Personal data

Privacy policy

In force as of 28 September 2026

The French version of this document prevails. This translation is provided for information only; in case of discrepancy, the French text governs.

Preamble

This policy informs users of the Vitreco website, in accordance with articles 12, 13 and 14 of Regulation (EU) 2016/679 (GDPR):

of the identity of the data controller;
of the personal data collected and the purposes of processing;
of the legal basis for each processing operation;
of the recipients and any transfers outside the European Union;
of the retention periods;
of the rights available to data subjects;
of the existence, where applicable, of automated decision-making.

This policy supplements the legal notice available on the site.

Article 1 — Principles governing collection and processing

In accordance with the GDPR and French law no. 78-17 of 6 January 1978 as amended, personal data is:

processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary (minimisation);
accurate and kept up to date;
kept no longer than necessary for the purposes;
processed in a manner that ensures its security.

Article 2 — Identity of the data controller

The data controller is:

Company name	VITRECO
Registered office	12 rue de la Part-Dieu, 69003 Lyon, France
SIRET	101 900 124 00013
Email	contact@vitreco.eu
Telephone	+33 7 64 23 98 68

No data protection officer has been appointed. For any question about the processing of your data, please write to contact@vitreco.eu.

Article 3 — Data collected, purposes and legal bases

3.1 How your data reaches us

The reseller area access request form is active; the contact form is not yet. Other exchanges take place through the channels below.

WhatsApp — main channel

The site invites you to write to us on WhatsApp and to attach a photograph of your opening. We then receive your telephone number, the content of your messages and, if you send one, the photograph. That conversation is hosted by WhatsApp Ireland Limited (Meta group) and may be transferred outside the European Union, under the terms specific to that service.

A photograph of an opening shows the inside of a home and may carry, in its metadata, the date and place it was taken. We use it only to answer your enquiry. If you would rather avoid that transmission, write to us by email: the photograph then stays on our servers in France.

Email and telephone

You can write to us directly at contact@vitreco.eu or call +33 7 64 23 98 68. Messages received by email are stored on the mailbox hosted by o2switch, in France.

Website forms

When you send the reseller access request form, the fields below are passed to us by email, through Brevo, to our mailbox hosted by o2switch. The website keeps no copy of them: it only keeps a technical log line, with no personal data, recording the date and the outcome of the sending. No email is sent automatically to the address you enter; we reply ourselves. The contact form is not active yet: the list that concerns it describes what will be collected once it is.

Contact form

first and last name
email address
telephone number
postcode
subject of the enquiry
opening width, in millimetres
opening height, in millimetres
quantity required
photograph of the opening, if you attach one — it may show the inside of your home and carry, in its metadata, the date and place it was taken
content of your message
your agreement that this data may be used to handle your enquiry

Reseller access request form

company name
trading area
business email address
your agreement that this data may be used to process your access request

3.2 Purposes and legal bases

In accordance with article 6 of the GDPR, each processing operation rests on a specific legal basis:

Purpose	Legal basis
Answering your enquiries and preparing a quotation	Legitimate interest (article 6.1.f) — replying after you have written to us
Processing a reseller account request	Consent (article 6.1.a), collected via the form checkbox
Managing an open reseller account and its pricing	Performance of pre-contractual measures and of the contract (article 6.1.b)
Sending commercial information to professional resellers, with an unsubscribe link in every message	Legitimate interest (article 6.1.f)

Contact details provided by private individuals are never used for commercial prospecting. Only professional resellers receive commercial information, and every message carries an unsubscribe link.

3.3 Mandatory or optional nature of collection

Fields marked as mandatory condition the provision of the corresponding service. Other fields are optional; leaving them blank has no consequence.

Article 4 — Retention periods

The default retention period is three years, without prejudice to statutory retention obligations (accounting, tax).

Certain data is subject to statutory periods, which prevail over the default period:

Document or data	Period	Basis
Invoices and accounting records	10 years from the close of the financial year	Article L123-22 of the French Commercial Code
Contracts concluded electronically for €120 or more	10 years from delivery	Article L213-1 of the French Consumer Code
Tax records	6 years	Article L102 B of the French Tax Procedures Book
Professional prospecting contact details	3 years after the last contact initiated by the person	CNIL recommendation — commercial management framework

WhatsApp conversations are an exception. We delete exchanges older than three years from our devices, but retention on WhatsApp’s own servers follows that service’s rules, over which we have no control. If you would like us not to keep a photograph, write to us and we will delete it from our devices.

Article 5 — Recipients and processors

Your data is disclosed to third parties only in the following cases:

o2switch SAS, host of the website and mailbox, in France;
Brevo (SENDINBLUE SAS), for the emails of the reseller area — login code, order confirmation, manufacturing order and activity report — since that area opened, on servers located within the European Union;
Brevo (SENDINBLUE SAS), also, to pass on to our mailbox the access requests sent through the reseller area form;
WhatsApp Ireland Limited (Meta group), when you choose that channel;
administrative or judicial authorities where the law so requires.

Processor planned, not yet in service

Stripe Payments Europe, Limited (Ireland) will receive your payment data and delivery address on the day online payment is activated. Card details will be entered directly on a page hosted by Stripe: VITRECO has no access to them and does not store them. No data is transmitted to it today.

Any processor added later — email delivery, payment — is listed here before it enters service, not after. This undertaking was not honoured once: Brevo entered service when the reseller area opened and was only added to this article on 2 September 2026. That is stated here rather than passed over in silence.

Article 6 — Transfers outside the European Union

Data you send us by email or telephone is processed within the European Union, on servers located in France. Exchanges you choose to conduct over WhatsApp, however, fall under WhatsApp Ireland Limited and the Meta group, which carry out transfers outside the European Union subject to the safeguards provided for in Chapter V of the GDPR. If you would rather your data did not leave the European Union, please use email or the telephone.

Article 7 — Automated decisions and profiling

No decision producing legal effects or significantly affecting you is taken solely on the basis of automated processing. No such profiling is carried out. The price calculation shown on the site is a simple table lookup: it processes no personal data.

Article 8 — Your rights

In accordance with articles 15 to 22 of the GDPR, you have the following rights:

right of access (art. 15): to obtain confirmation that data concerning you is processed and to access it;
right to rectification (art. 16);
right to erasure (art. 17), in the cases provided for;
right to restriction of processing (art. 18);
right to data portability (art. 20);
right to object (art. 21), in particular to commercial prospecting;
right to withdraw consent at any time (art. 7.3), without affecting the lawfulness of processing carried out before that withdrawal;
right to give directions concerning your data after your death (article 85 of the law of 6 January 1978).

To exercise these rights, write to us at contact@vitreco.eu. A reply will be provided within one month, extendable by two months where the request is complex (article 12.3 GDPR).

You also have the right to lodge a complaint with the CNIL: https://www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Article 9 — Data security

The data controller implements appropriate technical and organisational measures (article 32 GDPR): encryption of exchanges, access control, backups, logging and security updates.

In the event of a data breach likely to result in a high risk to your rights and freedoms, the CNIL is notified within 72 hours (article 33 GDPR) and, where applicable, you are informed (article 34 GDPR).

Article 10 — Changes to this policy

This policy may be amended to reflect regulatory or technical developments. Any substantial change is brought to your attention by an appropriate means.

Last updated: 28 September 2026.