UPS shipping to the USA is back!

Free delivery to the UK & Ireland for orders over €69.

Subscribe to Poppers Aromas Newsletter

Privacy Policy & GDPR

As part of its business activities, Black Sequoia processes personal data.

This Privacy Policy and Data Management Policy informs you about how Black Sequoia collects, uses and protects your personal data when you visit or use the Poppers Aromas website.

We invite you to read this Policy carefully.

This Policy applies to all individuals whose personal data is collected by Black Sequoia, including website visitors, customers, suppliers, service providers and job applicants.

Personal data means any information relating to an identified or identifiable natural person.

Black Sequoia attaches great importance to the protection of the personal data entrusted to it and is committed to respecting your privacy.

This Policy is designed to comply with applicable privacy and data protection legislation, including:

French Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms, as amended;

Regulation (EU) 2016/679 of 27 April 2016, known as the General Data Protection Regulation or GDPR.

Article 1. Data Controller

The data controller responsible for the processing described in this Policy is:

Black Sequoia SAS

  • Share capital: €240,000
  • RCS number: 805 112 042
  • VAT number: FR54805112042
  • SIRET number: 805 112 042 00041

Registered office:

1 Rue de Belle-Île

35760 Saint-Grégoire

France

Black Sequoia is represented by its legal representative.

For any question relating to the processing of your personal data or the exercise of your rights, you may contact Black Sequoia at:

Email: [email protected]

Article 2. Processing of Personal Data

All personal data provided to Black Sequoia is processed confidentially.

The data collected is limited to information that is relevant, adequate and necessary for the purposes described in this Policy.

Personal data is only accessible to authorised employees and service providers who need it to perform their duties.

Where the applicable retention period has expired, personal data may be anonymised and retained solely for statistical purposes. Anonymised data will not be used to identify individuals.

Black Sequoia does not use the data collected through the website to create profiles revealing sensitive personal data, such as racial or ethnic origin, political opinions, philosophical beliefs, trade-union membership, religious beliefs, sex life or health information.

2.1. Customer data

The following data may be collected when customers create an account or place an order:

First name and last name;

Mobile phone number;

Email address;

Delivery address;

Billing address;

Date of birth, where provided. This information is optional;

Gender, where provided.

This data is processed for the following purposes:

Creating and managing customer accounts;

Processing and delivering orders;

Managing payments and invoices;

Managing customer relations;

Providing customer service;

Managing returns, complaints and disputes;

Complying with legal and accounting obligations.

The recipients of this data may include authorised Black Sequoia employees, technical service providers, payment service providers, email service providers and delivery companies, including La Poste and GLS where applicable.

Customer data is retained for the period necessary to manage the customer relationship and comply with applicable legal, accounting and tax obligations.

2.2. Contact form data

When a user submits the contact form on the Poppers Aromas website, the following data is collected:

Email address;

Any personal information voluntarily included in the message.

This data is processed in order to:

Receive and manage the user’s request;

Respond to the user;

Provide customer assistance;

Manage any follow-up correspondence.

The legal basis for this processing is Black Sequoia’s legitimate interest in responding to messages received through the website and providing customer service.

The recipients of this data are the authorised Black Sequoia employees who have access to customer messages and the technical service providers required to operate the contact form.

Contact form data is retained for a period of one year from the end of the last contact relating to the request, unless a longer retention period is required by law or justified by the management of a dispute.

Submitting the contact form does not subscribe the user to marketing communications.

2.3. Supplier and service provider data

Black Sequoia may collect the following data from suppliers and service providers:

First name and last name;

Telephone number;

Email address;

Professional status;

Business contact details.

This data is processed in order to:

Manage business relationships;

Identify suppliers and service providers;

Assess and manage potential or existing business projects;

Communicate with professional contacts.

Supplier and service provider data is retained for a period of five years following the end of the calendar year in which the last business relationship ended, unless a longer period is required by law.

2.4. Job applicant data

When applicants send a CV or covering letter to Black Sequoia, the following data may be collected:

First name and last name;

Title;

Date of birth;

Nationality;

Postal address;

Email address;

Telephone number;

Professional status;

Education and qualifications;

Photograph, where provided;

Any other information included in the application documents.

This data is processed in order to identify applicants, assess applications, organise recruitment and contact applicants regarding their application.

Job applicant data is retained for a period of one year following the end of the calendar year in which it was collected, unless the applicant has agreed to a longer retention period or a longer period is required by law.

2.5. Legal bases for processing

Depending on the processing activity, Black Sequoia may rely on the following legal bases:

Legitimate interest

Legitimate interest is the legal basis used when Black Sequoia processes personal data in order to:

Respond to messages received through the contact form;

Provide customer assistance;

Manage customer, supplier and service provider relationships;

Ensure website security;

Prevent fraud and misuse;

Improve the website and services;

Manage potential disputes.

Performance of a contract

This legal basis applies when processing is necessary to:

Process an order;

Deliver products;

Manage a customer account;

Provide customer service;

Take pre-contractual steps at the user’s request.

Legal obligation

This legal basis applies when Black Sequoia must process personal data in order to comply with an applicable legal, accounting, tax or regulatory obligation.

Consent

In certain situations, where no other legal basis applies, Black Sequoia may ask for the user’s explicit consent.

Where processing is based on consent, the user may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

2.6. Third-party tools, cookies and service providers

Depending on the services used on the Poppers Aromas website, Black Sequoia may use the following service providers and technologies:

Google Analytics 4, for website audience measurement and analysis;

Microsoft Clarity, for analysing user interactions and improving the website;

User.com, for customer communication, audience analysis and related services;

Google reCAPTCHA, for protecting forms against spam and automated abuse;

Affilae, for affiliate tracking and conversion attribution;

Trustpilot, for managing customer reviews;

eKomi, for managing customer reviews;

Tipimail, for sending transactional or service-related emails;

La Poste and GLS, for delivery services;

Hosting, payment, accounting, technical and IT service providers.

The website uses technical, analytical and marketing cookies.

Technical cookies are necessary for the website to function correctly. Analytical and marketing cookies are used only according to the user’s cookie preferences and applicable legislation.

Users may manage their cookie preferences through the cookie management tool available on the website.

Article 3. Recipients of Personal Data

The processing of personal data collected through the website is strictly confidential.

Black Sequoia does not sell or rent personal data to third parties for their own commercial or advertising purposes.

Personal data may be made available securely to trusted service providers who assist Black Sequoia in operating the website and providing its services.

The recipients of personal data may include:

Authorised Black Sequoia employees;

Technical and hosting service providers;

Email and customer communication providers;

Payment service providers;

Delivery companies;

Accounting and legal service providers, where necessary;

Service providers such as Google, Microsoft, User.com, Google reCAPTCHA, Affilae, Trustpilot, eKomi, Tipimail, La Poste and GLS, where applicable;

Public authorities where required by law.

Black Sequoia requires its service providers and subcontractors to implement appropriate measures to ensure the confidentiality, security and integrity of personal data.

These service providers may only process personal data according to Black Sequoia’s instructions and for the purposes defined in the relevant contractual arrangements.

Personal data may not be sold, rented or used for purposes other than those described in this Policy without an appropriate legal basis.

Article 4. Data Subject Rights

4.1. Nature of the rights

In accordance with applicable data protection legislation, including the GDPR and French data protection law, every data subject has the following rights:

The right to obtain confirmation as to whether their personal data is being processed;

The right to access their personal data;

The right to request the correction or updating of inaccurate or incomplete data;

The right to request the deletion of their personal data, where legally permitted;

The right to request the restriction of processing;

The right to object to processing based on legitimate interests;

The right to data portability, where applicable;

The right to withdraw consent where processing is based on consent;

The right to define instructions concerning the retention, deletion and disclosure of personal data after death, where applicable under French law.

These rights may be subject to legal limitations or conditions.

4.2. Exercising your rights

Users may exercise their rights by contacting Black Sequoia:

By email:

[email protected]

By post:

Data Protection Contact

Black Sequoia SAS

1 Rue de Belle-Île

35760 Saint-Grégoire

France

The request should include:

  • The user’s first name and last name;
  • The user’s email or postal address;
  • The nature of the request;
  • Any information that may help identify the relevant data or account.

For security purposes, Black Sequoia may ask for proof of identity where this is necessary and proportionate to the request.

Black Sequoia will respond within one month of receiving the request. This period may be extended by up to two additional months where the request is complex or where several requests are being processed. The user will be informed if such an extension is necessary.

Users may also ask Black Sequoia to stop sending them commercial communications at any time.

4.3. Complaints

If a user believes that their personal data has been processed in breach of applicable data protection legislation, they may first contact Black Sequoia at:

[email protected]

Users may also lodge a complaint with the competent supervisory authority.

As Black Sequoia is established in France, the competent supervisory authority is generally:

Commission nationale de l’informatique et des libertés, CNIL

CNIL

Article 5. Transfers of Personal Data Outside the European Union

Some service providers used by the Poppers Aromas website may process personal data outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, Black Sequoia ensures that an appropriate legal transfer mechanism is used, where required by applicable law.

These mechanisms may include:

A European Commission adequacy decision;

Standard Contractual Clauses;

Appropriate technical, organisational and contractual safeguards;

Any other mechanism recognised under applicable data protection legislation.

Data collected through the website contact form and during the recruitment process may be processed through email or technical service providers whose infrastructure may be located outside the European Economic Area.

Data required for the delivery of an order may also be transferred to delivery companies or authorities located outside the European Economic Area where necessary to fulfil an international order.

Black Sequoia implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, unauthorised disclosure or any other form of unlawful processing.

However, no method of transmission or storage over the internet can be guaranteed to be completely secure.

Updates to this Policy

Black Sequoia may update this Privacy Policy to reflect changes in applicable legislation, the services provided, the technology used on the website or the way personal data is processed.

The latest version of this Policy will be made available on the Poppers Aromas website.