Privacy policy
This English version is provided for information purposes only. In the event of any discrepancy or dispute, the French version alone is legally binding. To read it, switch the site language to French.
Last updated: 6 October 2026
At Vortex Corner, we work with artists and collectors who place their trust in us. Your personal data deserves the same care as the works. This policy explains what data we collect, why, how long we keep it, with whom we share it and how to exercise your rights. It has been drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and amended French Law No. 78-17 of 6 January 1978 ("Informatique et Libertés").
1. Who is responsible for your data?
The data controller is SAS VORTEX, which operates the Vortex Corner shop:
- a simplified joint-stock company (société par actions simplifiée) with share capital of €2, registered with the Paris Trade and Companies Register (RCS Paris) under number 991 283 136;
- registered office: 200 rue de la Croix-Nivert, 75015 Paris, France;
- represented by Gaël Pentecouteau, President.
Contact for any question about your data: contact@vortex-corner.com, or by post to the registered office address.
We have not appointed a data protection officer, as the law does not require one for our activity. Your requests are handled directly by the management team.
2. What data do we collect, why and on what basis?
We only collect the data needed for each purpose. Mandatory fields are indicated in the forms. If you do not complete them, we cannot process your request.
| Purpose | Data concerned | Legal basis | Retention period |
|---|---|---|---|
| Processing and delivering your order, after-sales service, returns, guarantees | Surname, first name, delivery and billing addresses, email, telephone, order contents, purchase history, exchanges with customer service | Performance of the contract | 5 years after the order; accounting records and invoices 10 years (Article L. 123-22 of the French Commercial Code (Code de commerce)); contracts of €120 or more 10 years (Article L. 213-1 of the French Consumer Code (Code de la consommation)) |
| Payment | Payment method, transaction status and amount. Card numbers are processed solely by our payment service provider: we never have access to them | Performance of the contract | In accordance with the provider's obligations; transaction data together with the order |
| Fraud prevention and Site security | IP address, device and browser information, order history, risk analysis provided by Shopify | Legitimate interest (protecting ourselves against fraud) | Duration of the order concerned, and until the end of any proceedings |
| Customer account | Email, name, addresses, orders, Club membership status | Performance of the contract | Until the account is deleted, or 3 years without any login or order |
| Club Vortex and newsletter: news, drops, pre-orders, welcome code | Email, first name if provided, sign-up date, opens and clicks in our emails | Consent (voluntary sign-up). It may be withdrawn at any time | 3 years after your last contact or last interaction (click, order), or until you unsubscribe |
| Early access to drops | Club membership status linked to your account | Performance of the service requested | For as long as you are a Club member |
| Back-in-stock alert | Email, product and size concerned | Consent | Until the alert is sent, and at most 6 months |
| Contact and custom quote request | Name, email, telephone if provided, message content, project details | Pre-contractual measures or legitimate interest (replying to you) | 3 years after the last exchange; longer if an order results (see the first row) |
| Artist application | Name, email, links to your work (portfolio, social networks), message, material submitted | Pre-contractual measures, at your request | 2 years after the last exchange if no collaboration results; earlier deletion on simple request |
| Customer reviews with photo | First name and initial of surname (or pseudonym), review, rating, photo, product purchased, order verification | Consent (voluntary submission, authorisation to publish) | For as long as the review is published (indefinitely); removal at any time on simple request |
| Audience measurement and Site improvement | Pages viewed, browsing path, device type, cookie data | Consent (cookie banner) | 13 months for cookies; 25 months maximum for statistics |
| Legal obligations and defence of our rights | Data necessary to handle a dispute or a request from an authority | Legal obligation or legitimate interest | Duration of the proceedings, then the time limits for appeal |
Your favourites are not transmitted to us. The list of works you add to your favourites is stored solely in your browser, on your device. We do not have access to it.
Sensitive data. We do not collect any sensitive data (health, opinions, origin, etc.). Please do not include any in your messages.
Profiling. We may recommend works to you based on your purchases or your browsing on the Site. No decision producing legal effects concerning you is taken by entirely automated means. If an anti-fraud analysis flags an order as risky, it is reviewed by a person before any cancellation.
3. With whom do we share your data?
We never sell your data and use no advertising pixels or cookies (Meta, Google Ads, TikTok…). Your data is accessible to the Vortex Corner team, to the extent required by their duties, and to the service providers who help us run the shop. These providers act on our instructions and are bound by confidentiality and security commitments (Article 28 GDPR).
| Recipient | Role | Data concerned |
|---|---|---|
| Shopify International Limited (Dublin, Ireland) and its affiliates | Hosting of the Site, management of orders and accounts, sending of emails (Shopify Email), anti-fraud analysis | All shop data |
| Shopify Payments | Payment by bank card and digital wallets | Payment data |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) | PayPal payment, if chosen. PayPal then also acts as a separate controller for its own obligations | Identity, email, address, amount, order |
| Klarna Bank AB (Stockholm, Sweden) | Payment in 3 instalments, if chosen. Klarna acts as a separate controller for the creditworthiness assessment, in accordance with its own privacy policy | Identity, contact details, order, creditworthiness data |
| Carriers: La Poste (Colissimo), Chronopost and its Shop2Shop pick-up point network | Delivery and tracking | Name, address, telephone, email, parcel tracking |
| Specialised carrier (guitars and arcade cabinets) | Delivery of large items. The carrier is chosen for each order and named to you before shipping | Name, address, phone, email, order contents |
| A3Prod Logistique (Caen) | Order preparation, shipping (including orders combining prints and print-on-demand T-shirts) and receipt of returns | Name, delivery address, telephone, order contents |
| AVC Publicité | Print-on-demand production and shipping of T-shirts, when ordered on their own | Name, delivery address, telephone, order contents |
| Artists | Personalised dedication, if you request one | First name or name given for the dedication |
| Our chartered accountancy firm | Bookkeeping and tax obligations | Invoices |
| Administrative or judicial authorities | Only upon a lawful request | Strictly necessary data |
Shopify as a separate controller. For certain services, Shopify processes data on its own behalf and under its own responsibility: Shop Pay and the Shop app, if used, as well as platform-wide fraud prevention. Its policy then applies: https://www.shopify.com/fr/legal/confidentialite. You can exercise your rights with Shopify at https://privacy.shopify.com/fr.
4. Is your data transferred outside the European Union?
Our host Shopify is established in Ireland. Some data may nevertheless be processed:
- in Canada, by Shopify Inc. This country benefits from an adequacy decision of the European Commission;
- in the United States, by Shopify or some of its sub-processors. These transfers are based on the EU–US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses.
You can obtain a copy of these safeguards by writing to us.
5. How do we protect your data?
- The Site is fully encrypted (HTTPS).
- Payments are processed by a PCI DSS Level 1 certified platform. We neither see nor store your card numbers.
- Login to the customer account is by means of a one-time code sent by email, with no password to remember or to have stolen.
- Access to the shop's administration is restricted to authorised persons and protected by strong authentication.
As no system is infallible, we undertake to inform you, as well as the CNIL, of any data breach likely to present a risk to you, under the conditions laid down by the GDPR.
6. Cookies and trackers
On your first visit, a banner allows you to accept, refuse or customise non-essential cookies, as easily in one case as in the other. If you take no action, no non-essential cookies are placed.
| Category | Examples | Consent |
|---|---|---|
| Strictly necessary | Basket, session, security, language, remembering your cookie choice, favourites (local storage) | Not required |
| Audience measurement | Shopify visitor statistics | Required |
| Personalisation | Recommendations of works based on your browsing | Required |
Your choice is stored for 6 months, after which the banner is shown to you again. You can change it at any time via the "Cookie preferences" link at the bottom of the page, or by deleting cookies in your browser.
7. Your rights
You have the following rights over your data:
- access: to know what data we hold and obtain a copy of it;
- rectification: to correct inaccurate data;
- erasure: unless the law requires us to retain it, for example invoices;
- restriction: to freeze the use of your data while a dispute is being examined;
- portability: to receive the data you have provided to us in a readable format, in order to transmit it to another service;
- objection: to object to processing based on our legitimate interest and, at any time and without giving reasons, to direct marketing;
- withdrawal of consent: at any time, without affecting processing already carried out. For emails, the unsubscribe link appears in each message;
- post-mortem instructions: to determine what happens to your data after your death.
How? Write to contact@vortex-corner.com, specifying your request. We may ask you to prove your identity if there is reasonable doubt, but never a systematic copy of your identity document. We reply within one month. This period may be extended by two months for a complex request, in which case we will let you know.
Complaint. If you consider that your rights have not been respected, you may refer the matter to the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or www.cnil.fr/fr/plaintes.
8. Minors
The Site is intended for adults. Club Vortex membership is available from the age of 15. Below that age, it requires the consent of a holder of parental authority (Article 45 of the French "Informatique et Libertés" Act). If you believe that a minor has provided us with data without such consent, contact us: we will delete it.
9. Links to other sites
The Site contains links to third-party sites: social networks, artists' websites, partners. We are not responsible for their practices. Please consult their own privacy policies.
10. Changes
We may update this policy, in particular in the event of a new service or changes in the regulations. The date of the last update appears at the top of the page. In the event of a significant change, account holders and Club members will be informed by email.