Privacy policy
Data controller
The controller of your data is Rachel Rickson & Co, SAS, 1B chemin du Mignon, 77130 Montereau-Fault-Yonne, France, SIREN 984 297 903, represented by Rachel Rickson Madzou Loussika.
For any question about your data, write from the Contact page or to sav@madameintentionnelle.com.
Data collected
Depending on what you do on the site, we collect:
- Order: name, delivery and billing address, e-mail, phone, content and history of the order.
- Customer account: the shop does not open customer accounts, you order without creating one. If you choose Shop Pay, a Shop account is managed by Shopify under its own policy.
- Payment: processed by Shopify and its providers, including PayPal. We do not receive your full card number.
- Digital product: your express consent and waiver of withdrawal, recorded with the order, and the order data needed to send the download link.
- Newsletter and “Notify me”: first name, e-mail, city.
- English Track waiting list: first name (optional), e-mail and plan wanted, entered in a Google Forms form.
- Africa orders via WhatsApp Business: WhatsApp number, message content, products requested.
- Intentionnelles Academy: name, e-mail and profile information you enter on the Circle platform.
- Browsing: IP address, device, pages viewed, through cookies and trackers (see the cookie policy).
Mandatory fields are marked; without them we cannot process your request.
Purposes and legal bases
- Process, ship and follow your order, handle after-sales service: performance of the contract.
- Invoice, keep accounts, declare VAT: legal obligation.
- Prevent fraud and secure the site: legitimate interest.
- Reply to your messages: pre-contractual measures or legitimate interest.
- Send the newsletter and release alerts: your consent, which you can withdraw at any time.
- Measure audience and personalise: your consent through the cookie banner.
- Manage your Academy membership: performance of the contract.
Newsletter and communications
We send the newsletter, “Notify me” alerts (for example for the release of Volume 2) and shop offers only with your consent, collected through a sign-up form whose box is never pre-ticked.
Every e-mail contains an unsubscribe link; you can also write to us. Unsubscribing is immediate and does not stop e-mails linked to an order in progress (confirmation, shipping).
If you buy, we may also e-mail you offers for similar products on the basis of our legitimate interest, and you can object free of charge at any time.
E-mails are sent with Brevo (Brevo SAS, a French company; data hosted mainly in the European Union). Your newsletter sign-up goes through a technical relay that passes it to Brevo without keeping your e-mail address.
At checkout, an optional box, unticked by default, may also offer you to receive our e-mails; it is managed by Shopify.
Au paiement, une case facultative, décochée par défaut, peut aussi vous proposer de recevoir nos e-mails ; elle est gérée par Shopify.
Retention periods
- Orders, invoices and consent for digital products: 10 years (accounting obligation, article L. 123-22 of the French Commercial Code).
- Newsletter and waiting list: until you unsubscribe, then 3 years at most after your last contact with us.
- Contact messages: for the time needed to handle your request, then 3 years at most.
- Cookies: 13 months at most; audience data: 25 months at most.
These periods draw on CNIL recommendations.
Recipients and processors
Your data is accessible to Rachel Rickson & Co and, as needed, to its providers, who may use it only on our behalf:
- Shopify (online shop, hosting, payment, Shop Pay).
- PayPal and the other payment providers.
- Carriers and postal services in charge of delivery.
- Brevo (sending the newsletter and managing subscribers).
- Circle, the platform of the Intentionnelles Academy.
- BIG Digital Download (Penida, a French company), a Shopify app that sends the files of digital products: it receives the order data it needs (name, e-mail, product).
- Instagram (Meta) and YouTube (Google), including the home page ambient video; they act on their own behalf, under their own policies.
- Google Forms (Google), for the English Track waiting list.
- The partner bookseller in Dakar and WhatsApp (Meta), for orders from Africa.
- Our accountants, where applicable.
We do not sell your data. It may be passed to authorities if the law requires it.
Nous ne vendons pas vos données. Elles peuvent être transmises aux autorités si la loi l’exige.
Transfers outside the European Union
Some providers are established outside the European Union: Shopify Inc. (Canada), Circle, Meta and Google (United States), the partner bookseller (Senegal), as well as some subprocessors of Brevo and BIG Digital Download. Depending on the case, these transfers rely on the European Commission's adequacy decision for Canada, on the EU-US Data Privacy Framework (for certified companies, such as Google and Meta), on the European Commission's standard contractual clauses (for example for Circle) or, for orders from Africa, on performance of the contract you requested.
Brevo hosts its data mainly in the European Union. To get information about the safeguards that apply, write from the Contact page.
Your rights
You may ask for access to your data, its rectification or erasure, restriction of processing, object to it, receive your data in a reusable format (portability) and withdraw your consent. You may also set instructions for your data after your death.
Write from the Contact page. We reply within one month. We may ask for proof of identity in case of doubt.
You may also lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
Cookies and trackers
A consent banner appears on your first visit. You can accept, refuse or customise, and change your mind at any time with the “Manage my cookies” link in the footer.
Strictly necessary cookies do not require consent. Audience-measurement and advertising cookies are set only after you agree. The cookie policy gives the details.
Minors
The site is not aimed at children under 15. If you believe a minor has sent us data without parental consent, write to us: we will delete it.
Security
The site runs over an encrypted connection (HTTPS). Access to data is limited to the people and providers who need it.
Changes to this policy
We may update this policy. The online version is the one in force.
Last update: 9 October 2026.
