PRIVACY POLICY
Last updated: October 5, 2026
VISIONMODE SAS, trading as YUMALY ("YUMALY", "we", "us" or "our"), operates the YUMALY online store and website, including the related information, content, features, tools, products and services (the "Services").
Our store is powered by Shopify, which provides the e-commerce infrastructure enabling us to offer the Services.
This Privacy Policy explains how we collect, use, disclose and protect your personal information when you visit or use our website, make a purchase or other transaction, create or use an account, communicate with us, or otherwise interact with the Services.
If there is a conflict between our General Terms and Conditions of Sale and this Privacy Policy in relation to the collection, processing or disclosure of personal information, this Privacy Policy will prevail.
1. Data Controller
For the purposes of applicable data protection laws, including the General Data Protection Regulation ("GDPR"), the data controller is:
VISIONMODE SAS, trading as YUMALY, 101 rue de Sèvres, 75006 Paris, France. SIREN: 531 168 763. Email: contact@yumalyparis.com. Telephone: +33 1 71 27 35 72.
2. Personal Information We Collect or Process
"Personal information" means information that identifies you or can reasonably be linked to you.
Depending on how you interact with YUMALY, we may collect or process the following categories of personal information:
- Contact details, including your name, billing address, shipping address, telephone number and email address.
- Payment and financial information, including payment method, transaction information, payment confirmation and related payment details. Complete payment-card information is generally processed directly by our payment providers rather than stored by YUMALY.
- Account information, including your email address, preferences, settings and information associated with your customer account.
- Transaction information, including products you view, add to your cart or wishlist, purchase, return, exchange or cancel, and information about previous transactions.
- Communications with us, including information you provide when contacting Customer Care or otherwise communicating with YUMALY.
- Device and technical information, including browser type, device information, IP address, network information and other technical identifiers.
- Usage information, including how and when you interact with, browse or use the Services.
- Marketing preferences, including whether you have agreed to receive promotional communications and your preferences relating to advertising and cookies.
3. Sources of Personal Information
We may collect personal information:
- Directly from you, for example when you place an order, create or access an account, subscribe to communications, contact us or otherwise provide information to us.
- Automatically through the Services, including through cookies and similar technologies.
- From service providers, where they process information on our behalf or provide services necessary for the operation of our business.
- From Shopify and other partners or third parties, where permitted by applicable law.
4. How We Use Your Personal Information and Our Legal Bases
We process your personal information only where we have a valid legal basis under applicable law.
Providing the Services and Performing Our Contract With You
We process information where necessary to perform a contract with you or take steps at your request before entering into a contract.
This includes:
- processing and fulfilling orders;
- processing payments;
- arranging delivery;
- managing customer accounts;
- processing cancellations, returns, refunds and exchanges;
- managing gift cards, promotional benefits and loyalty or referral benefits where applicable;
- communicating with you about your order or account;
- providing Customer Care.
Compliance With Legal Obligations
We may process and retain information where necessary to comply with our legal obligations, including:
- accounting and tax obligations;
- record-keeping requirements;
- consumer-protection obligations;
- responding to lawful requests from public authorities;
- establishing or complying with legal and regulatory requirements.
Legitimate Interests
Where permitted by law, we may process personal information where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your fundamental rights and freedoms.
These purposes may include:
- protecting the security of our website and systems;
- detecting and preventing fraud and misuse;
- improving our Services and customer experience;
- managing our business and customer relationships;
- analysing the performance and use of our website;
- establishing, exercising or defending legal claims.
Consent
Where required by law, we rely on your consent for activities including:
- sending certain marketing communications;
- using non-essential advertising or analytics cookies;
- personalised advertising or similar processing where consent is required.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing carried out lawfully before your consent was withdrawn.
5. Marketing and Advertising
Where permitted by applicable law, we may use your personal information to send information about YUMALY products, collections, events, offers and other communications that may be of interest to you.
You may unsubscribe from promotional emails at any time by using the unsubscribe link included in our emails.
Even if you unsubscribe from marketing communications, we may continue to send non-promotional communications necessary for your orders, account, transactions or customer-service requests.
We may also use advertising and analytics technologies to measure the effectiveness of our communications and, where permitted, provide more relevant advertising.
Where consent is required for advertising cookies or similar technologies, such technologies will not be activated until the required consent has been obtained.
6. Cookies and Similar Technologies
We and our service providers may use cookies and similar technologies to operate the website, remember preferences, understand how the Services are used, improve performance and, where permitted, provide analytics and personalised advertising.
You can manage your cookie preferences through the cookie-consent tools made available on the YUMALY website.
Certain cookies that are strictly necessary for the operation and security of the website may be used without consent where permitted by law.
7. How We Disclose Personal Information
We may disclose personal information where necessary for the purposes described in this Privacy Policy, including:
- to Shopify, which provides our e-commerce infrastructure;
- to payment processors and financial-service providers;
- to shipping, logistics and fulfilment providers, including carriers used to deliver or return orders;
- to IT, hosting, cloud-storage, analytics and technical-service providers;
- to customer-service providers;
- to marketing and advertising providers where permitted by applicable law;
- to professional advisers such as accountants, auditors, lawyers and insurers;
- where you direct us or consent to disclosure;
- where disclosure is necessary to comply with legal obligations, enforce our rights, prevent fraud or protect YUMALY, our customers or others;
- in connection with a restructuring, merger, acquisition, sale or other business transaction.
Service providers processing personal information on our behalf are required to process such information only in accordance with applicable law and our instructions, where required.
8. Relationship With Shopify
Our online store is hosted by Shopify.
Shopify collects and processes certain personal information relating to your access to and use of the Services in order to provide its services to YUMALY.
Information submitted through our store may therefore be transmitted to and processed by Shopify and its service providers, including in countries outside your country of residence.
Certain Shopify features may also involve Shopify processing information about interactions with YUMALY and other Shopify merchants for purposes for which Shopify acts as an independent data controller.
Further information about Shopify's processing practices and the rights available to you can be found in Shopify's Consumer Privacy Policy and Privacy Portal.
9. Third-Party Websites and Services
Our website may contain links to websites, platforms or services operated by third parties.
YUMALY is not responsible for the privacy, security or content practices of third-party websites or services that we do not control.
We recommend reviewing the privacy policies of any third-party website or service before providing personal information to it.
10. Children's Data
The Services are not specifically directed at children.
We do not knowingly collect personal information from children in circumstances where parental or guardian authorisation would be required under applicable law.
If you believe that a child has provided personal information to us unlawfully, please contact us so that we can take appropriate action.
11. Security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure or misuse.
However, no method of electronic transmission or storage can be guaranteed to be completely secure.
We recommend that you do not send sensitive or confidential information through unsecured communication channels.
12. Retention of Personal Information
We retain personal information only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.
In particular:
- information relating to orders and transactions is retained for the period necessary to perform the contract and thereafter for applicable legal, accounting, tax and limitation periods;
- invoices and accounting records may be retained for up to 10 years where required by French law;
- customer-account information may be retained while the account remains active and thereafter for the period reasonably necessary to comply with legal obligations or resolve disputes;
- data used for commercial prospecting may generally be retained for up to three years after the end of the commercial relationship or the last relevant contact, subject to applicable law and renewal of consent where required;
- information necessary to establish, exercise or defend legal claims may be retained for the applicable limitation period.
At the end of the applicable retention period, information will be deleted, anonymised or archived where required by law.
13. Your Rights
Depending on your place of residence and applicable law, you may have the following rights in relation to your personal information:
- Right of access — to obtain confirmation as to whether we process your personal information and obtain access to it.
- Right to rectification — to have inaccurate or incomplete information corrected.
- Right to erasure — to request deletion of personal information in circumstances provided by law.
- Right to restriction — to request restriction of certain processing activities.
- Right to object — to object to certain processing based on legitimate interests and, at any time, to processing for direct marketing purposes.
- Right to data portability — to receive certain information in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller.
- Right to withdraw consent — where processing is based on consent.
- Rights relating to automated decision-making, where applicable.
You may exercise these rights by contacting us using the details set out below.
We may need to verify your identity before fulfilling a request.
You will not be discriminated against for exercising your privacy rights.
14. Sale, Sharing and Targeted Advertising Rights
Depending on where you reside, particularly in certain jurisdictions outside the European Economic Area, you may have additional rights to opt out of the "sale" or "sharing" of personal information or processing for targeted advertising, as those terms are defined by applicable law.
Where applicable, you may exercise those rights using the privacy or data-sharing opt-out functionality provided on the YUMALY website.
Where supported and legally required, we may also recognise Global Privacy Control signals.
15. Complaints
If you have questions or concerns about how we process your personal information, please contact us first using the contact information below.
If you are located in France, you also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL).
If you reside elsewhere in the European Economic Area or the United Kingdom, you may also lodge a complaint with the competent data-protection supervisory authority in your country of residence.
16. International Transfers
Some of our service providers, including Shopify and other technology providers, may process personal information outside France, the European Economic Area or the United Kingdom.
Where personal information is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards required by applicable law, such as the European Commission's Standard Contractual Clauses or equivalent UK-approved transfer mechanisms, where applicable.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, Services or applicable legal or regulatory requirements.
When we make changes, we will publish the revised Privacy Policy on our website and update the "Last updated" date.
Where required by law, we will provide additional notice of material changes.
18. Contact
For questions about this Privacy Policy, our privacy practices or the exercise of your data-protection rights, please contact:
VISIONMODE SAS, trading as YUMALY, 101 rue de Sèvres, 75006 Paris, France. Email: contact@yumalyparis.com. Telephone: +33 1 71 27 35 72.
For purposes of applicable data-protection law, VISIONMODE SAS is the data controller responsible for the processing described in this Privacy Policy.