Privacy policy

Privacy policy

This is a translation provided for convenience. The French version is the binding one.

Who processes your data

The data controller is Laurent Lévy, sole trader operating under the name Greffeur d'agrumes, whose full details appear in the legal notice.

For any question about your data, write to administratif@greffeurdagrumes.com.

What we collect, why, and for how long

Confirming your email address. When you create an account, we check that the domain of your address (the part after the "@") can receive email, then send you a confirmation link. You can order without waiting to open it. An account whose address has not been confirmed and which has placed no order is deleted automatically after 7 days, together with the data attached to it. Orders placed without creating an account are not affected.

We collect no special category data within the meaning of article 9 GDPR, and we carry out neither profiling nor automated decision-making.

Your card details

Payment is processed by Stripe, which acts as data controller for that operation. We never have access to your card number: it does not pass through our servers and we do not store it.

Who your data is shared with

Your data is neither sold, rented nor exchanged. It is passed only to those who need it to fulfil your order:

• Host — OVH SAS, France, which hosts the website and its database.
• Site protection — Cloudflare, Inc. (United States), through which every connection to the site passes: it receives your IP address, technical information about your browser and the address of the pages requested, in order to block bots and attacks. It acts as a processor and uses this data only for that service.
• Carrier — DPD, which receives your name, delivery address and, where applicable, your telephone number or email for delivery notifications.
• Payment provider — Stripe, for processing the card transaction.
• Email provider, for transactional messages and the newsletter where applicable.
• Google — Google Ireland Limited and Google LLC (United States), for the "I'm not a robot" checkbox (reCAPTCHA) and the map of DPD pickup points (Google Maps). See "Google services" below.

Our audience measurement tool is not on that list: it runs on our own server and therefore sends your data to nobody. See "Audience measurement" below.

Some data may be processed in the United States: by Google, for the two services described below, by Stripe, for payment, and by Cloudflare, for protecting the site. These transfers are covered by the EU–US Data Privacy Framework, to which Google, Stripe and Cloudflare are signed up, and where applicable by the European Commission's standard contractual clauses, in accordance with chapter V GDPR.

Cookies

This website uses only cookies that are strictly necessary for it to work: keeping your session, remembering the basket, your choice of language and form security. They are used neither for advertising nor for tracking you across other websites.

Because those cookies are essential to the service you are requesting, they do not require your prior consent. You may nonetheless delete or block them in your browser settings, on the understanding that ordering online will then no longer work.

We use no advertising cookie. Three providers may, however, read or set their own cookies, solely for security and for checkout to work: Google, on pages showing the "I'm not a robot" checkbox or the pickup point map, Stripe, on the payment page, for fraud detection, and Cloudflare, on every page, to tell visitors from bots ("__cf_bm" cookie, 30 minutes, and "cf_clearance" when a check has been shown to you). Our audience measurement tool, described below, sets no cookie at all.

Audience measurement

To know how many people visit the site and which pages interest them, we use Matomo, an open-source audience measurement package. We chose it because it lets us keep that measurement entirely in-house.

In practice:

• Matomo runs on our own server, in France, at OVH — the same one that hosts the shop. The measurements are sent to no third-party company, in France or anywhere else.
• It sets no cookie on your device.
• Your IP address is truncated before being recorded: we can tell which region you are in, never who you are.
• It honours your browser's "Do Not Track" signal: if you have switched it on, you are not counted.
• We combine these measurements with no other data, and we use them neither for advertising nor to recognise you from one visit to the next on other websites.
• The measurements are kept for 13 months, then deleted.

On product pages, in the basket and at order confirmation, Matomo records the product viewed, added to the basket or bought, and the basket or order amount. This tells us which varieties interest our visitors — that is the only reason we measure at all.

Because this measurement sets no cookie, follows nobody from one site to another and stays on our own server, it falls within the consent exemption recognised by the French data protection authority for audience measurement tools strictly limited to producing anonymous statistics. We therefore display no consent banner. You may nonetheless refuse to be measured: write to us at the address above, or switch on your browser's "Do Not Track" option, which is enough to exclude you.

Google services

Two steps of your visit rely on Google. In both cases your browser connects directly to Google's servers, which receive your IP address, technical information about your browser and the address of the page you are on.

• reCAPTCHA, on the sign-in, account creation and contact pages. The "I'm not a robot" checkbox blocks sign-ups and messages sent by automated programs. To do so, Google analyses your interaction with the checkbox and your browser; we receive only its answer: human or bot.
• Google Maps, on the checkout pages. Our carrier DPD uses it to show the map of pickup points near your address.

Google processes this data under its own privacy policy, which also sets how long it is kept: policies.google.com/privacy. We receive no data from Google that could identify you.

Your rights

You have, at any time, the rights of access, rectification, erasure, restriction, objection and portability set out in articles 15 to 22 GDPR. Where processing is based on your consent, you may withdraw it at any time without affecting what was done beforehand.

To exercise them, write to administratif@greffeurdagrumes.com or use your customer account. We reply within one month. Proof of identity may be requested where there is serious doubt about who is making the request.

If you ask us to delete an account that has orders, all the account data is erased except the invoices and accounting records, which the law requires us to keep for ten years.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Security

The website is served over HTTPS and traffic is encrypted. Access to the administration area is restricted and password-protected. Since no measure can guarantee absolute security, we undertake to apply reasonable means to protect your data and, in the event of a breach likely to result in a high risk to your rights, to inform you in accordance with article 34 GDPR.

Changes

This policy may change, in particular if we change provider or add a service. Last updated: 3 October 2026.