Privacy Policy

Last updated: October 24, 2026.

This policy describes how Happy Heroes SAS ("Happy Heroes", "we") collects, uses and protects your personal data when you use our website happy-heroes.com. We invite you to read it carefully: it concerns you directly.

1. Who is the data controller?

The controller of your data is:

• Happy Heroes SAS
• Simplified joint-stock company (SAS) with share capital of €3,000
• Registered office: Village des Voiles, 1 rue de l'Union, 59520 Marquette-lez-Lille, France
• RCS Lille Métropole 942 586 504 — SIRET 942 586 504 00014
• GDPR contact: support@happy-heroes.fr

Happy Heroes has not appointed a Data Protection Officer (DPO) within the meaning of Article 37 of the GDPR: our business does not require us to do so. For any question relating to your personal data, contact us at the address above.

2. What data do we collect?

• Identification data: title, last name, first name, date of birth, email, phone number.
• Delivery and billing data: postal addresses, delivery phone number.
• Order data: products purchased, dates, prices, status, tracking numbers, invoices.
• Payment data: we do not store any bank card numbers. Payments are processed directly by our provider CAWL / Worldline (Crédit Agricole Worldline), which receives the data necessary for the transaction.
• Customer service report data: description of the issue and photos uploaded when reporting an order issue.
• Browsing data: IP address, session identifiers, browser type, pages viewed. Technical cookies, and, only if you accept in the banner (“Visit measurement” switch, off by default, or “Accept all” button), audience measurement (Google Analytics), advertising measurement (Google Ads) and journey analysis (Microsoft Clarity, input fields masked) cookies.
• Communications: emails exchanged with our customer service.
• Personalized tracking data (only if you accept): pages viewed, baskets, clicks on links in campaign emails, linked to your account.

3. Why do we collect this data? On what legal basis?

• Creation and management of your account — legal basis: performance of the contract (Art. 6.1.b GDPR).
• Processing your orders, shipping, tracking, customer service, returns, refunds — legal basis: performance of the contract.
• Retention of invoices — legal basis: legal obligation (Art. 6.1.c GDPR, Art. L.123-22 of the French Commercial Code (Code de commerce)).
• Combating payment fraud and account security — legal basis: legitimate interest (Art. 6.1.f GDPR).
• Sending the newsletter and promotional messages — legal basis: consent (Art. 6.1.a GDPR). You can withdraw your consent at any time via the unsubscribe link included in every email.
• Technical security measures and logging of administrative access — legal basis: legitimate interest + legal obligation.
• Audience measurement and measuring the effectiveness of our Google ads — legal basis: consent (Art. 6.1.a GDPR). Nothing is set if you decline; you can change your mind at any time via the “Cookies” link in the footer.
• Personalized tracking: linking the pages you view, your baskets, and your clicks on links in our campaign emails to your account, so we can advise you better — legal basis: consent (Art. 6.1.a GDPR). Data: pages viewed, baskets, clicks on links in campaign emails linked to your account. Retention: 13 months. You give this consent with the “Tips and alerts made for me” switch in the cookie banner, or the personalized tracking box at sign-up and in Settings. It turns on the linking of your pages viewed, baskets and clicks in our campaign emails to your account, so we can offer you tailored tips and alerts; if you are logged in and visit measurement is accepted, your visit analysed by Microsoft Clarity is also linked to an encrypted account identifier. The switch and the box are off by default (“Accept all” turns on both banner switches, “Reject all” turns them off), and you can withdraw your consent at any time in My account, Settings. Without this consent, your visits are only counted anonymously (see below).

Anonymous audience measurement. To count visits and identify the steps at which a purchase is abandoned, we set a first-party cookie, hh-visite, which expires after 30 minutes of inactivity. It contains a randomly generated visit identifier and where the visit came from (Google, Google Ads, eBay, email, direct access; for a click from a campaign email, the reference of that email, which we only keep with your personalized tracking consent). No IP address, no identity: without that consent, nothing in this hh-visite measurement links the visit to you or to your account. We record only the steps reached (arrival, product page, basket, payment, purchase), and the page and product concerned. This data is used solely to produce aggregated statistics for this site, is not shared with any commercial or advertising partner, and is kept for 13 months. This measurement is exempt from consent (Art. 82 of the French loi Informatique et Libertés, CNIL guidelines): it works whatever you choose in the banner.

Visit details. Only if you accept “Visit measurement” in the banner, we also record, for the same visit: the site you came from and the campaign parameters in the address (utm, ad click); the country, city and type of device, inferred by our host without keeping your IP address; the browser language and screen size; the time spent and scrolling on each page; the labels of the buttons and links you click (never on the payment, account, order or basket pages); searches and filters. We never read what you type, except the words entered in the site search. These details are linked to your account only with the “Personalized tracking” consent. Retention: 13 months.

Offers by text message. Only if you tick the box offered at checkout (unticked by default), we send you our offers and new arrivals by text message, through OVH — legal basis: consent (Art. 6.1.a GDPR). Your number is kept for this purpose until you withdraw your consent: reply STOP to the number given in each text message, or write to us.

Log of actions on the site. To follow the shop’s activity, we record certain actions (adding to cart, favourites, arriving on the site), with the page or item concerned. They are linked to your account (identifier and email) only with your “personalised tracking” consent; without it, they are anonymous. Duration: 13 months.

4. Who do we share your data with?

Your data is not sold. It is shared only with the following processors, strictly for the needs of the service:

• Supabase Inc. (United States): hosting of the database and authentication service. Transfer governed by the European Commission's Standard Contractual Clauses (SCCs).
• Vercel Inc. (United States): hosting of the web application and servers. Transfer governed by the SCCs.
• CAWL / Worldline by Crédit Agricole (France): bank payment provider. Receives the data necessary to process the transaction.
• Resend (United States): sending of transactional emails (order confirmation, tracking, customer service) and of campaign emails. Campaign emails are sent from a dedicated address; Resend measures only clicks on their links, with no open-tracking pixel: we do not know whether you opened an email. These measurements are linked to you only if you have given your consent to personalized tracking; without that consent, clicks are only counted per campaign, with no link to you on our side. Transfer governed by the SCCs.
• Colissimo / La Poste (France): parcel delivery. Receives your name, delivery address and phone number for delivery purposes.
• CNPM-MCC Consumer Mediator (France): only in the event of a dispute and after your explicit acceptance.

Your data is never sold or rented. Apart from Google under the conditions below, no data is transmitted to commercial or advertising partners.

• Google Ireland Limited (Ireland): audience measurement (Google Analytics) and measurement of sales from our ads (Google Ads), only if you have accepted. Any transfer outside the EU is governed by the Data Privacy Framework.
• Microsoft Ireland Operations Limited (Ireland): analysis of journeys on the site (Microsoft Clarity), only if you have accepted; input fields are masked. Any transfer outside the EU is governed by the Data Privacy Framework.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): display of the pay-in-instalments offer on product pages, only if you have accepted; PayPal receives your IP address and may set its cookies.
• Sendcloud B.V. (Netherlands): preparation of shipping labels and search for pick-up points. Receives your name, delivery address, email and phone number.
• Mondial Relay (France) and FedEx: parcel delivery, depending on the method you choose. They receive your name, delivery address and phone number.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payment with PayPal, including payment in instalments, if you choose it. Receives the data needed for the transaction.
• OVH SAS (France): sending of text messages (order notices and, if you agreed, offers by text message). Receives your phone number.
• Google Ireland Limited (Ireland), for sign-in: if you choose “Continue with Google”, we receive your name, email and profile picture from Google to create or open your account.

5. How long do we keep your data?

• Active customer account: for as long as your account remains open.
• Inactive customer account: 3 years from your last login (CNIL recommendation), then deletion or anonymization.
• Orders and invoices: 10 years from the close of the accounting year (legal obligation, Art. L.123-22 of the French Commercial Code (Code de commerce)). If you delete your account, this data is kept in anonymized form (personal identification removed).
• Customer service report photos: kept for the duration of the incident's handling, then a maximum of 3 years to handle any potential claims.
• Orders that cannot go through: when an order cannot be completed (delivery impossible, order refused, payment not completed), we keep your email address, your country and the contents of your basket for 6 months at most, so that we can help you.
• Consents (Terms of Use, marketing, personalized tracking): 5 years after withdrawal, for evidentiary purposes.
• Administrative audit log: kept in append-only mode for traceability of access to personal data (Art. 30 GDPR). Emails are stored in hashed form (SHA-256) within it.
• Technical cookies: duration of the session (except for the access code cookie, which lasts 30 days).
• Google Analytics and Google Ads cookies (if accepted): 13 months at most; your banner choice is kept for 6 months.
• Microsoft Clarity cookies (if accepted): _clck 1 year, _clsk 1 day.
• Personalized tracking (if accepted): 13 months.
• Anonymous audience measurement: hh-visite cookie, 30 minutes after the last page viewed; measurement data, 13 months.
• Cookie banner choices: an anonymous log (your choice, the “personalised tracking” box, the time, and a random identifier kept in your browser, with no IP address or account) is kept for 5 years, so that the choice you made can be proven.

6. Your rights over your data

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access (Art. 15): to know what data we hold about you.
• Right to rectification (Art. 16): to correct inaccurate data.
• Right to erasure (Art. 17): to request the deletion of your account and your data.
• Right to restriction (Art. 18): to freeze the processing of your data.
• Right to data portability (Art. 20): to retrieve your data in a machine-readable format (JSON).
• Right to object (Art. 21): to object to processing based on legitimate interest.
• Right to withdraw your consent at any time, for processing based on consent (marketing, personalized tracking).
• Instructions for after your death (Art. 85 of the French Data Protection Act): you can tell us what you would like to happen to your data after your death by writing to support@happy-heroes.fr.

7. How to exercise your rights?

You can exercise most of your rights directly from your customer account, with no complicated steps:

• Download all your data (Art. 20): from My account, My info, "Download export" button.
• Modify your information (Art. 16): from My account, My info, edit each field directly.
• Delete your account (Art. 17): from My account, My info, at the bottom of the page, "Delete my account".

For other rights (objection, restriction, full access), send us an email at support@happy-heroes.fr with "GDPR" in the subject line. We will respond within 1 month maximum (Art. 12.3 GDPR).

8. Complaint to the CNIL

If you believe your rights are not being respected, you may at any time file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL — French Data Protection Authority):

• CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Phone: 01 53 73 22 22
• Online complaint: cnil.fr/plaintes

9. Security of your data

We implement technical and organizational measures to protect your data: TLS encryption for all exchanges, password hashing via Supabase Auth, strict role-based access control to data, immutable (append-only) logging of administrative access, regular security audits.

No system is infallible: if you detect a security flaw, contact us immediately at support@happy-heroes.fr.

10. Minors

Our site is intended for adult users. We do not knowingly collect data concerning persons under 15 years of age (the digital consent threshold in France under the loi Informatique et Libertés). If you are the parent or guardian of a minor who has created an account, contact us for immediate deletion.

11. Changes to this policy

This policy may change (new processor, new purpose, etc.). In the event of a substantial change, we will inform you by email and/or via a notification in your customer account. The date of the last update is indicated at the top of this page.

12. Contact

For any question relating to this policy or your personal data:

• Email: support@happy-heroes.fr
• Mail: Happy Heroes SAS, Village des Voiles, 1 rue de l'Union, 59520 Marquette-lez-Lille, France