Privacy policy

Last updated: 15 August 2026

1. Data controller

SHIVA BLENDS (SARL), registered under SIREN 999 659 709 (registered-office SIRET 999 659 709 000 11), with its registered office at 153 route de Cardonnac, 81170 Noailles, France. Contact: hello@shivablends.com.

2. What we collect

• Order data: name, billing / delivery addresses, e-mail, telephone, contents of the order.
• Payment data: processed directly by Viva.com. We do not store card details.
• Account data (if you create an account): e-mail, password hash, preferences.
• Enquiries: name, e-mail and the content of messages sent through our contact or reseller forms.
• Technical data: IP address, browser, pages visited, used to run and secure the Site.

3. Purposes & legal bases

• Order processing & customer service — performance of the contract.
• Compliance with legal obligations — accounting retention of invoices and orders.
• Adults-only access — legitimate interest. The site shows an age confirmation on the first visit. It is a declaration on your honour, recorded in a cookie in your browser: no date of birth is requested, and no age data is kept on our servers.
• Service improvement & security — legitimate interest.
• Marketing communications — consent (you can unsubscribe at any time).

4. Data sharing

We share data only with processors that help us run the service: payment provider (Viva.com), hosting (Vercel), shipping (Boxtal and the selected carrier), e-mail tools, analytics. All are bound by contractual data-protection commitments. We do not sell personal data.

4.1 Shipping — Boxtal and carriers

Our shipments are handled through Boxtal (a company established in France), which connects us to the carriers (Mondial Relay, Colissimo, Chronopost, Delivengo). Three distinct processings take place:

• Rate estimates. From our servers, we send Boxtal the destination country and postcode and the weight and dimensions of the parcel. Neither your name, nor your e-mail, nor your street is sent at this stage.
• Pick-up point search. If you choose a pick-up point, we send Boxtal, from our servers, the country, postcode, town and, where applicable, the street you entered, to offer you nearby points. No Boxtal script is loaded in your browser at this stage.
• Shipping the order. Once the order is paid, we send Boxtal, which passes them on to the chosen carrier, the data needed for the label and the delivery: first and last name, full address, postcode, town, country, e-mail and, for pick-up point deliveries, a mobile telephone number — the latter being required by the carrier to tell you the parcel is available. The e-mail and telephone are used for the delivery notifications sent by the carrier.

Legal basis: performance of the contract (article 6.1.b GDPR). This data is kept by Boxtal and the carrier for their own retention periods, in particular as proof of delivery and to handle disputes.

5. International transfers

Some processors may operate outside the EEA. In that case, transfers are covered by appropriate safeguards (Standard Contractual Clauses or equivalent).

6. Retention periods

• Orders and invoices: 10 years from the close of the financial year (article L. 123-22 of the French Commercial Code). This retention is a legal obligation and survives the deletion of the account: the invoice stays archived even if the customer account is erased.
• Account data: for as long as the account is active; deleted on request, with the exception of the accounting records above.
• Enquiries: 3 years after the last contact.
• Newsletter: for as long as the subscription is active. After you unsubscribe, we keep the record of your objection — the address and the date — so that we no longer write to you and can prove it. You can ask for its permanent erasure at any time.

7. Your rights

You may access, rectify, erase or object to the processing of your data, request its portability, restrict its processing, or set instructions for the use of your data after your death. Write to hello@shivablends.com. You may also lodge a complaint with the French data-protection authority, the Commission nationale de l'informatique et des libertés (CNIL).

8. Cookies

We use cookies that are strictly necessary for the basket and for payment (for example the sb_cart cookie), together with a cookie recording your age confirmation and your display language. These three uses are necessary for the site to work and serve neither analytics nor advertising.

Analytics or marketing cookies, if they are added later, will be subject to your prior consent through a cookie banner.

9. Minors

Our Site is intended for adults aged 18 and over. We do not knowingly collect data relating to minors.

10. Changes

We may update this policy. Substantial changes will be flagged on this page.

This page is a courtesy translation. In the event of any discrepancy between the French and English versions, the French version prevails.