Privacy policy

Last updated: October 26, 2026

Figarotk is the data controller for personal information collected through . This policy explains what we collect, why we collect it, who we share it with, and how you can exercise your rights. It is written to meet the EU General Data Protection Regulation (GDPR), which applies because Figarotk is established in France and processes personal data of individuals in the European Union. We also describe below how California residents may exercise comparable rights under the CCPA.

What we collect
Information you give us. When you place an order, create an account, or contact us, you provide your name, delivery address, email address, telephone number, and order details. If you contact us by email, we keep the content of that correspondence so we can resolve the issue and refer back to it if needed.

Payment information. We accept Visa, MasterCard, and PayPal. Card details are entered on the checkout page of our payment processor and are not stored on Figarotk’s servers. We receive a transaction confirmation and the last four digits of the card for reconciliation purposes, but not the full card number.

Information collected automatically. When you browse the site, our hosting and analytics tools record your IP address, browser type, device type, pages viewed, and referring URL. We use this to understand how the site is used and to keep it secure. We do not use automated decision-making that produces legal or similarly significant effects.

Cookies. We use a small number of cookies: a session cookie to keep your cart working, a preference cookie to remember your cookie choice, and analytics cookies to count visits and see which pages are used. Analytics cookies are set only after you accept them through the cookie banner. You can withdraw consent at any time by clearing cookies in your browser or by using the cookie settings link in the footer.

Why we use it
We process personal data to:

fulfil your order, including delivery and returns;

respond to enquiries and resolve issues;

comply with French accounting and tax obligations, which require us to retain invoice and transaction records;

detect and prevent fraud or misuse of the site;

understand site usage in aggregate so we can improve product information and navigation.

We do not sell personal data. We do not use your email address for marketing unless you have explicitly opted in, and every marketing email includes an unsubscribe link.

Who we share it with
We share only what is necessary for each purpose:

Carriers — Colissimo, Chronopost, and Colis Privé receive your name, delivery address, and telephone number so they can deliver the parcel and contact you about delivery if needed.

Payment processors — Visa, MasterCard, and PayPal process your payment and receive the transaction amount and billing details required by card network rules.

Hosting and analytics providers — these providers process technical data on our behalf under data processing agreements.

Accountants and legal advisers — where necessary to meet French accounting and legal obligations.

We do not transfer personal data outside the European Economic Area except where the recipient is covered by an adequacy decision or standard contractual clauses. We will disclose personal data if required by French law or a competent authority, and we will tell you unless prohibited from doing so.

How long we keep it
Order and invoice records are kept for 10 years from the end of the accounting period, as required by French commercial law. Customer service correspondence is kept for 3 years from the last exchange. Analytics data is kept in identifiable form for 14 months, after which it is aggregated or deleted. Cookie consent records are kept for 6 months and then refreshed.

Your rights
Under the GDPR you have the right to:

access the personal data we hold about you;

correct inaccurate or incomplete data;

erase data where there is no overriding legal or contractual reason for us to keep it;

restrict processing while a dispute about accuracy or lawfulness is resolved;

object to processing based on legitimate interests;

receive data you provided to us in a portable, machine-readable format;

withdraw consent for cookies or marketing at any time, without affecting processing that already took place.

To exercise any of these rights, email info@figarotk.my with the subject line “Data request.” We respond within one month. We may ask for information to confirm your identity before acting, but we will not ask for more than is necessary.

If you are not satisfied with our response, you have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés), the French data protection authority.

California residents
If you are a California resident, you may request to know the categories of personal information we have collected about you, request deletion of that information, and request to opt out of any “sale” of personal information. Figarotk does not sell personal information as that term is defined under the CCPA. To make a request, email info@figarotk.my with “California request” in the subject line. You will not be discriminated against for exercising these rights.

Changes to this policy
If we change how we handle personal data, we update this page and change the date at the top. Material changes that affect how existing data is used will be communicated by email to the address on your most recent order, where we have one.