Privacy Policy

Last updated: 16 October 2026

This Privacy Policy describes how ATELIER BOX ("we", "us", or "our") collects, uses, discloses, and protects information about you when you visit or interact with our website atelierbox.com (the "Website"). This Policy is intended to comply with applicable privacy laws, including the European General Data Protection Regulation (GDPR – EU Regulation 2016/679), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other U.S. state privacy laws where applicable.

1. Data Controller / Business

The entity responsible for the processing of your personal information is:

ATELIER BOX
A Société par actions simplifiée (SAS) incorporated under the laws of France
Registered office: 4 rue du Caire, 75002 Paris, France
Paris Trade and Companies Register number 920 939 386
Represented by Paul Polyakov, publication director.

For any privacy-related inquiries: contact@atelierbox.com

2. Target Audience

The Website is intended exclusively for businesses, sole proprietors, and professionals. Personal information collected typically concerns individuals acting in a professional capacity (business contacts, employees of customer companies, etc.).

3. Information We Collect

In the course of our B2B activities, we collect the following categories of personal information:

  • Business identification data: name, first name, job title, company name
  • Business contact information: shipping and billing address, business email address, business phone number
  • Business legal data: company registration number, tax identification number (EIN for U.S. companies), VAT number where applicable
  • Order data: products ordered, purchase history, amounts, payment status
  • Payment and billing data: payments are processed by bank transfer or credit card via our provider Stripe. We never have access to full credit card numbers, which are processed directly by Stripe in compliance with PCI-DSS standards.
  • Communications data: information you voluntarily provide via our contact form or quote request forms
  • Navigation data: IP address, browser type, operating system, pages visited, time spent, referring URL (via cookies – see Section 8)

We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected such information, please contact us immediately.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

  • To process and fulfill orders, deliver products, and manage customer relationships
  • To issue invoices and comply with accounting and tax obligations
  • To respond to inquiries received through our contact form
  • To manage customer relationships through our CRM system
  • To process credit card payments
  • To measure website audience and improve user experience
  • To prevent fraud and secure our IT systems
  • To establish, exercise, or defend legal claims

ATELIER BOX does not send newsletters or unsolicited commercial email communications.

5. How We Disclose Your Information

We do NOT sell your personal information. We do NOT share your personal information for cross-context behavioral advertising purposes.

We may disclose your personal information to the following categories of recipients:

  • authorized internal personnel of ATELIER BOX (sales, logistics, accounting)
  • our service providers, in particular:
    • Shopify International Limited – website hosting (Ireland)
    • Stripe Payments Europe Ltd. – credit card payment processing (Ireland)
    • HubSpot, Inc. – customer relationship management (United States)
    • Google LLC – analytics (Google Analytics, Google Search Console, Google Tag Manager)
    • our shipping and logistics providers for order delivery
    • our accountant, auditors, and, where applicable, legal advisors
  • governmental authorities, courts, or third parties in the context of legal obligations or the protection of our legal rights

Each service provider is bound by a contract requiring appropriate data protection measures. We do not sell your personal information to third parties.

6. International Data Transfers

ATELIER BOX is based in France. Your information may be transferred to, stored, and processed in France, the European Union, and other countries where our service providers operate, including the United States.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards under Articles 44 et seq. of the GDPR, including:

  • adherence to the Data Privacy Framework (DPF) for certified U.S. providers;
  • Standard Contractual Clauses (SCC) adopted by the European Commission;
  • and, where applicable, additional technical and organizational measures.

7. Retention Period

Type of Data Retention Period
Customer data (orders, contracts, invoices) 10 years from the end of the commercial relationship (accounting obligation)
Prospect data (quote requests, contact form) 3 years from the last contact
Navigation data and cookies maximum 13 months
Data for defense of legal claims until expiry of applicable statute of limitations

8. Cookies and Similar Technologies

The Website uses cookies to ensure proper functionality, measure audience, and improve user experience. On your first visit, a consent banner allows you to accept, refuse, or customize the placement of non-strictly necessary cookies.

Strictly necessary cookies (cart, session, security) do not require your consent. You may modify your preferences at any time via the cookie banner or your browser settings.

We do not use cookies for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals where technically feasible.

9. Your Rights Under GDPR (EU/EEA Residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the GDPR:

  • Right of access to your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten"), subject to legal exceptions
  • Right to restriction of processing
  • Right to data portability
  • Right to object, particularly to processing based on legitimate interest
  • Right to withdraw consent at any time
  • Right to lodge a complaint with a supervisory authority (in France: CNIL – www.cnil.fr)

10. Your Rights Under U.S. State Privacy Laws

10.1 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, California residents have the following rights:

  • Right to Know: You have the right to request that we disclose to you the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which we use it, and the categories of third parties with whom we share it.
  • Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., completion of transactions, legal compliance).
  • Right to Correct: You have the right to request correction of inaccurate personal information.
  • Right to Opt-Out of Sale or Sharing: ATELIER BOX does not sell your personal information and does not share personal information for cross-context behavioral advertising purposes. Accordingly, no opt-out mechanism is currently required, but you may confirm this by contacting us.
  • Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes that would trigger the right to limit under the CPRA.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, contact us at contact@atelierbox.com. We may need to verify your identity before processing your request. You may also designate an authorized agent to make requests on your behalf.

10.2 Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey Residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), New Hampshire, and New Jersey have similar rights, including:

  • Right to access, correct, and delete personal information;
  • Right to opt out of targeted advertising, sale of personal information, and profiling in furtherance of decisions producing legal or similarly significant effects (ATELIER BOX does not engage in these activities);
  • Right to data portability;
  • Right to appeal a denial of any of these rights.

To exercise these rights, contact us at contact@atelierbox.com.

10.3 Verification and Response Time

We will acknowledge receipt of your request within 10 business days and respond substantively within 45 days (extendable by 45 additional days if reasonably necessary). We may request additional information to verify your identity before processing your request.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including HTTPS encryption throughout the Website, restricted access controls, secure hosting with Shopify, regular backups, and staff awareness training. Credit card payments are processed via Stripe, PCI-DSS Level 1 certified. Notwithstanding these measures, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

12. Do Not Track Signals

Some browsers include a "Do Not Track" feature. Because there is no industry standard interpretation of DNT signals, we do not currently respond to them. However, we honor Global Privacy Control (GPC) signals where technically feasible.

13. Children's Privacy

The Website is intended exclusively for business users and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a child, please contact us at contact@atelierbox.com and we will promptly delete it.

14. Changes to This Privacy Policy

ATELIER BOX reserves the right to modify this Privacy Policy at any time to reflect legal, regulatory, or technical developments. The version in effect at the time of your visit shall apply. The date of the last update is indicated at the top of the document. Material changes will be notified via a prominent notice on the Website.

15. Contact Us

For any questions regarding this Privacy Policy or the processing of your personal information, please contact us: