PRIVACY AND DATA PROTECTION POLICY

PRIVACY AND DATA PROTECTION POLICY

Last updated: 26 June 2026

───────────────────────────────────────
DATA CONTROLLER
───────────────────────────────────────

9MM Europe — SAS
128 rue La Boétie, 75008 Paris
RCS Paris: 993 313 758
Contact: contact@9mm-energy.com

───────────────────────────────────────
ARTICLE 1 — DATA COLLECTED
───────────────────────────────────────

When you browse the website and make purchases, we collect:

Identification data:
Surname, first name, email address, postal delivery and billing addresses, 
telephone number (optional).

Order data:
Products ordered, amounts, purchase history and order numbers.

Browsing data:
IP address, browser type, pages visited, visit duration, 
traffic source.

Payment data:
Processed directly and exclusively by Shopify Payments. 
9MM Europe has no access to complete banking details.

───────────────────────────────────────
ARTICLE 2 — PURPOSES OF PROCESSING
───────────────────────────────────────

Your data is used for:

- Processing and tracking orders
- Managing your customer account
- Sending order confirmations and dispatch notifications
- After-sales service and returns management
- Improving the website and user experience (analytics)
- Sending commercial communications (only with your consent)
- Complying with our accounting and legal obligations
- Preventing fraud

───────────────────────────────────────
ARTICLE 3 — LEGAL BASIS FOR PROCESSING
───────────────────────────────────────

- Performance of the contract: processing and delivering orders
- Legal obligation: invoicing and retention of accounting records (10 years)
- Legitimate interest: preventing fraud and improving the service
- Consent: newsletters and marketing communications

───────────────────────────────────────
ARTICLE 4 — RETENTION PERIODS
───────────────────────────────────────

- Order and invoicing data: 10 years (legal obligation)
- Customer account data: duration of the relationship + 3 years after inactivity
- Browsing data and analytics cookies: a maximum of 13 months
- Marketing data: until consent is withdrawn

───────────────────────────────────────
ARTICLE 5 — DATA RECIPIENTS
───────────────────────────────────────

Your data may be shared with:

- Shopify Inc. (hosting and secure payment)
- Partner carriers (to deliver your orders)
- Analytics tools (Google Analytics — anonymised data)

9MM Europe never sells, rents or transfers your personal data 
to third parties for commercial purposes.

───────────────────────────────────────
ARTICLE 6 — YOUR RIGHTS (GDPR)
───────────────────────────────────────

Under EU Regulation 2016/679 (GDPR), you have the following 
rights in relation to your personal data:

✓ Right of access: obtain a copy of your data
✓ Right to rectification: correct inaccurate data
✓ Right to erasure: request deletion of your data
✓ Right to data portability: receive your data in a readable format
✓ Right to object: object to processing
✓ Right to restriction: restrict processing
✓ Right to withdraw consent: at any time for marketing

To exercise these rights, contact us at: contact@9mm-energy.com
We will respond within a maximum of 30 days.

You may also lodge a complaint with the CNIL:
Commission Nationale de l'Informatique et des Libertés
www.cnil.fr — 3 Place de Fontenoy, 75007 Paris

───────────────────────────────────────
ARTICLE 7 — SECURITY
───────────────────────────────────────

9MM Europe implements all appropriate technical and organisational 
measures to protect your data against unauthorised access, 
loss, destruction or alteration:

- SSL/TLS encryption of all communications
- Restricted access to personal data (authorised personnel only)
- Secure Shopify infrastructure (PCI DSS Level 1 certified)

───────────────────────────────────────
ARTICLE 8 — TRANSFERS OUTSIDE THE EU
───────────────────────────────────────

Shopify Inc. is a Canadian company. Canada benefits from an 
adequacy decision of the European Commission (Art. 45 GDPR), 
guaranteeing a level of protection equivalent to that of the EU.

Some data may be processed in the United States under 
appropriate contractual safeguards (standard contractual clauses).