Last updated: 4 August 2026

Protecting your personal data matters to us. This page explains, simply and completely, what data Herba Barona collects when you use the website www.paris-herbabarona.com, why we collect it, how long we keep it, and what your rights are, in accordance with the General Data Protection Regulation (GDPR) and the French «Informatique et Libertés» law.

1. Data controller

HERBA BARONA, a SARL with capital of €8,000, registered with the Paris Trade and Companies Register (RCS) under number 488 181 231, with registered office at 10 rue Théophile Roussel, 75012 Paris.
Phone: 01 43 42 43 80 — Email: contact@herbabarona.com
Represented by its manager, Alexandre Félici.

2. Data we collect

• Orders: first name, surname, billing and delivery addresses, email address, phone number, details of the products ordered.
• Customer account: login credentials and information provided in your profile.
• Contact requests: your message and the contact details needed to reply to you.
• Browsing: technical data (IP address, browser type, pages viewed) collected via cookies and trackers, only according to your consent choices.

No banking data is stored on our servers: payment is processed directly by secure providers (see point 4). We also do not collect any so-called «sensitive» data, including health data: the choice of your products belongs to you and is never recorded for profiling purposes.

3. Why we use your data

• Processing and delivering your orders (including in-store pickup) and managing your customer account — legal basis: performance of the contract.
• Issuing invoices and complying with our accounting and tax obligations — legal basis: legal obligation.
• Responding to your requests — legal basis: legitimate interest or pre-contractual measures.
• Measuring site audience and improving our content — legal basis: your consent.
• Ensuring site security and fighting fraud — legal basis: legitimate interest.

4. Recipients and subcontractors

Your data is never sold or rented. It is only transmitted to providers strictly necessary for the operation of the shop:

• Payment: Monetico (Crédit Mutuel) and PayPal, which directly and securely process your payment data;
• Delivery: La Poste (Colissimo) and Mondial Relay, which receive the contact details needed to ship and track your parcel;
• Website hosting: Hostinger;
• Audience measurement: Google Analytics (if you have consented);
• Security and performance: Cloudflare.

5. Retention periods

• Orders and invoices: 10 years, in accordance with accounting obligations;
• Customer account: until deleted by you, or at most 3 years after your last activity;
• Contact requests: the time necessary to process them, at most 3 years;
• Cookies and trackers: 13 months maximum; your consent choice is kept for at most 12 months.

6. Cookies

On your first visit, a banner lets you accept or refuse non-essential cookies. You can change your choice at any time via the «Cookies» link at the bottom of the page. The details of the cookies used are listed in our cookie policy.

7. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction of processing, objection and portability of your data, as well as the right to withdraw your consent at any time and to set guidelines on what happens to your data after your death.

To exercise them, write to us at contact@herbabarona.com or by post to HERBA BARONA, 10 rue Théophile Roussel, 75012 Paris. We reply within one month. In case of reasonable doubt about your identity, proof of identity may be requested.

If you believe your rights are not being respected, you can file a complaint with the CNIL (www.cnil.fr).

8. Security

The site is fully served over HTTPS. Access to data is restricted to people who need it to process your orders, and the site undergoes regular backups as well as firewall protection.

9. Transfers outside the European Union

Some providers (Google, PayPal, Cloudflare) may process data outside the European Union. These transfers are governed by the mechanisms provided for by the GDPR, in particular the European Commission’s adequacy decisions and standard contractual clauses.

10. Changes to this policy

This policy may be updated, particularly in the event of changes to the site or to regulations. The version in force is the one published on this page, with its update date.