REVE BAGAGES

Privacy Policy

‌Effective Date: October 9, 2026‌

REVE DE BAGAGES, a company registered and operating at 11 Rue de Berstheim, 67500 Haguenau, France, with its official e-commerce website accessible via www.revebagages.com, takes the protection of your personal data extremely seriously. This Privacy Policy is designed to inform all users, visitors, and customers of our platform about how we collect, process, store, share, and safeguard your personal information, in full compliance with the EU General Data Protection Regulation (GDPR), the General Product Safety Regulation (GPSR, Regulation 2023/988), 2026 French e-commerce regulatory updates, and all applicable local data protection laws in France and the European Economic Area (EEA). For any inquiries related to your personal data or this policy, you may contact our dedicated data protection representative at any time via email at moonst@revebagages.com, or by phone at +33 6 5253 2306, or via postal mail at our registered physical address listed above.

1. Core Commitment to Lawful, Fair and Transparent Data Processing

As an e-commerce retailer specializing in premium luggage and travel accessories, we adhere strictly to the GDPR mandate that all personal data processing activities are lawful, fair, and fully transparent. Every data collection practice on [www.revebagages.com] is built on a clearly defined valid legal basis, with no hidden, unauthorized, or overreaching data harvesting activities. We do not collect any personal information that is not strictly necessary for the explicitly stated purposes communicated to you at the point of data capture, and all processing operations are aligned with the scope of consent you provide, or other legally permitted grounds recognized under EU data protection rules.

We distinguish and apply the correct legal basis for every category of data processing:

  • ‌Necessity for contract performance‌: This applies to all data required to process your orders, complete payment transactions, arrange shipping, handle post-delivery customer support, and fulfill our contractual obligations under the purchase agreement you enter with us when placing an order on our platform.
  • ‌Explicit, freely given user consent‌: This serves as the legal basis for all optional processing activities, including subscription to our marketing newsletters, use of non-essential analytics and personalization cookies, participation in customer satisfaction surveys that are not tied to order fulfillment, and any promotional outreach that falls outside the scope of our legitimate operational interests. You retain the full right to withdraw this consent at any time, with immediate effect and no negative impact on your ability to use our e-commerce services.
  • ‌Legitimate interest‌: This restricted, carefully assessed legal basis is only applied to activities that do not override your fundamental data privacy rights, including fraud prevention, network and website security, operational troubleshooting, internal anonymized statistical analysis to improve our product offering, and mandatory compliance checks to meet our legal obligations under GPSR, EPR (Extended Producer Responsibility) rules, and French consumer protection legislation.

All processing activities are documented in our internal data processing register, which you may request to review in part (excluding confidential business security protocols) by submitting a formal data access request via our provided contact channels.

2. Categories of Personal Data We Collect and Corresponding Collection Purposes

We only collect personal data that is directly relevant and limited to the specific purposes disclosed to you. The categories of personal information we process include the following:

  1. ‌Identity and Contact Information‌: This includes your full name, billing and delivery address, email address, phone number, and optional user account profile details you voluntarily submit when creating an account on [www.revebagages.com]. We process this data exclusively to verify your identity for order processing, arrange accurate product delivery, send you order confirmation and shipping update notifications, respond to your customer support inquiries, and comply with GPSR requirements to maintain traceability records for consumer product safety, ensuring we can reach out to you promptly if a product safety recall or risk assessment follow-up is required for the luggage or travel goods you purchased from us.
  2. ‌Transaction and Payment Data‌: This includes your order history, purchased product details, payment amount, selected payment method, partial payment card or e-wallet identifier data, billing address verification records, and refund or exchange request logs. To fully comply with PCI-DSS security standards and GDPR data minimization rules, we never store full credit or debit card details on our internal servers. We leverage the built-in data anonymization features of our accredited payment service providers (including Stripe and PayPal) to process all full payment credential information, ensuring your sensitive financial data is never exposed to unauthorized internal or external access. VAT numbers that you voluntarily submit for cross-border EU clearance purposes are processed under a formal Data Processing Agreement (DPA) with our logistics partners, and retained for no longer than 3 years for customs declaration compliance, after which these records are permanently anonymized or securely deleted.
  3. ‌Website Usage and Technical Data‌: This includes your IP address, browser type and version, device identifiers, time zone setting, website navigation paths, pages viewed on [www.revebagages.com], search queries submitted on our platform, and interaction data with our product pages. We separate cookies into strictly defined categories: strictly necessary session cookies that are mandatory for the website to function correctly (such as maintaining your shopping cart contents during your visit, and supporting the 14-day withdrawal function required under 2026 French e-commerce rules), non-essential analytics cookies that only activate if you provide explicit opt-in consent, and marketing targeting cookies that are disabled by default until you confirm your agreement via our GDPR-compliant cookie consent banner. Our cookie management system allows you to modify or withdraw your consent to non-essential cookies at any time, with no forced consent for access to core e-commerce features of our website.
  4. ‌Marketing and Preference Data‌: This includes your explicit opt-in status for email and SMS newsletters, your stated product preferences, feedback you provide on purchased items, and your participation in voluntary promotional campaigns. As required by the 2026 French regulatory update that mandates prior explicit consent for all telemarketing activities, we never initiate phone marketing calls to any customer who has not provided clear, documented opt-in consent, and we maintain verifiable logs of all consent records to demonstrate compliance with this rule.
  5. ‌Compliance and Safety Related Data‌: As a distributor of consumer luggage products operating in the EU under GPSR requirements, we process limited additional data related to product safety reports you submit, to conduct mandatory pre-market risk assessments for new product lines, and maintain records required for EPR (Extended Producer Responsibility) compliance for packaging waste and any relevant electronic components embedded in our travel accessories. We also retain proof of Triman labeling compliance records and Wheelie Bin recycling mark documentation as required by French ADEME regulations, to ensure we meet our legal responsibilities for product end-of-life recycling management.

3. Data Retention Policy

We adhere to the GDPR principle of data storage limitation, meaning we never retain your personal data for longer than is strictly necessary to fulfill the specific purposes for which it was collected. The retention periods for different categories of personal data are clearly defined as follows:

  • Order-related personal data (identity, contact, transaction records) is retained for a period of 10 years, in line with French commercial and tax record keeping requirements, after which non-essential data fields are anonymized, and only anonymized statistical data is kept for operational analysis.
  • Data collected based on your explicit consent (such as newsletter subscription information) is retained from the moment you provide consent until you actively withdraw that consent, after which all associated personal data is permanently deleted from our active marketing databases within 7 working days.
  • Website technical usage data and IP address logs are retained for a maximum period of 12 months, after which they are fully anonymized and cannot be linked back to any individual user.
  • VAT numbers collected for customs clearance purposes are retained for a maximum of 3 years as stipulated in our DPA with logistics partners, after which these records are securely erased.
  • If you request permanent deletion of your user account on [www.revebagages.com], all personal data associated with your account will be deleted within 30 days, except for limited records we are legally obligated to retain to meet tax, consumer protection, and product safety traceability requirements, which will be restricted from any further processing outside of mandatory legal compliance purposes.

4. Data Sharing and International Data Transfers

We never sell, rent, or trade your personal data to third parties for unrelated commercial purposes without your explicit prior written consent. We only share your personal data with carefully vetted third party service providers who are bound by strict data protection obligations that meet GDPR standards, and only to the minimal extent required to deliver the services you have requested:

  • Authorized logistics and delivery partners, who receive only your name, delivery address, and contact phone number to arrange successful shipment of your ordered products.
  • Accredited payment processing service providers, who process your payment data in full compliance with PCI-DSS rules, as outlined earlier in this policy.
  • IT service providers who support our website hosting, security maintenance, and cookie management system operations, all of whom are bound by formal data processing agreements that restrict their use of your personal data exclusively to the services they provide for REVE DE BAGAGES.

For any data transfers that take place outside of the European Economic Area, we fully comply with GDPR requirements for adequate data protection safeguards. We use the official standard contractual clauses (SCCs) provided by recognized e-commerce platform and service providers, and complete the required GDPR cross-border data transfer authorization process via our e-commerce platform backend, to ensure that your personal data receives the same level of strong data protection that is mandated within the EU, even when processed in third countries. No cross-border data transfer is initiated before all required compliance documentation is fully executed.

5. Your Rights as a Data Subject Under EU and French Law

Under the GDPR and applicable French data protection legislation, you hold a comprehensive set of enforceable rights over your personal data that we fully respect and support. You may exercise any of these rights at no cost, by submitting a request via our contact channels listed at the start of this policy, and we will respond to your valid request within one month as required by GDPR rules:

  • ‌Right of Access‌: You have the right to request a full copy of all personal data we hold about you, alongside a clear explanation of all processing activities we carry out related to your information.
  • ‌Right to Rectification‌: If you find that any personal data we hold about you is inaccurate, incomplete, or out of date, you have the right to request immediate correction or completion of that data. You may also edit most of your profile and contact information directly via your user account dashboard on [www.revebagages.com].
  • ‌Right to Erasure (“Right to be Forgotten”)‌: You have the right to request permanent deletion of your personal data, in circumstances where the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent for processing, or our processing of your data no longer has a valid legal basis. This right is subject to our legal obligation to retain limited records for tax, product safety, and consumer dispute resolution purposes.
  • ‌Right to Restriction of Processing‌: You have the right to request that we suspend processing of your personal data, for example when you contest the accuracy of the data we hold, or when you object to our processing activities based on legitimate interest, pending verification of your request.
  • ‌Right to Data Portability‌: You have the right to receive all personal data you have provided to us in a structured, machine-readable, commonly used format, or request that we transfer this data directly to another data controller you specify, where technically feasible.
  • ‌Right to Object‌: You may object to our processing of your personal data that is based on legitimate interest at any time, on grounds related to your specific personal situation. We will stop processing your data unless we can demonstrate compelling legitimate grounds for processing that override your rights, or the processing is required for the establishment, exercise, or defense of legal claims. You also have the absolute right to object to direct marketing activities at any time, with immediate effect.
  • ‌Right to Withdraw Consent‌: For all processing activities that are based on your explicit consent, you may withdraw that consent at any time. This withdrawal will not affect the lawfulness of any processing that was carried out before your consent was revoked.
  • ‌Right to Lodge a Complaint‌: If you believe that our processing of your personal data violates applicable data protection regulations, you have the right to submit a complaint to the relevant supervisory authority in your EU member state of residence, or in France with the Commission nationale de l’informatique et des libertés (CNIL).

We have also fully implemented the 2026 French e-commerce regulatory requirement that allows you to exercise your 14-day contract withdrawal right directly on our website, via a clearly marked “Rescind Contract Here” button that remains visible for the full 14-day cooling off period after you complete your order. This function is integrated directly with our personal data processing workflows, so any data processing related to the order that you withdraw from will be suspended immediately, except for data required to process your full refund.

6. Data Security and Protection Measures

We implement a multi-layered set of technical and organizational security measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or unlawful disclosure. These measures include end-to-end encryption for all data transmitted between your browser and our website, regular security audits of our server infrastructure, role-based access control that limits internal staff access to your personal data only to the extent required for their job responsibilities, staff data protection training conducted on a quarterly basis, and regular backup protocols that ensure no loss of order traceability data required for GPSR and product safety compliance.

We have aligned our data protection protocols with the requirements of upcoming EU Digital Fair Act provisions, to ensure that no misleading interface design patterns are used on [www.revebagages.com] to trick users into unintended consent to data processing, or force users to accept unnecessary collection of their personal information to access core e-commerce features. All our data collection prompts are clear, unbiased, and designed to give you full control over your information.

7. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our processing activities, new regulatory requirements including 2026 French e-commerce rules, updates to GDPR guidance, or changes to our operational practices. Any revised version of this policy will be published on this page on [www.revebagages.com], with a clearly marked updated effective date. For any changes that materially alter the scope of how we collect or process your personal data, we will send a direct notification to all registered users via email, to ensure you have full opportunity to review the changes before they take effect.

This Privacy Policy, published with an effective date of October 9, 2026, supersedes all previous versions of our data protection notices for the [www.revebagages.com] platform. If you have any questions, comments, or concerns about how we handle your personal data, do not hesitate to contact our team at moonst@revebagages.com, by phone at +33 6 5253 2306, or via post at 11 Rue de Berstheim, 67500 Haguenau, France. We are committed to upholding the highest standards of data privacy for every customer, as we strive to deliver a safe, trusted, and transparent shopping experience for all users of REVE DE BAGAGES.