Privacy policy
This policy explains what personal data we collect when you use the website aniscardamome.com, why we use it, how long we keep it and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
Data controller
ARBORESCENCE, SAS with a sole shareholder and share capital of €2,500, Lyon RCS 812 075 133, 18 chemin de Montpellas, 69009 Lyon, France, which operates the Anis & Cardamome brand. Contact: contact form, email to [TO BE COMPLETED: email address] or by post to our registered office.
Data collected and purposes
Orders and customer account
Surname, first name, billing and delivery addresses, email address, telephone number, company name and VAT number where applicable, order contents and history. This data is used to process and deliver your orders and to manage your account, customer service, returns and invoicing.
Legal basis : performance of the sales contract; legal accounting and tax obligations for invoicing.
Payment
Card payments are processed by our payment provider Stripe. Your bank details are entered and stored directly by Stripe: ARBORESCENCE never has access to your card number.
Legal basis : performance of the contract; fraud prevention (legitimate interest).
Contact form
Name, email address and the content of your message, in order to reply to your request.
Legal basis : legitimate interest in replying to requests sent to us.
Back-in-stock alert
If you ask to be notified when an item is back in stock, we keep your email address solely to send you that alert.
Legal basis : your consent, which you may withdraw at any time.
Website security
IP address and connection data, recorded by our security tools to protect the website against attacks and fraud.
Legal basis : legitimate interest in ensuring the security of the website.
We do not send marketing communications without your prior consent and we never sell your data.
Recipients of data
Your data is accessible only to authorised ARBORESCENCE staff and, strictly as needed for their tasks, to our service providers:
- the website host, OVH SAS (France);
- the payment provider Stripe;
- the carrier responsible for your delivery (La Poste – Colissimo, DHL or FedEx depending on the destination);
- our technical providers for website maintenance and backups.
Transfers outside the European Union
Some providers, such as Stripe, may process data outside the European Union. These transfers are covered by appropriate safeguards (European Commission standard contractual clauses or an adequacy decision). For deliveries outside the European Union, your details are necessarily passed to the carrier and to the customs authorities of the destination country, as this transfer is essential to fulfil your order.
Retention periods
- Order and customer account data: for the duration of our commercial relationship, then 3 years from your last purchase or last login;
- Invoices and accounting records: 10 years, in accordance with the French Commercial Code;
- Contact form messages: for the time needed to handle your request, then 3 years maximum;
- Back-in-stock alert: until the alert is sent or you unsubscribe;
- Security logs: a few months at most;
- Cookies subject to consent: 13 months at most.
Cookies
The website uses cookies that are necessary for it to work (basket, login, security, language choice, remembering your cookie choices). Other cookies, such as audience measurement cookies, are only set with your consent, collected through the banner shown during your visit. You can change your choices at any time via the “Manage consent” link.
Your rights
You have the right to access, rectify and erase your data, to restrict and object to its processing and to data portability, as well as the right to withdraw your consent at any time and to set instructions regarding your data after your death. To exercise these rights, write to us via the contact form or by post to ARBORESCENCE, 18 chemin de Montpellas, 69009 Lyon, France. We reply within one month.
If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Security
The website is secured by an SSL certificate (https connection), protected by a web application firewall and backed up regularly.
Changes to this policy
This policy may be updated, in particular if the website or the regulations change. The date of the last update is shown below.
Last updated: 21 October 2026.
