Privacy policy
oxydz.com — version of 8 September 2026
1. Who processes your data
The data controller is Guy-Charley IRIU, sole trader (entrepreneur individuel) trading under the business name Oxydz, 24 avenue César Franck, 78260 Achères, France — SIRET 519 417 117 00016.
Contact for any question about your data: contact@oxydz.com.
No data protection officer has been appointed, as the business is not required to do so.
2. What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Process orders, produce and send licence agreements | Surname, first name, stage name, postal address, email, order contents | Performance of the contract (Art. 6.1.b GDPR) | Term of the licence, then archived |
| Issue invoices and meet accounting obligations | Identity, address, amount, date | Legal obligation (Art. 6.1.c) — Art. L123-22 French Commercial Code | 10 years |
| Take payment | Card data, processed directly by Stripe | Performance of the contract | See Stripe’s policy |
| Ship physical products | Name, postal address, email | Performance of the contract | As long as needed for delivery, then accounting archive |
| Reply to messages sent through the contact form | Name, email, message | Legitimate interest: replying to an enquiry | 3 years after the last exchange |
| Manage a customer account | Username, email, order history | Performance of the contract | 3 years after last activity |
| Send the newsletter | Email, first name | Consent (Art. 6.1.a) | Until consent is withdrawn, then 3 years |
| Fight spam | IP address, email of the message | Legitimate interest: site security | As per Akismet |
| Keep the site secure and working | Connection logs, IP address | Legitimate interest, and legal retention obligation | 1 year |
Data needed to fulfil an order is mandatory: without it the order cannot be processed. For licences, the name and address appear on the agreement and must be accurate. Other information is optional.
3. Who receives your data
Your data is never sold, rented or exchanged. It is disclosed only to the providers strictly necessary to operate the service, who act as processors on our instructions:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Website hosting | France |
| Stripe | Payment processing | Ireland and United States |
| Brevo | Sending the newsletter | France |
| Printful | Manufacture and shipping of physical products | European Union and United States |
| Automattic | WooCommerce and Akismet, shop operation and anti-spam | United States |
It may also be disclosed to the tax authorities or to a judicial authority where the law so requires.
4. Transfers outside the European Union
Some of the providers above are established in the United States or process data there. Those transfers are framed by the safeguards provided for in Chapter V of the GDPR, in particular the European Commission’s standard contractual clauses and, where applicable, certification under the EU-US Data Privacy Framework.
You may obtain a copy of those safeguards by writing to contact@oxydz.com.
5. Cookies
The website places only cookies that are necessary for it to work:
| Cookie | Role | Duration |
|---|---|---|
woocommerce_cart_hash, woocommerce_items_in_cart | Remember the contents of your basket | Session |
wp_woocommerce_session_* | Link your basket and order to your visit | 2 days |
wordpress_logged_in_, wp-settings- | Keep you signed in to a customer account | Session to 1 year |
oxz_lang | Remember the language chosen for the licence page and checkout | 30 days |
__stripe_mid, __stripe_sid, __ssid | Set by Stripe on the payment page, to prevent fraud | 30 minutes to 1 year |
These cookies are exempt from consent under Article 82 of the French Data Protection Act, as they are strictly necessary to provide the service you have requested. None of them is placed unless you create a basket or an account.
The website uses no advertising cookie, no social network tracker, no audience measurement tool and no marketing attribution device. No browsing data is sent to any third party for statistical or commercial purposes.
Fonts are hosted on our own servers: displaying them discloses your IP address to no third party.
You may delete the cookies placed at any time from your browser settings. Blocking functional cookies prevents the basket and the customer account from working.
6. Your rights
You have the following rights over the data concerning you:
- access: obtain confirmation that it is processed and receive a copy;
- rectification: have it corrected if inaccurate;
- erasure: ask for it to be deleted, within the limits of our legal retention obligations;
- restriction: freeze its use while a point is verified;
- objection: object to processing based on legitimate interest;
- portability: receive your data in a machine-readable format;
- withdrawal of consent at any time for the newsletter, without affecting mailings already sent;
- post-mortem directives: decide what becomes of your data after your death.
These rights are exercised at contact@oxydz.com. You will receive a reply within one month. Proof of identity may be requested in the event of reasonable doubt as to your identity.
Data needed to evidence a contract or to meet an accounting obligation cannot be erased before the statutory period expires.
7. Complaints
If, after contacting us, you consider that your rights are not respected, you may refer the matter to the French data protection authority: Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr. You may also contact the supervisory authority of your own country of residence.
8. Security
The site is served over HTTPS. Payment data never passes through our servers and is not stored: it is transmitted directly to Stripe. Access to order data is limited to the data controller.
9. Changes to this policy
This policy may be amended to reflect legal or technical developments. The applicable version is the one published on this page, dated at the top. In the event of a substantial change affecting processing based on your consent, you will be informed.