Last updated: 16 August 2026
This policy explains how STEREOS.STORE processes your personal data when you browse the shop, create an account, place an order — including as a guest —, contact customer service, apply for a professional account, publish a contribution or manage your cookie choices.
1. Data controller
The data controller is STRL 54, a French single-member simplified joint-stock company with share capital of EUR 100, registered with the Nancy Trade and Companies Register under number 949 525 760, whose registered office is at 15 rue de Haigneville, 54290 Bayon, France.
- SIRET: 949 525 760 00011
- Intra-Community VAT number: FR20 949525760
- Website: https://stereos.store
- Data-protection contact: contact@stereos.store
- Telephone: +33 3 55 06 40 06
STRL 54 has not appointed a data protection officer (DPO). The contact above handles requests concerning personal data.
2. Data we process
Depending on how you use the shop, we may process:
- your first and last name, optional title, postal and email addresses and telephone number;
- account data: identifier, hashed password, preferences, login history and an optional date of birth where provided. No birthday campaign is currently configured;
- products, amounts, invoices, delivery information, returns, refunds, exchanges, warranties and communications relating to your orders;
- the transaction identifier, payment method and status and information needed to prevent fraud. Full payment-card details are processed by the payment provider and are not stored by STRL 54;
- for a professional account: company, contact name and email address, SIRET or other business identifier, VAT number where applicable, country, business activity and optional business website or page;
- customer-service requests, messages, product reviews, blog comments and communication subscriptions;
- technical data such as IP address, security logs, device, browser, pages viewed and browsing or conversion events;
- privacy choices: accepted or rejected categories, pseudonymous proof identifier, version, shop, language and date of the choice.
The number called, time and duration of a telephone call may appear in technical telephone records. Calls with STEREOS.STORE are not recorded.
Data is obtained mainly from you, from operation of the shop, payment and delivery providers, or technologies enabled by your consent choices.
You do not have to create an account to place an order. Fields marked as mandatory are required to create the account you choose, perform the order or assess a professional-account application. Without that information, the relevant operation cannot be processed. The telephone number is used only for the order, delivery or customer service; STEREOS.STORE does not send commercial text messages.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention period |
|---|---|---|
| Creating and managing an account | Contract or pre-contractual steps | Commercial relationship, then deletion after 2 years without user activity following prior notice; required evidence and invoices are archived separately |
| Cart and order | Pre-contractual steps and contract | Until the order; an abandoned cart is deleted no later than 30 days after the last activity |
| Payment, delivery, returns, warranties and after-sales support | Contract | Performance of the contract, then archiving only what is needed for the applicable statutory or limitation periods |
| Invoicing, accounting and tax duties | Legal obligation | 10 years from the end of the relevant financial year for accounting records |
| Professional-account application | Pre-contractual steps and legitimate interest in checking eligibility | Rejected or unanswered application: no more than 30 days; approved account: professional relationship, then the periods applying to the account, orders and invoices |
| General request unrelated to a contract | Legitimate interest in replying and following up | No more than 3 years after the person's last contact; documents that are no longer useful are deleted earlier |
| Security and fraud prevention | Legitimate interest and, where applicable, legal obligation | Technical and security logs: 6 rolling months by default; only information needed for an incident or dispute may be isolated for the justified period |
| Newsletter and electronic marketing | Consent, except for any statutory customer exception for similar products | Until withdrawal or objection; otherwise, customers: commercial relationship and no more than 3 years after it ends or the last active contact; prospects: no more than 3 years after collection or the last active contact; minimum objection data kept for at least 3 years |
| Approved product review | Author's voluntary action and legitimate interest in publishing and moderating | Up to 10 years while the product page remains accessible; displayed name anonymised or review deleted at the author's choice |
| Approved blog comment | Author's voluntary action and legitimate interest in publishing and moderating; consent for reply subscriptions | Up to 10 years while the article remains accessible; anonymisation or deletion at the author's choice; subscription until unsubscribe or account deletion |
| Audience measurement | Consent | According to the authorised service and the periods shown by the cookie manager or provider |
| Advertising measurement and conversion attribution | Consent | According to the authorised service and the periods shown by the cookie manager or provider |
| Managing and proving consent choices | Compliance with tracker rules and legitimate interest in proving choices | Choice: 180 days; pseudonymous proof: 395 days |
| Establishing, exercising or defending legal claims | Legitimate interest | Applicable limitation period and, for proceedings, until they are finally closed |
Data may be placed in intermediate archives when it must be retained to comply with a legal duty or defend legal rights, with access restricted to those purposes.
4. Recipients and external services
To the extent needed for their duties, data may be accessible:
- to authorised STRL 54 personnel and hosting provider LWS;
- to Stripe and PayPal for payment and fraud prevention, and to banks for an exceptionally agreed bank transfer;
- to La Poste/Colissimo, Delivengo and Mondial Relay, their local partners and customs authorities where required by the destination;
- to Google for Google Analytics 4 and Google Ads;
- to Microsoft for Microsoft Advertising UET, used to measure advertising and conversion events, including the
purchaseevent, only with marketing consent; - to Trustindex, Google reCAPTCHA and remote content or font providers where the relevant feature is used and authorised;
- to Brevo to deliver transactional emails required for accounts, orders and customer service, synchronise contact records, their subscription status and attributes, confirm subscriptions, and, with marketing consent, track viewed pages and abandoned-cart actions;
- to Klaviyo, used until 16 August 2026 for account-creation or account-update events, email-subscription events and order-status events. The integration is now disabled and no new browser component was observed during the post-removal check; historical profiles are to be erased after the technical observation period;
- to Meta/Facebook, used until 16 August 2026 through browser components subject to marketing consent. The corresponding module is now disabled and none of those components was observed during the post-removal check;
- to the public for the displayed name, rating, title and content of a product review, and the chosen name or pseudonym and text of a blog comment, after moderation;
- to advisers, insurers, auditors and legally authorised public bodies where necessary.
The shop's eBay connector synchronises products; it does not transmit PrestaShop orders or customer data.
Some providers act as STRL 54 processors, while others — particularly for payment, fraud prevention or a service operated under their own responsibility — act as separate controllers. Their own policies then apply to processing they determine. STRL 54 does not sell your personal data.
5. Transfers outside the European Economic Area
Some international providers may process data outside the European Economic Area. Where this occurs, the transfer must rely on an applicable adequacy decision, European Commission standard contractual clauses or another safeguard recognised by the GDPR, supplemented where necessary by additional measures.
A delivery outside the EEA also requires the data strictly needed for transport and customs formalities to be disclosed to the carrier, its local partners and authorities in the destination country.
You may ask for information about the destination and safeguard applying to a specific provider by emailing contact@stereos.store.
6. Cookies, audience measurement and advertising
The "Your privacy choices" manager lets you accept all, reject all or choose by purpose. Non-essential technologies remain blocked until the corresponding purpose has been accepted.
The manager governs technologies loaded in your browser. It does not govern transactional-email delivery or the server-side synchronisations expressly described in section 4.
- Strictly necessary: cart, authentication, security, PrestaShop operation and storage of your choices.
- Optional features: Google reCAPTCHA, remote fonts and review widgets such as Trustindex.
- Audience measurement: Google Analytics 4.
- Marketing: Google Ads, Microsoft Advertising UET and Brevo page-view or cart-action components actually loaded with this consent.
- External media: YouTube, Vimeo, Facebook or other platform content only where embedded on a page.
Google Tag Manager is shared infrastructure. With Consent Mode v2, it may load after acceptance of audience measurement or marketing, but each tag remains subject to its relevant signal: analytics_storage for Google Analytics and ad_storage for Google Ads and Microsoft Advertising UET. When all optional purposes are rejected, these tags are not loaded.
The shop pushes a minimised purchase event to the dataLayer, containing the transaction reference, amounts, currency and product information, but no name, email address, postal address or customer-account identifier. Authorised measurement tags may use the parameters configured for them to measure the purchase and prevent duplicate counting.
Your choice is stored for 180 days. You can change or withdraw it at any time using the permanent "Manage my cookies" button. Withdrawal does not affect the lawfulness of processing carried out beforehand.
7. Product reviews and blog
Product reviews and blog comments are moderated before publication. A blog comment can be submitted without an account using a freely chosen name or pseudonym. Reply subscriptions are optional and available only to registered users. An author may request anonymisation or deletion of their contribution.
8. Your rights
Depending on the processing and its legal basis, you have rights of access, rectification, erasure, restriction, objection, portability and withdrawal of consent, and the right to set instructions concerning your data after death under French law.
You may object at any time, without giving reasons and free of charge, to the use of your data for direct marketing, including related profiling. Where processing for another purpose relies on legitimate interests, you may object on grounds relating to your particular situation; we then stop the processing unless there are compelling legitimate grounds or it is needed to establish, exercise or defend legal claims. You may withdraw consent at any time without affecting processing carried out before withdrawal.
A logged-in customer can export their data as PDF or CSV and change some information from their account. For another correction, account erasure or any other request, use the contact form, email contact@stereos.store or write to STRL 54, 15 rue de Haigneville, 54290 Bayon, France.
Identity evidence is not requested systematically. Additional information is requested only where there is reasonable doubt and to the extent necessary. We normally respond within one month. This may be extended by two months for a complex or numerous request, in which case you will be informed within the first month.
You may lodge a complaint with the French data-protection authority, the CNIL.
9. Automated decisions
Professional-account applications are approved or rejected following human involvement.
Automated Stripe and PayPal payment or fraud checks may reject a payment and prevent the order from being confirmed; they do not cancel an order that has already been paid. They may take into account the transaction, payment method, contact information, billing and delivery addresses, IP address, device, approximate location and history of attempts.
If a payment is rejected, you can email contact@stereos.store to provide your comments, request human review and, where possible, another payment option. The Stripe and PayPal policies also describe their own processing.
10. Security and updates
STRL 54 implements technical and organisational measures intended to protect data, including HTTPS, access restrictions, updates, monitoring and backups. If a personal-data breach occurs, STRL 54 applies the applicable documentation and assessment duties and, where the legal conditions are met, notification to the CNIL and information to affected people.
This policy may be updated to reflect changes to the shop, its providers or legal requirements. The date of the current version appears at the top of the page.