Skip to content

Privacy Policy

Last updated: 29 October 2026.

This policy explains how DS Wood Alsace collects, uses and protects your personal data when you visit the website dswood-alsace.com, place an order, create an account or contact us. It is drawn up in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

1. Data controller

The data controller is:

David SCHUDY, sole trader, trading as DSWOOD (“DS Wood Alsace”)
SIREN: 840 018 493
SIRET: 840 018 493 00014
Address: 39 rue Clemenceau, 67650 Dambach-la-Ville, France
Telephone: 06 33 00 19 63
Email: dswood.alsace@gmail.com

For any question about your data, write to us at dswood.alsace@gmail.com or by post to the address above.

2. Why we use your data, on what legal basis and for how long

2.1. Order, payment and delivery

  • Data: surname, first name, delivery and billing address, email address, telephone number, contents of the order, engraving text where applicable, chosen means of payment and payment confirmation. Bank card numbers are entered with the payment provider: we neither receive nor store them.
  • Legal basis: performance of the sales contract (Article 6.1.b of the GDPR) and legal accounting and invoicing obligations (Article 6.1.c).
  • Retention: for the duration of the contractual relationship and the handling of any claims, then 10 years for accounting records (invoices, proof of payment), in accordance with the French Commercial Code.
  • This data is necessary to process your order: without it, we cannot deliver it.

2.2. Customer account

  • Data: email address, name, saved addresses, order history, preferences.
  • Legal basis: performance of the service requested (Article 6.1.b).
  • Retention: as long as the account is active, then 3 years after your last activity. You can ask for your account to be deleted at any time.

2.3. Contact and after-sales service

  • Data: name, email address, telephone number and content of your message, sent through the contact form, by email or by telephone.
  • Legal basis: legitimate interest in answering your requests (Article 6.1.f) and, when you are preparing an order, pre-contractual measures taken at your request (Article 6.1.b).
  • Retention: the time needed to deal with your request, then 1 year. Exchanges relating to an order follow the retention period of the order.

2.4. Newsletter

  • Data: email address and date of your subscription.
  • Legal basis: your consent (Article 6.1.a), given by ticking the box provided or by entering your address in the footer form.
  • Retention: until you unsubscribe (link included in every message), then at most 3 years after your last contact with us. You can withdraw your consent at any time, free of charge.

2.5. Customer reviews displayed on the website

  • Data: first name (or initial of the surname) and text of the reviews voluntarily left by customers, in particular on the workshop’s Google listing.
  • Legal basis: legitimate interest in presenting our customers’ feedback (Article 6.1.f). You can ask for a review that concerns you to be removed.
  • Retention: as long as the review remains displayed, or until you ask for its removal.

2.6. Website security and fraud prevention

  • Data: IP address, technical information about your device and browser, transaction data.
  • Legal basis: legitimate interest in securing the shop and payments (Article 6.1.f).
  • Retention: the period strictly necessary for these checks, as defined by our providers (Shopify and the payment providers).

2.7. Visitor statistics

  • Data: pages viewed, products viewed, origin of the visit, type of device, IP address.
  • Legal basis: your consent (Article 6.1.a), collected through the cookie banner, before any non-essential tracker is placed.
  • Retention: 13 months at most for trackers.

We do not take any decision based solely on automated processing that produces legal effects concerning you. We do not collect sensitive data (health, opinions, origin) and we never sell your data.

3. Who receives your data

Your data is intended for DS Wood Alsace. It is only passed on to the providers below, to the extent necessary for their task, and to authorities that request it in the context of a legal obligation.

  • Shopify International Limited (Ireland) and the companies of the Shopify group, including Shopify Inc. (Canada): website hosting, shop, basket, checkout, customer accounts, order emails, newsletter, statistics and fraud prevention. Shop Pay, the accelerated payment service offered by Shopify, is used only if you choose it. Policy: shopify.com/legal/privacy.
  • Payment providers: Shopify Payments (operated in the European Union by Stripe Payments Europe Ltd, Ireland), PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and, depending on the device you use, Apple Pay (Apple Distribution International Ltd, Ireland) or Google Pay (Google Ireland Limited). Each provider processes your payment data on its own behalf, under its own privacy policy.
  • Carriers: Colissimo (La Poste) and, where applicable, Mondial Relay, for delivering your parcel. They receive your name, delivery address, telephone number and email address.
  • Adobe Inc. (United States, via Adobe Systems Software Ireland Ltd in Ireland): Adobe Fonts service, which supplies the website’s typefaces. Your browser downloads the fonts from Adobe’s servers, which receive your IP address and technical information about your browser on that occasion.
  • Wistia, Inc. (United States): player for the workshop’s presentation videos. Wistia’s servers are only contacted when you start playing a video; Wistia then receives your IP address and information about your device.
  • Elfsight (publisher of the module that displays the Instagram feed, a company established outside the European Union) and Meta Platforms Ireland Limited (Instagram): the Instagram feed is only loaded after your consent. Otherwise, the website only displays a link to our Instagram account.
  • Google: the website contains a link to our Google listing. No Google tracker is placed by our website; if you click on this link, Google processes your data under its own policy. Our email service (dswood.alsace@gmail.com) is also hosted by Google.
  • Social networks (Instagram, Facebook, LinkedIn): the website only contains links. No data is exchanged as long as you do not click.

4. Transfers of data outside the European Union

Some of the providers mentioned above (Shopify Inc. in Canada, Adobe, Wistia, Elfsight, Google, Meta) may process data outside the European Union, in particular in Canada and the United States. These transfers are governed by an adequacy decision of the European Commission (in particular the EU-US Data Privacy Framework for certified companies) or, failing that, by the European Commission’s standard contractual clauses. You can obtain further information by writing to us at dswood.alsace@gmail.com.

5. Cookies and trackers

A cookie is a small file saved on your device when you visit a website. We distinguish two categories:

  • Strictly necessary cookies: basket, session, security, payment, language and currency. They are essential for the shop to work and do not require your consent.
  • Audience measurement, personalisation and marketing cookies: visitor statistics and third-party content (Instagram feed). They are only placed after you have consented.

On your first visit, a banner lets you accept, refuse or customise these cookies. Your choice is remembered, and you can change it at any time from the same banner or from your browser settings. Refusing non-essential cookies does not prevent you from placing an order.

6. Security

Exchanges with the website are encrypted (HTTPS). Payments are processed by PCI-DSS certified providers. We limit access to your data to those who need it and choose providers that offer sufficient security guarantees.

7. Your rights

You have the following rights over your data:

  • the right of access and to obtain a copy of your data;
  • the right to rectification of inaccurate data;
  • the right to erasure;
  • the right to restriction of processing;
  • the right to object, in particular to receiving marketing;
  • the right to data portability;
  • the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
  • the right to set directives regarding the fate of your data after your death.

To exercise them, write to us at dswood.alsace@gmail.com or by post to the address given in article 1. We may ask you for proof of identity in case of doubt. We reply within one month, which may be extended by two months for complex requests.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the CNIL (the French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

8. Changes to this policy

We may update this policy to take account of changes to the website, to our providers or to the regulations. The version in force is the one published on this page, with its update date.