Privacy policy

1. Purpose and Scope of the Privacy Policy


JEROME DREYFUSS attaches the utmost importance and care to the protection of privacy and Personal Data, as well as compliance with applicable legislation.

Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such Data (hereinafter the “GDPR”) provides that Personal Data must be processed lawfully, fairly and transparently. Accordingly, this privacy policy (hereinafter the “Policy”) aims to provide you with clear and straightforward information about the Processing of Personal Data concerning you, in connection with your browsing and the activities carried out on our website.

2. Data Controller


When you use the website www.jerome-dreyfuss.com, we collect and use Personal Data relating to you, as a natural person (hereinafter the “Data Subject”).

For all Processing activities, JEROME DREYFUSS SARL 108, a French limited liability company (SARL) with share capital of €100,000, registered with the Paris Trade and Companies Register under number RCS 501 408 173 00059, whose registered office is located at 31 rue Charlot, 75003 Paris, determines the means and purposes of the Processing. We therefore act as the Data Controller within the meaning of the regulations relating to Personal Data, and in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such Data.

3. What Personal Data do we collect and how?


When using our website or when you communicate with our customer service, you provide us with a certain amount of information about yourself, some of which may identify you (“Personal Data”). This is the case when you browse our website, when you complete online forms, when you access your customer account, when you contact our customer service or simply when you place an order on our online store.

The nature and type of Personal Data collected about you vary depending on your interactions with JEROME DREYFUSS. The main categories are as follows:

Identification Data

This includes all information that may enable us to identify you, such as your last name, first name and telephone number. We may also collect your email address, as well as your postal address, delivery address and billing address (in the event of payment, the billing address is required to generate an invoice).

Login Data

This refers to the information necessary to authenticate you and provide access to your customer account. You can access your account without a password: you enter your email address and receive a one-time 6-digit verification code by email to access your account.

We also collect your IP address for maintenance and statistical purposes.

Financial Data

This refers to banking information such as bank account details.

Documents of Various Types

Documents of various types (PDF, Office formats, images) containing titles, content, folder names or information relating to a document, such as comments written in the documents, alert and reminder dates. In the event of a dispute, proof of identity and a handwritten declaration on honour may also be requested.

Browsing Information

When browsing our website, you interact with it. As a result, certain information relating to your browsing is collected.

4. Why do we collect your Personal Data and how?


We collect your Personal Data for specific purposes and on different legal bases.

For the performance of the contract or pre-contractual measures

Your Data is processed for the following purposes:

  • Management of orders and purchases;
  • Management of contracts;
  • Management of your customer account;
  • Management of requests made to customer service;
  • Management of complaints and after-sales service;
  • Management of rights requests;
  • Management of deliveries;
  • Management of online returns;
  • Management of complaints relating to carriers.

On the basis of your consent

Your Data is processed for the following purposes:

  • Commercial and marketing prospecting;
  • Transmission of your Data to our business partners;
  • Management of the newsletter;
  • Management of cookies requiring your consent;
  • Management of customer events;
  • Invitation to partner sales events (Arlettie).

On the basis of JEROME DREYFUSS’s legitimate interest

Your Data is processed for the following purposes:

  • Production of statistics to improve products and services;
  • Analysis of the customer journey and customer lifecycle;
  • Conducting satisfaction surveys and polls;
  • Management of pre-litigation and litigation.

For compliance with the legal and regulatory obligations to which JEROME DREYFUSS is subject

Your Data is processed for the following purposes:

  • Fraud prevention;
  • Prevention of money laundering and terrorist financing;
  • Maintenance of general and auxiliary accounting records;
  • Billing management.

5. Do we share your Personal Data?


Your Data is intended for authorised JEROME DREYFUSS employees responsible for managing and performing contracts and legal obligations, depending on the purposes of the collection and within the limits of their respective duties.

It may also be disclosed for certain tasks related to these purposes, and within the limits of their respective duties and authorisations, to the following recipients:

  • Entities of the JEROME DREYFUSS Group in the event of outsourcing an activity to another group entity;
  • Service providers and processors that we use to carry out a range of operations and tasks on our behalf, including:
    • Payment service and transaction fraud prevention providers: Shopify, Alma, Adyen, Paypal, Global-e;
    • Logistics provider: C-LOG;
    • Carriers: DHL, UPS, Global-e;
    • CRM provider: Splio;
    • Third parties providing IT services: Antadis, Cod4IS, Superspace;
  • Business partners, only where you have expressly consented through a checkbox included in our Data collection forms;
  • Jérôme Dreyfuss Vintage with our partner Faume;
  • Duly authorised public authorities (judicial, regulatory and other authorities), in connection with our legal and regulatory obligations;
  • Regulated professionals (lawyers, bailiffs, etc.) who may intervene in connection with the implementation of guarantees, debt collection or litigation.

When your Data is disclosed to our service providers and processors, they are also required not to use the Data for purposes other than those initially intended. We take all necessary measures to ensure that these Third Parties maintain the confidentiality and security of your Data.

In all cases, only the Data necessary for the relevant purpose is provided. We take all necessary measures to ensure the secure communication or transmission of your Data.

We do not sell your Data.

6. Is your Personal Data transferred to Third Countries?


JEROME DREYFUSS endeavours to keep Personal Data in France, or at least within the European Economic Area (EEA).

However, it is possible that the Data we collect when you use our platform or as part of our services may be transferred to other countries. This may be the case, for example, if some of our service providers are located outside the European Economic Area.

In the event of such a Transfer, we ensure that it is carried out:

  • To a country providing an adequate level of protection, meaning a level of protection equivalent to that required by European regulations;
  • On the basis of standard contractual clauses;
  • On the basis of binding corporate rules.

7. How long do we retain your Personal Data?


We retain your Personal Data only for as long as necessary to fulfil the purpose for which we hold such Data, in order to meet your needs or comply with our legal obligations.

Retention periods vary depending on several factors, such as:

  • The needs of JEROME DREYFUSS’s activities;
  • Contractual requirements;
  • Legal obligations;
  • Recommendations from supervisory authorities.

Your Data is retained for the following periods:

  • Management of orders and purchases: 5 years from the date of the first purchase
  • Management of contracts: For the duration of the contractual relationship, then 5 years
  • Management of your customer account: 5 years from the creation of your customer profile
  • Management of requests made to customer service: For the duration of the contractual relationship, then 5 years
  • Management of complaints and after-sales service: For the duration of the contractual relationship, then 5 years
  • Management of rights requests: For requests to exercise rights under the GDPR, Data is retained for the duration of the processing of your request, then for an additional 6 years
  • Management of deliveries: For the duration of the contractual relationship, then 5 years
  • Management of complaints relating to carriers: For the duration of the contractual relationship, then 5 years
  • Commercial and marketing prospecting: 3 years
  • Transmission of your Data to our business partners: 3 years
  • Management of the newsletter: 3 years
  • Management of cookies requiring your consent: 6 months
  • Management of customer events and invitations to partner sales events (Arlettie): 1 year following the end of the event, then 3 years from the last contact
  • Production of statistics to improve products and services: For the period necessary to achieve the purpose of the statistics or until the exercise of the right to object
  • Analysis of the customer journey and customer lifecycle: For the entire duration of the commercial relationship
  • Conducting satisfaction surveys and polls: For the period necessary to achieve the purpose of the survey or until the exercise of the right to object or withdrawal of consent
  • Management of pre-litigation and litigation: 5 years
  • Fraud prevention: 5 years
  • Prevention of money laundering and terrorist financing: 5 years
  • Maintenance of general and auxiliary accounting records: 10 years
  • Billing management: 10 years

8. How do we ensure the security of your Personal Data?


JEROME DREYFUSS undertakes to protect the Personal Data we collect or process against loss, destruction, alteration, unauthorised access or disclosure.

We therefore implement all appropriate technical and organisational measures, taking into account the nature of the Data and the risks associated with its Processing. These measures are intended to preserve the security and confidentiality of your Personal Data. They may include practices such as restricting access to Personal Data to authorised persons based on their duties, pseudonymisation or encryption.

In addition, our practices and policies and/or physical and/or logical security measures (secure access, authentication processes, backups, software, etc.) are regularly reviewed and updated where necessary.

9. What are your rights?


The GDPR provides Data Subjects with rights that they may exercise. These include:

  1. Right to information: the right to receive clear, precise and complete information about the use of Personal Data by JEROME DREYFUSS.
  2. Right of access: the right to obtain a copy of the Personal Data held by the Data Controller concerning the requester.
  3. Right to rectification: the right to have Personal Data rectified if it is inaccurate or outdated and/or completed if it is incomplete.
  4. Right to erasure / right to be forgotten: the right, under certain conditions, to have Data erased or deleted, unless JEROME DREYFUSS has a legitimate interest in retaining it.
  5. Right to object: the right to object to the Processing of Personal Data by JEROME DREYFUSS for reasons relating to the requester’s particular situation (subject to conditions).
  6. Right to withdraw consent: the right to withdraw Consent at any time where the Processing is based on Consent.
  7. Right to restriction of Processing: the right, under certain conditions, to request that the Processing of Personal Data be temporarily suspended.
  8. Right to Data portability: the right to request that Personal Data be provided in a reusable format allowing it to be transferred to another Data system.
  9. Right not to be subject to automated decision-making: the right to refuse fully automated decision-making and/or to exercise the additional safeguards provided in this regard.
  10. Right to define post-mortem directives: the right to define directives concerning what should happen to Personal Data after death.

Additional rights may be granted to Data Subjects under applicable local regulations.

To this end, JEROME DREYFUSS has implemented a Data Subject rights management procedure in accordance with the requirements of applicable legislation. This procedure establishes:

  • The standards to be followed to ensure transparent information for Data Subjects;
  • The legal requirements that must be complied with;
  • The authorised means of submitting a request for each right, depending on the category of Data Subject;
  • The operational processes for handling these requests in accordance with the aforementioned requirements;
  • The parties involved in these processes, together with their roles and responsibilities.

To exercise your rights, you may contact the Data Protection Officer (DPO): dpo@jerome-dreyfuss.com.

When submitting a request to exercise a right, you are asked to specify, as far as possible, the scope of the request, the type of right being exercised, the Processing of Personal Data concerned and any other useful information, in order to facilitate the review of your request. In addition, where there is reasonable doubt, you may be asked to provide proof of your identity.

You also have the right to lodge a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés – CNIL), 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, regarding the way in which [JEROME DREYFUSS] collects and processes your Data.

10. Updates to this Policy


This Policy may be updated regularly to take into account changes in regulations relating to Personal Data.

Last updated: 14/09/2026.