---|---|---|
| Shopify Inc. | E-commerce, orders, payments | shopify.com/legal/privacy |
| Analytics providers | Site usage analysis (anonymised) | Provider-specific |
| DHL / Chronopost | Order delivery | Carrier-specific |
Each provider operates under their own privacy policy and appropriate data processing agreements.
6. International Data Transfers
Some third-party providers may transfer your data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place (Standard Contractual Clauses approved by the European Commission).
7. Your Rights
Under the GDPR, you have the following rights:
- Access (Art. 15): obtain a copy of your data
- Rectification (Art. 16): correct inaccurate data
- Erasure (Art. 17): request deletion of your data
- Restriction (Art. 18): limit how your data is processed
- Portability (Art. 20): receive your data in a portable format
- Objection (Art. 21): object to processing based on legitimate interest or for direct marketing
To exercise any of these rights, email [email protected]. We will respond within 30 days.
If you believe your rights have not been respected, you may lodge a complaint with the CNIL: cnil.fr.
8. Cookies
| Cookie type | Purpose | Retention |
|---|---|---|
| Essential | Cart, session, security | Session / up to 1 year |
| Analytics | Site usage (anonymised) | 13 months |
| Preferences | Language, display settings | 1 year |
You can manage your cookie preferences via your browser settings. Refusing non-essential cookies does not affect your ability to browse or purchase.
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. Payment data is encrypted and processed exclusively by Shopify's secure infrastructure.
10. Contact
Email: [email protected]
CNIL: cnil.fr