Privacy Policy

Last updated: April 2026

Sparkle is committed to protecting your privacy. This Privacy Policy applies to all visitors, prospects and customers of sparkle.bzh and describes how we collect, use and protect your personal data.

1. Data controller

The data controller is Sparkle, registered address: 41 Avenue du Général de Gaulle, 56170 Quiberon, France.

Sparkle has not appointed a Data Protection Officer (DPO). For any questions regarding your personal data: [email protected]

2. Data collected

In the course of your use of the Site and our services, we may collect the following data:

Category	Examples	Collection method
Identification & contact	First name, last name, email address, phone number	Contact form, account creation, order
Order data	Delivery address, purchase history, product preferences	Purchase process
Browsing data	IP address, browser type, pages visited, session duration	Automatically via cookies
Age verification data	Date of birth (age verification)	Age verification pop-up on site entry
Communication data	Message content, exchange history	Contact form, emails
Behavioural data	Email open history, clicks, purchasing behaviour	Via Klaviyo, with your consent

3. Purposes of processing

Your data is used for the following purposes:

Processing and tracking your orders
Managing your customer account
Responding to your contact requests
Sending our newsletter and marketing communications (with your consent)
Segmentation and personalisation of marketing communications (with your consent)
Verifying your age, in accordance with regulations applicable to the sale of alcohol
Improving our services and user experience
Complying with our legal and accounting obligations
Fraud prevention

Sparkle does not carry out any fully automated decision-making that produces legal effects or significantly affects you within the meaning of Article 22 of the GDPR. Segmentation carried out via Klaviyo for marketing purposes is based on your consent and may be objected to at any time.

4. Legal basis for processing

Purpose	Legal basis
Order processing	Performance of a contract
Customer account management	Performance of a contract
Newsletter and marketing communications	Consent
Marketing segmentation and profiling (Klaviyo)	Consent
Age verification	Legal obligation
Non-essential cookies	Consent
Service improvement / analytics	Legitimate interest
Accounting and tax obligations	Legal obligation
Fraud prevention	Legitimate interest

5. Recipients of your data

Your data may be shared with the following recipients:

Authorised Sparkle staff — strictly limited to what is necessary for the performance of their duties
Shopify International Limited (Dublin, Ireland) — our e-commerce platform and website host
Klaviyo, Inc. (Boston, USA) — our email marketing and automation tool, used for newsletters and marketing segmentation, with your consent
UPS and Colissimo (La Poste) — our delivery carriers, for order fulfilment (name, delivery address, phone number)
Shopify Payments — our payment provider, for securing transactions (no banking data is stored by Sparkle)

All our service providers are contractually required to maintain the confidentiality of your data and comply with applicable law. Your data is never sold to third parties.

6. Transfers outside the European Union

Some of our service providers are based outside the European Union and may process your data in third countries:

Shopify — transfers data outside the EU via Standard Contractual Clauses in accordance with Article 46 of the GDPR
Klaviyo, Inc. — a US company based in Boston, which transfers your data to the United States under the EU–US Data Privacy Framework, to which Klaviyo is certified. Should this framework be invalidated, Standard Contractual Clauses apply as a fallback mechanism

In all cases, Sparkle ensures that appropriate safeguards are in place to protect the security and confidentiality of your data.

7. Data retention

Data category	Retention period
Customer account data	Duration of commercial relationship + 3 years
Order data	10 years (statutory accounting obligation)
Contact / form data	3 years from last contact
Newsletter consent and Klaviyo data	Until consent is withdrawn or 3 years of inactivity
Cookies and browsing data	13 months maximum
Age verification data	Current session only

8. Cookies

Our Site uses cookies. To find out more about the cookies we use, their purpose and how to manage them, please see our Cookie Policy (currently available in French only).

9. Your rights

Under the GDPR, you have the following rights:

Right of access — obtain a copy of your personal data
Right of rectification — correct inaccurate or incomplete data
Right to erasure — request deletion of your data (right to be forgotten)
Right to restriction — temporarily restrict the processing of your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interest or for direct marketing purposes
Withdrawal of consent — at any time, for processing based on your consent (newsletter, non-essential cookies, Klaviyo profiling)

To exercise these rights: [email protected]

We will acknowledge receipt of your request within 5 business days and commit to responding within one month of receipt.

If you believe your rights have not been respected after contacting us, you may lodge a complaint with the supervisory authority in your country of residence:

France — CNIL (Commission Nationale de l'Informatique et des Libertés)
Belgium — APD (Autorité de Protection des Données)
Spain — AEPD (Agencia Española de Protección de Datos)
Netherlands — AP (Autoriteit Persoonsgegevens)

10. Policy updates

This Privacy Policy is reviewed at least once a year and updated whenever there is a significant change in our data processing practices. We encourage you to consult it regularly. In the event of a material change, we will notify you by email or via a prominent notice on the Site.