Privacy Policy — GDPR
Data Controller
BlobFarm, Paris, France. Contact: hello@blobfarm.com
Data Collected
We collect the data necessary to manage your orders and our customer relationship:
- Identity: first name, last name
- Contact details: email, phone number (optional), delivery and billing address
- Order data: products purchased, amounts, dates
- Navigation data: pages and product pages viewed, via cookies placed with your consent (banner displayed upon your arrival on the site)
Purposes of Processing
- Order processing and delivery
- Customer service and after-sales support
- Newsletter sending (opt-in only)
- Improving our offering (anonymized statistics)
- Audience measurement and email personalization (with your consent)
- Compliance with our legal obligations (accounting, taxation)
Legal Basis
The processing of your data is based on:
- The performance of the contract (orders)
- Your consent (newsletter, non-essential cookies)
- Our legal obligations (accounting record keeping)
Retention Period
- Order data: 10 years (accounting obligation)
- Customer account: until a deletion request is made
- Newsletter: until you unsubscribe
- Cookies: 13 months maximum
Recipients
Your data is shared with:
- Shopify — e-commerce platform, site hosting, and payments (Shopify Payments)
- Klaviyo, Inc. — sending our emails and measuring your navigation on the site (pages and product pages viewed) in order to personalize these communications
- Judge.me — collection and display of customer reviews
- Our carriers — La Poste, Mondial Relay
Each is bound by a data processing agreement in accordance with Article 28 of the GDPR, and only uses your data for the services we entrust to them.
Transfers outside the European Union
Some of our processors are established outside the European Union. Each transfer is governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission via Implementing Decision (EU) 2021/914 of 4 June 2021:
- Shopify Inc. (Canada / United States) — site hosting, order processing, and payments. SCCs published by Shopify: shopify.com/legal/dpa.
- Klaviyo, Inc. (United States) — email sending and navigation measurement for personalization. SCCs published by Klaviyo: klaviyo.com/legal/dpa.
- Judge.me (Hong Kong / United States) — collection and display of customer reviews. SCCs published by Judge.me: judge.me/dpa.
You may object to these processing activities at any time: by refusing non-essential cookies in the banner for audience measurement, and by unsubscribing (link at the bottom of every email) for marketing communications.
Minors
Our kits are intended for children aged 7 and up under adult supervision. Orders must be placed by an adult of legal age or the legal guardian of a minor; no personal data is collected directly from a child under 16 without the authorization of the holder of parental responsibility (GDPR Art. 8).
Your Rights
In accordance with the GDPR, you have the following rights:
- Right of access, rectification, and erasure
- Right to restriction of processing
- Right to data portability
- Right to object
- Right to withdraw your consent at any time
To exercise your rights: hello@blobfarm.com. Response within 30 days maximum.
Complaint
You may file a complaint with the CNIL: www.cnil.fr
Last updated: October 3, 2026
