Privacy Policy and Personal Data Protection
Last updated: 2 November 2026
At Mandalashop, we attach particular importance to protecting your personal data and respecting your privacy.
Since 2014, our French family business has been committed to building a relationship of trust with its customers, based on transparency and respect for their personal information.
This privacy policy explains what data we collect, why we use it, how long we retain it and how you can exercise your rights.
1. Who is responsible for your personal data?
The website www.mandalashop-online.com is operated by:
SARL UNIWORLD – Mandalashop
1400 rue de la Castelle
34070 Montpellier – France
Email: contact@mandalashop-online.com
SARL UNIWORLD is the data controller responsible for processing personal data collected through the Mandalashop website.
This processing is governed by the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).
2. What personal data do we collect?
Depending on how you use our online store, we may collect the following information:
- Identification details: surname, first name, email address, telephone number and date of birth if you choose to provide it.
- Delivery and billing details: postal addresses and information required to process your orders.
- Order information: products purchased, amounts, dates, purchase history, delivery methods and transaction references.
- Account information: login details, securely stored password and account preferences.
- Business information: company name, business contact details and tax identification number, where required.
- Communication data: newsletter subscriptions, contact requests, email alerts and correspondence with our customer service team.
- Technical data: information relating to your browsing activity and use of our website.
Required fields are identified in the relevant forms. They correspond to the information needed to provide the requested service. Other fields are optional.
3. Why do we use your personal data?
We use your data only for specific purposes related to the operation of our online store and the services we provide.
Managing your account and orders
We use your information to create and manage your account, record your purchases, prepare your orders, arrange delivery and handle any returns or after-sales enquiries. This processing is necessary to fulfil your order or provide the services you request.
Billing and accounting
Certain information is retained to issue invoices and comply with our accounting and tax obligations.
Contact forms and customer service
When you contact us, we use your contact details and the content of your message to respond to your enquiry and follow it up, as part of our contractual relationship or our legitimate interest in providing customer support.
Newsletter and marketing communications
If you choose to subscribe to our newsletter, we use your email address to send you news, new product announcements, advice, articles, updates and special offers.
Subscription is optional and independent of creating a customer account.
These communications are based on your consent. Under certain conditions provided for by Article L34-5 of the French Postal and Electronic Communications Code, we may also send existing customers offers relating to products or services similar to those they have previously purchased.
You can unsubscribe at any time using the link included in our emails.
Business accounts
When you request access to our business terms and conditions, we use the information necessary to review your application, identify your company and manage our business relationship. This processing is necessary to prepare for or fulfil our contractual relationship.
Email alerts
When you request to be notified about product availability, we use your email address to send you the corresponding alert, in accordance with your request and, where required, your consent.
Website traffic analysis
Technical data may be used to understand traffic to our online store and measure the performance of our services and communications. The use of the relevant trackers depends on their purpose and the applicable consent requirements.
4. Who do we share your data with?
Mandalashop does not sell or rent your personal data.
However, certain information may be shared with service providers necessary for the operation of our online store:
- Payment service providers: to process and secure your transactions.
- Delivery companies: to ship and deliver your orders.
- Hosting and IT maintenance providers: to ensure the operation and security of the website.
- Communication service providers: to manage newsletters and requested communications.
- Analytics and advertising providers: where the relevant tools are used.
These service providers receive only the information necessary to carry out their tasks.
Some services may involve transferring data outside the European Economic Area. Where such transfers occur, they must be protected by safeguards provided for under the GDPR, including an adequacy decision or standard contractual clauses.
5. How do we protect your data?
We implement technical and organisational measures designed to protect your personal information against unauthorised access, loss, alteration or disclosure.
Our online store uses a secure HTTPS connection to protect data exchanged through the website.
Payments are processed by specialised service providers. Mandalashop does not store complete bank card numbers or card security codes.
Access to personal information is restricted to individuals and service providers who need it to perform their duties.
6. How long do we retain your data?
The retention period depends on the nature of the information and how it is used.
Invoices and accounting records: 10 years
Accounting records and supporting documents are retained for ten years, in accordance with Article L123-22 of the French Commercial Code.
Article L102 B of the French Tax Procedures Code also provides for a general six-year retention period for documents subject to inspection by the French tax authorities, subject to specific provisions.
Customer account data
Personal data associated with your account is retained for as long as necessary to manage your account and provide our services.
Certain information may be retained for longer where necessary to comply with our legal obligations or manage potential disputes.
Data used for marketing: 3 years
In accordance with the recommendations of the French Data Protection Authority (CNIL):
- For prospective customers, data may be retained for three years from its collection or the last active contact initiated by the individual.
- For customers, data used for marketing may be retained throughout the business relationship and for three years after it ends.
Simply opening a newsletter does not necessarily constitute active contact that would extend this period.
You can request to stop receiving marketing communications at any time.
Contact requests and customer service
Information provided during your exchanges with Mandalashop is retained for as long as necessary to process and follow up on your request.
Longer retention may be justified in the event of a complaint, warranty claim or dispute.
Email alerts
Data used for alerts is retained for as long as necessary to provide the requested service or until you withdraw your consent, where consent is the legal basis for processing.
When retention is no longer justified, data is deleted or anonymised, subject to applicable legal obligations.
7. What are your rights?
Under the GDPR, you have the following rights, subject to the conditions laid down by the regulations:
- Right of access: to find out what personal data we hold about you and obtain a copy.
- Right to rectification: to have inaccurate or incomplete information corrected.
- Right to erasure: to request the deletion of your data where the legal conditions are met.
- Right to restriction: to request the temporary restriction of certain processing activities.
- Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format.
- Right to object: to object to certain processing activities, particularly direct marketing.
- Right to withdraw consent: to withdraw your consent at any time where processing is based on it.
Withdrawing your consent does not affect the lawfulness of processing carried out before its withdrawal.
Certain rights may be restricted where a legal obligation requires data to be retained, particularly for accounting and invoicing purposes.
8. How can you exercise your rights?
You can view and modify some of your personal information directly in the "Personal Information" section of your Mandalashop customer account.
Our online store also uses PrestaShop's Official GDPR module to manage information and consent associated with certain forms.
To exercise your rights of access, rectification, erasure, objection or data portability, you can contact us:
By email: contact@mandalashop-online.com
By post:
SARL UNIWORLD – Mandalashop
Personal Data Protection Department
1400 rue de la Castelle
34070 Montpellier – France
We normally respond within one month of receiving your request, in accordance with Article 12 of the GDPR.
This period may be extended by a further two months where justified by the complexity or number of requests. You will be informed of any extension within the first month.
We may ask you to verify your identity if we have reasonable doubts about it.
If you believe your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL):
9. Cookies and browsing data
A cookie is a small file stored on your device when you visit a website.
At Mandalashop, certain cookies are used to ensure the technical operation of our online store, including shopping cart management, customer account login and the checkout process.
Other tracking technologies may be associated with website analytics and advertising tools.
In accordance with Article 82 of the French Data Protection Act, trackers that are not strictly necessary generally require your prior consent, unless an exemption applies.
Cookies essential to providing a service expressly requested by you, such as shopping cart management, may be exempt from this requirement.
You can configure your browser to block or delete cookies. However, disabling technical cookies may affect certain features of our online store.
For any questions about the use of your browsing data, please contact us at contact@mandalashop-online.com.
10. Changes to our privacy policy
We may update this policy to reflect changes in our services, technical tools or applicable regulations.
The date of the latest update is indicated at the top of this page.
We encourage you to review it regularly to stay informed about how we use and protect your personal data.
