Privacy policy

1. Data controller

2. Data protection officer

The role of data protection contact is held by Marie-Antoinette Rix. For any question relating to your personal data or the exercise of your rights, please contact: marie.rix@muralova.com.

3. Data collected and purposes

Muralova only collects data strictly necessary for the purposes described below.

4. Cookies and trackers

The site uses two types of cookies:

• Strictly necessary cookies: essential for the operation of the site (session, cart, language preferences, consent storage). They are placed without obtaining consent, in accordance with article 82 of the French Data Protection Act.
• Audience measurement cookies (Google Analytics 4): they allow us to analyse site traffic in an anonymised way. They are only placed after your explicit consent via the cookie banner. Muralova uses Google's "Consent Mode v2": until you have accepted, no personal data is sent to Google.

You can change your choices at any time by clearing the site's cookies in your browser: the banner will appear again.

5. Recipients and processors

Your data is intended for Muralova and its technical processors, who act on its instructions and offer guarantees compliant with the GDPR:

• Lovable (application editing and hosting) — European Union / United States.
• Supabase (database, authentication, storage) — hosting in the European Union.
• Cloudflare (site delivery, attack protection).
• Google Ireland Ltd. (Google Analytics 4) — audience measurement, subject to your consent.
• Carriers and payment providers, only for processing your orders.

In the event of transfers outside the European Union, these transfers are governed by the European Commission's Standard Contractual Clauses or any other mechanism recognised by the GDPR.

6. Retention periods

• Contact form messages: 3 years from the last exchange.
• Customer account: duration of the contractual relationship, then 3 years from the last activity for prospecting purposes.
• Order and invoicing data: 10 years (accounting obligation, article L.123-22 of the French Commercial Code).
• Newsletter: until consent is withdrawn, then deletion within 30 days.
• Audience measurement cookies: maximum 13 months (CNIL recommendation).
• Technical logs: maximum 12 months.

7. Security

Muralova implements appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS), password hashing, access control, regular backups and environment segregation.

8. Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• right of access and copy;
• right of rectification;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to portability;
• right to object, in particular to commercial prospecting;
• right to withdraw your consent at any time;
• right to define post-mortem directives concerning your data.

To exercise these rights, write to marie.rix@muralova.com attaching, if necessary, proof of identity. A reply will be sent to you within a maximum period of one month.

You also have the right to lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

9. Minors

The site is not intended for minors under 15 years of age. Muralova does not knowingly collect data concerning children. If you believe that a minor has provided us with data, please contact us so that we can delete it.

10. Changes

This policy may be updated at any time to reflect legal, technical or functional changes to the site. The date of the last update appears at the top of the page.