Privacy policy

Last updated: October 2026

This policy explains how your personal data is processed when you visit the website www.ornawall.com (“Ornawall”) or buy our products. It is written in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and, for customers in the United Kingdom, the UK GDPR and the Data Protection Act 2018.

1. Data controller

The data controller is Shahin GHARBI, a French sole trader (micro-entreprise), 443 rue des Combes, 73000 Chambéry, France, SIRET 903 950 210 00018.

For any question about your data or to exercise your rights: info@ornawall.com or phone and WhatsApp +33 7 82 21 49 93.

2. What data we process

  • Identification and contact data: first name and surname, email address, phone number.
  • Delivery and billing data: shipping and billing address.
  • Order data: products bought, amounts, payment method used, shipping status.
  • Payment data: payments (card, PayPal, Apple Pay, Google Pay) are handled by payment service providers through Shopify; we receive confirmation of the result, not the full details of your payment method.
  • Communications: the messages you send us (email, WhatsApp) and the information you give us in support requests, returns and complaints.
  • Browsing data: IP address, type of device and browser, pages visited, data collected through cookies and similar tools, according to your choices (see the “Cookie policy”).

3. Purposes and legal bases

  • Managing the order: handling the purchase, payment, shipping and delivery, returns and refunds. Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
  • Customer service: answering your requests and complaints, including by email or WhatsApp. Legal basis: performance of a contract (Art. 6(1)(b)) and legitimate interest in handling requests efficiently (Art. 6(1)(f)).
  • Legal obligations: complying with accounting, tax and record-keeping obligations, managing consumer rights. Legal basis: legal obligation (Art. 6(1)(c)).
  • Security and fraud prevention: protecting the Site and orders against abuse and fraudulent payments. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Statistics and improving the Site: analysing the use of the Site through analytics cookies. Legal basis: consent (Art. 6(1)(a)), which you can give or refuse through the cookie banner.
  • Marketing and advertising: marketing cookies and, if there are any, commercial communications. Legal basis: consent (Art. 6(1)(a)), which can be withdrawn at any time.
  • Defence of rights: establishing, exercising or defending a legal claim in or out of court. Legal basis: legitimate interest (Art. 6(1)(f)).

Providing the data needed for the order is essential to conclude the purchase: without it we cannot process the order. Consent for non-essential cookies and for marketing is always voluntary.

4. Who we share data with

The data is processed by the controller and shared only with those who help us provide the service, to the extent necessary:

  • Shopify International Ltd (Dublin, Ireland) and Shopify Inc., which provide the online shop platform and host the Site;
  • payment service providers (including PayPal, Apple Pay and Google Pay, as well as the card payment services built into the platform);
  • product suppliers and carriers, who receive the data needed to prepare and deliver the order (usually your name, delivery address and phone number);
  • advisers and authorities, where legal obligations require it or to defend our rights.

We do not sell your personal data.

5. Transfers outside the European Economic Area and the United Kingdom

Some of the parties listed above (in particular Shopify Inc., the suppliers who ship from China and the carriers in the country of delivery) may be located outside the European Economic Area and the United Kingdom. The transfer relies on an adequacy decision or on appropriate safeguards, such as standard contractual clauses. To suppliers in countries without an adequacy decision, such as China, we pass on only the data needed to prepare and deliver your order, because it is necessary to perform the contract you have entered into with us (Art. 49(1)(b) GDPR). You can ask us for information about the safeguards applied by writing to the contact details above.

6. How long we keep data

  • Order data and accounting and tax documents: for the period required by the applicable accounting and tax rules (as a rule, 10 years).
  • Support, returns and complaints data: for as long as needed to handle the request and then for the period in which rights arising from the contract can be asserted (legal guarantee and limitation periods).
  • Data processed on the basis of consent (marketing, non-essential cookies): until consent is withdrawn or the cookies expire, according to the Cookie policy.
  • Browsing data: for the lifetime of the cookies and tools used, as stated in the Cookie policy.

Once the retention periods have passed, the data is deleted or anonymised.

7. Your rights

Under the GDPR (and, for customers in the United Kingdom, the UK GDPR and the Data Protection Act 2018) you have the right to:

  • access your data and receive a copy (Art. 15);
  • have inaccurate data corrected or incomplete data completed (Art. 16);
  • have your data erased in the cases provided for (Art. 17);
  • obtain restriction of processing (Art. 18);
  • receive your data in a structured, machine-readable format and ask for it to be transmitted to another controller, where applicable (Art. 20);
  • object to processing based on legitimate interest (Art. 21);
  • withdraw your consent at any time, without affecting the lawfulness of the processing carried out before.

If you live in another country, you also have the rights granted by the data protection law of your country of residence, where it applies.

To exercise your rights, write to us at info@ornawall.com. We may ask you to verify your identity before replying. If you have doubts or are not satisfied with the reply, you can lodge a complaint with a supervisory authority.

8. Complaint to the supervisory authority

You can lodge a complaint with the supervisory authority of your country of residence: in the United Kingdom, the Information Commissioner’s Office (ICO) (ico.org.uk); in the European Union, the data protection authority of your Member State (the list is published by the European Data Protection Board at www.edpb.europa.eu). You can also complain to the French supervisory authority, the CNIL (www.cnil.fr), since the controller is based in France. If possible, please contact us first, so that we can look for a solution together.

9. Cookies

The Site uses cookies and similar technologies provided by Shopify. You will find all the information in the “Cookie policy”.

10. Changes to this policy

We may update this policy, for example because of regulatory developments or changes to our services. The date of the last update is shown at the top of the page.