Privacy Policy

Last updated: 15 May 2026

1. Who we are

This Privacy Policy describes how RANK SAS ("POPSTRAP", "we", "us", "our") collects, uses, stores and discloses personal data when you visit, interact with, or place an order on popstrap.shop (the "Website").

Data controller within the meaning of the EU General Data Protection Regulation 2016/679 ("GDPR") and the French Data Protection Act 78-17 of 6 January 1978 (as amended):

RANK SAS — 63 bis Boulevard de Metz, 35700 Rennes, France — SIREN 934 234 949 — represented by Mr. Joseph Lecomte, President.

Privacy contact: privacy@popstrap.shop.

2. What personal data we collect

  • Identification & contact data: first name, last name, email address, postal address, phone number.
  • Order data: products purchased, order number, price, dates, billing and shipping addresses.
  • Payment data: payment method, transaction ID, fraud signals. Full card details are entered directly on our payment processors' pages and are not stored on our servers.
  • Account / waitlist data: email address, marketing tags, subscription preferences.
  • Technical & usage data: IP address, browser, device, operating system, referring URL, pages visited, time spent, interactions, language and country (inferred from IP).
  • Customer-service data: messages exchanged with us by email or contact form.

3. Purposes and legal bases

Purpose Legal basis (GDPR)
Process and ship your order, manage returns, handle warranty & repair Performance of the sales contract (Art. 6(1)(b))
Customer support and responding to enquiries Performance of contract / legitimate interest (Art. 6(1)(b) & (f))
Fraud prevention, chargeback management, IT security Legitimate interest in protecting our business (Art. 6(1)(f))
Accounting, invoicing, statutory record-keeping Legal obligation (Art. 6(1)(c))
Marketing emails, drop alerts, waitlist communications Consent (Art. 6(1)(a)) — you can withdraw at any time
Analytics, site improvement, A/B testing Consent for non-essential cookies (Art. 6(1)(a)) / legitimate interest for aggregated metrics
Defending or asserting legal rights, responding to lawful requests Legal obligation / legitimate interest (Art. 6(1)(c) & (f))

4. Who we share data with

We only share personal data with the categories of recipients strictly necessary to operate the Website and fulfil orders:

  • Shopify International Limited (Ireland) — hosting and e-commerce platform.
  • Payment providers (e.g., Shopify Payments, Stripe, PayPal) — processing of payments.
  • Shipping carriers and fulfilment partners — production and worldwide delivery of orders.
  • Email and marketing tools (e.g., Shopify Email, transactional email provider) — order confirmations, drop notifications, marketing emails (with consent).
  • Analytics and advertising providers (only with your prior consent, where required by law) — to measure and improve the Website.
  • Accountants, legal counsel, public authorities — where required by law or to defend our rights.

We do not sell your personal data.

5. International transfers

Some of our service providers may be located outside the European Economic Area (e.g., the United States). When we transfer personal data outside the EEA, we rely on the safeguards provided by the GDPR, including the European Commission's Standard Contractual Clauses or an adequacy decision (e.g., EU-US Data Privacy Framework, where applicable). A copy of the safeguards is available on request.

6. How long we keep your data

  • Customer accounts and order data: 10 years after the last transaction (statutory accounting retention, Art. L123-22 of the French Commercial Code).
  • Marketing subscribers: until you unsubscribe, then within 3 years of last interaction your data is anonymised for statistics or deleted.
  • Prospects who have not purchased: up to 3 years from collection or last contact.
  • Customer-service exchanges: up to 5 years.
  • Server logs and security data: up to 12 months.
  • Cookie consent: 6 months.

7. Your rights

Under the GDPR, you have the right to:

  • access your personal data and obtain a copy;
  • have inaccurate data corrected (rectification);
  • have your data erased, where the conditions are met;
  • restrict the processing of your data;
  • object to processing based on legitimate interest or for direct marketing;
  • receive your data in a structured, machine-readable format (portability);
  • withdraw your consent at any time, without affecting prior processing;
  • define directives concerning the fate of your personal data after your death;
  • lodge a complaint with the French data protection authority (CNIL) — www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

You can exercise your rights at any time by writing to privacy@popstrap.shop. We may ask for reasonable proof of identity before acting on a request. We respond within one month, extendable by two months for complex requests.

8. Cookies and similar technologies

We use cookies and similar trackers to operate the Website, secure your session, remember your cart, and — only with your prior consent — to measure audience and to display personalised marketing.

  • Essential cookies (cart, session, security, fraud prevention): no consent required.
  • Functional cookies (language preference, recently viewed): used to improve your experience.
  • Analytics cookies (audience measurement): only with your consent.
  • Marketing & advertising cookies: only with your consent.

You can manage your preferences at any time through the consent banner or your browser settings. For more details and to exercise opt-out rights, you may visit our Your Privacy Choices page.

9. Children

The Website is not intended for users under 16. We do not knowingly collect personal data from minors under 16 without parental consent. If you believe a minor has provided us with personal data, please contact privacy@popstrap.shop and we will delete it.

10. Security

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, access controls, and security monitoring through Shopify's infrastructure. However, no transmission over the internet can be guaranteed perfectly secure, and you accept this inherent residual risk.

11. Updates to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date above will be amended accordingly. For significant changes, we will provide additional notice (e.g., banner or email).

12. Contact

RANK SAS — Privacy
63 bis Boulevard de Metz, 35700 Rennes, France
privacy@popstrap.shop