Privacy policy

1. Purpose and Scope of the Policy


JEROME DREYFUSS attaches the utmost importance and care to the protection of privacy and Personal Data, as well as compliance with the provisions of Applicable Legislation.

Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such Data (hereinafter the “GDPR”) states that Personal Data must be processed lawfully, fairly and transparently. Accordingly, this privacy policy (hereinafter the “Policy”) aims to provide you with simple and clear information about the Processing of Personal Data concerning you, in connection with your browsing and the activities carried out on our website.

2. Data Controller


In connection with your activity on the website www.jerome-dreyfuss.com, we collect and use Personal Data relating to you, as a natural person (hereinafter the “Data Subject”).

For all Processing activities, JEROME DREYFUSS SARL 108 is a French limited liability company (SARL) with a share capital of €100,000, registered with the Paris Trade and Companies Register under number RCS 501 408 173 00059, whose registered office is located at 31 rue Charlot, 75003 Paris, and determines the means and purposes of the Processing. We therefore act as the Data Controller within the meaning of the regulations relating to Personal Data, and in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such Data.

3. What Personal Data do we collect and how?


When using our website or when you interact with our customer service, you provide us with a certain amount of information about yourself, some of which may identify you (“Personal Data”). This is the case when you browse our website, when you complete online forms, when you create your customer account, when you contact our customer service or simply when you place an order on our online store.

The nature and type of Personal Data collected about you vary depending on your interactions with JEROME DREYFUSS, the main categories being:

Identification Data

This includes all information that enables us to identify you, such as your surname, first name and telephone number. We may also collect your email address, as well as your postal address, delivery address and billing address (in the event of payment, the billing address is required to issue an invoice).

Login Data

This includes all information required to access your personal account, such as your password and other information necessary for authentication and access to an account.

We also collect your IP address for maintenance and statistical purposes.

Financial Data

This refers to banking information such as bank account details.

Documents of Various Types

Documents of various types (PDF, Office format, Image) with titles, content, folder names or information relating to a document, such as comments written in the documents, alert dates and reminder dates. In the event of a dispute, you may also be asked to provide proof of identity and a handwritten declaration on honour.

Browsing Information

When browsing our website, you interact with it. As a result, certain information relating to your browsing is collected.

4. Why do we collect your Personal Data and how?


We collect your Personal Data for specific purposes and on various legal grounds.

For the performance of the contract or pre-contractual measures

Your Data is processed for the following purposes:

  • Order and purchase management;
  • Contract management;
  • Management of your customer account;
  • Management of requests made to customer service;
  • Management of complaints and after-sales service;
  • Management of rights requests;
  • Delivery management;
  • Management of online returns;
  • Management of claims against carriers.

On the basis of your consent

Your Data is processed for the following purposes:

  • Carrying out commercial and marketing prospecting activities;
  • Transfer of your Data to our business partners;
  • Newsletter management;
  • Management of cookies requiring your consent;
  • Management of customer events;
  • Invitations to partner sales events (Arlettie).

On the basis of JEROME DREYFUSS’s legitimate interest

Your Data is processed for the following purposes:

  • Preparation of statistics to improve products and services;
  • Analysis of the customer journey and customer lifecycle;
  • Conducting satisfaction surveys and polls;
  • Management of pre-litigation and litigation.

In accordance with the legal and regulatory obligations to which JEROME DREYFUSS is subject

Your Data is processed for the following purposes:

  • Fraud prevention;
  • Prevention of money laundering and terrorist financing;
  • Maintenance of general and subsidiary accounting records;
  • Billing management.

5. Do we share your Personal Data?


Your Data is intended for authorised JEROME DREYFUSS employees responsible for managing and performing contracts and legal obligations, depending on the purposes of the collection and within the scope of their respective responsibilities.

For certain tasks relating to these purposes, and within the scope of their respective duties and authorisations, your Data may be disclosed to the following recipients:

  • Entities of the JEROME DREYFUSS Group as part of the outsourcing of an activity to another group entity;
  • Service providers and processors whom we engage to carry out a range of operations and tasks on our behalf, including:
    • Payment and transaction security service providers for fraud prevention: Shopify, Alma, Adyen, Paypal, Global-e;
    • Logistics provider: C-LOG;
    • Transport providers: DHL, UPS, Global-e;
    • CRM provider: Splio;
    • Third parties providing IT services: Antadis, Cod4IS, Superspace;
  • Business partners only where you have expressly consented through a checkbox included in our Data collection forms;
  • Jérôme Dreyfuss Vintage with our partner Faume;
  • Duly authorised public authorities (judicial, supervisory, etc.) as part of our legal and regulatory obligations;
  • Regulated professionals (lawyers, bailiffs, etc.) who may intervene in connection with the implementation of guarantees, debt recovery or litigation.

When your Data is disclosed to our service providers and processors, they are also required not to use the Data for purposes other than those initially intended. We take all necessary measures to ensure that these Third Parties maintain the confidentiality and security of your Data.

In all cases, only the Data necessary for the relevant purpose is provided. We take all necessary measures to ensure the secure communication or transfer of your Data.

We do not sell your Data.

6. Is your Personal Data transferred to third countries?


JEROME DREYFUSS endeavours to retain Personal Data in France, or at least within the European Economic Area (EEA).

However, the Data we collect when you use our platform or in connection with our services may be transferred to other countries. This may be the case, for example, if some of our service providers are located outside the European Economic Area.

In the event of such a Transfer, we guarantee that it will be carried out:

  • To a country providing an adequate level of protection, i.e. a level of protection equivalent to that required by European regulations;
  • Under standard contractual clauses;
  • Under binding corporate rules.

7. How long do we retain your Personal Data?


We retain your Personal Data only for as long as necessary to fulfil the purpose for which we hold such Data, in order to meet your needs or comply with our legal obligations.

Retention periods vary depending on several factors, such as:

  • The needs of JEROME DREYFUSS’s activities;
  • Contractual requirements;
  • Legal obligations;
  • Recommendations from supervisory authorities.

The retention periods for your Data are as follows:

  • Order and purchase management: 5 years from the date of the first purchase
  • Contract management: For the duration of the contractual relationship, then 5 years
  • Management of your customer account: 5 years from the date the customer account was created
  • Management of requests made to customer service: For the duration of the contractual relationship, then 5 years
  • Management of complaints and after-sales service: For the duration of the contractual relationship, then 5 years
  • Management of rights requests: For requests to exercise rights under the GDPR, the data is retained for the duration of the processing of your request, then for an additional 6 years
  • Delivery management: For the duration of the contractual relationship, then 5 years
  • Management of claims against carriers: For the duration of the contractual relationship, then 5 years
  • Carrying out commercial and marketing prospecting activities: 3 years
  • Transfer of your Data to our business partners: 3 years
  • Newsletter management: 3 years
  • Management of cookies requiring your consent: 6 months
  • Management of customer events and invitations to partner sales events (Arlettie): 1 year following the end of the event, then 3 years from the last contact
  • Preparation of statistics to improve products and services: For the period necessary to achieve the purpose of the statistics or until the right to object is exercised
  • Analysis of the customer journey and customer lifecycle: For the entire duration of the business relationship
  • Conducting satisfaction surveys and polls: For the period necessary to achieve the purpose of the survey or until the right to object is exercised or consent is withdrawn
  • Management of pre-litigation and litigation: 5 years
  • Fraud prevention: 5 years
  • Prevention of money laundering and terrorist financing: 5 years
  • Maintenance of general and subsidiary accounting records: 10 years
  • Billing management: 10 years

8. How do we ensure the security of your Personal Data?


JEROME DREYFUSS undertakes to protect the Personal Data we collect or process against loss, destruction, alteration, unauthorised access or disclosure.

Accordingly, we implement all appropriate technical and organisational measures, depending on the nature of the Data and the risks associated with its Processing. These measures are intended to preserve the security and confidentiality of your Personal Data. They may include practices such as restricting access to Personal Data to authorised persons based on their functions, pseudonymisation or encryption.

In addition, our practices and policies and/or physical and/or logical security measures (secure access, authentication procedures, backup copies, software, etc.) are regularly reviewed and updated where necessary.

9. What are your rights?


The GDPR grants Data Subjects rights that they may exercise. These include:

  1. Right to information: the right to receive clear, precise and comprehensive information about the use of Personal Data by JEROME DREYFUSS.
  2. Right of access: the right to obtain a copy of the Personal Data held by the Data Controller concerning the requester.
  3. Right to rectification: the right to have Personal Data rectified if it is inaccurate or outdated and/or completed if it is incomplete.
  4. Right to erasure / right to be forgotten: the right, under certain conditions, to have Data erased or deleted, unless JEROME DREYFUSS has a legitimate interest in retaining it.
  5. Right to object: the right to object to the Processing of Personal Data by JEROME DREYFUSS on grounds relating to the requester’s particular situation (subject to conditions).
  6. Right to withdraw consent: the right to withdraw Consent at any time where the Processing is based on Consent.
  7. Right to restriction of Processing: the right, under certain conditions, to request that the Processing of Personal Data be temporarily suspended.
  8. Right to Data portability: the right to request that Personal Data be provided in a reusable format enabling it to be used in another database.
  9. Right not to be subject to an automated decision: the right for the requester to refuse entirely automated decision-making and/or to exercise the additional safeguards provided in this respect.
  10. Right to define post-mortem directives: the right for the requester to define directives concerning what happens to their Personal Data after their death.

Additional rights may be granted to Data Subjects by local regulations.

For this purpose, JEROME DREYFUSS has implemented a Data Subject rights management procedure in accordance with the requirements of Applicable Legislation. This procedure establishes:

  • The standards to be followed to ensure transparent information for Data Subjects;
  • The legal requirements that must be complied with;
  • The authorised means of submitting a request for each right, depending on the category of Data Subject;
  • The operational processes for handling these requests in accordance with the aforementioned requirements;
  • The parties involved in these processes, their roles and responsibilities.

To exercise your rights, you may contact the Data Protection Officer (DPO): dpo@jerome-dreyfuss.com.

When you submit a request to exercise a Right, you are asked to specify, as far as possible, the scope of the request, the type of right being exercised, the Personal Data Processing concerned and any other useful information, in order to facilitate the examination of your request. In addition, in the event of reasonable doubt, you may be asked to provide proof of your identity.

You also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, regarding the way in which [JEROME DREYFUSS] collects and processes your data.

10. Updates to this Policy


This Policy may be regularly updated to take account of changes in regulations relating to Personal Data.

Last updated: 09/10/2025.