Privacy policy
This policy explains what personal data we collect when you visit our online shop or place an order, why, how long we keep it, who we share it with and how to exercise your rights. It is written in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).
1. Data controller
OLA is a brand operated by GROUPE NEXT SAS, 3 allée des Châtaigniers, 95390 Saint-Prix, RCS Pontoise 991 963 364. The data controller is GROUPE NEXT SAS, a société par actions simplifiée with share capital of €1,000, 3 allée des Châtaigniers, 95390 Saint-Prix, France, 991 963 364 R.C.S. Pontoise.
For any question about your data: support@ola-product.com, or by post to the address above.
2. Data we collect
- Identity and contact details: last name, first name, email address, phone number (needed by the carrier to reach you), delivery and billing addresses.
- Order: products ordered, amount, purchase history, exchanges with customer service (emails and online chat messages), requests for returns, withdrawal or guarantee.
- Payment: payment is handled by our payment providers. We do not receive or keep your full card number; we receive only the payment confirmation and the last digits of the card.
- Technical and browsing data: IP address, type of device and browser, pages viewed, source of the visit, actions on the site, identifiers collected by cookies and similar technologies (see section 5).
- Subscription to our emails: where applicable, email address, date and source of the subscription, interactions with our messages.
Data is collected directly from you, or automatically as you browse. The information required to place an order is flagged at checkout: without it, we cannot fulfil the order.
3. Why we use it, on what basis and for how long
| Purpose | Legal basis | Retention period |
|---|---|---|
| Process your order: payment, preparation, shipping, tracking, invoice | Performance of the contract | For the duration of the order, then archiving for the limitation period (up to 5 years) |
| Customer service (email, online chat), returns, withdrawal, guarantees, delivery protection | Performance of the contract; legitimate interest in handling your requests | Duration of the guarantee and of the limitation period, up to 5 years after the last exchange |
| Accounting and tax obligations | Legal obligation | 10 years for accounting documents and invoices |
| Fraud prevention and site security | Legitimate interest | As long as needed for the analysis, then 12 months at most, unless there is a dispute |
| Sending emails about our products to our customers (similar products), where applicable | Legitimate interest, with a right to object at each mailing | 3 years from the last purchase or the last contact |
| Newsletter and offers sent to people who are not customers, where applicable | Consent | 3 years from the last active contact, or until you withdraw your consent |
| Audience measurement, browsing analysis, site improvement (Microsoft Clarity, Google) | Consent (non-essential trackers) | Cookies: 13 months at most; statistical data: 25 months at most |
| Advertising and campaign measurement (Google) | Consent | Cookies: 13 months at most; advertising data: for the period set by each partner, up to a maximum of 25 months |
| Compliance with our legal obligations (request from an authority, rights of individuals) | Legal obligation | As long as needed for the procedure |
At the end of these periods, data is deleted or anonymised.
4. Who receives your data
We do not sell your data. We entrust it to providers who act only on our instructions or for their own obligations:
| Recipient | Role |
|---|---|
| Shopify | Shop platform: hosting, management of orders and customers, order emails, payment and fraud prevention |
| Shopify Inbox | Online chat: the messages you type and the contact details you give there are used to reply to you |
| PayPal, Klarna, Apple Pay and the other payment providers offered at checkout | Collection of payment, refunds, authentication, fraud prevention. Klarna alone decides whether to accept payment in instalments, under its own terms and its own privacy policy. |
| Warehouses and carriers | Preparation and delivery of your parcel: they receive the recipient's name, delivery address and phone number, and usually their email. The warehouses are located in the European Union (Germany or Poland, depending on the product). |
| Microsoft (Microsoft Clarity) | Audience measurement and browsing analysis, with your consent |
| Audience measurement, conversion measurement and advertising, with your consent | |
| Email and customer support providers | Handling the emails and requests you send us |
| Authorities, on a legal request | Responding to a legal obligation or an order |
Delivery: sharing with warehouses and carriers
To deliver your order, your delivery data (name, address, recipient's phone number) is passed to the warehouses that prepare the parcel and to the carriers that deliver it. This is necessary for the parcel to reach you: without it, we cannot fulfil your order.
Transfers outside the European Economic Area
Some recipients are established outside the European Economic Area (for example Shopify in Canada, Google and Microsoft in the United States). In that case, the transfer is covered by a European Commission adequacy decision (for example the EU-US Data Privacy Framework for certified companies, or the decision that applies to Canada) or, failing that, by the European Commission's standard contractual clauses, with additional measures where necessary. You can ask for a copy at the address above.
5. Cookies and trackers
Strictly necessary cookies (cart, payment, security) work without your consent. The others (audience measurement and browsing analysis with Microsoft Clarity, measurement and advertising with Google) are set only after you consent, which you can refuse or withdraw at any time. You can also manage or delete cookies in your browser settings. For any question about trackers, write to us at support@ola-product.com.
6. Your rights
You have the following rights over your data:
- the right of access and to obtain a copy;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure, in the cases provided by law;
- the right to restriction of processing;
- the right to object, in particular to direct marketing, at any time and free of charge;
- the right to portability of the data you have given us;
- the right to withdraw your consent at any time, without affecting earlier processing;
- the right to give instructions about what happens to your data after your death (French law).
To exercise a right, write to support@ola-product.com or by post to GROUPE NEXT SAS, 3 allée des Châtaigniers, 95390 Saint-Prix, France. We may ask for proof of identity if we have doubts about who you are. We reply within one month, which can be extended by two months for complex requests, with prior notice. To stop receiving our marketing emails, click the unsubscribe link at the bottom of each message.
If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. If you live in another European Union country, you can also contact the data protection authority of your country.
7. Automated decisions
We make no decision that produces legal effects on you based solely on automated processing, apart from the anti-fraud checks carried out by our payment providers and, if you choose payment in instalments, the assessment made by Klarna, which may refuse this payment method. You can ask for a new human review of your order by writing to us.
8. Security
The site is served over an encrypted connection. Access to your data is limited to the people and providers who need it, and payments are handled by providers that apply the security standards of the payment card industry. No system is infallible: if a data breach presented a high risk to you, we would inform you as the law requires.
9. Minors
The site is intended for adults. We do not knowingly collect data about children under 15. If you think a minor has sent us data, write to us and we will delete it.
10. Changes
We may update this policy, for example if we change tools or the law changes. The online version is the one that applies; in case of an important change, we will inform you.
Last updated: 28 October 2026.