Privacy policy

1. Identity of the data controller

The data controller is:

• Company name: LIGHTON
• Legal form: SAS
• Share capital: SARL
• Registered office: ZI ATHELIA AVENUE DES MATTES 13600 LA CIOTAT
• SIRET: 103 202 974 00012
• RCS: 103 202 974 R.C.S. La Ciotat
• Publication director: PASCAL BARDEL
• Telephone: 04 48 47 09 33
• Contact email: contact@lighton-solutions.com

2. Data Protection Officer (DPO)

A Data Protection Officer (DPO) has been appointed. You can contact him with any questions about the processing of your personal data or the exercise of your rights:

• Name: PASCAL BARDEL
• Email: pascal@lighton-solutions.com

3. Main processors (Article 28 GDPR)

To operate the website and its services, LIGHTON uses processors acting on documented instructions and bound by a contract compliant with Article 28 of the GDPR.

• Hosting provider: IONOS SARL, 7 place de la Gare, BP 70109, 57200 Sarreguemines Cedex, France, 09 70 80 89 11
• Payment provider: Online payment provider
• Newsletter delivery provider: other provider

All our processors are bound by a contract compliant with Article 28 of the GDPR and provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures.

4. Purposes, legal bases and retention periods

In accordance with Articles 13 and 14 of the GDPR, the processing activities are as follows.

4.1 Contact form

• Data collected: identity (surname, first name), email address, message content and anything the user chooses to provide.
• Purpose: responding to requests submitted through the contact form.
• Legal basis: LIGHTON's legitimate interest in responding to enquiries it receives (Article 6(1)(f) GDPR).
• Retention period: 3 years from the last contact with the user (CNIL recommendation — commercial management framework).

4.2 Newsletter

• Data collected: email address (and first name if provided).
• Purpose: sending commercial communications and news.
• Legal basis: the data subject's freely given, specific, informed and unambiguous consent (Articles 6(1)(a) and 7 GDPR), collected through an opt-in mechanism (double opt-in where applicable).
• Retention period: until the user unsubscribes, or after 3 years without interaction (CNIL recommendation).
• Unsubscribing: an unsubscribe link is included in every email sent.

4.3 Orders / E-commerce

• Data collected: identity, billing and delivery addresses, telephone number, email, order history and after-sales correspondence.
• Purpose: performing the sales contract, invoicing, delivery, after-sales service and compliance with legal and tax obligations.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR) and compliance with legal obligations (Article 6(1)(c) GDPR).
• Retention periods:
  • Customer data: 5 years after the last order (civil limitation period, Article 2224 of the French Civil Code).
  • Invoices and accounting records: 10 years (Article L123-22 of the French Commercial Code).
  • Banking data: not stored by LIGHTON, managed directly by the payment provider (Online payment provider); where tokenisation is used to facilitate subsequent purchases, a maximum retention period of 13 months (CNIL recommendation).

4.4 Customer account

• Data collected: identity, contact details (email, telephone, addresses), browsing and order history, preferences.
• Purpose: creating and managing the customer account, personalising the user experience.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Retention period: until the user requests account deletion, plus 1 year for retention of technical connection logs.

4.5 Technical security logs

• Data collected: IP address, connection date and time, pages viewed, user agent.
• Purpose: ensuring website security, preventing and detecting fraud or intrusions, and ensuring service availability.
• Legal basis: LIGHTON's legitimate interest in securing its information system (Article 6(1)(f) GDPR).
• Retention period: 1 year (CNIL recommendation).

5. Data transfers outside the European Union

Some third-party tools deployed on the website involve transfers of personal data outside the European Economic Area.

The following tools may generate such transfers:

• Google Analytics (Google LLC, United States)
• Google Ads (Google LLC, United States)
• Meta Pixel (Meta Platforms Inc., United States)

These transfers are governed by the standard contractual clauses adopted by the European Commission (Article 46 GDPR) and, where applicable, by applicable adequacy decisions (in particular the EU–US Data Privacy Framework for certified organisations).

6. Cookies and trackers (Article 82 of the French Data Protection Act)

The website uses cookies and trackers. In accordance with Article 82 of the French Data Protection Act and CNIL guidelines, trackers that are not strictly necessary for the website to function are only placed after obtaining the user's prior consent.

Users may at any time:

• accept or refuse trackers through the consent banner displayed on their first visit;
• change their choices or withdraw consent through the cookie management module accessible from the website;
• configure their browser to block or delete cookies already placed.

Refusing trackers has no effect on access to the website's essential content and services.

6.1 Strictly necessary technical cookies

These cookies are essential for the website to function (session management, shopping cart, security, load balancing, remembering consent choices). They are exempt from the consent requirement under Article 82 of the French Data Protection Act.

6.2 Google Analytics

Google Analytics (Google Ireland Limited)

• Purpose: audience measurement and website traffic analysis.
• Legal basis: user consent (Article 82 of the French Data Protection Act).
• Cookie retention period: a maximum of 13 months (CNIL recommendation).
• Transfer outside the EU: yes, to the United States (Google LLC). Safeguards: European Commission standard contractual clauses (Article 46 GDPR).
• Third-party policy: https://policies.google.com/privacy

Google Ads

• Publisher: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
• Purpose: targeted advertising, remarketing and advertising campaign performance measurement.
• Legal basis: user consent (Article 82 of the French Data Protection Act and Article 6(1)(a) GDPR).
• Retention period: a maximum of 13 months (CNIL recommendation).
• Transfer outside the EU: yes, to Google LLC (United States), governed by standard contractual clauses (Article 46 GDPR) and the Data Privacy Framework.
• Privacy policy: https://policies.google.com/privacy

Meta Pixel

Meta Pixel (Meta Platforms Ireland Limited)

• Purpose: measuring the performance of Meta advertising campaigns (Facebook, Instagram), advertising targeting and retargeting.
• Legal basis: user consent (Article 82 of the French Data Protection Act).
• Cookie retention period: a maximum of 13 months (CNIL recommendation).
• Transfer outside the EU: yes, to the United States (Meta Platforms Inc.). Safeguards: European Commission standard contractual clauses (Article 46 GDPR).
• Third-party policy: https://www.facebook.com/privacy/policy

7. Mandatory or optional data

Fields identified as mandatory in forms (in particular those marked with an asterisk) must be completed to process the request, fulfil an order or provide the service concerned. Otherwise, LIGHTON will be unable to act on the request.

Optional fields are left to the user's discretion and help personalise the response or service.

8. Automated decisions and profiling

LIGHTON does not implement any automated decision-making that produces legal effects or significantly affects the user within the meaning of Article 22 of the GDPR, unless otherwise stated in this policy.

9. Your rights

Under Articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights over your personal data:

• Right of access (Article 15 GDPR): obtaining confirmation that your data is being processed and receiving a copy.
• Right to rectification (Article 16 GDPR): having inaccurate data corrected or incomplete data completed.
• Right to erasure / right to be forgotten (Article 17 GDPR): requesting deletion of your data in the cases provided for by the GDPR.
• Right to restriction of processing (Article 18 GDPR): requesting the suspension of processing in certain circumstances.
• Right to data portability (Article 20 GDPR): receiving your data in a structured, commonly used and machine-readable format, or transferring it to another controller.
• Right to object (Article 21 GDPR): objecting at any time, on grounds relating to your particular situation, to processing based on legitimate interest, and without giving reasons to processing for direct marketing purposes.
• Right to withdraw consent (Article 7(3) GDPR): withdrawing your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to set instructions after death (Article 85 of the French Data Protection Act): arranging what happens to your data after your death.

How to exercise your rights: these rights may be exercised by email to pascal@lighton-solutions.com or by post to: LIGHTON, ZI ATHELIA AVENUE DES MATTES 13600 LA CIOTAT.

You will receive a response within one month of receipt of the request. This period may be extended by two months due to the complexity or number of requests (Article 12(3) GDPR). Exercising these rights is free of charge. Proof of identity may be requested where there is reasonable doubt about the applicant's identity.

10. Complaints to the CNIL

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the French Data Protection Authority (CNIL):

• Address: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
• Telephone: 01 53 73 22 22
• Online complaint form: https://www.cnil.fr/fr/plaintes
• Website: https://www.cnil.fr

11. Security (Article 32 GDPR)

LIGHTON implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR:

• encryption of communications using HTTPS/TLS;
• access control for information systems based on the principle of least privilege;
• password hashing using robust algorithms;
• regular data backups and restoration tests;
• access logging and monitoring of security events;
• staff awareness and training on data protection;
• rigorous processor selection and GDPR-compliant contractual arrangements.

12. Changes to this policy

This policy may change to reflect legal, regulatory, technical or organisational developments. Any change applies as soon as it is published on the website.

Last updated: 9 September 2026