This Privacy Policy explains how Vagabond Atelier (“we”, “us”) collects and uses your personal data when you visit www.vagabond-atelier.com, buy from us, contact us or subscribe to our newsletter.
1. Who we are
The data controller is Ms. Cristina Contini, sole proprietor, trading as Vagabond (Vagabond Atelier), 339 Route de la Ferme, 74310 Les Houches, France, VAT number FR79988523304 and SIRET number 98852330400018. For any privacy question, write to us at info@vagabond-atelier.com.
Last updated: 12 October 2026.
2. Personal data we collect
We collect only the data we need, depending on how you use the site:
- Identity and contact details: name, email address, phone number, delivery and billing address.
- Order data: products purchased, amounts, payment status and delivery details. We never see or store your full card number: payments are handled by our payment providers.
- Account data: login details, order history and wishlist, if you create an account.
- Messages and forms: what you write in our contact, partner, design partner and bespoke project forms, including your business type, country or city, and any file you upload.
- Newsletter data: email address, sign-up date and how you interact with our emails.
- Technical data: IP address, browser and device type, pages visited and cookie identifiers.
3. Why we use your data
We use your data only for the purposes below, each with its legal basis under the GDPR.
| Purpose | Legal basis |
|---|---|
| Process and deliver your orders, manage returns and invoices | Performance of a contract |
| Answer your messages and handle partner and bespoke project requests | Pre-contractual steps or our legitimate interest |
| Send our newsletter | Your consent |
| Measure audience and use marketing cookies | Your consent |
| Secure the site, prevent fraud, improve our service | Our legitimate interest |
| Keep accounting and tax records | Legal obligation |
4. Orders, payments and delivery
Our shop runs on WooCommerce. When you order, we share the data needed to complete your purchase with [payment providers, Crédit Agricole for debit/credit cards, PayPal and Apple Pay] and with the carriers or artisans who ship your order. These partners process your data only to deliver their service. Invoices and order records are kept for the period required by French law (see section 9).
5. Newsletter and marketing emails
We send our newsletter only if you subscribe, based on your consent. We use Mailchimp (The Rocket Science Group LLC, United States) to manage the mailing list and send emails. Mailchimp receives your email address and records whether you open our emails and click our links.
You can withdraw your consent at any time by clicking the unsubscribe link at the bottom of every email, or by writing to info@vagabond-atelier.com. We then keep only your email address on a suppression list so that we do not contact you again.
6. Contact, partner and bespoke project forms
When you fill in one of our forms (contact, partner, design partner, bespoke project or hospitality request), the data you enter is sent by email to our team through Contact Form 7. We use it only to answer you and, where relevant, to assess your request or project. Files you upload are used for that purpose alone and are not shared outside our team, except with the artisan concerned by your bespoke project when you ask us to put you in touch.
7. Cookies and analytics
On your first visit, a banner managed by CookieYes lets you accept, refuse or customise cookies by category: strictly necessary, functional, analytics and marketing. Only strictly necessary cookies are set without your consent.
With your consent, we also use tools that measure how visitors reach and use the shop, such as WooCommerce order attribution, and Mailchimp’s tracking for WooCommerce, which connects shop activity with your Mailchimp contact record. If you create an account, login cookies last two days, or two weeks if you choose “Remember me”. You can change or withdraw your choice at any time through the cookie bottom in the footer. Cookies are kept for a maximum of 13 months.
8. Live chat and other service providers
If you use the chat window on the site, the messages and the contact details you give are processed by Chatway so that we can reply to you. We also rely on technical providers who process data on our behalf and under our instructions: [Obly S.R.L.S, our hosting provider], Google (Google Workspace, for our email) and the tools that run the site. We choose providers that offer sufficient guarantees for the protection of your data.
9. Recipients, transfers and retention
Your data is accessible only to our team and to the providers named in this policy. We do not sell your data. Some providers, such as Mailchimp, are based in the United States; transfers are covered by the European Commission’s standard contractual clauses or by the EU-US Data Privacy Framework.
| Data | How long we keep it |
|---|---|
| Orders and invoices | 10 years, as required by French accounting law |
| Customer account | Until you ask us to delete it |
| Messages and form requests | 3 years after our last contact |
| Blog comments | 3 years after publication, or until you ask us to delete them |
| Newsletter subscription | Until you unsubscribe |
| Cookies | 13 months maximum |
10. Your rights
You have the right to access, correct, delete, restrict or port your data, to object to its use, to withdraw your consent at any time, and to give instructions about your data after your death. To exercise a right, write to info@vagabond-atelier.com; we reply within one month. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.
We protect your data with appropriate technical and organisational measures. Our site is not intended for children under 15. We may update this policy; the date at the top shows the latest version.
11. Blog comments and account emails
When you comment on a blog post, we collect the data in the comment form, plus your IP address and browser user agent to detect spam. A hashed (anonymised) string created from your email address may be sent to Gravatar to check whether you have a profile picture; once your comment is approved, that picture is visible next to it. You can choose to save your name, email and website in cookies for one year so that you do not have to type them again. Comments and their data are kept for the period shown in section 9.
Blog posts may include content embedded from other sites (videos, for example), which can set their own cookies and collect data as if you had visited those sites. If you ask for a password reset, your IP address is included in the reset email.
