1. Data controller
The data controller is XTREMOTIVATION, the brand operated by Kreative Monster (Steeve Aukingso). Its identity is set out in our Legal Notice. For any data protection request, or to reach the person responsible for data protection matters, use the Support page.
2. Data we collect
Data you provide to us
- Account data: name, email, password (stored hashed, never in plain text).
- Order data: items, size, delivery address, order history.
- Messages you send us via support or forms.
Technical connection data
When you submit a form on this site (for example account creation, checkout or support), we automatically collect technical connection data: your IP address, your browser's user agent, an approximate geolocation derived from the IP, and a timestamp. We retain this data for the purposes of security, prevention of fraud and harassment, and the establishment, exercise or defence of legal claims. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in protecting the site, our team and our customers, and being able to act in the event of an offence.
3. Purposes and legal bases
- Process and deliver your order, provide support: performance of the contract.
- Take payment and prevent payment fraud: contract and legitimate interest.
- Secure our forms and prevent abuse and harassment: legitimate interest.
- Send transactional emails (confirmation, shipping updates): contract.
- Send marketing emails, only if you consent: consent.
- Comply with our accounting and legal obligations: legal obligation.
4. Payment
Payments are processed by Stripe, acting as payment provider. We do not store your full card number. Card data is processed directly by the payment provider, under its own terms and security standards.
5. Processors and recipients
- Stripe: payment processing.
- Resend: sending transactional emails.
- Cloud hosting and database located within the European Union and the European Economic Area.
Each processor acts under a data processing agreement and only for the purposes described here. Where a processor transfers data outside the European Economic Area, the transfer is made subject to the appropriate safeguards required by the GDPR (for example the European Commission's standard contractual clauses).
6. Cookies
We use cookies and similar technologies as described in our Cookie Policy. Analytics and marketing trackers only fire after your consent. You can change your choice at any time from that page.
7. Retention periods
We keep your personal data only for as long as necessary for the purposes described in this policy. Account and order data are kept for as long as your account is active and for as long as required by our accounting and legal obligations. Technical connection and security logs are kept for the period necessary to establish, exercise or defend legal claims, after which they are deleted or anonymised.
8. Your rights
Under the GDPR, you can request access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest. To exercise a right, contact us via the Support page. You can also lodge a complaint with your supervisory authority; in France, this is the CNIL.
9. Changes
We may update this policy. The date at the top of the page shows the last update.