Privacy policy

Last updated: 27 August 2026

1. Data controller

This policy explains how RIOULT & HUREAUX, operating the DIVAG brand, collects and processes your personal data when you visit divag-studio.com, create an account, place an order or communicate with us.

The data controller is:

RIOULT & HUREAUX (DIVAG)
French simplified joint-stock company (SAS)
SIREN: 990 955 049
3 rue Jules Guilbert
50000 Saint-Lô
France
Email: contact@divag-studio.com

The store is hosted by Shopify, which provides the technical infrastructure that enables DIVAG to offer its products and services online.

2. Personal data collected

Depending on how you use the website, we may collect the following categories of data:

  • Identity and contact data: first and last name, postal address, billing address, delivery address, email address and phone number.

  • Customer account data: login credentials, preferences, order history and account settings.

  • Order and transaction data: products viewed or purchased, cart, amounts, discounts, delivery methods, returns, refunds and exchanges.

  • Payment data: payment method type, payment confirmation and status, and information required to prevent fraud. Full banking details are processed by Shopify Payments or the relevant payment provider and are not stored directly by DIVAG.

  • Communications data: customer-service messages, return requests, complaints, reviews and other exchanges with DIVAG.

  • Technical and browsing data: IP address, device type, operating system, browser, technical identifiers, pages viewed, interactions with the website, visit source and data generated by cookies or similar technologies.

  • Marketing data: newsletter subscription, communication preferences, consents, opt-outs and interactions with advertising campaigns.

We do not ask you to provide special-category personal data within the meaning of the GDPR.

3. Sources of data

We may collect your data:

  • directly from you when you create an account, place an order, subscribe to communications or contact us;

  • automatically when you browse the website, through cookies and similar technologies;

  • from Shopify and our payment, delivery, analytics or advertising providers; and

  • from social-media or advertising platforms with which you interact, including Meta and Google, where transmission is permitted by your settings and consent.

4. Purposes and legal bases

Order management

We use your data to record orders, process payments, prepare parcels, arrange delivery, handle returns, exchanges and refunds, and provide after-sales service. The legal basis is performance of the contract with you.

Customer account management

We use your data to create and administer your account, remember your preferences and allow you to view your history. The legal basis is performance of the contract or steps taken at your request.

Customer service and complaints

We use your data to answer requests, resolve issues and manage complaints. The legal bases are performance of the contract and DIVAG’s legitimate interest in providing effective customer service and defending its rights.

Accounting and legal obligations

We retain certain order, invoice, payment and refund information to comply with accounting, tax and regulatory obligations. The legal basis is compliance with our legal obligations.

Security and fraud prevention

We use certain technical and transaction data to protect the website, detect fraudulent or abusive activity, and secure payments and accounts. The legal bases are DIVAG’s legitimate interest in protecting its business, customers and systems, and compliance with applicable legal obligations.

Commercial communications

With your consent where required, we may send newsletters, news, offers or promotional communications. Where permitted by law, we may also inform existing customers about products similar to those they have already purchased.

You can object free of charge at any time using the unsubscribe link in each message or by emailing contact@divag-studio.com.

Audience measurement, personalisation and advertising

Subject to your consent where required, we may use audience-measurement, personalisation and advertising tools, including tools provided by Shopify, Meta and Google.

These tools may help us understand website use, measure campaign performance, improve our services and display relevant content or advertising.

Non-essential cookies or trackers associated with these tools are placed only after consent has been obtained where required by law.

5. Cookies and similar technologies

Strictly necessary cookies

These trackers enable the technical operation of the store, retention of cart contents, customer-account authentication, secure payment processing, fraud prevention, website security and storage of essential preferences such as language or country.

They are necessary to provide the requested service and do not require prior consent.

Audience-measurement cookies

When enabled, these tools may measure website traffic, help us understand browsing journeys and improve store performance.

Personalisation cookies

When enabled, these tools may adapt certain content or features to your preferences and use of the website.

Advertising cookies

When enabled, these tools may be used by DIVAG and its partners, including Meta and Google, to measure campaign performance, limit repeated advertising or display relevant advertising content.

Audience-measurement, personalisation or advertising cookies that require consent are placed only after you agree.

You may accept, refuse or change your choices at any time through the cookie-management tool available on the website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Cookie lifetimes depend on their purpose. Unless a shorter period is set by the relevant provider, audience-measurement and advertising cookies are not retained for more than 13 months. Your cookie choice may be retained for approximately six months so that you are not asked on every visit.

Refusing non-essential cookies does not prevent you from ordering. Blocking strictly necessary cookies may, however, prevent the cart, customer account or checkout from working correctly.

6. Recipients of data

Your data may be shared, only to the extent necessary for their work, with:

  • Shopify, which hosts and provides the store infrastructure;

  • payment providers;

  • carriers and logistics providers;

  • technical, hosting, security and customer-service providers;

  • analytics or advertising tools, including Meta and Google, when the relevant tools are enabled and permitted by law or your consent;

  • DIVAG’s professional advisers, including accounting, legal and IT providers; and

  • administrative, tax, judicial or law-enforcement authorities where required by law.

Depending on the circumstances, these recipients act as processors or separate controllers. DIVAG does not sell your personal data.

7. Relationship with Shopify

Shopify processes certain data required to host, secure and operate the store. Information you submit on the website is processed by Shopify in accordance with its privacy commitments and DIVAG’s instructions when Shopify acts as a processor.

Certain Shopify features may also use interactions across multiple merchants to improve services or offer a personalised experience. In those cases Shopify may act as a separate controller.

For more information, see the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

8. International transfers

Some providers, including Shopify, Meta or Google, may process data in countries outside the European Economic Area.

Where such transfers occur, they rely on a mechanism recognised by applicable law, including an adequacy decision by the European Commission, the European Commission’s Standard Contractual Clauses or another appropriate safeguard under the GDPR.

You may contact us at contact@divag-studio.com for more information about safeguards applying to a particular transfer.

9. Retention periods

We retain data only for as long as necessary for the purposes for which it was collected and, where necessary, for statutory limitation or archiving periods.

  • Order and customer-relationship data is retained during the commercial relationship and then archived for as long as necessary to defend our rights.

  • Invoices and accounting records are retained for 10 years in accordance with legal obligations.

  • Customer marketing data is retained during the commercial relationship and for up to three years after the last purchase or contact from the customer.

  • Prospect data where no purchase has been made is retained for up to three years from collection or the last contact.

  • Customer-service requests may be retained while being handled and then for up to three years, unless a legal obligation or dispute requires longer retention.

  • Data concerning the exercise of rights is retained for as long as necessary to handle the request and document its handling.

  • Cookie choices may be retained for approximately six months.

  • Cookies and advertising identifiers are retained for the period stated in the cookie-management tool and, unless a justified exception applies, for no more than 13 months.

Certain data may be retained longer where required by law, a complaint, litigation or fraud prevention.

10. Security

DIVAG and its providers implement reasonable technical and organisational measures to protect personal data against loss, unauthorised access, disclosure, alteration or destruction.

No IT system can be completely secure. We recommend protecting your login credentials and not sending confidential information through unsecured channels.

11. Your rights

Where provided by applicable law, you have the right to access your data, correct inaccurate or incomplete data, request erasure, request restriction of processing, object to certain processing including direct marketing, receive the data you provided in a portable format, withdraw consent at any time for processing based on consent, give instructions regarding your data after death where French law applies, and lodge a complaint with a supervisory authority.

To exercise your rights, email contact@divag-studio.com or write to:

RIOULT & HUREAUX (DIVAG)
3 rue Jules Guilbert
50000 Saint-Lô
France

To protect your data, we may request information reasonably necessary to verify your identity. We will respond within the period required by law, normally within one month of receiving your request.

You may lodge a complaint with:

CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
https://www.cnil.fr

12. Children’s data

Our Services are not specifically directed at minors. We do not knowingly seek to collect a minor’s personal data without appropriate authorisation where required.

If you believe that a minor has provided data to us inappropriately, contact contact@divag-studio.com so that we can review the matter.

13. Third-party websites and services

The website may contain links to services operated by third parties. Those services have their own privacy policies and DIVAG is not responsible for their practices. Please review the relevant privacy policy before providing personal data.

14. Changes to this policy

We may amend this policy to reflect changes in our practices, tools or applicable law. The updated version will be posted on the website with a new update date. Where required by law, we will separately notify you of material changes.

15. Contact

For any question about this policy or the processing of your personal data:

RIOULT & HUREAUX (DIVAG)
3 rue Jules Guilbert
50000 Saint-Lô
France
contact@divag-studio.com