Privacy Policy – exclusivestickers.com
Last update: September 28, 2026
Preamble
AV DIGITAL (hereinafter "we", "our" or "the Operator") places great importance on the protection of your personal data and the respect of your privacy.
This Privacy Policy informs you about how we collect, use, share and protect your personal data when you use the site Custom Stickers — Exclusive Stickers (hereinafter the "Site").
It is established in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and the amended Law No. 78-17 of January 6, 1978 on information technology, files and freedoms.
Article 1 – Data Controller
The controller of your personal data is:
AV DIGITAL SAS, with a capital of €20,000 Registered office: 19 Rue des Ardennes, 21000 Dijon, France RCS Dijon B 883 574 857 Email: support@exclusivestickers.com
Article 2 – Personal data collected
2.1 Data categories
A) Identification and contact data
- Title, surname and first name
- Postal addresses (billing and shipping)
- Email address
- Phone number
B) Professional data (professional clients only)
- Company name
- Contact details
C) Order-related data
- Products, materials, formats and quantities ordered
- Order history and transaction amounts
- Delivery method, including information on the chosen relay point if applicable
- Tracking number and shipping/delivery dates
- Payment method used (credit card data is processed exclusively by our payment providers and is not stored by us)
D) Files and designs
- Visuals uploaded by you (images, photographs, logos, text)
- Saved designs and generated print proofs
- Validation history of designs
E) Customer account data
- Login ID
- Password (stored in encrypted form)
- Saved designs
- Time-limited secure login links, allowing access to an order without a password
F) Connection and navigation data
- IP address
- Browser type and operating system
- Pages viewed and actions performed on the Site (add to cart, start checkout, etc., subject to your consent when required)
- Technical identifiers related to cookies and trackers (see Article 5 and our Cookie Policy)
2.2 Mandatory nature of the data
Fields marked with an asterisk (*) are mandatory to process your order. Without this information, we will not be able to proceed.
2.3 Data origin
Data is collected directly from you (account creation, order, exchanges with customer service) or automatically during your navigation, under the conditions described in Article 5.
2.4 Specific case of Visuals you upload
The Visuals you upload to the Site may contain personal data about you or third parties, including photographs of identifiable people.
In accordance with the Terms and Conditions of Sale, you guarantee that you have obtained, before uploading, the authorization of any identifiable person appearing in a Visual, or that of their legal representatives if they are a minor. We process these files solely on your instructions and for the sole purpose of fulfilling your order.
We recommend that you do not upload files containing sensitive data within the meaning of Article 9 of the GDPR (data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health status or sexual orientation). If you choose to do so, this upload is your sole initiative and responsibility.
Article 3 – Purposes, legal bases and retention periods
PurposeLegal basisRetention periodOrder management and tracking (processing, delivery)Performance of contract (Art. 6.1.b GDPR)Duration of the order, then 3 years from the last orderManufacture of custom productsPerformance of contractDuration of the orderStorage of Visuals and DesignsPerformance of contract6 monthsPayment management and fraud preventionPerformance of contract; legitimate interest (Art. 6.1.f) for fraud preventionCard data not stored by us; specific durations of our payment providersCustomer account managementPerformance of contractAs long as the account is active, then 3 years from the last activityCustomer service and after-sales supportPerformance of contract3 years from the last interactionManagement of legal guarantees, complaints and defense of our legal rightsLegitimate interest (Art. 6.1.f)5 years from the end of the relationship or the closing of the complaintControl of Visuals flagged as illegalLegitimate interest (Art. 6.1.f)3 yearsBilling and accounting/tax obligationsLegal obligation (Art. 6.1.c)10 years (restricted access archiving)Commercial prospecting towards clients (similar products or services)Legitimate interest (Art. 6.1.f)3 years from the last contactCommercial prospecting towards prospectsConsent (Art. 6.1.a)3 years from the last contactAudience measurement and Site improvement (Google Analytics 4)Consent (Art. 6.1.a)14 monthsAd conversion measurement and remarketing (Google Ads)Consent (Art. 6.1.a)Click identifier (gclid): 90 days; see Article 5
At the end of these periods, your data is deleted or anonymized, subject to the retention periods imposed by law. Invoices and accounting documents are kept for 10 years in intermediate archiving, with access limited only to authorized persons.
Article 4 – Data recipients
Your data is intended for:
A) Our internal departments: sales, customer service, production, accounting, limited to what is necessary for the performance of their duties.
B) Our service providers and partners:
- Hosting, database and authentication: the Base44 platform
- Payment: Stripe, PayPal, Apple Pay and Google Pay, for secure payment processing. For certain operations that are their responsibility (fraud prevention, regulatory obligations), they act as separate data controllers
- Transport and delivery: La Poste / Colissimo, Chronopost (including relay point delivery), 2Shop
- Transactional emails and communications: Resend
- Production: PrintNode, for transmitting manufacturing orders to our printing equipment
- Audience measurement and advertising: Google (Google Analytics 4, Google Ads), subject to your consent (see Article 5). Depending on the service, Google Ireland Limited acts as a processor or as a data controller, in accordance with its data processing terms
C) Competent authorities, upon legal request (tax administration, customs, judicial or police authorities).
D) Third-party reporting parties: in the event of a complaint based on an infringement of a third party's rights by a Visual, information strictly necessary for processing the report may be communicated within the applicable legal framework.
We do not sell or rent your data to third parties.
Article 5 – Audience measurement, advertising and cookies
5.1 Principle
Trackers that are not strictly necessary for the operation of the Site (audience measurement, ad conversion measurement, remarketing, ad personalization) are only used with your consent, collected via the banner displayed during your first visit. You can refuse everything from the first screen of the banner, choose category by category, and modify or withdraw your choice at any time via the "Manage my cookies" link available at the bottom of each page of the Site.
Your choice is recorded in a cookie (es_consent) and kept for a maximum of 13 months. Details of the cookies are provided in our Cookie Policy.
5.2 Audience measurement (Google Analytics 4)
If you accept the "Statistics" category, we measure site traffic and visitor journeys (product view, add to cart, start checkout, purchase) in order to improve the Site and our offers.
5.3 Ad conversion measurement (Google Ads)
If you accept the "Conversions and remarketing" category:
- when you arrive at the Site from a Google ad, the click identifier (gclid) is stored in a Site cookie for 90 days, in order to link an order to the campaign that originated it;
- navigation events (product view, add to cart, start checkout, purchase) are transmitted to Google Ads;
- during a purchase, enhanced conversion data (email address, phone number, first name, last name, postal code, country) are transmitted to Google in hashed form, in order to more accurately attribute the order to a campaign.
If you also accept the "Ad personalization" category, this data can also be used to personalize the ads presented to you.
5.4 Conversion tracking from our servers
After validation of an order payment, our server may transmit the conversion to Google Analytics 4 and Google Ads to improve measurement reliability. The following are transmitted: transaction number, amount, currency, cart details, taxes, shipping costs, promotional code and, for Google Ads, hashed identifiers (email, phone, first name, last name, postal code, country).
This transmission depends on the choice you made at the time of the order, recorded with it: it only takes place to Google Analytics 4 if you have accepted the "Statistics" category, and to Google Ads only if you have accepted the "Conversions and remarketing" category. If you have refused, no order data is transmitted by our server to these services. Tracking identifiers attached to the order are kept only for the time necessary for this transmission, then deleted, at the latest within 90 days.
5.5 Behavior in case of refusal (Google Consent Mode)
As long as you have not made a choice, and if you refuse, Google tags remain configured in "refused" mode: no measurement or advertising cookie is deposited. For the technical operation of the service, minimal requests (notably IP address and browser information) may be sent to Google, without advertising identifier or cookie. Furthermore, the Google click identifier present in the address of the landing page may be kept in the Site links during your navigation, without being recorded in a cookie.
Article 6 – Transfers outside the European Union
Your account and order data is hosted within the European Union (Ireland).
Some of our service providers (notably Google, Stripe, PayPal, Resend, PrintNode and Base44) may process data outside the European Union, notably in the United States. These transfers are framed by the guarantees provided in Chapter V of the GDPR: adequacy decision of the European Commission (notably the Data Privacy Framework for certified providers) or standard contractual clauses.
You can obtain a copy of these guarantees by writing to us at support@exclusivestickers.com.
Article 7 – Data security
We implement appropriate technical and organizational measures:
- SSL/TLS encryption of exchanges and payments;
- passwords stored in encrypted form;
- access to data restricted to authorized persons;
- uploaded files stored in a private space, accessible only by signed link;
- regular backups and monitoring of systems;
- staff awareness.
Article 8 – Your rights
In accordance with the GDPR, you have the following rights:
- Right of access: obtain a copy of your personal data.
- Right of rectification: have your inaccurate or incomplete data corrected.
- Right to erasure: request the deletion of your data, subject to our legal retention obligations.
- Right to restriction of processing: in cases provided for by the GDPR.
- Right to portability: retrieve the data you have provided to us in a structured and commonly used format.
- Right to object: object, for a reason related to your particular situation, to processing based on legitimate interest, and, at any time and without reason, to commercial prospecting.
- Right to withdraw your consent: at any time, without calling into question the legality of the processing carried out before this withdrawal. For cookies and trackers, use the "Manage my cookies" link at the bottom of the page.
- Right to set post-mortem directives: relating to the fate of your data after your death.
How to exercise your rights?
- By email: support@exclusivestickers.com
- By post: AV DIGITAL – Protection des données, 19 Rue des Ardennes, 21000 Dijon
In case of reasonable doubt about your identity, we may ask you for additional proof.
We will respond within one month, extendable by two months in case of a complex request or a high number of requests; you will then be informed.
Article 9 – Complaint to a supervisory authority
If you believe that the processing of your data constitutes a violation of the GDPR, you can lodge a complaint with the CNIL:
Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 Phone: 01 53 73 22 22 – Site: CNIL — Personal data protection
If you reside in another Member State of the European Union, you can also contact the supervisory authority of your country of residence.
Article 10 – Automated decisions
We do not take any decisions producing legal effects on you, or significantly affecting you, based solely on automated processing.
Article 11 – Data relating to minors
The Site is not intended for minors. Placing an order assumes having the legal capacity to contract.
For processing based on consent, the age at which a minor can consent alone varies according to the Member States of the European Union. In France, Article 45 of the Data Protection Act sets this age at fifteen; below that, consent must be given jointly by the minor and the holder(s) of parental authority.
We do not knowingly collect data regarding minors. If you hold parental authority and believe that your child has provided us with data, contact us at support@exclusivestickers.com so that we may proceed to their deletion.
Article 12 – Links to third-party sites
The Site may contain links to third-party sites, to which this Policy does not apply. We invite you to consult their own privacy policies.
Article 13 – Modification of the policy
We may modify this Policy at any time. In the event of a substantial modification, we will inform you by an appropriate means. The date of the last update appears at the top of the page.
Article 14 – Contact
For any questions regarding this Policy or your personal data: support@exclusivestickers.com