Privacy policy

Privacy policy

Last updated: 8 October 2026.

This policy explains how we handle your personal data when you browse the website www.univers-aquaponie.com, create an account, place an order, subscribe to our newsletter or contact us. It has been drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the General Data Protection Regulation, hereinafter the "GDPR") and French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

1. Data controller

The data controller is AQUAPONEASY FRANCE, which operates the Univers Aquaponie shop, a SAS (simplified joint-stock company) with share capital of €100.00, registered with the Sarreguemines Trade and Companies Register under number 981 599 996, with its registered office at 14 rue du Hommel, 57600 Forbach, France (hereinafter "we" or "us").

For any question about your data: contact@univers-aquaponie.com, or by post to the registered office address.

2. Data we process

  • Identity and contact data: surname, first name, postal address, email address, telephone number.
  • Order data: products ordered, amounts, billing and delivery addresses, delivery method, order history, and correspondence relating to returns and complaints.
  • Payment data: transaction status and identifier. Your full bank card details are processed directly by the payment provider; we do not have access to them.
  • Customer account data: login credentials and preferences.
  • Correspondence data: the content of your messages to customer service.
  • Browsing data: IP address, type of device and browser, pages viewed, and data collected by cookies and trackers, under the conditions described in section 8.
  • Marketing data: email address and communication preferences if you subscribe to our newsletter.
  • If you are a business customer: your company name and VAT number.

The data marked as mandatory in the forms is necessary to process your order or your request. Without it, we cannot act on your request.

3. Purposes and legal bases

  • Order management (processing, payment, delivery, invoicing, returns, withdrawal, warranties, after-sales service): performance of the contract concluded with you (Article 6(1)(b) of the GDPR).
  • Customer account management: performance of the contract (Article 6(1)(b) of the GDPR).
  • Responding to your enquiries sent to customer service: performance of the contract or pre-contractual steps taken at your request (Article 6(1)(b) of the GDPR) and, outside the context of an order, our legitimate interest in replying to people who contact us (Article 6(1)(f) of the GDPR).
  • Compliance with our legal obligations, in particular accounting and tax obligations, and responding to requests from the authorities: legal obligation (Article 6(1)(c) of the GDPR).
  • Payment fraud prevention and site security: legitimate interest in protecting our business and our customers (Article 6(1)(f) of the GDPR).
  • Sending commercial offers by email: your consent (Article 6(1)(a) of the GDPR); if you are already a customer, we may send you offers for products similar to those you have bought, on the basis of our legitimate interest, unless you objected when your address was collected or have done so since (Article L34-5 of the French Postal and Electronic Communications Code).
  • Audience measurement, personalisation and advertising by means of non-essential cookies: your consent (Article 82 of Act No. 78-17 of 6 January 1978 and Article 6(1)(a) of the GDPR).
  • Dispute management and the establishment, exercise or defence of our rights: legitimate interest (Article 6(1)(f) of the GDPR).

We do not take any decision based solely on automated processing that produces legal effects concerning you, other than the automatic fraud checks carried out by payment providers, following which you may request human intervention.

4. Recipients of the data

Your data is intended for authorised staff of AQUAPONEASY FRANCE. It is disclosed, to the extent necessary, to the following recipients:

  • Shopify, which provides the e-commerce platform and hosts the site and the shop's data, acting as a processor;
  • payment providers, for payment processing and fraud prevention;
  • carriers and, where applicable, the partner workshop or producer that ships your product directly, for delivery (name, address, telephone number, email address, contents of the parcel);
  • the partner training provider, to set up your access if you purchase an online course;
  • our providers of email sending, customer service and audience measurement, acting as processors;
  • our chartered accountant and our advisers, who are bound by professional secrecy;
  • administrative or judicial authorities, where required by law.

Our processors act on our instructions and are bound by contract to protect your data. We do not sell your data.

When you click on a link to a third-party site, in particular an affiliate link to Amazon, that site processes your data in accordance with its own privacy policy and under its own responsibility.

5. Transfers outside the European Union

Some of our providers, in particular Shopify, whose parent company is established in Canada, as well as certain payment, email and audience measurement providers, may process data outside the European Economic Area. Such transfers are made only to a country recognised by the European Commission as ensuring an adequate level of protection, or on the basis of standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. If your order is delivered outside the European Union, your delivery data is passed to the carrier and to the customs authorities of the destination country, which is necessary for the performance of the contract. You can obtain information about these safeguards by writing to us.

6. Retention periods

  • Customer data (orders, correspondence, complaints): for the duration of the commercial relationship, then archived for 5 years from the date of the last order, being the limitation period for legal actions, for the management of warranties and disputes.
  • Accounting documents and invoices: 10 years from the close of the financial year (Article L123-22 of the French Commercial Code).
  • Customer account: until it is deleted at your request; an account that has been inactive for 2 years is deleted, without affecting the retention of order data indicated above.
  • Data used for marketing: customers, 3 years from the end of the commercial relationship (last purchase or last contact from you); non-customers subscribed to the newsletter, 3 years from collection or from their last contact; if you unsubscribe, your address is kept on a suppression list for as long as necessary to respect your choice.
  • Payment data: we do not keep your card details; the payment provider keeps them in accordance with its own legal obligations.
  • Requests to exercise rights: until we have replied, after which the reply is kept as evidence for the applicable limitation period.
  • Cookies and trackers: 13 months at most from the time they are placed; information collected by audience measurement trackers is kept for 25 months at most; your choice to accept or refuse cookies is kept for 6 months.

7. Security

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access and disclosure: encrypted connection to the site, access restricted to authorised persons, and selection of providers offering sufficient guarantees. In the event of a data breach likely to result in a risk to your rights, we notify the CNIL (the French data protection authority) and, if the risk is high, we inform you.

8. Cookies and trackers

When you visit the site, cookies and other trackers may be placed on, or read from, your device.

  • Strictly necessary cookies: these allow the site to function (basket, payment, account login, security, remembering your cookie choice, language and currency). They do not require your consent.
  • Audience measurement cookies: these let us know how many people visit the site and improve how it works. They are placed with your consent, unless they meet the exemption conditions set by the CNIL.
  • Personalisation and advertising cookies: these allow us to show you tailored content and advertising, on our site or on other sites, and to measure their effectiveness. They are placed only with your consent.

On your first visit, a banner lets you accept or refuse these cookies, with equal ease, or choose by category. Continuing to browse does not constitute consent. You can change your choice at any time using the cookie management link at the bottom of the page, or configure your browser to block cookies. Withdrawing your consent is as easy as giving it. The list of cookies used by the Shopify platform can be viewed at www.shopify.com/legal/cookies.

9. Your rights

You have the following rights over your data:

  • the right of access and the right to obtain a copy of your data;
  • the right to rectification of inaccurate or incomplete data;
  • the right to erasure, under the conditions laid down in Article 17 of the GDPR;
  • the right to restriction of processing;
  • the right to portability of the data you have provided to us, where the processing is based on your consent or on the contract;
  • the right to object at any time to the processing of your data for marketing purposes, and, on grounds relating to your particular situation, to processing based on our legitimate interest;
  • the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
  • the right to set directives on what happens to your data after your death.

Every commercial email contains an unsubscribe link. To exercise your other rights, write to contact@univers-aquaponie.com or to AQUAPONEASY FRANCE, 14 rue du Hommel, 57600 Forbach, France. We will reply within one month, which may be extended by 2 months in the case of a complex request; we will then inform you of the extension. If we have reasonable doubts about your identity, we may ask you for further information.

You can also register free of charge on Bloctel, the French opt-out list for telephone canvassing (www.bloctel.gouv.fr).

10. Complaint to the CNIL

If, after contacting us, you consider that your rights are not being respected, you can lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, France, or online at www.cnil.fr/fr/plaintes. If you live in another European Union member state, you can also contact the data protection authority in your country.

11. Minors

The site is intended for adults. A minor may place an order only with the consent of their parents or legal guardian. We do not knowingly collect data relating to children under 15. If you are a parent or legal guardian and believe that a minor has provided us with data, please contact us to request its deletion.

12. Changes to this policy

We may amend this policy to reflect changes in our processing or in the regulations. The date of the last update appears at the top of the page. In the event of a significant change, we will inform you by appropriate means.