1. Data controller
The data controller is KREATIVE MONSTER GLOBAL, a SASU registered with the R.C.S. Nanterre under SIREN 109 679 761, whose registered office is at 99 avenue Achille Peretti, 92200 Neuilly-sur-Seine, France. KREATIVE MONSTER GLOBAL operates the XTREMOTIVATION brand and this store. Its full details are set out in our Legal Notice. For any data protection request, write to hello@kreativemonster.com or use the Support page.
2. Data we collect
Data you provide to us
- Account data: name, email, password (stored hashed, never in plain text).
- Order data: items, size, delivery address, order history.
- Messages you send us via support or forms.
Technical connection data
When you submit a form on this site (for example account creation, log in, password reset, checkout, sign-up to a drop, a waitlist or a territory request), we automatically collect technical connection data: your full IP address, your browser's user agent and the device it describes, basic browser settings (screen size, time zone, languages), an approximate geolocation derived from the IP, and a timestamp to the second. We record it together with what you entered in the form, except passwords and security tokens, which are never stored there. Blocked attempts are recorded too.
We retain this data in a dedicated security log that cannot be edited, for the purposes of security, prevention of fraud, abuse and harassment, and the establishment, exercise or defence of legal claims, including reporting an offence to the authorities. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in protecting the site, our team and our customers, and being able to act in the event of an offence. This data is not used for marketing or analytics.
To check whether an IP address belongs to a VPN, an anonymous proxy or a hosting provider, we send that IP address to proxycheck.io, acting as our processor for IP reputation. Some forms refuse submissions made through a VPN or anonymous proxy; Apple iCloud Private Relay is accepted.
3. Purposes and legal bases
- Process and deliver your order, provide support: performance of the contract.
- Take payment and prevent payment fraud: contract and legitimate interest.
- Secure our forms and prevent abuse and harassment: legitimate interest.
- Send transactional emails (confirmation, shipping updates): contract.
- Send marketing emails, only if you consent: consent.
- Comply with our accounting and legal obligations: legal obligation.
4. Payment
Payments are processed by Stripe, acting as payment provider. We do not store your full card number. Card data is processed directly by the payment provider, under its own terms and security standards. PayPal would process your payment only if it were offered at checkout; it is not offered at present.
5. Processors and recipients
- Vercel Inc. (United States): hosting of the site, and Vercel Web Analytics if you accept Analytics.
- Neon: database hosting (accounts, orders, security log).
- Stripe: payment processing.
- Resend: sending our emails (order, shipping, account and, if you subscribed, news emails).
- proxycheck.io: IP reputation checks on form submissions (VPN and proxy detection).
- Google (Google Analytics 4), Meta (Meta Pixel) and TikTok (TikTok Pixel): only if you accept the corresponding cookie category, as described in our Cookie Policy. These companies also process the data for their own purposes, under their own policies.
Each processor acts only for the purposes described here. Our team accesses the data only as needed to run the store, handle your orders and requests, and protect the site.
Transfers outside the European Union
Some of these providers are established, or process data, outside the European Economic Area, in particular in the United States: the site itself is hosted by Vercel Inc. in the United States. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (certification of each provider to be verified). You can ask us for information on these safeguards via the Support page.
6. Cookies
We use cookies and similar technologies as described in our Cookie Policy. Analytics and marketing trackers only fire after your consent. You can change your choice at any time from that page.
7. Retention periods
- Orders, invoices and the accounting records that support them: 10 years from the end of the financial year, as required by article L.123-22 of the French Commercial Code.
- Account data: for as long as your account exists. You can ask us to delete it at any time.
- Log of emails sent: 90 days.
- Technical connection data and security log: for the period necessary to establish, exercise or defend legal claims, after which they are deleted or anonymised.
8. Your rights
Under the GDPR, you can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest. Where processing is based on your consent, you can withdraw it at any time. You can also set guidelines on the retention, erasure and communication of your personal data after your death (article 85 of the French Data Protection Act no. 78-17 of 6 January 1978). To exercise a right, write to hello@kreativemonster.com or use the Support page.
You can also lodge a complaint with a supervisory authority. In France, this is the CNIL (Commission nationale de l'informatique et des libertés, cnil.fr).
9. Changes
We may update this policy. The date at the top of the page shows the last update.