This Privacy Policy explains how Dragon Digital SAS, trading as Dragon Digital SAS, collects and uses personal data through www.dragondigital.fr (the “Website”), including ecommerce orders, enquiries and newsletter activity.
1. Data controller
Data controller: Lisa Jones
Business address: 10 Rue des Coudriers, La Coudre, Argentonnay 79150 FRANCE
Privacy contact email: contact@dragondigital.fr
Data Protection Officer (if appointed): Lisa Jones
2. Personal data we may collect
- Identity and contact data, such as name, email address, telephone number, billing address and delivery address.
- Order and transaction data, including products ordered, order history, delivery information, refunds and customer-service records.
- Payment-related information. The Website should avoid storing full payment-card details where payment is handled by an external payment processor.
- Account data, if customer accounts are enabled.
- Enquiry and correspondence data submitted through forms, email or customer support.
- Marketing preferences and newsletter subscription information.
- Technical and usage data, such as IP address, device/browser information, security logs and cookie/analytics information where applicable.
3. Why we process personal data and legal bases
| Purpose | Typical data | Likely legal basis |
| Process orders, payment, delivery, returns and customer service | Identity, contact, order and transaction data | Performance of a contract |
| Accounting, tax, fraud prevention and legal record keeping | Transaction and relevant identity data | Legal obligation and/or legitimate interests |
| Respond to enquiries before a purchase | Contact details and enquiry content | Pre-contractual steps / legitimate interests |
| Send marketing or newsletters where permitted | Contact and preference data | Consent, or another lawful basis where specifically permitted |
| Website security and prevention of abuse | Technical and security data | Legitimate interests |
| Non-essential analytics, advertising or third-party tracking | Cookie identifiers and usage data | Consent where required |
4. Who receives personal data?
Data may be accessed by authorised personnel and service providers that need it to operate the Website and professional advisers or authorities where legally required.
5. How long data is kept
Personal data is kept only for as long as necessary for the purpose for which it was collected and for any applicable legal, accounting, tax, warranty or dispute periods. The client should complete and approve the operational retention schedule below.
| Data category | Retention period / rule |
| Orders and invoices | 10 years |
| Customer enquiries | 3 years from last contact |
| Customer accounts | While account is active; review/delete after 2–3 years inactivity |
| Newsletter data | Until unsubscribe/withdrawal, with inactive prospect data normally limited to 3 years from collection or last genuine contact |
| Cookie consent records | 6 months |
| Security logs | 6–12 months |
6. Your data-protection rights
Subject to the conditions in applicable law, individuals may have rights of access, rectification, erasure, restriction, objection and data portability. Where processing relies on consent, consent may be withdrawn at any time without affecting processing already carried out lawfully.
Requests should be sent to contact@dragondigital.fr. The business may need to verify identity before acting on a request. Individuals also have the right to lodge a complaint with the CNIL, the French data-protection authority.
8. Marketing
Marketing emails should only be sent where there is an appropriate lawful basis. Every marketing email should provide a simple way to unsubscribe. Withdrawing from marketing does not prevent the business from sending necessary transactional communications about an order.
9. Cookies
The Website uses cookies and similar technologies as described in the Cookie Policy. Where consent is required, non-essential cookies should not be activated until consent is obtained.
10. Security
Appropriate technical and organisational measures should be used to protect personal data, including access controls, secure passwords, software updates, backups and secure payment processing. No internet system can be guaranteed completely secure.
11. Children
The Website is not intended to collect personal data from children unnecessarily. If products or services are specifically directed to children, the client should obtain tailored legal advice on the additional requirements.
12. Changes and contact
This policy may be updated when processing activities or suppliers change. Questions or rights requests: contact@dragondigital.fr. Effective date: 01/09/2025