Privacy Policy

Last updated: October 2026

This Privacy Policy explains how CRESTWHITE collects, uses, stores and shares personal data when you visit our website, use our services, place an order or contact us.

We process personal data in accordance with applicable data-protection law, including the General Data Protection Regulation (GDPR) where it applies.

1. Who is responsible for your data?

The controller responsible for the personal data described in this policy is:

CRESTWHITE
14 Rue de Penthièvre
75008 Paris
France

Phone: +33 7 82 41 94 89

Main privacy contacts:

• contact@mycrest.net
• info@mycrest.net

Our other contact addresses are listed in Section 17.

2. Personal data we may collect

Depending on how you interact with us, we may process:

• Contact and delivery details: your name, email address, phone number, postal address, billing address and delivery address.
• Shopping and order information: products viewed or added to your cart, purchases, order history, returns, refunds, exchanges and cancellations.
• Payment and transaction information: payment status, transaction amount, payment method and transaction reference. Full payment credentials are generally processed directly by the relevant payment provider.
• Customer account information: your account identifier, preferences, information associated with your account and order history, where an account feature is available.
• Customer service communications: information you provide when asking a question, requesting support or making a complaint.
• Technical and usage information: your IP address, device and browser type, pages visited, visit dates and times, and information about how you use the website.

We collect only the information needed for the relevant purpose. Please avoid sending unnecessary sensitive information through unsecured channels.

3. How we collect personal data

We may receive information:

• Directly from you, when you place an order, create an account, complete a form, contact us or subscribe to our newsletter.
• Automatically, through your device, cookies and similar technologies, subject to the consent rules described below.
• From service providers, including those involved in payments, delivery, hosting, security, analytics and customer support.
• From partners, where the sharing and use of that information are permitted by applicable law.

4. Why we use your data

We may use personal data to:

• Confirm orders, process payments, prepare purchases and arrange delivery.
• Provide order updates and tracking information.
• Handle returns, refunds, exchanges and cancellations.
• Answer questions, provide customer support and resolve complaints.
• Detect suspicious transactions, prevent fraud and protect the website.
• Maintain the website, diagnose technical issues and improve our services.
• Understand website usage and, where permitted, improve the shopping experience.
• Send product news, promotions and other marketing communications where the law allows.

5. Legal bases for processing

The legal basis depends on the purpose of the processing:

Where information is needed to fulfil an order or meet a legal obligation, failing to provide it may prevent us from processing the order or providing the requested service. Optional marketing consent is not required to make a purchase.

Where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

6. Who may receive your data?

We may share the information needed to provide our services with relevant recipients, including:

• Payment service providers.
• Carriers and logistics providers.
• Hosting, IT and security providers.
• Customer support and communication providers.
• Analytics providers and marketing partners, where permitted by law and subject to any required consent.

Access is limited to what is necessary for the recipient's role. Some providers may also process information under their own privacy notices and legal responsibilities.

We may also disclose information where required by law or a court order, or where necessary to establish, exercise or defend legal rights.

7. Cookies and similar technologies

Our website may use cookies and similar technologies for essential functions, preferences, audience measurement, analytics and advertising.

Strictly necessary technologies may be used without consent where the law allows. Technologies requiring consent are used only after you have given that consent.

You can use the website's cookie-preference controls to accept or reject optional technologies and change or withdraw your consent at any time. Accepting and rejecting optional technologies must be equally straightforward.

Please use these controls and the associated cookie information to review the available options. Browser settings may offer additional controls, although blocking essential cookies can affect website functions.

8. How long we keep your data

We keep personal data only for as long as necessary for the relevant purpose, subject to legal retention duties. We determine retention by considering:

• Whether an order, delivery, return, refund or customer service request is still being handled.
• Whether an account remains in use and which account information is still needed.
• Whether a marketing relationship or valid permission remains in place, taking account of objections and withdrawals.
• Accounting, tax and other legal record-keeping requirements.
• Applicable limitation periods and the need to handle a dispute or legal claim.
• A justified and proportionate need to prevent fraud or protect security.

When data is no longer needed, it is deleted or anonymised, unless continued restricted retention is required or justified by law. Some records may need to be kept after an account is closed or a deletion request is made.

9. Security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse, alteration and unlawful disclosure.

No method of electronic transmission or storage can guarantee absolute security. Please protect your account credentials and contact us if you suspect unauthorised account activity.

10. Your data-protection rights

Subject to the conditions in applicable law, you may have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete information.
• Erase data where the legal conditions are met.
• Restrict certain processing.
• Object to processing based on legitimate interests, on grounds relating to your situation.
• Object to direct marketing at any time.
• Data portability, where applicable, by receiving relevant data in a structured, commonly used, machine-readable format or requesting its transfer.
• Withdraw consent where processing relies on consent.

You can unsubscribe from promotional emails through the unsubscribe link in those messages or by contacting us. Unsubscribing does not prevent us from sending service messages needed to manage your order.

11. How to exercise your rights

Email contact@mycrest.net or info@mycrest.net, or write to the postal address in Section 1.

Please explain your request and provide enough information for us to locate the relevant records. If we have reasonable doubts about your identity, we may request additional information necessary to verify it.

We respond without undue delay and normally within one month of receiving your request. Where permitted because of the complexity or number of requests, this may be extended by up to two further months. We will tell you within the first month if an extension is needed and explain why.

Requests are generally free of charge. Any lawful refusal or permitted fee for a manifestly unfounded or excessive request will be explained.

12. Complaints to a supervisory authority

If you believe your data has not been handled in accordance with applicable law, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data-protection authority, or another competent supervisory authority.

The CNIL's complaint service is available at cnil.fr/fr/plaintes.

You are welcome to contact us to discuss a concern, without this limiting your right to complain to an authority.

13. International transfers

Some service providers may process or store personal data outside the European Economic Area (EEA).

Where such a transfer is subject to GDPR requirements, we use an appropriate lawful mechanism, such as an adequacy decision, European Commission-approved standard contractual clauses with any necessary supplementary safeguards, or another permitted mechanism.

You may contact us for information about the safeguards relevant to your data and how to obtain details or a copy, subject to lawful confidentiality restrictions.

14. Third-party websites

Our website may link to websites or services operated by third parties. They have their own privacy notices, and we do not control their independent privacy practices.

Please review their notices before providing personal data. This does not limit our own responsibilities for information that we share with service providers.

15. Children's data

Our services are not specifically intended for children. We do not knowingly collect or use children's personal data in breach of applicable law.

If you believe a child has provided personal data to us inappropriately, contact us so we can investigate and take any necessary action.

16. Changes to this policy

We may update this policy to reflect changes to our services, practices, technology or legal requirements. The current version is published on our website with its last-updated date.

Where the law requires additional notice or renewed consent, we will provide it.

17. Contact

For questions about this Privacy Policy or the use of your personal data:

CRESTWHITE
14 Rue de Penthièvre
75008 Paris
France

Phone: +33 7 82 41 94 89

Main privacy contacts:

• contact@mycrest.net
• info@mycrest.net

Other contact emails:

• contact@crest-white.nl
• contact@crest-white.fr
• contact@crestwhite.fr
• contact@crestwhite.us
• support@crest-officiel.fr