Privacy policy

1. Data controller

Hookah International Inc., a company governed by US law (corporation) registered in the State of [STATE OF REGISTRATION], 141 East 33rd Street, New York, NY 10016, United States, registration no. [REGISTRATION NUMBER] (“we”), processes your personal data as data controller, in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of January 6, 1978 (the “Informatique et Libertés” Data Protection Act).

For any question about your data or to exercise your rights: support@maxpouches.fr, or by mail at the address above.

2. Data we process

Identity and contact: last name, first name, email address, shipping and billing address, phone number if you give it.
Order and subscription: products, contents of the cans, amounts, dates, order and subscription number, shipment history, self-declared confirmation that you are 18 or over.
Payment: payment method used, payment status. Card numbers are processed directly by Shopify Payments; we do not have access to them.
Customer relations: your messages, withdrawal, cancellation or guarantee requests, complaints.
Reviews: display name, rating, text, photos if any, date, order concerned.
Adverse effects: if you report an adverse effect to us, the information you give us about your health.
Browsing: technical data (IP address, device, browser, pages viewed) and, with your consent, data from the trackers described in our cookie policy.
Newsletter: email address and date of your consent.

3. Why and on what basis

Managing your orders, deliveries, payments and your subscription (charges, management and cancellation): performance of the contract.
Checking that you declare you are 18 or over: performance of the contract and legitimate interest in reserving the sale for adults.
Handling your withdrawal, cancellation and guarantee requests and your complaints: legal obligation and performance of the contract.
Keeping the accounts and retaining invoices: legal obligation.
Collecting, checking and publishing reviews: legitimate interest in informing other customers, in compliance with Articles L111-7-2 and D111-9 et seq. of the French Consumer Code.
Recording and, where applicable, reporting an adverse effect (nutrivigilance): legal obligation and reasons of public interest in the area of public health (Article 9.2.i of the GDPR).
Sending you our newsletter and our offers by email: your consent, which you can withdraw at any time using the unsubscribe link in every email.
Preventing fraud and securing the site: legitimate interest.
Measuring audience, improving the site and measuring our ads (Google, Meta, TikTok, Microsoft Clarity): your consent, collected through the cookie banner.

4. Retention periods

Order and customer account data: for the duration of the business relationship, then 5 years from the last order to assert or defend our rights (ordinary limitation period).
Subscription: for the entire duration of the subscription, then 5 years after it ends.
Invoices and accounting records: 10 years (Article L123-22 of the French Commercial Code).
Withdrawal, cancellation and guarantee requests, with their acknowledgments of receipt: 5 years.
Newsletter: until you unsubscribe, or 3 years after your last contact with us (click, order, message).
Reviews: for the publication period stated on the How we verify reviews page.
Adverse effect reports: for the time needed for follow-up and for nutrivigilance obligations.
Trackers: see our cookie policy. Your choice in the banner is kept for 12 months.

5. Recipients

Your data is accessible to our team, within the limits of what is necessary, and to our service providers, who process it on our behalf and according to our instructions (processors), unless stated otherwise:

Shopify (Shopify International Limited, Ireland): hosting of the store, orders, payment through Shopify Payments, emails (Shopify Email and notifications), subscriptions (Shopify Subscriptions) and forms. Data transferred to Canada (adequacy decision of the European Commission) and the United States (EU–US Data Privacy Framework or standard contractual clauses). For certain processing, in particular fraud prevention, Shopify acts as a separate data controller: Shopify's policy.
Logistics providers: preparation and shipping of orders.
Carriers: delivery of parcels.
Microsoft Clarity (Microsoft Ireland Operations Limited and Microsoft Corporation, United States), with your consent: browsing measurement and session recording, input fields masked. Transfer to the United States governed by the EU–US Data Privacy Framework.
Google (Google Ireland Limited and Google LLC, United States), with your consent: audience measurement and advertising. Transfer to the United States governed by the EU–US Data Privacy Framework.
TikTok (TikTok Technology Limited, Ireland), with your consent: advertising measurement and targeting. Transfers outside the European Union governed by standard contractual clauses.
Meta (Meta Platforms Ireland Limited, Ireland), with your consent: advertising measurement and targeting on Facebook and Instagram. For the collection and transmission of data by the Meta pixel, Meta and we are joint controllers; Meta is solely responsible for the processing it then carries out. Transfer to the United States governed by the EU–US Data Privacy Framework. Meta's policy: facebook.com/privacy/policy.

Your data may also be disclosed to the competent authorities when the law requires it (for example, a nutrivigilance report to ANSES), to our accountant and, in the event of a dispute, to our lawyer or to the consumer mediator.

We do not sell your data.

6. Transfers outside the European Union

When your data is transferred outside the European Economic Area, the transfer is governed by an adequacy decision of the European Commission (Canada, United Kingdom, or a company certified under the EU–US Data Privacy Framework) or by the European Commission's standard contractual clauses. You can obtain a copy of these safeguards by writing to us at support@maxpouches.fr.

7. Your rights

You have the following rights over your data:

right of access, rectification and erasure;
right to restriction of processing;
right to object, in particular to direct marketing, at any time and without giving a reason;
right to portability of the data you have provided to us;
right to withdraw your consent at any time, without affecting processing already carried out;
right to set instructions on what happens to your data after your death.

To exercise them, write to support@maxpouches.fr or to Hookah International Inc., 141 East 33rd Street, New York, NY 10016, United States. We reply within one month, which may be extended by two months if the request is complex. We may ask you to prove your identity in case of reasonable doubt.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.

If you give us your phone number, you can register free of charge on the Bloctel telemarketing opt-out list: bloctel.gouv.fr.

8. Cookies and trackers

Trackers that require consent are placed only after you agree in the banner. You can change your choice at any time: Manage my cookies. Details in our cookie policy.

9. Minors

Our products and our site are reserved for adults 18 and over. We do not knowingly collect data from minors. If you think a minor has sent us data, write to us: we will delete it.

10. Security

We implement appropriate technical and organizational measures to protect your data: access limited to authorized persons, encrypted connections (HTTPS), service providers contractually bound on security and confidentiality.