Privacy policy

Who is responsible for your data?

R&Z SUPPLY, 128 rue La Boétie, 75008 Paris, France (“we”). Contact for any question or to exercise your rights: contact@hayakutcg.com.

What we collect, why, and how long we keep it

• Orders, delivery, after-sales (identity, contact details, addresses, order history) — performance of the contract — 3 years after your last order, then accounting archive.
• Invoicing and accounting — legal obligation — 10 years.
• Customer account (optional) — contract — until you delete it (“Delete my account” button) or after 3 years of inactivity.
• Fraud prevention and per-customer purchase limits on allocated products (IP address, email, account) — legitimate interest — 12 months.
• Site security (IP address, time of login attempts) — legitimate interest — 3 days (counters), 12 months (payment logs).
• Newsletter (email, first name, language) — consent, withdrawable at any time via the link in every email — until you unsubscribe.
• Business account requests — pre-contractual measures / legitimate interest — 3 years after last contact.

Recipients

Our team; Inflow (online payment — card data is entered on its page and never reaches us); La Poste / Colissimo and Mondial Relay (delivery; the pickup-point selector at checkout is loaded from Mondial Relay's servers); our host Hostinger International Ltd (servers in the EU); our email provider; WhatsApp (Meta) if you contact us that way; authorities upon legal request. We never sell your data. Any transfer outside the EU is covered by an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.

Your rights

Access, rectification, erasure (including deleting your account from “My account → My details”), restriction, objection, portability, withdrawal of consent and post-mortem instructions — write to contact@hayakutcg.com, we reply within one month. You may lodge a complaint with the CNIL (www.cnil.fr).

Cookies

One strictly necessary cookie only (“hayaku_session”: cart, language, account login and form protection; 30 days), exempt from consent. No advertising cookies, no third-party analytics; fonts are self-hosted.