Privacy policy

This English translation is provided for information only. If it differs from the French version, the French version prevails.

This policy describes how PlusHaut SRL, operator of CollectoFig, processes personal data. It is the only source on this subject; the legal statements and the GTCs refer to them.

Data controller PlusHaut SRL, Rue Vallaville 36B, 7870 Lens, Belgium, BE0865.041.248. Contact: contact@collectofig.com No data protection officer is appointed.

Data collected

We collect only what is necessary:

• Order and payment: identity, e-mail, delivery address, basket details (SKU and quantities), payment status. These data pass through Stripe Checkout; we do not see or store card numbers.
• Contact: If you write to us at contact@collectofig.com, the content of your message and your email address.
• Basket on your device: the basket is saved in your browser’s localStorage (SKU and quantities). This information remains on your device until payment and is sent to the server only at checkout.
• Worker technical log: a truncated IP address used to limit abuse (rate limiting), without profiling.

No customer account, no newsletter, no advertising pixel, no audience measurement to date.

Purposes and legal bases

• Process orders, receive payment, deliver and manage stock: performance of a contract.
• Invoicing and accounting obligations: legal obligation.
• Reply to a contact e-mail: ** legitimate interest** (response) or pre-contractual measures.
• Checkout security (abuse limitation): ** legitimate interest**.
• Exercising a right of withdrawal or guarantee: ** performance of contract** and ** legal obligation**.

Recipients and subcontractors

Only the following providers, actually used:

• O2Switch (France, EU): static site hosting.
• Cloudflare: Worker who creates the payment session, tracks the stock and receives the webhook Stripe.
• Stripe (Stripe Payments Europe Limited, Ireland; Stripe, Inc., USA): payment. A transfer outside the EU is possible, under the umbrella of the Stripe standard contractual clauses.

We don’t sell your data.

• Google Ireland Limited (Google Analytics 4): traffic measurement, only if you have consented. Data may be transferred to the United States, covered by the EU-US Data Privacy Framework to which Google adheres.

Transfers outside the EU

Stripe may process data in the United States under its standard contractual clauses. Cloudflare may also process data outside the EU depending on routing; the Worker is configured solely for CollectoFig.

Shelf life

• Orders and accounting records: 10 years (Belgian legal obligation).
• Contact e-mails: processing time, then deletion or limited archiving.
• Shopping cart localStorage: until you empty it or erase the data from the site.
• Abuse limitation logs: a few minutes (technical window).
• Digital download tokens, if this feature is enabled in the future: 48 hours.

Your rights

You may request access, rectification, erasure, limitation, opposition and, if applicable, portability, and withdraw consent. Write to contact@collectofig.com. Response within one month.

You can also lodge a complaint with the Belgian Data Protection Authority (APD), Rue de la Presse 35, 1000 Brussels, autoriteprotectiondonnees.be.

Cookies and trackers

The site uses Google Analytics 4 to measure traffic. This tool sets cookies and therefore requires your prior consent.

• Nothing is loaded before your consent. A banner asks for your choice on your first visit. Until you accept, no Google script runs and no measurement cookie is set.
• Declining is as easy as accepting: both buttons have the same shape and the same place.
• Your choice is kept on your device in localStorage, without a cookie. You can change it at any time: reopen the traffic measurement choice.
• If you accept, Google Analytics sets _ga and _ga_* cookies lasting at most 13 months, and your IP address is anonymised.

Other trackers, independent of your choice:

• Strictly necessary cookies: those of Stripe on checkout.stripe.com during payment, a page hosted by Stripe.
• No cookie for the basket: localStorage only, on your device.
• The accessibility widget stores your preferences in localStorage, without a cookie and without sending anything to a server.
• The language you choose on the home page is kept in localStorage, so it is not suggested to you again.
• Your choice about traffic measurement is also kept in localStorage: declining cookies does not set a cookie.

These four items count as strictly necessary storage under the ePrivacy directive: they serve a service you asked for, stay on your device and are passed to no one.

Security

The browser is never trusted as the source of the amount due: the Worker checks the catalogue and the corresponding Stripe Price. Proof of payment is the signed Stripe webhook, not the thank-you page. Secrets (Stripe keys and workshop credentials) remain server-side and are never exposed by the site.

Last update: September 5, 2026.