Privacy Policy

Controller

PBM EDITIONS is the controller within the meaning of Art. 4 (7) of the EU General Data Protection Regulation (GDPR).

What we process, and why

• Website visit (hosting): our website is hosted by Vercel Inc. (USA). When you visit, technical data such as your IP address, browser type and the pages you request are processed in short-lived server logs to deliver the site securely. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in a secure, functioning website).
• Shop and orders: our shop system and hosted checkout are operated by Shopify (Shopify International Limited, Ireland). When you order, we process your name, delivery and billing address, email address and the contents of your order to fulfil the contract. Legal basis: Art. 6 (1)(b) GDPR.
• Payment: payments are handled inside the Shopify checkout by Shopify and its payment providers. We never see your full card details. Legal basis: Art. 6 (1)(b) GDPR.
• Printing and delivery: because every book is printed on demand, our print production partner and the postal carrier receive your name, delivery address and the items to be printed and shipped. Legal basis: Art. 6 (1)(b) GDPR.
• Support: if you email support@cleverbookshop.com or use the contact form on this website, we process your name (if you provide it), your email address and the content of your message in order to answer you. Contact form messages are stored in our shop system (Shopify). Legal basis: Art. 6 (1)(b) or (f) GDPR.

Cookies, analytics and advertising

• Essential cookies and local storage: we store your language and market selection and your cart on your device. The shop cannot work without them. Legal basis: Art. 6 (1)(f) GDPR.
• Analytics: we use Plausible Analytics (Plausible Insights OÜ, Estonia), a cookieless service hosted in the EU. It counts visits in aggregate and cannot identify you. Legal basis: Art. 6 (1)(f) GDPR.
• Advertising pixels: only if you accept marketing cookies in our cookie banner do we load the Meta Pixel (Meta Platforms Ireland Limited) and the TikTok Pixel (TikTok Technology Limited, Ireland). They tell us whether our ads work. With that same consent we also confirm completed purchases to Meta (Conversions API) and TikTok (Events API) directly from our server, transmitting the order value, technical browser data (IP address, browser identifiers) and, only in hashed (pseudonymised) form, your email address and phone number — to Meta additionally your name and delivery address (city, postal code, region and country), likewise only hashed. If you decline, no pixel loads, nothing is sent to Meta or TikTok, and the shop works exactly the same. Legal basis: Art. 6 (1)(a) GDPR (consent). You can withdraw your consent at any time via the Cookie settings link in the footer.

Recipients and processors

We share personal data only with the service providers named above (Shopify, Vercel, Plausible, our print production partner and postal carriers, plus Meta and TikTok if you accepted marketing cookies) and, where legally required, with authorities. We do not sell personal data.

International transfers

Some providers process data outside the EU/EEA, for example Vercel in the USA; Meta and TikTok may also process data in the USA. Where that happens, transfers are protected by an EU adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or by EU standard contractual clauses.

Retention

Order, invoice and accounting data are kept for the statutory retention periods under French commercial and tax law (up to 10 years). Support correspondence is deleted once the matter is resolved, unless we are required to keep it. Technical server logs are short-lived.

Your rights

To exercise your rights, email support@cleverbookshop.com. Where processing is based on consent, you may withdraw it at any time with effect for the future.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6 (1)(f) GDPR (Art. 21 GDPR)

Complaints

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the French CNIL (cnil.fr) as the authority responsible for the controller, or the authority of your habitual residence.

Changes

We will update this policy whenever our processing changes; the current version is always published on this page.