Privacy policy
Last updated: September 27, 2026
This Privacy Policy explains how KAARA LU collects, uses, stores, shares and protects the personal data of individuals who visit the website, create an account, place an order, subscribe to the newsletter or contact customer service.
ARTICLE 1 — DATA CONTROLLER
The data controller responsible for the processing of personal data is:
Karamatou Lubangi Mutoke, sole trader operating under the trading name KAARA LU
Address: 15 rue Defresne Bast, 95100 Argenteuil, France
SIREN: 102 866 746
SIRET: 102 866 746 00013
Email: Contact@kaaralu.com
Hereinafter referred to as “KAARA LU”.
ARTICLE 2 — PERSONAL DATA COLLECTED
Depending on how the website is used, KAARA LU may collect the following categories of personal data.
2.1 Identification and contact information
The following information may in particular be collected:
- first and last name;
- postal address;
- billing address;
- delivery address;
- email address;
- telephone number;
- country of residence.
2.2 Order information
The following information may in particular be collected:
- products ordered;
- size and quantity;
- order amount;
- any discounts applied;
- delivery method;
- order number;
- order history;
- returns, exchanges and refunds;
- communications relating to the order.
2.3 Payment information
KAARA LU may receive information relating to the payment status, the payment method used and certain information identifying the transaction.
KAARA LU does not have direct access to complete bank card details. These are processed by the secure payment providers available through Shopify.
2.4 Browsing and interaction data
When visiting the website, certain technical and usage data may be collected, including:
- IP address;
- device type;
- operating system;
- browser type and version;
- pages viewed;
- date and time of connection;
- browsing journey;
- interactions with products and content;
- interactions with advertisements;
- shopping cart data;
- conversion data;
- technical identifiers;
- cookies and similar technologies.
2.5 Customer account data
Where this feature is available, KAARA LU may collect the information required to create and manage a customer account, including the email address, contact details, order history and saved preferences.
Passwords and authentication mechanisms are securely processed by the technical platform and are not accessible to KAARA LU in plain text.
2.6 Customer service data
When a customer contacts KAARA LU, the following information may in particular be collected:
- content of the request;
- order number;
- photographs provided;
- supporting documents where required;
- history of communications;
- information relating to delivery, return or complaint.
KAARA LU only requests information that is reasonably necessary to process the request.
2.7 Marketing communication data
When subscribing to the newsletter or a waiting list, KAARA LU may collect:
- email address;
- subscription date;
- proof of consent;
- communication preferences;
- interactions with communications sent, where this functionality is enabled.
ARTICLE 3 — SOURCES OF PERSONAL DATA
Personal data may be collected:
- directly from the individual concerned;
- when an order is placed;
- when an account is created;
- when subscribing to the newsletter;
- during communications with customer service;
- automatically during browsing, including through cookies and similar technologies;
- from Shopify and applications installed on the store;
- from payment providers;
- from delivery carriers;
- from providers involved in fraud prevention;
- from advertising and analytics platforms used by KAARA LU, within the limits permitted by applicable law and the user’s choices.
ARTICLE 4 — PURPOSES AND LEGAL BASES
KAARA LU processes personal data for the following purposes.
4.1 Order management
Personal data is used to:
- register orders;
- process payments;
- prepare and ship products;
- provide necessary information to delivery carriers;
- send order confirmations and tracking information;
- manage returns, exchanges and refunds.
This processing is based on the performance of the contract entered into with the customer.
4.2 Customer service
Personal data is used to respond to questions, complaints and requests relating to products or orders.
This processing is based on the performance of the contract or on KAARA LU’s legitimate interest in providing effective customer service.
4.3 Compliance with legal obligations
Certain data is retained in order to comply with KAARA LU’s accounting, tax, administrative and legal obligations.
This processing is based on compliance with a legal obligation.
4.4 Fraud prevention and website security
Personal data may be used to:
- detect suspicious orders;
- prevent fraudulent use of payment methods;
- protect the website, customer accounts and transactions;
- prevent attacks on information systems;
- establish, exercise or defend KAARA LU’s legal rights.
This processing is based on KAARA LU’s legitimate interest in securing its business, subject to the rights and freedoms of the individuals concerned.
4.5 Newsletter and marketing communications
Where consent is required by law, marketing communications are only sent after the individual has given their consent.
Consent may be withdrawn at any time by using the unsubscribe link included in each email or by contacting KAARA LU.
Where permitted by applicable law, KAARA LU may also inform existing customers about products similar to those they have previously purchased. Customers may object free of charge and at any time.
4.6 Audience measurement, analytics and website improvement
Subject to the choices made regarding cookies and similar technologies, certain data may be used to:
- measure website traffic;
- understand visitor browsing behaviour;
- identify technical issues;
- improve the shopping experience;
- evaluate page performance;
- measure advertising campaign performance;
- attribute certain visits, actions or conversions to a campaign;
- understand interactions between users, the website and advertising platforms.
Depending on the tool used, this processing is based on consent or on legitimate interest where permitted by applicable law.
4.7 Personalisation and advertising
Subject to consent where required, certain data may be used to:
- personalise the experience offered on the website;
- display more relevant advertising;
- measure advertising campaign effectiveness;
- create or measure advertising audiences;
- understand how visitors interact with KAARA LU, its products and its advertisements.
Cookie and advertising preferences can be changed at any time through the privacy tools available on the website.
ARTICLE 5 — REQUIRED INFORMATION
Certain information is essential in order to process an order, arrange delivery, process a payment or respond to a request.
Mandatory fields are identified when information is collected.
If the customer does not provide the required information, KAARA LU may be unable to process the relevant order or request.
Newsletter subscription is optional and is not required to place an order.
ARTICLE 6 — RECIPIENTS OF PERSONAL DATA
Personal data is accessible only to persons and service providers who require it to perform their duties.
It may in particular be shared with:
- KAARA LU and authorised persons involved in managing the store;
- Shopify, which provides the e-commerce platform;
- payment service providers;
- relevant banking institutions;
- delivery carriers, including Colissimo, Chronopost, DHL, UPS or Mondial Relay;
- IT and hosting providers;
- email and newsletter service providers;
- fraud prevention providers;
- audience measurement, analytics and advertising providers, including Google, Meta, TikTok and Pinterest, where these services are enabled and subject to the user’s privacy choices;
- KAARA LU’s legal, accounting or administrative advisers;
- public authorities where required by law.
Certain information may also be processed by Shopify and other service providers in connection with technical, analytics, advertising, personalisation, security or improvement services provided to KAARA LU and its customers.
KAARA LU does not sell or rent customers’ personal data in exchange for payment. However, certain data transfers used for purposes such as targeted advertising may be considered “sharing” under certain US privacy laws and may therefore be subject to a right to opt out.
ARTICLE 7 — SHOPIFY
The KAARA LU store is hosted and operated using the Shopify platform.
Shopify processes certain personal data when visitors browse the store or make purchases, including in order to provide the services required to operate the website, process orders, secure transactions, prevent fraud and improve its services.
Shopify may also process certain information in order to provide services based on users’ interactions with KAARA LU, Shopify and other Shopify merchants.
Further information is available in Shopify’s Consumer Privacy Policy.
7.1 Shopify Network Intelligence and Enhanced Services
KAARA LU uses Shopify Network Intelligence.
When this functionality is enabled, Shopify may securely use certain data relating to customers’ interactions with KAARA LU together with data and information resulting from their interactions with Shopify and other merchants using Shopify in order to provide features referred to as Enhanced Services.
These Enhanced Services may in particular enable Shopify and KAARA LU to:
- provide a more personalised experience;
- display more relevant advertising;
- improve advertising measurement and performance;
- understand how customers interact with the store and advertisements;
- improve Shopify’s services, products and features;
- improve fraud prevention and security.
Information relating to users’ activity on KAARA LU may therefore be shared with Shopify and certain third parties required to provide these services, including where such service providers are located in other countries.
Where applicable law requires consent, including within the European Economic Area, the United Kingdom or Switzerland, the relevant non-essential or advertising-related processing is carried out in accordance with the choices made by the user.
Users can change or withdraw their consent using the cookie banner and the preference management tool available on the website.
Shopify also provides a Privacy Portal through which users may exercise certain choices relating to the processing of their personal data in connection with Enhanced Services.
ARTICLE 8 — INTERNATIONAL DATA TRANSFERS
Certain service providers used by KAARA LU or Shopify may be located outside the European Economic Area.
This may in particular apply to certain technical, advertising, analytics, payment, social media or personalisation services.
Personal data may therefore be transferred to Shopify or other service providers located in other countries in order to provide the services used by KAARA LU, including certain Enhanced Services involving information relating to interactions with KAARA LU, other merchants or Shopify.
Where personal data is transferred to a country that is not covered by an adequacy decision of the European Commission, the transfer is subject to appropriate safeguards provided for by applicable law.
Such safeguards may include:
- Standard Contractual Clauses approved by the European Commission;
- Binding Corporate Rules;
- or any other legally recognised mechanism.
ARTICLE 9 — DATA RETENTION
KAARA LU retains personal data only for as long as necessary for the purposes for which it was collected and thereafter for any period required or permitted by law.
The main retention periods are as follows:
- data required to process an order: for the duration of the order and for the period necessary to manage the business relationship;
- accounting documents and invoices: ten years from the end of the relevant financial year;
- data used for marketing to an existing customer: for the duration of the commercial relationship and for a maximum of three years after its end or the last relevant contact;
- data relating to a prospect or newsletter subscriber: until consent is withdrawn or, in the absence of interaction, for a maximum of three years from the last contact;
- customer service requests: for the period required to process the request and then archived where necessary to establish or defend a legal right;
- data relating to disputes: for the duration of the proceedings and until expiry of any applicable appeal period;
- cookie choices: generally for six months, unless a different period is justified;
- audience measurement trackers: according to the retention period configured in the relevant tool and limited to what is necessary.
Certain data may be archived for a longer period where required by law or where necessary to establish, exercise or defend a legal right.
ARTICLE 10 — COOKIES AND SIMILAR TECHNOLOGIES
A cookie is a file or identifier stored or accessed on a user’s device when visiting a website.
The KAARA LU website may use different categories of cookies and similar technologies.
10.1 Strictly necessary cookies
These cookies may in particular enable:
- display and operation of the website;
- storage of the shopping cart;
- processing and security of orders;
- customer account login;
- fraud prevention;
- storage of cookie choices.
These cookies do not require consent where they are strictly necessary to provide a service requested by the user.
10.2 Audience measurement cookies
These cookies make it possible to measure website traffic and understand how the website is used.
Where they do not meet the conditions for an exemption from consent, they are only stored or activated after the user has given consent.
10.3 Advertising and personalisation cookies
KAARA LU uses advertising, analytics and measurement tools provided in particular by Meta, Google, TikTok, Pinterest and Shopify.
These technologies may in particular be used to:
- measure advertising campaign performance;
- identify interactions with certain advertisements;
- attribute certain conversions or sales to a campaign;
- improve marketing performance measurement;
- personalise advertisements where this functionality is enabled;
- create or measure advertising audiences;
- understand users’ journeys between certain platforms and the KAARA LU website;
- improve personalisation and certain Enhanced Services provided by Shopify.
Some of these tools may operate using browser-side and server-side technologies.
Where consent is required, these technologies are only used for non-essential purposes after the user has given their consent.
10.4 Managing preferences
On their first visit, users may accept, refuse or customise non-essential cookies.
Refusing cookies must be as easy as accepting them.
Users may change or withdraw their consent at any time using the preference management tool available on the website.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
10.5 Opting out of data sharing and targeted advertising
In certain jurisdictions, including certain US states, users may have the right to opt out of the sale or sharing of their personal data or its use for targeted advertising.
KAARA LU provides, in the relevant regions, a page enabling users to exercise these choices.
Where available, users can access this page through the privacy links available on the website.
Shopify’s automated privacy settings may also recognise certain privacy signals and opt-out requests in accordance with applicable law.
ARTICLE 11 — NEWSLETTER
Subscription to the KAARA LU newsletter allows users to receive information relating in particular to:
- collections;
- launches;
- new pieces;
- availability;
- events;
- brand news.
Subscription is optional.
Each marketing communication contains a link allowing users to unsubscribe free of charge and at any time.
Unsubscribing from marketing communications does not prevent KAARA LU from sending messages that are strictly necessary for processing and managing an order.
ARTICLE 12 — DATA SECURITY
KAARA LU implements reasonable technical and organisational measures designed to protect personal data against:
- unauthorised access;
- loss;
- alteration;
- disclosure;
- destruction;
- unlawful use.
Access to personal data is limited to persons and service providers who require it to perform their duties.
As no computer system can guarantee absolute security, KAARA LU undertakes to respond as quickly as reasonably possible to any incident that may affect personal data and to make any notifications required by applicable law.
ARTICLE 13 — INDIVIDUAL RIGHTS
In accordance with applicable law and depending on the circumstances, individuals may in particular exercise the following rights:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to object;
- right to withdraw consent at any time;
- right to data portability where the applicable conditions are met;
- right to give instructions regarding the use of personal data after death where applicable;
- right not to be subject to certain decisions based solely on automated processing where this right applies.
Depending on the relevant country or region, additional rights may apply, including the right to opt out of certain advertising processing or the sale or sharing of personal data.
Certain rights may be restricted where processing is necessary for the performance of a contract, compliance with a legal obligation or the defence of KAARA LU’s legal rights.
ARTICLE 14 — EXERCISING YOUR RIGHTS
To exercise your rights with KAARA LU, please contact:
Email: Contact@kaaralu.com
or by post:
KAARA LU – Karamatou Lubangi Mutoke
15 rue Defresne Bast
95100 Argenteuil – France
The request must specify the right being exercised and contain the information necessary to identify the individual and the relevant personal data.
Proof of identity may be requested only where there is reasonable doubt regarding the identity of the person making the request.
KAARA LU will respond to requests within a maximum period of one month from receipt.
This period may be extended by two additional months where the request is complex or where numerous requests have been received. The individual will be informed of any extension within the initial one-month period.
For certain processing activities carried out directly by Shopify, including those relating to Enhanced Services and Shopify Network Intelligence, users may also consult or exercise certain choices through Shopify’s Privacy Portal.
ARTICLE 15 — COMPLAINTS TO THE CNIL
If an individual believes that their rights have not been respected, they may lodge a complaint with the French Data Protection Authority:
Commission nationale de l'informatique et des libertés – CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
KAARA LU encourages individuals to contact us first so that we may attempt to resolve the matter directly.
ARTICLE 16 — LINKS TO THIRD-PARTY WEBSITES, PLATFORMS AND SOCIAL NETWORKS
The website may contain links to websites, platforms or social networks operated by third parties.
When a user leaves the KAARA LU website or uses a service provided by a third party, the processing of their personal data is governed by that third party’s privacy policy.
KAARA LU encourages users to review the relevant policies before providing personal information.
ARTICLE 17 — CHILDREN’S DATA
The KAARA LU website and products are not specifically intended for children.
Where a minor does not have the legal capacity to enter into a contract independently, the order must be placed or authorised by their legal representative.
If KAARA LU becomes aware that personal data relating to a minor has been collected in breach of applicable law, appropriate steps will be taken to delete it.
ARTICLE 18 — SIGN IN WITH GOOGLE
When you choose to sign in to your KAARA LU account using Google, KAARA LU and Shopify receive the information necessary to identify and authenticate your account, including the email address associated with your Google account.
This email address is used to identify you, create or retrieve your KAARA LU customer account, secure your login and allow you to access your orders and information associated with your account.
KAARA LU does not access your Gmail emails, contacts, Google Drive files or other content in your Google account through this sign-in functionality.
The email address obtained when you sign in is stored in your Shopify customer profile and processed in accordance with this Privacy Policy.
You can withdraw the authorisation granted to KAARA LU through the security settings of your Google account.
ARTICLE 19 — CHANGES TO THIS PRIVACY POLICY
KAARA LU may amend this Privacy Policy to reflect legislative, regulatory, technical or commercial developments or changes to the tools and services used by the store.
The updated version will be published on the website together with the revised date.
Where changes materially affect the way personal data is used, individuals will be informed by an appropriate means where required by applicable law.
ARTICLE 20 — CONTACT
For any question regarding this Privacy Policy or the processing of personal data:
KAARA LU – Karamatou Lubangi Mutoke
15 rue Defresne Bast
95100 Argenteuil – France
Email: Contact@kaaralu.com