Privacy Policy

Privacy Policy

Last updated: 30 March 2026

CLOWN.ART, a French simplified joint-stock company (SAS) with share capital of €1,000.00, registered with the Paris Trade and Companies Register (RCS) under number 928 269 463, with its registered office at 200 rue de la Croix Nivert, 75015 Paris, France, is committed to protecting the privacy of its customers and visitors in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the amended French Data Protection Act (Loi Informatique et Libertés).

1. Data controller

CLOWN.ART — 200 rue de la Croix Nivert, 75015 Paris, France. Email: support@clown.art.

2. Data collected

• Identity: first name and surname.
• Contact details: email address, postal addresses for delivery and billing, telephone number.
• Orders: purchase history, order numbers and invoices.
• Browsing: IP address, browser type, pages visited, advertising identifiers, interactions with our advertisements, session data and browsing behaviour.
• Online school: progress data (lessons taken and exercises submitted), Discord username.

Payment information: we never have access to your full banking details. Transactions are handled by Shopify Payments (PCI-DSS certified).

3. Purposes and legal bases

• Processing and dispatching orders: performance of a contract (GDPR Article 6(1)(b)).
• Customer service, after-sales support and returns: performance of a contract.
• Access to and progress tracking for online courses: performance of a contract.
• Sending commercial offers through the Klaviyo newsletter: consent or legitimate interest (existing customers).
• Accounting and tax obligations: legal obligation (GDPR Article 6(1)(c)).
• Fraud prevention: legitimate interest.
• Targeted advertising and retargeting: consent through the cookie banner.
• Analysis of browsing behaviour (ContentSquare, Microsoft Clarity): consent.
• Advertising performance measurement: legitimate interest.

4. Retention periods

• Customer data for marketing: 3 years from the last purchase or contact.
• Invoices and accounting records: 10 years (legal obligation under the French Commercial Code).
• Prospect data (non-customers): 3 years from collection or the last click.
• Online school data: for the duration of access, plus 3 years after access ends.
• Cookies: up to 13 months for consent and 25 months for analytics data.

5. Data recipients

Your data is strictly confidential. We never sell it. It is shared only with essential technical service providers:

• E-commerce: Shopify Inc. (store hosting and payment).
• Online school: Infomaniak Network SA (course hosting).
• Logistics: Kairos Logistique and our carriers (La Poste, Mondial Relay, DPD, Colissimo).
• Payments: Shopify Payments.
• Accounting: our accountant.
• Email and marketing: Klaviyo.
• Browsing analytics: ContentSquare, Microsoft Clarity, Google Analytics through Google Tag Manager.
• Advertising platforms: Meta (Facebook/Instagram), Google and Pinterest. Data is transmitted through pixels and secured and encrypted (hashed).
• Marketplace: SOCULTUR SAS (Cultura) for marketplace orders, in accordance with the GDPR appendix to the partnership agreement.
• Community: Discord Inc. (the online school’s community space).

6. Transfers outside the European Union

Some providers are based outside the EU. Transfers are governed as follows:

• Canada (Shopify): European Commission adequacy decision.
• United States (Shopify, Google, Meta, Pinterest, Discord, ContentSquare, Microsoft, Klaviyo): the Data Privacy Framework (DPF), approved on 10 July 2023, or European Commission Standard Contractual Clauses (SCCs).
• Switzerland (Infomaniak): European Commission adequacy decision.

7. Your rights

Under the GDPR, you have the following rights:

• Access (Article 15): obtain a copy of your data.
• Rectification (Article 16): correct inaccurate data.
• Erasure (Article 17): request deletion of your data.
• Restriction of processing (Article 18).
• Data portability (Article 20): receive your data in a structured format.
• Objection (Article 21): object to processing, particularly direct marketing.
• The right not to be subject to an automated decision (Article 22).
• The right to withdraw consent at any time.
• Post-mortem instructions (Article 85 of the French Data Protection Act): set instructions for the handling of your data after your death.

To exercise these rights, email support@clown.art or write to our registered office. We respond within one month, which may be extended by two months. If you do not receive a satisfactory response, you may complain to the CNIL (www.cnil.fr).

8. Cookies and trackers

Our Website uses cookies and trackers. On your first visit, a banner lets you accept, reject or configure cookies. You can change your choices at any time.

8.1. Strictly necessary cookies (no consent required)

These cookies are essential to the Website and cannot be disabled.

8.2. Analytics cookies (subject to consent)

These cookies measure audience activity and analyse browsing behaviour.

8.3. Marketing and advertising cookies (subject to consent)

These cookies enable personalised advertising.

8.4. Fonts and external resources

Maximum cookie duration: 13 months, in accordance with CNIL recommendations. You can manage your preferences at any time through the consent manager accessible in the Website footer.