Last updated: October 2026
This policy explains what personal data we collect on this website, why, how long we keep it and how you can exercise your rights under the GDPR.
1. Data controller
Zorro is responsible for your personal data.
2. What we collect
- Account: name, email address, password (stored hashed, never in plain text), a profile photo if you add one, notification preferences, and two-factor authentication settings if you turn it on.
- Orders: delivery address, phone number (optional), items ordered, amounts and coupon codes used. For a guest order: your email and address.
- Delivery: a photo of the delivered parcel may be taken as proof of delivery; it's shown on your order page.
- Payment: handled by Stripe. We only receive the payment status, never your full card details. If you choose a method such as Klarna, Amazon Pay or Apple Pay, that provider also receives the data needed for the payment (Klarna may check whether you can pay later) and handles it under its own privacy policy.
- Reviews: if you post a review, it's shown on the website with your name.
- Communication: contact form messages, newsletter sign-up, back-in-stock alerts, your wishlist.
- Technical data: IP address (used briefly to stop abuse, such as repeated sign-in attempts) and server logs. For each device signed in to your account: device and browser type, IP address and approximate location (city, country) worked out from the IP — shown only to you in Data & Privacy, so you can spot a device that isn't yours, and deleted when it signs out or after 8 days unused (12 hours if "Keep me signed in" wasn't ticked).
3. Why we use it and our legal basis
- To process, deliver and follow up your orders, run your account and answer your messages — performance of our contract with you.
- Invoicing and accounting — legal obligation.
- Keeping the website secure and preventing fraud — legitimate interest.
- A reminder email when a payment wasn't finished (sent once, no sooner than 2 hours later), or when items stay in your account's cart for a day (one reminder) — legitimate interest; you can turn it off in your account's notification settings. Never sent for guest orders.
- Newsletter and emails about new products and offers — your consent, which you can withdraw at any time with the unsubscribe link in every email.
4. Who receives it
We never sell your data. It's available to our team — including our own delivery staff, who get your name, address and phone number to deliver your order — and to the service providers we need to run the website:
- Stripe — payments; and, depending on the method you choose, Klarna, Amazon Pay, Apple or your bank;
- Brevo — sending emails;
- Vercel — website hosting; Supabase — database and photo storage;
- OpenStreetMap (Nominatim) — working out the distance between your address and our shop for the delivery price;
- Google (Gmail) — our email inbox, where messages sent through the contact form arrive.
Some providers may process data outside the European Union; these transfers are protected by appropriate safeguards (the European Commission's standard contractual clauses or the EU–US Data Privacy Framework).
5. How long we keep it
- Account: until it's deleted. An account whose email is never confirmed is deleted after 30 days.
- Orders and invoices: 10 years (accounting obligations).
- Newsletter: until you unsubscribe.
- Contact messages: as long as needed to reply, then at most 3 years.
- Technical security data: from a few minutes to a few days.
If you delete your account, your name, password, profile photo, addresses not used in an order, wishlist, reviews and newsletter sign-up are erased and you can no longer sign in. Orders you already placed (with the email and delivery address used) are kept for our accounting obligations.
6. Your rights
You have the right to access, correct, delete, restrict, port and object to the processing of your data, and to withdraw your consent. You can update your details, manage your notifications and delete your account yourself from your account pages, or write to us at zorrogroup24@gmail.com. You can also complain to the French data protection authority, the CNIL (www.cnil.fr).
7. Security
Encrypted connection (HTTPS), hashed passwords, optional two-factor authentication, and access to data limited to the people who need it.
8. Cookies
We only use cookies the website needs to work. See our Cookie Policy.
9. Changes
We may update this policy; the date of the last update is shown at the top of this page.
Preparing your fresh picks…