Rewel • Version as of September 25, 2026
This policy concisely explains how Rewel uses the personal data of visitors, customers, and individuals who contact its customer service.
1. Data Controller
The data controller is Gaétan REINARTZ, a sole proprietorship (EI), operating as Rewel. His legal address can be found in the Legal Notice.
- Email regarding personal data: contact@rewelcare.fr
Rewel has not appointed a Data Protection Officer. Any request regarding privacy may be addressed to the contact details above.
2. Data Processed
- Identity and contact details: surname, first name, postal and email addresses, telephone number.
- Orders and commercial relationship: products, cart, orders, invoices, deliveries, returns, refunds, exchanges, and complaints.
- Customer account: identifier, history, preferences, and authentication data managed by Shopify. Rewel does not access the customer’s password, login code, or any other authentication secret.
- Payment: status, amount, transaction identifier, and information necessary for fraud prevention. Rewel does not receive the full card number.
- Site usage: IP address, device, browser, pages visited, technical events, and cookie preferences, according to the choices expressed.
- Communication: newsletter subscription, messages sent to customer service, and responses to surveys or reviews, when offered.
- Information voluntarily provided for advice: skin concerns and, only if necessary and expressly accepted, photographs or information that may reveal health status.
- Customer reviews: identity or pseudonym, email address, associated order, product concerned, rating, content of the review, date of experience, and any photograph submitted.
- Marketing and performance measurement: subscription, consent status, campaigns received, opens, clicks, browsing, purchases, and marketing segments, according to the choices expressed.
- Online conversation: content of exchanges made via the Site's messaging or chat service, identity, contact details, order information, and attachments voluntarily transmitted.
- Advertising and audience analysis: IP address, cookie or device identifiers, browser, pages visited, cart additions, orders, purchase amounts, and interactions with campaigns, only when the required consent has been obtained.
- Delivery: identity, address, telephone, email address, chosen Pickup Point, parcel number, and tracking events.
3. Purposes, Legal Bases, and Main Retention Periods
| Purpose | Main data | Legal basis | Indicative duration |
|---|---|---|---|
| Display the Site, cart, and account | Connection, account, necessary preferences | Contract or legitimate interest in providing a secure service | Active account, then up to 3 years of inactivity, unless requested or otherwise required |
| Process orders, payment, delivery, return, and refund | Identity, contact details, order, transaction, delivery | Performance of the contract | Active management, then archiving necessary for evidence; invoices and accounting documents: 10 years |
| Customer service and complaints | Order, exchanges, supporting documents | Contract and legitimate interest in handling requests | Duration of processing, then up to 5 years in intermediate archiving if necessary for evidence |
| Prevent fraud, abuse, and incidents | Transaction, IP, technical logs | Legitimate interest and legal obligations | Period strictly necessary; payment proof by the provider is generally 13 months, 15 months for deferred debit cards |
| Send newsletter and electronic offers | Email, preferences, useful history | Consent; or rules applicable to customers for similar products with simple opt-out | Until withdrawal or 3 years after the last active contact |
| Measure audience that is not strictly necessary | Cookie identifiers, browsing, device | Consent | According to the tool; audience measurement data for a maximum of 25 months when such a cap is applicable |
| Personalize advertising | Browsing, interactions, advertising identifiers | Consent | According to the tool and until withdrawal of consent |
| Respond to a request for voluntary advice | Message, concerns, potentially a photo | Pre-contractual measures or requested service; explicit consent if health data is necessary | Up to 6 months after the last exchange, then deletion unless evidentiary necessity |
| Comply with legal obligations and defend Rewel's rights | Orders, invoices, exchanges, and evidence | Legal obligation or legitimate interest | Applicable legal or limitation periods |
| Collect, check, and publish customer reviews | Identity or pseudonym, associated order, rating, review, and any photograph | Rewel's legitimate interest in informing customers and improving its offer; separate consent for any advertising reuse | Maximum period of five years, unless justified early removal |
Periods may be extended when required by law, when a dispute justifies it, or when data must be kept in intermediate archiving to establish, exercise, or defend a legal right. They are then deleted or anonymized.
4. Cookies and Other Trackers
When visiting the Site, cookies and other trackers, such as pixels or similar technologies, may be stored or read on your device. They primarily ensure the operation of the Site, remember your preferences, measure its audience, improve its performance, and, subject to your consent, measure or personalize advertising communications.
4.1 Categories of Trackers Used
The Site may use the following categories:
- trackers strictly necessary for the operation and security of the Site, cart management, payment, customer account login, and saving your privacy choices. These trackers do not require your consent;
- functional trackers allowing the activation of certain optional features, such as experience personalization, chat service, or the display of certain content;
- audience measurement and performance trackers allowing us to understand Site usage and improve its operation;
- advertising trackers allowing, with your consent, to measure campaign effectiveness, limit ad repetition, and offer communications tailored to your interests.
4.2 Consent Management
When a tracker is not strictly necessary, its storage or reading is subject to your prior consent.
During your first visit, the cookie management banner allows you to accept, refuse, or customize your choices with an equivalent degree of simplicity. Absence of choice or simply continuing to browse does not constitute consent.
You can modify or withdraw your consent at any time using the "Manage my cookies" or "Cookie preferences" link, accessible from the footer of the Site. Withdrawal of consent takes effect for the future and does not call into question the lawfulness of processing carried out previously.
Refusing non-necessary trackers does not prevent you from visiting the Site or placing an order. However, it may limit certain optional features, particularly content personalization or the display of integrated third-party services.
4.3 Partners, Purposes, and Durations
Some trackers may be stored by Rewel or by its technical, analytical, and advertising partners. The updated list of relevant partners, tracker purposes, and their operating durations are accessible from your browser or the cookie management center. This panel supplements this policy.
Trackers and the information resulting from them are kept only for a duration proportional to their purpose. Choices expressed regarding cookies are kept for six months, unless there is a significant change in the services used or the addition of a new purpose requiring new consent.
Some partners may process data outside the European Economic Area. These transfers are governed by the safeguards described in the section of this policy devoted to international data transfers.
For any questions regarding the use of cookies, you can contact Rewel at the address: contact@rewelcare.fr.
5. Mandatory and Optional Information
Fields marked as mandatory are necessary to create an account, place an order, deliver, or respond to a request. Otherwise, Rewel may not be able to provide the service. Marketing subscription, non-necessary cookies, and sending photographs are optional and do not affect the ability to purchase.
The telephone number provided for an order is used for its processing, delivery, and customer service. It is not used for telephone prospecting purposes without the prior consent of the person concerned.
6. Origin of Data
Data primarily comes from the person concerned when they browse, create an account, order, contact Rewel, or choose their cookies. Some information is transmitted by Shopify, the payment provider, the carrier, or a technical partner to confirm a transaction, tracking, or an incident.
7. Recipients
To the extent necessary for their mission, data may be communicated to:
- authorized personnel within Rewel;
- Shopify, which provides the e-commerce platform and hosting;
- payment providers actually offered during the order;
- Chronopost, Colissimo/La Poste, Sendcloud, or the carrier actually selected during the order;
- technical service providers actually activated, including Shopify and its integrated tools (Forms, Flow, Bundles, Translate & Adapt, and Messaging), Judge.me for reviews, ConvertX for certain conversion functions, Sendcloud and Chronopost for shipment preparation or tracking, as well as WhatsApp by Meta when this channel is used;
- professional advisors, insurers, auditors, and authorities when required by law or justified by a dispute.
Each provider only receives the information useful for their mission and acts according to their legal role and contractual commitments.
8. Payment
Payments are secure and processed directly by the chosen provider. Rewel does not access the cryptogram or the full card number. Payment providers may process certain data for their own security, fraud prevention, know-your-customer, or compliance obligations, according to their respective policies.
9. Transfers Outside the European Economic Area
Some providers or their subcontractors may process data outside the European Economic Area, including in Canada, the United Kingdom, or the United States. Depending on the situation, these transfers rely on an adequacy decision, the EU-US Data Privacy Framework when the recipient is validly certified, standard contractual clauses, or another safeguard recognized by the GDPR.
Shopify indicates that it governs data transfers from the European Economic Area and Switzerland, notably through adequacy decisions, particularly regarding Canada, and standard contractual clauses when these are necessary. Other providers must rely on an adequacy decision, the EU-US framework when they are validly certified there, standard contractual clauses, or another safeguard provided for by the GDPR.
A copy or additional information regarding the applicable safeguard can be requested at contact@rewelcare.fr, subject to confidential elements. This information does not replace the contractual and security obligations imposed on the providers.
10. Security
Rewel implements measures proportional to the risks, including access limitation, the use of secure authentication means, the updating of its equipment, the use of recognized providers, and an incident management procedure. Rewel also benefits from the security and continuity measures implemented by Shopify and its providers. As no system offers absolute security, Rewel re-evaluates these measures and notifies data breaches when required by law.
11. Your Rights
According to the conditions provided by the GDPR and the Data Protection Act, you can request access to, rectification, erasure, or portability of your data, the limitation of a processing, object to processing based on legitimate interest, or withdraw your consent at any time. Withdrawal of consent does not call into question previous lawful processing.
You can also define directives regarding the fate of your data after your death where French law permits, and you may object to commercial prospecting at any time.
To exercise a right, write to contact@rewelcare.fr indicating the right concerned and information allowing your account or order to be found. Proof of identity is only requested in case of reasonable doubt and only to the extent necessary. Rewel generally responds within one month, which may be extended in cases provided for by law.
12. Complaint to the CNIL
If you believe that your rights are not being respected, you can contact Rewel and then file a complaint with the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07, or at www.cnil.fr.
13. Minors
The Site is not designed to knowingly collect data from children. A minor should only place an order with the authorization and under the responsibility of their legal representative, in accordance with applicable capacity rules.
14. Update
Rewel may update this policy in the event of legal, technical, or functional developments. The current version is published on the Site with its update date. Last update: 09/25/2026.