Privacy policy
1. Who we are
This Privacy Policy describes how JUMAJO collects and processes your personal data.
Data Controller: JUMAJO, SASU, 7 Rue Descartes, 95330 Domont, France. SIRET 808837660. Contact: info@jumajo.fr. (No Data Protection Officer has been appointed, as such an appointment is not mandatory given the nature of our activities.)
2. The data we collect
When you place an order — first and last name, delivery and billing address, email address, telephone number, order details, amount and order history. Payment data (card number) is processed directly by our payment service provider: we never receive or store it.
When you browse our store — IP address, browser and operating system type, pages visited, through the cookies described in Section 8.
If you give your consent — your email address, to receive our news and updates.
When you place an order through a marketplace (Amazon, eBay) — we receive from the marketplace the information necessary to ship your order: name, delivery address and, where applicable, a contact method. We do not receive your banking details.
3. Why we process your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Process, prepare and ship your order; provide you with tracking information | Performance of the contract |
| Verify the validity of the delivery address | Performance of the contract |
| Manage returns, refunds and warranties | Performance of the contract |
| Issue and retain invoices | Legal obligation |
| Respond to your requests | Performance of the contract / Legitimate interest |
| Prevent fraud and secure our systems | Legitimate interest |
| Send you our news and updates | Consent, which may be withdrawn at any time |
We do not carry out any automated decision-making or profiling that produces legal effects concerning you.
4. How long we retain your data
-
Order and delivery data: for as long as necessary to fulfill the order, and thereafter until the expiry of the applicable legal warranties, i.e. 3 years from the date of delivery.
-
Orders placed through a marketplace: buyer contact details provided by the marketplace are deleted within 30 days following delivery, in accordance with the marketplace's rules. Only the invoice is retained.
-
Invoices and accounting records: 10 years, as required by the French Commercial Code.
-
Marketing data (newsletter): 3 years from your last contact with us, or until you withdraw your consent.
-
Cookies: 13 months at most.
-
Technical and security logs: 12 months.
Once these retention periods have expired, the data is permanently deleted, including from our backups when those backups reach the end of their retention cycle.
5. Who we share your data with
We never sell, rent or exchange your personal data. We only share it with service providers necessary to fulfill your order, each acting on our instructions:
| Recipient | Role | Data concerned |
|---|---|---|
| Shopify | Online store platform | Account, order, browsing data |
| Shopify Payments | Payment processing | Payment and billing data |
| Mondial Relay, DPD, Delivengo (La Poste), SPRING GDS | Carriers | Name, address, telephone number |
| OVH Mail | Transactional emails and newsletter | Name, email address |
| OVHcloud (Gravelines, France) | Hosting of our servers | All hosted data |
| Amazon, eBay | Marketplaces | Orders placed through these platforms |
| Our chartered accountant | Accounting obligations | Invoices |
Your data may also be disclosed to administrative or judicial authorities where we are legally required to do so.
6. Transfers outside the European Union
Our servers and database are located in France. Some of the service providers mentioned above (particularly Shopify) may process data outside the European Union. Such transfers are governed by the safeguards provided for under the GDPR: European Commission Standard Contractual Clauses or participation in the EU–US Data Privacy Framework. A copy of the applicable safeguards may be obtained upon request.
7. How we protect your data
-
Encryption of all communications (TLS 1.2 or higher) and encryption of data at rest.
-
Access restricted to employees who need it, using individual named accounts and authorization levels; no shared accounts.
-
Access logging, allowing each access to be attributed to an individual.
-
Database inaccessible from the Internet.
-
Encrypted backups stored at a separate location.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and, where the risk is high, the individuals concerned.
8. Cookies
We use strictly necessary cookies required for the operation of the store (shopping cart, session, security), which do not require your consent, and, subject to your consent, audience measurement cookies. You can change your choice at any time via the consent banner or your browser settings. Refusing non-essential cookies does not prevent you from placing an order.
9. Your rights
You have the following rights regarding your data: access, rectification, erasure, restriction of processing, data portability, objection to processing based on our legitimate interest, and withdrawal of your consent at any time for marketing purposes.
To exercise these rights, please contact us at info@jumajo.fr, specifying your request. We will respond within one month. Proof of identity may be requested where there is a reasonable doubt regarding your identity.
If you are not satisfied with our response, you may lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
10. Minors
Our store is not intended for persons under the age of 16, and we do not knowingly collect their personal data. If you become aware that a minor has provided us with personal data, please contact us and we will delete it.
11. Changes
We may amend this Privacy Policy to reflect changes to our practices or applicable regulations. The date of the latest update is indicated below. Any material changes will be brought to your attention.
Last updated: September 23, 2026