Privacy policy

The website www.laboutiqueduthe.com (the “Site”) and the La Boutique du Thé shops in Bordeaux (19 rue des Remparts, 33000 Bordeaux) and Nice (4 rue de la Liberté, 06000 Nice) are operated by THEDisNice, a single-shareholder simplified joint-stock company (société par actions simplifiée à associé unique) with share capital of 10,000 euros, registered with the Bordeaux Trade and Companies Register (RCS) under number 991 514 803, whose registered office is at 1 rue Édouard Herriot, 33440 Ambarès-et-Lagrave (“we”).

THEDisNice is the controller of the processing of personal data described in this policy, within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and of amended French Law No. 78-17 of 6 January 1978. For any question relating to your data: direction@laboutiqueduthe.fr, or THEDisNice, 4 rue de la Liberté, 06000 Nice, +33 (0)4 93 17 42 81 (standard call rate).

This policy applies to data collected on the Site, in our shops and in the course of our exchanges with you (email, telephone). It supplements our Terms and Conditions of Sale and the rules of the game “L'École du thé”.

Your customer account is unique: whether it is created on the Site or in one of our shops, it is managed within our point-of-sale and customer management system (Square) and brings together your information, your in-shop and online purchase history, your membership of the loyalty programme, your progress in the game “L'École du thé” and your taste profile. The same protection rules apply to your data whatever the channel through which you entrusted it to us.

You may also order on the Site as a guest, without creating an account: in that case we process only the data strictly necessary to fulfil your order.

The table below summarises our processing operations. Data marked as mandatory are necessary for the stated purpose; failing this, we cannot provide you with the corresponding service.

Your data are processed by authorised persons at THEDisNice (shop teams, customer service, management) and, solely for the purposes described above, by our processors and partners, who are contractually bound to confidentiality and security:

• Square (Block, Inc.): main card payment provider, point-of-sale system, management of the single customer account, loyalty programme, digital gift cards, subscriptions (in which case Square retains your saved card);
• Stripe (Stripe Payments Europe Ltd): payment by Klarna in France and Belgium, and payment in Swiss francs for Switzerland;
• Klarna: immediate, instalment or deferred payment, depending on Klarna's offer. Apple Pay and Google Pay are offered where your device allows. Each payment provider acts as controller for the execution of the payment, in accordance with its own privacy policy;
• Supabase Pte. Ltd.: hosting of the Site's database (account data, orders, game, taste profile), stored in Frankfurt, Germany (European Union), as well as sending registration confirmation and password reset emails;
• Cloudflare, Inc. (represented in the EU by Cloudflare Portugal Unipessoal Lda.): delivery and security of the Site;
• Lovable: hosting and deployment platform for the Site;
• Amazon Web Services: original storage of the Square catalogue photos, in the United States. Photos are served to you from our own storage (Supabase, Frankfurt); your browser contacts Amazon only as a fallback, for a photo added the same day and not yet copied;
• Google: maps displayed on our shop pages, and audience measurement of the Site where you consent to it;
• Microsoft (Clarity): audience measurement of the Site where you consent to it (heatmaps, session replay). Your account, order and notebook pages are masked: their content is never recorded;
• La Poste (Colissimo): delivery of orders (identity, address, telephone and email for tracking);
• Resend: sending our order, dispatch and quote request reply emails;
• Anthropic PBC (United States): artificial intelligence model that writes the replies of the Site's assistant (see Article 11);
• CC'S GLOBAL: agency responsible for the development and technical maintenance of the Site;
• CM2C: consumer mediator, in the event of a dispute;
• our advisers (chartered accountant, lawyers) and administrative or judicial authorities where required by law.

We neither sell nor rent your data to third parties.

Your data are hosted in the European Union (Frankfurt). Some of our providers (Square, Cloudflare, Supabase, Stripe, Resend, Lovable, Amazon Web Services, Google, Microsoft, Anthropic) are, however, established or have infrastructure outside the European Union, notably in the United States or Singapore. Where a transfer takes place, it is governed by the safeguards provided for by the GDPR: an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework for providers certified under it) or standard contractual clauses of the European Commission, supplemented where appropriate by additional security measures. You may obtain a copy of these safeguards by writing to us.

We implement appropriate technical and organisational measures: encryption of exchanges (TLS), passwords stored in hashed form, bank details never retained by us and processed by PCI-DSS certified providers, access control limited to authorised persons, backups, logging and monitoring of access. As the transmission of data over the internet cannot, however, be guaranteed to be completely secure, we invite you to protect your login details and to report any suspicious use of your account to us. In the event of a data breach likely to result in a high risk to your rights, we will inform you under the conditions provided for by the GDPR.

Under the conditions provided for by the regulations, you have the following rights: right of access to your data and to a copy thereof; right to rectification; right to erasure; right to restriction of processing; right to object, in particular to direct marketing, at any time and without giving reasons; right to portability of the data you have provided to us; right to withdraw your consent at any time, without affecting the lawfulness of prior processing; right to set out instructions regarding the fate of your data after your death.

To exercise your rights: from your customer account, you can change your name and password, redo your taste profile and delete the pages of your tasting notebook. For any other request, in particular access, deletion of your account and portability, write to us: all requests relating to your data are handled at the address direction@laboutiqueduthe.fr, or by post to THEDisNice, La Boutique du Thé, 4 rue de la Liberté, 06000 Nice. We may ask you for proof of identity where there is reasonable doubt as to your identity. Exercising your rights is free of charge, except in the case of manifestly unfounded or excessive requests. We will reply within one month, which may be extended by two months if your request is complex.

Each marketing email contains an unsubscribe link. You may also object to telephone canvassing by registering on the Bloctel list (www.bloctel.gouv.fr).

If you consider that your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

The Site, the customer account, the loyalty programme and the prizes of the game “L'École du thé” are reserved for persons of legal age. We do not knowingly collect data concerning minors; if you believe that a minor has sent us data, please contact us so that we can delete it.

The use of cookies and other trackers on the Site is described in our Cookie policy, accessible in the footer of the Site and via the consent management module.

The Site may contain links to third-party sites and sharing buttons for social networks (Instagram, Facebook). This policy applies only to the data we collect; we are not responsible for the practices of these sites and platforms, which we invite you to consult. When you interact with our pages on social networks, the platform concerned and we ourselves may be jointly responsible for certain processing (page statistics), under the conditions set by the platform.

The Site offers an assistant that answers your questions about our teas, our infusions, our accessories, our shops, delivery and our terms of sale. It is an artificial intelligence program, not a person: it may make mistakes. Its answers replace neither our product pages nor our General Terms and Conditions of Sale, which are authoritative, and it gives no health advice. A member of our shop staff will answer you on 04 93 17 42 81 (Nice), on 05 56 90 03 03 (Bordeaux) or via the contact form.

Data processed: your messages and the assistant's answers; the page of the Site from which you query it; the contents of your basket (products, formats, quantities and prices), so as to answer you in full knowledge of the facts; a random identifier, stored in your browser's memory to retrieve your conversation if you reload the page and to apply usage limits; your IP address, made unreadable by hashing, for these same limits. If you are logged in to your account, the assistant consults, at the time of your question and in order to answer it, the relevant information in your account: your orders and their tracking, your purchases, your loyalty points balance. It never discloses information about another person. Do not share with it any bank details, passwords or information about your health.

Purposes and legal bases: to inform you (legitimate interest of THEDisNice in responding to its customers and visitors; performance of the contract where the answer concerns your account or your orders); to review conversations in order to check the accuracy of answers and correct our information; to prevent abuse, by limiting the number of messages per day. No decision concerning you is made by automated means, and your conversations are not used to send you commercial solicitations.

Recipients: the authorised staff of THEDisNice, who may review conversations from our administration tool. Answers are written by the artificial intelligence model of Anthropic PBC (United States), which acts as a processor: your messages, the page viewed, your basket and, where applicable, the account information needed for the answer are transmitted to it solely for the purpose of writing the answer. Under its commercial terms, Anthropic does not use this data to train its models. This transfer outside the European Union is governed as set out in article 5. If you ask to speak to a person, the conversation, together with your email address if you provide it, is sent by email to our shop.

Retention period: conversations, as well as the counters used for usage limits, are automatically deleted after 90 days. The email sent to the shop at your request is retained in the same way as our other exchanges with customer service (article 3). The identifier stored in your browser remains there until you clear the Site's data in your browser.

Your rights: you have the rights described in article 7, in particular the right to access your conversations and to have them erased, by writing to direction@laboutiqueduthe.fr ; state the day and approximate time of the conversation so that we can find it. The assistant is optional: the Site, ordering and our shops all work without it.

We may amend this policy, in particular in the event of changes to our services or to regulations. The version in force is the one published on the Site, with its date of update. In the event of a substantial amendment, we will inform you by any appropriate means (email, message on the Site or in your account).

Last updated: 3 October 2026.