Politique de confidentialité
type: policy
name: HEMFORGE Privacy Policy
entity: DOLECOM (micro-entrepreneur, France)
date: 2026-06-14 (guarantee aligned to 60 days)
note: seul changement vs version Arthur = §4.1 "30-day" → "60-day"
---
# HEMFORGE — PRIVACY POLICY
*Last Updated: [bump to current date on publish]*
## 1. Who We Are
HEMFORGE is a men's wellness brand operated by DOLECOM, a sole proprietorship (entrepreneur individuel under the French micro-entrepreneur regime) registered under French law.
Legal representative: Arthur DOLEAC
Registered with the Registre du Commerce et des Sociétés de Saint-Malo under number 990 187 049 R.C.S. Saint-Malo (registered on August 11, 2025).
SIREN: 990 187 049
SIRET (registered office): 990 187 049 00012
VAT number: FR82 990 187 049
Registered office: 38 Avenue Albert Caquot, 35800 Dinard, France.
Contact for privacy matters: info@hemforge.com
As a French legal entity, DOLECOM is subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and French data protection law. As an operator selling to residents of the United States, DOLECOM is also subject to applicable US state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
## 2. Scope of This Policy
This Privacy Policy explains how DOLECOM collects, uses, stores, shares, and protects the personal information of visitors and customers of the HEMFORGE website (hemforge.com) and related digital properties (collectively, the "Site").
This Policy applies to:
- All visitors to the Site, regardless of location
- All customers who place orders through the Site
- All individuals who subscribe to our email communications or marketing programs
- All individuals who interact with our advertisements on third-party platforms
## 3. Information We Collect
### 3.1 Information You Provide Directly
- Contact information: first name, last name, email address, phone number (if provided)
- Shipping and billing information: delivery address, billing address
- Payment information: payment card details are processed directly by Shopify Payments and are not stored by HEMFORGE
- Account information: email address and password if you create an account
- Communications: messages you send us via email or contact forms
- Subscription preferences: your choices regarding subscription frequency and product selection
### 3.2 Information Collected Automatically
- Device and browser information: browser type and version, operating system, device type
- Usage data: pages visited, time spent on pages, referring URLs, clicks
- IP address and approximate geographic location derived from it
- Cookie identifiers and similar tracking data (see Section 7)
- Session data: how you navigate through the Site
### 3.3 Information from Third Parties
- Meta Platforms, Inc.: interaction data from our advertisements (impressions, clicks, conversions)
- Klaviyo, Inc.: email engagement data (opens, clicks, unsubscribes)
- Shopify, Inc.: order and transaction data processed through their platform
## 4. How We Use Your Information
### 4.1 Order Fulfillment and Customer Service
- Processing and fulfilling your orders
- Sending order confirmations, shipping notifications, and tracking information
- Responding to your inquiries, refund requests, and support tickets
- Managing returns and the 60-day money-back guarantee process
### 4.2 Marketing and Communications
- Sending promotional emails and newsletters (with your consent)
- Personalizing marketing content based on your purchase history and preferences
- Managing subscription communications through Klaviyo
- Running targeted advertising campaigns on Meta platforms
### 4.3 Business Operations
- Preventing fraud and ensuring platform security
- Analyzing Site performance and improving user experience
- Complying with legal obligations and enforcing our terms
- Processing subscription management through Katching
## 5. Legal Basis for Processing (GDPR)
For individuals located in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on the following legal bases:
- Performance of a contract (Article 6(1)(b) GDPR): processing necessary to fulfill your order, manage your account, and provide customer service
- Legitimate interests (Article 6(1)(f) GDPR): fraud prevention, security, improving our services, and direct marketing to existing customers
- Consent (Article 6(1)(a) GDPR): for email marketing to new subscribers, cookies and tracking technologies beyond strictly necessary cookies
- Legal obligation (Article 6(1)(c) GDPR): compliance with tax, accounting, and regulatory requirements
You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
## 6. Third-Party Services and Data Sharing
We do not sell your personal information. We share data only with the service providers listed below, strictly for the purposes described.
**6.1 Shopify, Inc.** — Role: Data processor / service provider. Purpose: E-commerce platform, payment processing, order management, hosting. Data shared: Name, email, address, order details, device and browsing data. Privacy policy: shopify.com/legal/privacy
**6.2 Meta Platforms, Inc. (Facebook / Instagram)** — Role: Independent controller / advertising partner. Purpose: Advertising, retargeting, conversion tracking via Meta Pixel. Data shared: Hashed email address, browsing events, purchase events, IP address (hashed), device identifiers. Note: Meta may use this data in accordance with its own privacy policy for its own advertising products. California residents may opt out of this sharing (see Section 10). Privacy policy: facebook.com/privacy/policy
**6.3 Klaviyo, Inc.** — Role: Data processor / service provider. Purpose: Email marketing automation, subscriber management, behavioral tracking for email personalization. Data shared: Email address, name, purchase history, browsing behavior on the Site, email engagement data. Privacy policy: klaviyo.com/legal/privacy
**6.4 Katching (Subscription Management)** — Role: Data processor / service provider. Purpose: Managing recurring subscription orders. Data shared: Name, email address, subscription preferences, billing information (processed by Shopify Payments).
**6.5 Other Disclosures** — We may also disclose personal information: to comply with legal obligations, court orders, or government requests; to protect the rights, property, or safety of HEMFORGE, our customers, or others; in connection with a merger, acquisition, or sale of substantially all of our assets.
## 7. Cookies and Tracking Technologies
### 7.1 What We Use
- Strictly necessary cookies: required for the Site to function (shopping cart, session management). These cannot be disabled.
- Analytics cookies: help us understand how visitors use the Site
- Marketing cookies: used by Meta Pixel to measure ad performance and enable retargeting
- Functional cookies: remember your preferences (currency, session)
### 7.2 Cookie Management
Upon first visiting the Site, you will be presented with a cookie consent banner. You may accept, reject, or customize non-essential cookies at any time through the cookie settings accessible in the footer of the Site.
### 7.3 Global Privacy Control (GPC)
We recognize and honor the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal, we will treat this as a valid opt-out of the sale and sharing of your personal information for targeted advertising purposes.
## 8. Email Marketing
We use Klaviyo to manage our email communications. By subscribing to our mailing list or making a purchase, you may receive transactional emails (order confirmations, shipping notifications) and marketing emails (promotions, product news).
You may unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any email or by contacting us at info@hemforge.com. Unsubscribing will not affect transactional communications related to active orders or subscriptions.
## 9. Your Privacy Rights
### 9.1 Rights Under GDPR (EU, EEA, UK, Switzerland)
Right of access; rectification; erasure (subject to legal retention); restriction of processing; data portability; objection (legitimate interests / direct marketing); withdraw consent at any time.
Supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr
We respond to GDPR requests without undue delay and within one month (extendable to three months for complex requests).
### 9.2 Rights Under CCPA/CPRA (California Residents)
Right to know; right to delete; right to correct; right to opt-out of sale/sharing (see Section 10); right to non-discrimination.
To submit a request, contact us at info@hemforge.com. We will respond within 45 days as required by law.
### 9.3 Other US State Rights
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Florida, Oregon, Montana, and other states with comprehensive privacy laws have similar rights. We extend these rights to all US residents where applicable.
## 10. Do Not Sell or Share My Personal Information
HEMFORGE does not sell personal information for monetary consideration. However, under California law, certain sharing of personal information with Meta Platforms for cross-context behavioral advertising may constitute "sharing" of personal information.
California residents may opt out by: enabling the Global Privacy Control (GPC) signal in your browser; or contacting us at info@hemforge.com.
## 11. Data Retention
- Order and transaction data: 7 years (French commercial and tax law requirements) *[à vérifier : la loi comptable FR peut imposer 10 ans]*
- Customer account data: for the duration of your account, plus 3 years after closure
- Email marketing data: until you unsubscribe or withdraw consent, plus 3 years
- Analytics and behavioral data: 13 months
- Customer service records: 3 years from last interaction
## 12. International Data Transfers
DOLECOM is a French entity and processes data primarily within the European Union. Our service providers — including Shopify, Meta, and Klaviyo — are headquartered in the United States and may transfer personal data internationally. Such transfers are conducted using Standard Contractual Clauses (SCCs) approved by the European Commission or other appropriate safeguards. You may request a copy by contacting info@hemforge.com.
## 13. Children's Privacy
The Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. Our products are intended for adult use only. If you believe a minor has provided us with personal information, please contact info@hemforge.com and we will promptly delete it.
## 14. Data Security
We implement appropriate technical and organizational measures to protect your personal information, including SSL/TLS encryption, restricted internal access, and Shopify's certified payment security. No method of transmission is 100% secure. In the event of a personal data breach, we will notify relevant authorities and affected individuals as required by applicable law.
## 15. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last Updated" date. For material changes, we will notify you via email or a prominent Site notice before the change becomes effective