1. Who Is Responsible for Your Personal Data?
KARDARIA is operated by Levana, registered under 940 441 306 R.C.S. Paris, with its registered office at 24 rue Lalo, 75116 Paris, France.
Levana is the data controller for the processing of personal data described in this policy. This means that we determine why and how that information is used for our business activities.
Website: kardaria.com
Privacy contact: help@kardaria.com
This policy concerns your interactions with our website, purchases, pre-orders and customer support. References to optional features apply when those features are offered and you use them.
2. Information Used to Provide Our Services
Orders and deliveries: Your name, email address, billing and delivery addresses, contact details requested for delivery, purchased products, order references and delivery instructions.
Payments and refunds: The transaction amount, payment method, transaction reference, payment confirmation and refund information. The payment service selected at checkout processes the payment credentials needed for that transaction. Please do not send full payment-card details or security codes by email.
Customer communications: The information in your enquiries, complaints, return requests and supporting documents or photographs that you choose to provide.
Accounts and subscriptions: The details and preferences you provide when creating an available customer account or requesting email notifications.
Technical operation: Connection and session information needed to deliver and protect the website, such as IP addresses, browser information and session identifiers. Optional tracking is subject to the conditions described in Section 8.
Information comes from your interactions with us, payment confirmations, delivery updates from shipping providers and the technical operation of the website.
Information necessary to process an order, deliver goods or issue a legally required invoice must be provided for those purposes. Without it, we cannot complete the relevant transaction. Optional marketing subscriptions are not required to make a purchase.
3. Why We Use Your Information
We use personal data for the following purposes and legal bases under the General Data Protection Regulation (GDPR):
Providing requested services — Article 6(1)(b): Taking steps at your request before a purchase, processing orders and payments, arranging delivery, managing pre-orders and providing contractual customer support.
Meeting legal obligations — Article 6(1)(c): Keeping required accounting and transaction records, fulfilling statutory consumer obligations and responding to valid data-protection requests.
Legitimate interests — Article 6(1)(f): Answering general enquiries, protecting the website and customers against misuse and fraud, and establishing or defending legal claims. These interests do not override your fundamental rights where those rights require protection.
Consent — Article 6(1)(a): Sending optional promotional communications you subscribe to and using cookies or similar technologies that require consent.
Reading this policy or accepting our sales terms does not, by itself, constitute consent to marketing or optional tracking.
4. Email Notifications and Marketing
When you request a launch notification, product-availability alert or other optional email update, we use your email address for the notification you requested.
A request for a specific notification does not automatically authorise unrelated promotional emails. General marketing subscriptions require a separate choice from you.
You can withdraw your consent using the unsubscribe option in a promotional email or by contacting help@kardaria.com. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Unsubscribing from marketing does not stop essential communications about an existing order, delivery, return or refund.
5. Who Receives Your Information?
Access is limited to the people and organisations that need information for the purposes described in this policy.
The relevant recipients include authorised KARDARIA personnel; website, hosting and technical service providers; the payment providers involved in your transaction; fulfilment providers and carriers handling your order; and providers supporting customer communications.
Accountants, legal advisers or public authorities receive information where necessary for accounting, legal claims or a lawful disclosure obligation. The information supplied depends on the recipient’s role: for example, a carrier needs delivery details rather than unrelated customer correspondence.
Providers acting on our behalf must process personal data under appropriate contractual instructions and safeguards. Some organisations, such as payment providers or public authorities, also process information as independent controllers for their own legal responsibilities. Their own privacy notices apply to that processing.
You can contact help@kardaria.com for information about the recipients involved in processing your personal data.
6. International Processing and Transfers
Our shipping arrangements involve the United States, Canada and France. Fulfilling an order from outside the European Economic Area (EEA) can require sharing the necessary order and delivery information with the relevant fulfilment and shipping providers.
Transfers governed by the GDPR require a valid transfer mechanism. Depending on the recipient and circumstances, this can be a European Commission adequacy decision or appropriate safeguards, such as the Commission’s Standard Contractual Clauses, together with any necessary additional protections.
A country’s recognition as adequate does not automatically cover every organisation or every transfer to that country.
For information about the countries, recipients and transfer safeguards applicable to your data, including how to obtain a copy of relevant safeguards, contact help@kardaria.com.
7. How Long We Keep Information
Different records have different retention periods. Keeping an invoice does not justify retaining all browsing or marketing information for the same period.
Order and support records are used while needed to process the order, handle returns and fulfil after-sales obligations. Relevant evidence can then be kept in restricted archives for applicable legal retention or claims periods.
Invoices and accounting supporting documents are retained for 10 years from the end of the relevant financial year, as required by French accounting rules.
Electronic consumer contracts worth EUR 120 or more are retained for the legally required period, including 10 years from delivery where delivery is not immediate.
Marketing information about prospects is retained for up to 3 years from collection or the last affirmative contact from the person, unless consent is withdrawn earlier. Customer information used for marketing is retained during the customer relationship and for up to 3 years after it ends, unless consent is withdrawn earlier.
Specific notification requests are retained until the requested notification has been sent or the request is withdrawn, apart from any minimal information needed to demonstrate compliance.
Account information is used for the duration of the account relationship. Closing an account removes the need to retain account-only information, but does not require deletion of invoices or other records that must lawfully be kept.
Consent and opt-out records are limited to what is necessary to demonstrate your choices and prevent unwanted communications. They are not used to restart marketing after you unsubscribe.
Technical and tracking information requires retention periods appropriate to each technology and purpose. Cookie-specific lifetimes must be identified in the information accompanying the relevant consent choices.
Records needed for an existing dispute or legal obligation are retained only to the extent and for the period necessary for that purpose. Other information is deleted or irreversibly anonymised when it is no longer needed.
8. Cookies and Similar Technologies
Strictly necessary technologies support requested functions such as maintaining a shopping cart, protecting a session and remembering privacy choices.
Advertising cookies and analytics technologies that do not qualify for a legal exemption require your prior consent. This includes relevant pixels and similar tracking technologies, not only traditional cookies.
Before consent-based tracking is used, the consent information must identify its purposes, the organisations involved and the relevant lifetimes. You must be able to refuse optional tracking as easily as you accept it, and withdraw consent through accessible controls with the same ease.
Continuing to browse, remaining silent or accepting general terms is not consent to optional tracking.
Questions about cookies can be sent to help@kardaria.com. Email support does not replace the website controls required to manage tracking choices.
9. Your Data-Protection Rights
Subject to the applicable legal conditions, you can request access to your personal data, correction of inaccurate information, deletion and restriction of processing.
You can request portability of data you have provided where processing is automated and based on consent or a contract.
Where processing relies on legitimate interests, you can object for reasons relating to your particular situation. We must stop that processing unless a lawful reason permits it to continue.
You can object to direct marketing at any time, including related profiling. This objection does not require you to explain your situation.
Where processing relies on consent, you can withdraw it at any time. Some records must nevertheless be retained on another valid basis, such as a legal accounting obligation.
You also have protections concerning decisions based solely on automated processing that have legal or similarly significant effects. Where applicable, these include rights to information, to contest a decision and to obtain human intervention.
10. How to Exercise Your Rights
Email help@kardaria.com, or write to:
Levana (KARDARIA) — Privacy Enquiries
24 rue Lalo
75116 Paris
France
Please describe your request and provide enough information to identify the relevant records. You do not have to use a special form.
We respond without undue delay and normally within one month of receiving your request. Where legally permitted because of the complexity or number of requests, this period can be extended by up to two additional months. We will explain the extension within the initial month.
We request additional identity information only where reasonably necessary to verify that the request concerns your data.
Requests are normally free of charge. Any permitted refusal or charge must have a legal basis and be explained to you.
11. Security
We are responsible for implementing technical and organisational measures appropriate to the risks associated with the personal data we process, including restricting access to authorised persons and protecting information against unauthorised disclosure or loss.
If a personal-data breach requires notification to you or a supervisory authority, we will provide it in accordance with applicable law.
Please contact help@kardaria.com if you suspect misuse of your account or personal information.
12. Complaints and Updates
You can raise a privacy concern with us at help@kardaria.com.
You also have the right to complain to a competent data-protection authority, including the French Commission Nationale de l’Informatique et des Libertés (CNIL). Information about complaints is available on cnil.fr. Where applicable, you can complain to the authority in the country of your habitual residence, place of work or the alleged infringement. Contacting us first is not a condition of that right.
We will update this policy when necessary and identify the revision date. Where a change requires further information or fresh consent, publishing an updated policy does not replace that requirement.
Nothing in this policy limits mandatory privacy rights available to you under applicable law.