Last updated: June 26, 2026.
This privacy policy describes how the personal data of people who visit the site https://www.lapetitenuit.com and who place an order on the La Petite Nuit online store (hereinafter the “site”) is collected, used, stored and protected. Its purpose is to inform you, with full transparency, of your rights and of the commitments made to ensure the confidentiality and security of your data, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and the amended French Data Protection Act (“Informatique et libertés”) of 6 January 1978.
We invite you to read this document carefully. By using the site and placing an order, you acknowledge that you have read this policy. For the management of cookies and trackers, please refer to our cookie policy. For the terms of sale, see our terms and conditions of sale and our legal notice.
1. Introduction and data controller
The controller of the personal data collected through the site is Kyronix Labs LLC, a limited liability company registered in the State of New Mexico, United States, identified under EIN 98-1961162. Kyronix Labs LLC runs the online store under the La Petite Nuit brand and determines the purposes and means of the processing described in this policy.
The technical management, digital marketing and operation of the site are handled by ADZENCLICK, SAS (simplified joint-stock company) with share capital of €1,000, SIREN 978 699 932, RCS Metz, which acts as a service provider on behalf of Kyronix Labs LLC and according to its instructions.
For any question about the protection of your data, or to exercise your rights, you can contact the controller by email at bonjour@lapetitenuit.com, or by post at the registered office address given above. You can also use our contact page.
2. Data we collect
We only collect the data needed for the purposes described in this policy. Depending on how you use the site, the following categories of data may be processed:
- Identity data: title, last name and first name, given when you create an account or place an order.
- Contact data: email address and, where applicable, phone number, used for order tracking and customer relations.
- Shipping and billing address: the full postal address needed to ship your order and to issue accounting documents.
- Order data: products ordered, amount, date and order history, communications related to tracking.
- Payment data: payment information (card number, expiry date, security code) is collected and processed directly by Shopify and its payment providers. We never have access to your full card number, which does not pass through our own servers.
- Newsletter sign-up data: the email address you give us if you choose to receive our marketing communications.
- Browsing data and cookies: IP address, browser type, pages viewed, connection data and identifiers set by cookies and trackers, under the conditions set out in our cookie policy.
- Messages to customer service: the content of the messages, requests and attachments you send us when you contact us.
Most of this data is collected directly from you. Some technical browsing data is collected automatically during your visit. Mandatory form fields are marked; if you do not fill them in, we may be unable to process your order or your request.
3. Purposes and legal bases
Each processing operation relies on a legal basis provided for by the GDPR. Your data is used for the following purposes:
- Managing orders and customer relations (creating the account, processing, preparing, shipping and tracking the order, handling returns and after-sales service): this processing is based on the performance of the contract between you and us, or on the performance of pre-contractual measures taken at your request.
- Accounting, tax and legal obligations (issuing and keeping invoices, handling any disputes): this processing is based on compliance with a legal obligation to which we are subject.
- Sending the newsletter and marketing communications: this processing is based on your consent, which you can withdraw at any time, or on our legitimate interest in building the loyalty of our customers for similar products, within the limits allowed by law.
- Improving the site, audience measurement and fraud prevention: this processing is based on our legitimate interest in ensuring the proper functioning, security and improvement of our services, or on your consent when cookies that are not strictly necessary are used.
- Responding to your requests sent to customer service: this processing is based on our legitimate interest in responding to your enquiries and ensuring the quality of customer relations.
4. Recipients and processors
Your data is intended for the authorized internal teams of Kyronix Labs LLC in charge of order management and customer relations. For the purposes described above, it may also be shared with the following recipients and processors, who act on our behalf and according to our instructions:
- Shopify (Shopify International Limited, Dublin, Ireland), which provides the online store platform, hosts the customer database, and manages the checkout and payment processing.
- The payment providers operating through Shopify, responsible for securing and carrying out financial transactions.
- The carrier in charge of delivery, which receives the data needed to deliver your parcel (name and shipping address, contact details).
- Vercel Inc. (United States), which provides the hosting and technical delivery of the site.
- ADZENCLICK (SAS (simplified joint-stock company) with share capital of €1,000, SIREN 978 699 932, RCS Metz), which handles the technical management, digital marketing and operation of the site on our behalf.
- Our email delivery provider, which delivers transactional emails and, where applicable, the newsletter.
These providers are contractually required to ensure the confidentiality and security of your data and to use it only for the purposes entrusted to them. Your data may also be disclosed to administrative or judicial authorities when the law requires us to do so. We never sell your data, and we do not rent it or exchange it with third parties for commercial purposes.
5. Data transfers outside the European Union
Kyronix Labs LLC, the controller, is a company established in the United States. In addition, some of our processors, including Shopify and Vercel, may host or process data from the United States or from other countries outside the European Union. As a result, your personal data may be transferred and processed outside the European Union, including to the United States.
When such a transfer is made to a country that does not provide a level of protection recognized as adequate by the European Commission, we make sure it is governed by appropriate safeguards within the meaning of Articles 44 et seq. of the GDPR. These safeguards rely in particular on the conclusion of standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical and organizational measures, or on any other transfer mechanism recognized by the applicable regulations. You can obtain a copy of these safeguards or information on their availability by writing to us at bonjour@lapetitenuit.com.
6. Retention periods
Your data is kept only for as long as strictly necessary for the purposes for which it was collected, then archived or deleted in accordance with the legal time limits:
- Order and customer account data: kept for the duration of the contractual relationship, then archived in an intermediate database for the time needed to handle any disputes.
- Billing data and accounting documents: kept for the period required by the applicable legal and tax obligations, generally ten years from the end of the financial year.
- Prospecting and newsletter data: kept until you withdraw your consent or unsubscribe, and at the latest three years from your last contact with us.
- Cookies and trackers: kept for no more than thirteen months, under the conditions set out in our cookie policy.
- Messages sent to customer service: kept for the time needed to handle your request, then archived according to the periods applicable to any disputes.
7. Your rights
In accordance with the GDPR and the French Data Protection Act (“Informatique et libertés”), you have the following rights over your personal data:
- Right of access: obtain confirmation that your data is being processed and receive a copy of it.
- Right to rectification: have inaccurate data corrected or incomplete data completed.
- Right to erasure: request the deletion of your data, within the limits provided by law.
- Right to restriction of processing: request the temporary suspension of the use of certain data.
- Right to object: object, on grounds relating to your particular situation, to processing based on legitimate interest, and object at any time to marketing.
- Right to data portability: receive the data you have provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller.
- Right to withdraw your consent at any time, where the processing is based on it, without affecting the lawfulness of the processing carried out before the withdrawal.
- Right to set instructions regarding what happens to your data after your death (post-mortem instructions).
To exercise these rights, simply write to us at bonjour@lapetitenuit.com, specifying your request. We may ask you to prove your identity to avoid disclosing your data to a third party. We undertake to respond as quickly as possible and, in any event, within one month of receiving your request, which may be extended by two months for complex requests.
8. Complaint to the CNIL
If, after contacting us, you believe your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority. In France, this is the Commission nationale de l’informatique et des libertés (CNIL), whose contact details and complaint procedures are available on its official website. You may also contact the data protection authority of your State of residence within the European Union.
9. Data security
We implement appropriate technical and organizational measures to protect your data against loss, alteration, unauthorized access and disclosure. The site uses an encryption protocol for exchanges (HTTPS), and payment transactions are secured by our specialized providers. Access to data is limited to authorized persons who are bound by a duty of confidentiality. Despite all the care taken over security, no data transmission over the Internet can be guaranteed to be completely secure; we undertake to inform you, under the conditions provided by law, in the event of a data breach likely to result in a high risk to your rights and freedoms.
10. Cookies and trackers
The site uses cookies and other trackers intended to ensure its proper functioning, to measure its audience and, subject to your consent, for personalization purposes. You can set your preferences at any time and get details of the trackers used by consulting our cookie policy.
11. Minors’ data
Our products are intended for parents and responsible adults. The site is not intended for minors, and we do not knowingly collect personal data about children. If you believe that a minor has sent us data without the permission of their legal representatives, please contact us at bonjour@lapetitenuit.com so that we can delete it, where appropriate.
12. Changes to the policy
This privacy policy may be updated at any time, in particular to take into account legal, regulatory, technical or organizational changes. The date of the last update is shown at the top of this document. In the event of a substantial change, we will inform you by appropriate means. We invite you to check this page regularly.
13. Contact
For any question about this privacy policy or the processing of your personal data, you can write to us at bonjour@lapetitenuit.com or use our contact page.