Privacy and cookies
Controller and purposes
LaFig Miniatures, at the legal-notice contact address, controls shop data processing. Email, identity, billing address, country, account type, orders, rights evidence and payment references are used to perform the contract, deliver files and provide support. Accounting and tax evidence fulfil legal duties. Technical logs, IP addresses and security records protect access and prevent abuse (legitimate interests). Required fields are identified; without them the relevant service cannot be provided. LaFig does not receive full card numbers.
Recipients
Access is restricted to authorised LaFig staff and necessary providers: ALWAYSDATA (hosting/storage), Google (email), PayPal (payment/fraud prevention). PayPal also processes data under its own notice https://www.paypal.com/fr/legalhub/paypal/privacy-full. Google and PayPal services may involve processing outside the EEA under their transfer mechanisms, including adequacy decisions or standard contractual clauses when necessary; request information on applicable safeguards from LaFig. Data are not sold. A sculptor does not automatically receive the entire customer list.
Retention
Account and rights evidence are retained while access is provided, then as necessary for evidence or legal duties. Accounting documents are kept for ten years; relevant electronic contracts for ten years under applicable rules. Support records remain during handling and, where necessary, the claim limitation period. Technical data are limited to security needs and not retained unnecessarily. Erasure requests do not remove legally required evidence; LaFig explains what must remain. This notice promises no automatic deletion of acquired rights.
Cookies and choices
Strictly necessary cookies protect sessions and requests (up to24 hours), and guest-order access (up to7days). They are not advertising cookies. Language is stored locally until cleared or changed. No advertising or analytics tracker is configured in this build. PayPal pages have their own notices. Purchase, Samples and reward linking never automatically subscribe you to a newsletter; any marketing consent is separate and withdrawable.
Directory and rights
Public business name, country, logo, website and licensed packs are displayed at the holder’s choice. Emails and evidence stay private. An external logo may load from its owner’s chosen server, revealing the visitor’s IP to that server. Removing a listing does not remove the licence.
Contact [email protected] for access, rectification, erasure, restriction, portability, objection within their legal scope, or future withdrawal of consent. Proportionate identity verification may be needed. You may complain to CNIL (https://www.cnil.fr/) and give directions for data after death. Responses follow statutory time limits, normally one month, with notice of any permitted extension.
Cloudflare protects the domain and routes traffic, processing IP addresses and request data needed for security and site delivery (legitimate interests). Its global network may involve transfers outside the EEA under applicable safeguards. Information: https://www.cloudflare.com/privacypolicy/.