Privacy policy

This privacy policy describes how we collect, use, and protect your personal data when you interact with the nexovault.com website. In accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Informatique et Libertés), we inform you clearly and transparently about our practices.

Data controller

The data controller is NEXVAULT (a SASU — French simplified joint-stock company — with share capital of 1 000 €, RCS Poitiers 104 281 944), whose registered office is located at MBE n°320, 52 route de Gencay, 86000 Poitiers.

Contact to exercise your rights: contact@nexovault.com

Data collected

We only collect the data strictly necessary for the purposes described below:

• Email address (via the waitlist form)
• Preferred safe size (Ø65, Ø80)
• Anonymised technical data (browser, operating system, device type) for statistical purposes only

Providing your email address is required to subscribe to the waitlist. Without it, we cannot keep you informed of the launch. Other data (preferred safe size, anonymised technical data) is optional.

Purposes of processing

Your data is used solely to:

• Inform you of the official launch of NEXOVAULT products
• Keep you informed of major project developments (launch, opening of pre-orders)
• Improve the site's user experience (anonymised statistics)
• Process your orders and pre-orders (payment, delivery, invoicing, customer service)

We undertake to never use your data for third-party marketing, and not to share, sell, or rent it to unauthorised third parties.

Legal basis

The legal basis for processing your data is your freely given, specific, informed, and unambiguous consent, explicitly collected when you sign up to the waitlist (GDPR checkbox). For orders and pre-orders, the legal basis is the performance of a contract (see the “Orders and pre-orders” section below). The anti-bot check on the form (Cloudflare Turnstile) is based on our legitimate interest in protecting the form against spam and bots (Article 6(1)(f) GDPR).

Data retention period

Your data is retained for a maximum period of 3 years (1,095 days) from your last interaction with our services, or until you request its deletion. This limit is applied automatically by our system: once this period has elapsed, your data is deleted through an automated process, with no human intervention required.

You may request early deletion of your data at any time by contacting us at contact@nexovault.com.

Orders and pre-orders

When you place an order or a pre-order, it is processed through the Shopify platform. The following data is processed:

• Identity (first name, last name)
• Delivery and billing addresses
• Email address
• Phone number
• Order content (product, size, quantity, amount)
• Payment data, processed by Shopify Payments

Card data is processed directly by Shopify Payments: NEXVAULT never has access to your full card number.

Legal basis: performance of the sales contract (Article 6(1)(b) GDPR).

Retention period: order data is kept for as long as needed to manage the order and the customer relationship, then archived in line with accounting obligations, i.e. 10 years for accounting records (Article L123-22 of the French Commercial Code).

Parcel-point delivery: your name, address and phone number are transmitted to Mondial Relay, as a recipient of this data for the sole purpose of delivery.

Your rights

In accordance with the GDPR, you have the following rights regarding your data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request deletion of your data
• Right to restriction of processing
• Right to data portability: receive your data in a structured format
• Right to object to processing
• Right to withdraw consent at any time

To exercise these rights, send an email to contact@nexovault.com specifying your request. We undertake to respond within a maximum of 30 days, extendable by two months for complex requests (Article 12(3) GDPR).

Data processors

We use the following data processors, all committed to complying with the GDPR:

• Brevo (formerly Sendinblue) — email and waitlist management. French company, data processed within the European Economic Area (EEA).
• Vercel (Vercel Inc., a US company based in California) — site hosting and serverless functions. Vercel acts as a data processor under a Data Processing Agreement (DPA) incorporating the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) to govern data transfers to the United States.
• Shopify (Shopify International Limited, a company established in Ireland) — online sales platform: processing of orders and pre-orders, payments (Shopify Payments), delivery and invoicing. Transfers to Canada and the United States may occur (see “International data transfers”).
• Cloudflare (Cloudflare, Inc., a US company) — Turnstile anti-bot service on the waitlist form: analysis of technical browser signals and the IP address to tell a person from a bot. Legal basis: legitimate interest (Article 6(1)(f) GDPR), protecting the form against spam and bots. Transfer to the United States governed by the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR).

International data transfers

Some of our data processors process data outside the European Union: Vercel and Cloudflare (United States), as well as Shopify (established in Ireland, with possible transfers to Canada and the United States). In accordance with Articles 44 to 50 GDPR, transfers to the United States are governed by the Standard Contractual Clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021), ensuring a level of data protection equivalent to that applicable within the European Union. Transfers to Canada are based on the European Commission's adequacy decision (Article 45 GDPR; Decision 2002/2/EC of 20 December 2001).

You may obtain a copy of the Standard Contractual Clauses by contacting us at contact@nexovault.com.

Cookies

The nexovault.com website uses no advertising tracking cookies. Only technical cookies strictly necessary for the site to function may be stored (user preferences, 3D animation state). These cookies do not require prior consent under CNIL guidelines.

Security

In accordance with Article 32 GDPR, we implement appropriate technical and organisational measures to ensure the security of your data:

• Encryption of communications via HTTPS (TLS 1.3);
• Pseudonymisation of IP addresses through SHA-256 hashing (Article 4(5) GDPR);
• Authentication tokens (JWT) limited to 72 hours;
• Honeypot anti-spam protection on forms;
• Mandatory double opt-in to confirm any sign-up;
• Restricted data access through strong identity control;
• Robust passwords and secure management of administrator access.

We carry out regular reviews of our security measures to adapt them to evolving risks.

Complaints

If you believe that the processing of your data does not comply with the GDPR, you may lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority), or with the supervisory authority of your member state of residence: www.cnil.fr.

Changes to this policy

This policy may be amended to reflect legal developments or our practices. Any significant change will be notified to you by email.

This English translation of our privacy policy is provided for information purposes only. The original French version is the only legally binding text. In case of any discrepancy or dispute, the French version prevails.