Preamble
L'Atelier de la Route du Rhum (Z.T. RHUM) takes the protection of your personal data seriously. This policy explains what data we collect when you browse the site, create an account, or book a workshop, why we collect it, how long we keep it, and what rights you can exercise, in accordance with the General Data Protection Regulation (GDPR) and French data protection law.
Data Controller
The controller responsible for the personal data collected on this site is Z.T. RHUM, a French SARL with a share capital of €1,000, registered with the Compiègne Trade and Companies Register under number 921 489 381, with its registered office at 12 rue des Cordeliers, 60200 Compiègne, France. It can be contacted at contact@atelier-route-du-rhum.com or +33 6 41 42 00 28. For full details on the publisher and hosting of this site, see our Legal Notice.
Data We Collect
Depending on how you use the site, we collect the following categories of data:
User Account
Name, email address, password (stored encrypted, never in plain text), optional phone number, and for business accounts, company name and registration number.
Google Sign-in
If you sign in with Google, we receive your name, email address, and Google ID — never your Google password.
Orders and Payment
The details of your orders (products, workshops, gift cards) and your delivery address where applicable. Your banking details never pass through our servers: payment is processed entirely by Stripe on its own secure site.
Workshop Participants
First name, last name, email, and phone number of participants registered for a workshop, including when they differ from the buyer (booking for someone else or for a company group).
Browsing and Cookies
IP address, pages visited, and session duration, collected only if you accept analytics cookies via the banner shown on your first visit.
Why We Collect It
This data is processed to fulfil your order or booking (contract performance), issue invoices (legal accounting obligation), manage your account and prevent fraud (legitimate interest), and measure site traffic (consent, revocable at any time). We never sell any data to third parties and never use it for targeted advertising.
Who Has Access to Your Data
Your data is only shared with the providers strictly necessary to operate the site, each acting as a processor under a GDPR-compliant contract:
- •Stripe Payments Europe, Ltd. — card payment processing.
- •Resend — sending transactional emails (order confirmation, invoices, gift cards).
- •Google — authentication via Google OAuth and traffic measurement via Google Analytics, if you consent.
- •Vercel Inc. and Railway Corporation — technical hosting of the site and API (see our Legal Notice for their contact details).
How Long We Keep It
| User Account | For the entire duration of our relationship, then 3 years after your last activity, unless you request earlier deletion. |
| Invoices and Accounting Data | 10 years, in accordance with our legal obligation to retain accounting records under French commercial law. |
| Analytics Cookies | 13 months maximum, in line with CNIL recommendations. |
How We Protect It
Your passwords are stored encrypted and are never readable, including by us. Exchanges with the site are encrypted (HTTPS), and access to your account is protected by a secure authentication token. Access to data by our team is limited to those who genuinely need it to process your order.
Cookies
A banner lets you accept or refuse analytics cookies (Google Analytics) from your first visit. Cookies strictly necessary for the site to function (cart, login session) are not subject to consent. You can change your choice at any time via the "Manage cookies" link at the bottom of every page. We use no advertising cookies and sell no data to third parties.
Your Rights
Under the GDPR, you have the following rights over your personal data:
- •Right of access to your data
- •Right to rectification of inaccurate data
- •Right to erasure ("right to be forgotten")
- •Right to data portability
- •Right to restriction and objection to processing
- •Right to define what happens to your data after your death
To exercise any of these rights, write to us at contact@atelier-route-du-rhum.com. If you believe your rights are not being respected after contacting us, you may lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.
Changes to This Policy
We may update this policy at any time, in particular to remain compliant with changes in the law. The version in force is the one published on this page on the date of your visit.