Data controller
The data controller is the sole trader operating Guitar Icons, based in 84350 Courthézon, France. For questions concerning personal data, contact contact@guitar-icons.com.
Personal data that may be processed
Depending on the features used, the store may process account and authentication data, contact details, billing and delivery addresses, basket contents, order history, contact and return requests, reviews, language preferences, technical security data and information needed for customer support.
Full payment-card information is not intended to be stored by the store where an external payment provider handles transactions.
Purposes and legal bases
Data is used to create and manage accounts, fulfil orders, reserve and update stock, collect or refund payments, arrange shipping, handle returns, respond to requests, prevent misuse, secure the service and comply with accounting, tax and administrative obligations. Depending on the purpose, processing relies on performance of a contract, compliance with a legal obligation, the controller's legitimate interests or consent where required.
Service providers and recipients
Payments: Stripe. Hosting: OVHcloud. Other providers may handle emails or shipping according to the services actually used for an order. Google Tag Manager and Google Analytics 4 are configured but not activated on the public site at the date of this update. Only information necessary for the relevant service is shared.
Transfers outside the European Economic Area
Some providers may process data from a country outside the European Economic Area. Where such a transfer occurs, the store must ensure that it relies on a transfer mechanism recognised under applicable data protection law and the appropriate safeguards required by the GDPR.
Google sign-in
If Google sign-in is enabled, information obtained through this service is limited to what is needed for authentication and the user profile supported by the application. This feature should only be offered in production if properly configured and documented.
Retention periods
Personal data is kept for periods appropriate to its purpose and applicable legal duties. Accounting records are generally kept for ten years. Account, order and support data is retained as needed to provide the service, comply with legal duties and protect legal rights, then deleted or appropriately archived. Cookie choices and the consent log are currently configured for 180 days; this period does not apply to all personal data.
Cookies and other trackers
Strictly necessary cookies or local storage may be used for sessions, the basket, authentication, security and preferences. Current situation: Google Analytics 4 and Google Tag Manager have been prepared but are not active. If audience measurement is enabled later, trackers requiring consent will only be triggered after the corresponding category has been accepted.
When a tracker is not strictly necessary and requires consent, it must not be used until the visitor has made a free, specific, informed and unambiguous choice. Refusal must be as accessible as acceptance, and consent must be easy to withdraw.
Cookie consent
The banner allows visitors to accept, refuse or customise optional categories. Preferences can be changed using the “Cookies” button. The currently configured period for remembering choices and purging the consent log is 180 days; this is not a general retention period for all personal data.
Individuals' rights
Depending on the processing concerned, individuals may request access, rectification, erasure or restriction of their data, object to certain processing and exercise the right to data portability where applicable. Consent can be withdrawn at any time without affecting the lawfulness of processing undertaken previously.
Requests can be sent to contact@guitar-icons.com. Proof of identity is requested only when necessary to verify the applicant's identity. If difficulties persist, a complaint may be lodged with the French data protection authority (CNIL).
Security
The store applies appropriate technical and organisational measures to reduce the risks of unauthorised access, loss, destruction or alteration of data. Administrative and service-provider access is limited to what is necessary for their duties.