1. Data controller
The controller is the site publisher identified in the legal notice: Darmi Vault, sole trader Diaw Younouss Fadel, 994 531 994 R.C.S. Paris, Apartment 327, 129 boulevard Davout, 75020 Paris, France.
Contact: hello@darmivault.com
2. Data processed and purposes
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account management | Name, email, hashed password, language, phone | Performance of contract | Life of the account, then anonymisation |
| Order processing | Delivery and billing addresses, items, amounts | Performance of contract | 10 years (accounting obligation) |
| Payment | Transaction identifiers, card brand and last 4 digits | Contract and legal obligation | Same as orders |
| Seller verification | Identity, registration, supporting documents | Legal obligation and legitimate interest | 5 years after the end of the business relationship |
| Customer reviews | First name, rating, text, linked order | Legitimate interest | Until the review is deleted |
| Site security | Technical logs, hashed IP, anti-abuse counters | Legitimate interest | 12 months maximum |
| Seller payouts | Account holder, IBAN, BIC | Performance of contract (seller terms) | Duration of the business relationship; transfer records are kept 10 years (accounting obligation) |
| Catalogue opening notice | Email, language | Consent | Until the opening message is sent, then deletion |
| Marketing emails | Consent | Until consent is withdrawn |
No full card data is collected or stored by this site. Entry takes place directly in a secure form provided by Stripe.
3. Recipients
- Stripe (payment provider): data required for payment and fraud prevention.
- Darmi Vault's bank: seller account holder and IBAN, to execute the transfers due to them.
- The sellers concerned: only what is needed to ship (name, delivery address, phone if provided, their part of the order). Sellers see neither your payment method, nor your billing address, nor your other orders.
No data is sold or shared for advertising purposes.
4. Your rights
You have rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent at any time.
From your account, under My data, you can immediately download a copy of your data as JSON, request a correction, or request deletion of your account.
Important limitation: deletion anonymises your account but does not remove orders already paid or the related accounting records, whose retention is required by law.
You may lodge a complaint with the French data protection authority, CNIL (cnil.fr).
5. Security
Passwords are stored as irreversible hashes. Traffic is encrypted over HTTPS. Seller documents are stored outside the public area of the server and are accessible only to administrators, with every access logged.
6. Cookies
See the cookie policy.