Privacy policy - Kinthia

Last updated: July 11, 2026

This privacy policy is intended to help you understand how Kinthia collects, processes and stores your personal data through the Site.

Kinthia understands that data protection and privacy are a concern for all users visiting the Site.

Kinthia is committed, in accordance with the GDPR, to respecting your privacy and protecting your personal data, meaning any data that can identify you directly or indirectly as a person.

The purpose of this privacy policy is to set out Kinthia’s commitments in this area.

Definition

When you use our Site, we may ask you to provide personal data about yourself.

The term “personal data” means any data that can identify an individual, including in particular your last name, first names, username, photograph, postal and email address, job title, phone numbers, date of birth, data about your transactions on the Site, details of your purchases, bank card numbers, SIRET number, intra-community VAT number, IP address, and any other information you choose to provide about yourself.

Purpose

The purpose of this charter (hereinafter the “Charter”) is to inform you about the means we use to collect your personal data, in strict compliance with your rights.

In this regard, we inform you that, in collecting and managing your personal data, we comply with French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties, in its current version (hereinafter the “Informatique et Libertés Law”), and with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).

Identity of the data controller

The controller responsible for collecting your personal data is Arfooo, a SASU with share capital of 500 euros, registered with the Pontoise Trade and Companies Register under number 992 041 764, whose registered office is at 40 rue du Val de Glatigny, 95280 Jouy-le-Moutier, France (hereinafter “We”).

Collection of personal data

The legal basis for our collection of your personal data is as follows:
• this collection is necessary to perform the contract concluded when you use our services on our Site,
• legitimate interest, when you voluntarily provide personal data during your visit to our Site, the data then being collected so that we can better respond to your requests for information about our services.

Your personal data is collected for one or more of the following purposes:
• Managing your access to and use of certain services available on the Site,
• Carrying out operations related to Customer management regarding contracts, invoices and the follow-up of the Customer relationship,
• Building a file of users, customers and prospects,
• Sending newsletters, solicitations and promotional messages. If you do not wish to receive them, we give you the option to refuse when your data is collected,
• Producing commercial and traffic statistics for our services,
• Organizing contests, lotteries and any promotional operations, excluding online gambling subject to approval by the French online gaming authority,
• Managing people’s reviews of products, services or content,
• Managing unpaid amounts and any disputes regarding the use of our products and services,
• Personalizing the answers to your requests for information,
• Complying with our legal and regulatory obligations. When collecting your personal data, we tell you whether certain data is mandatory or optional (by asterisks visible on the Site).

Why do we collect your personal data?	What categories of personal data do we collect for this purpose?	What legal basis allows us to collect your personal data for this purpose?
We collect your personal data to identify you when you use our site and to send you messages related to the proper administration of our site (e.g. registration confirmation, changes to the site or to the terms of use, etc.)	Données d’identification Données de connexion	The legal basis for this processing is the performance of the contract binding us when you accept our general terms upon creating your account
We collect your personal data to deliver your order/service.	Données d’identification	The legal basis for this processing is the performance of the contract binding us when you accept our general terms upon creating your account
We collect your personal data to improve and optimize our site, for example by studying your behavior during your visit and drawing conclusions to make changes to usability and the user experience.	Données d’utilisation et consommation Données de connexion	The legal basis for this processing is our legitimate interest in providing and improving the user experience of our site’s visitors and members.
We collect your personal data to understand your preferences and offer you commercial offers for services/products similar to those already ordered.	Données d’utilisation et consommation Données d’identification	The legal basis for this processing is our legitimate interest in providing and improving the user experience of our site’s visitors and members.

When collecting your personal data, we tell you whether certain data is mandatory or optional.

Recipients of personal data

The following will have access to your personal data:
• Our company’s staff,
• The departments responsible for control (in particular lawyers and accountants),
• Our subcontractors (communication providers, productivity software providers, data hosting provider, payment service providers, invoicing provider, analytics and audience measurement providers, customer relationship management providers),
• Public bodies may also receive your personal data, solely to meet our legal obligations, as well as court officers, ministerial officers and debt collection bodies.

Retention period of personal data

Regarding data related to customer and prospect management:

Your personal data will not be kept beyond the time strictly necessary to manage our commercial relationship with you.

However, data used to establish proof of a right or a contract, which must be kept to comply with a legal obligation, will be kept for the period provided by the law in force.

For any prospecting operations aimed at customers, their data may be kept for three (3) years from the end of the commercial relationship.

Personal data relating to a prospect who is not a customer may be kept for three (3) years from its collection or from the last contact from the prospect.

At the end of this three (3) year period, we may contact you again to find out whether you wish to continue receiving commercial solicitations.

If the right of access or rectification is exercised, data relating to identity documents may be kept for the period provided by Article 9 of the French Code of Criminal Procedure, i.e. one (1) year. If the right to object is exercised, this data may be archived for the limitation period provided by Article 8 of the French Code of Criminal Procedure, i.e. three (3) years.

Financial transactions relating to the payment of purchases and fees through the Site are entrusted to a payment service provider, which ensures that they run smoothly and securely.

For the purposes of the services, this payment service provider may receive your personal data relating to your bank card numbers, which it collects and keeps in our name and on our behalf. We do not have access to this data.

So that you can regularly make purchases or pay the related fees on the Site, your bank card data is kept for as long as you are registered on the Site and, at the very least, until your last transaction.

Data relating to the card security code (CVV2) shown on your bank card is not stored.

If you refuse to have your personal data relating to your bank card numbers kept under the conditions specified above, we will not keep this data beyond the time needed to complete the transaction.

In any event, data relating to them may be kept as evidence in the event of any dispute over the transaction, in intermediate archives, for the period provided by Article L 133-24 of the French Monetary and Financial Code, namely thirteen (13) months from the debit date. This period may be extended to fifteen (15) months to account for the possible use of deferred debit cards.

Regarding the management of opt-out lists for prospecting:

The information used to take your right to object into account is kept for at least three (3) years from the exercise of that right.

Regarding audience measurement statistics:

Information stored on users’ devices, or any other element used to identify users and allowing them to be traced or their visits to be measured, will not be kept beyond thirteen (13) months.

Cookies and tracking technologies

Types of cookies used:
• Functional cookies needed for the site to work
• Analytics cookies to measure the audience (Google Analytics)
• Advertising cookies for ad personalization (Google Ads, Meta Ads, Pinterest Ads)

Cookie retention periods:
• Functional cookies: session
• Analytics cookies: 13 months maximum
• Advertising cookies: 13 months maximum

Consent management:
A cookie manager is available on our site to manage your preferences. For users in the EU, the United Kingdom and Switzerland, we use a Consent Management Platform (CMP).

Cookie	Duration	Description
wcml_client_currency	2 days	Description is currently not available.
wcml_client_currency_language	2 days	Description is currently not available.
commercekit-nonce-value	2 hours	Description is currently not available.
commercekit-nonce-state	2 hours	Description is currently not available.
o2s-chl	1 day	o2Switch sets this cookie to block the automated access by the host.
wt_consent	1 year	Used for remembering users’ consent preferences to be respected on subsequent site visits. It does not collect or store personal information about visitors to the site.
wp-wpml_current_language	session	The WordPress multilingual plugin sets this cookie to store the current language settings.

Cookie	Duration	Description
_ga_*	1 year 1 month 4 days	Google Analytics sets this cookie to store and count page views.
_ga	1 year 1 month 4 days	Google Analytics uses this cookie to calculate visitor, session and campaign data and to track site usage for the site’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
sbjs_migrations	session	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.
sbjs_current_add	session	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.
sbjs_first_add	session	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.
sbjs_current	session	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.
sbjs_first	session	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.
sbjs_udata	session	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.
sbjs_session	1 hour	Sourcebuster sets this cookie to identify the source of a visit and stores user action information in cookies. This analytical and behavioral cookie is used to enhance the visitor experience on the website.

Cookie	Duration	Description
_uetsid	1 day	Bing Ads sets this cookie to engage with a user who has previously visited the website.
_uetvid	1 year 24 days	Bing Ads sets this cookie to engage with a user who has previously visited the website.

Manage cookie preferences

You can change your cookie preferences at any time by clicking the Consent preferences button.

This will take you back to the cookie consent banner so you can change your preferences or withdraw your consent immediately. In addition, different browsers offer different ways to block and delete the cookies used by websites. You can change your browser settings to block or delete cookies. Below are links to the support documents explaining how to manage and delete cookies in the main web browsers.

Chrome: https://support.google.com/accounts/answer/32050
Safari: https://support.apple.com/en-in/guide/safari/sfri11471/mac
Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectslug=delete-cookies-remove-info-websites-stored&redirectlocale=en-US
Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

If you use another web browser, please see your browser’s official support documents.

Use of Google Ads, Meta, Pinterest, advertising cookies and analytics cookies

Google, Meta and Pinterest services used

We use Google Ads, Google Analytics and other Google services, as well as Meta and Pinterest, to promote our products and services. These services may collect and process personal data in accordance with their own privacy policies.

Consent for personalized advertising:
• For users in the EU/EEA, the United Kingdom and Switzerland: we ask for your explicit consent for the use of advertising cookies and ad personalization
• This consent covers the use of your personal data for remarketing and targeted advertising purposes
• You can withdraw your consent at any time through our cookie manager

Legal basis for advertising processing:
• EU/EEA and United Kingdom: consent (Article 6(1)(a) of the GDPR)
• United States: legitimate interest, subject to your opt-out rights under applicable laws (CCPA, etc.)

Advertising and analytics cookies

• Google Ads cookies: enable personalized ads to be shown
• Meta Ads cookies: enable personalized ads to be shown
• Pinterest Ads cookies: enable personalized ads to be shown
• Remarketing cookies: show you ads based on your previous visits
• Analytics cookies: Google Analytics collects data on your use of the site

Purposes of processing

• Showing targeted ads
• Measuring advertising performance
• Improving our marketing campaigns
• Analyzing visitor behavior

You can manage your advertising preferences:

• Google: https://adssettings.google.com
• Meta: https://www.facebook.com/settings
• Pinterest: https://policy.pinterest.com/privacy-policy

In accordance with the GDPR and Google’s consent policies, we obtain your consent before:
• Placing cookies that are not strictly necessary
• Processing data for advertising purposes
• Sharing data with advertising partners

You can withdraw your consent at any time through our cookie banner or by contacting us.

Managing your preferences

You can:
• Accept or refuse advertising cookies
• Change your preferences at any time
• Turn off ad personalization in your Google settings

Rights of California residents (CCPA/CPRA)

If you are a California resident, you have the following rights:
• Right to know: know what personal information is collected
• Right to delete: request the deletion of your data
• Right to non-discrimination: not be discriminated against for exercising your rights
• Right to opt out: refuse the “sale” of your personal information

“Sale” of personal information

We do not sell your personal information in the traditional sense. However, some data transfers to our advertising partners may constitute a “sale” as defined by the CCPA.

How to exercise your rights

Email us at [email protected]
or write to:
Arfooo
40 rue du Val de Glatigny
95280 Jouy-le-Moutier
France

Security

We inform you that we take all useful precautions and appropriate organizational and technical measures to preserve the security, integrity and confidentiality of your personal data, and in particular to prevent it from being distorted or damaged or accessed by unauthorized third parties. We also use secure payment systems that comply with the state of the art and applicable regulations.

Hosting

We inform you that your data is kept and stored, for its entire retention period, on the servers of the company o2switch, located in the European Union.

Transfers outside the European Union

Your data may be transferred outside the European Union as part of the tools we use and our relationships with our subcontractors.

This transfer is secured by the following means:
• Either the data is transferred to a country that the European Commission has found to offer an adequate level of protection,

• Or we have concluded a specific contract with our subcontractors governing transfers of your data outside the European Union, based on the standard contractual clauses between a controller and a processor approved by the European Commission.

Access, rectification, restriction and erasure of your personal data

In accordance with European personal data protection regulations, you have the following rights:

• A right of access, allowing you at any time to know whether or not your personal data is being processed by our services and, if so, to access that personal data and the information required by law concerning how it is processed,

• A right of rectification, allowing you to request that any inaccuracy in your personal data be corrected as soon as possible,

• A right to erasure, allowing you to request that your personal data be erased as soon as possible, provided that the request meets the conditions required by applicable law,

• A right to restrict the processing of your personal data, provided that the request meets the conditions required by applicable law,

• A right to data portability, allowing you to receive your personal data in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller, provided that the request meets the conditions required by applicable law,

• A right to object to the processing of your personal data on grounds relating to your particular situation, provided that the objection meets the conditions required by applicable law,

• The right to withdraw at any time the specific consent given to the collection of your personal data, in particular when it is processed for commercial prospecting purposes,

• The right to set guidelines for the retention, erasure and disclosure of your personal data after your death.

You have the right to obtain the restriction of the processing of your personal data in the cases defined in Article 18 of the GDPR:

• During the verification we carry out, when you contest the accuracy of your personal data,

• When the processing of this data is unlawful and you wish to restrict it rather than delete your data,
• When we no longer need your personal data but you wish it to be kept so that you can exercise your rights,
• During the period of verification of legitimate grounds, when you have objected to the processing of your personal data.

People whose data is collected on the basis of our legitimate interest are reminded that they may object at any time to the processing of data concerning them. We may, however, continue processing if there are legitimate grounds for it that override your rights and freedoms, or if the processing is necessary to establish, exercise or defend our legal rights.

You can unsubscribe from our promotional emails using the link provided in them. Even if you choose to stop receiving promotional messages from us, you will continue to receive our administrative messages.

Portability of your personal data

You have a right to the portability of the personal data you have provided to us, meaning the data you actively and knowingly declared when accessing and using the services, as well as the data generated by your activity when using the services.

We remind you that this right does not cover data collected and processed on a legal basis other than consent or the performance of the contract between us.

This right can be exercised free of charge, at any time, and in particular when closing your account on the Site, in order to retrieve and keep your personal data.

In this context, we will send you your personal data, by any means deemed appropriate, in a standard, open, commonly used and machine-readable format, in line with the state of the art.

Filing a complaint with a supervisory authority

You are also informed that you have the right to file a complaint with a competent supervisory authority (the Commission nationale de l’informatique et des libertés, or CNIL, for France) in the Member State of your habitual residence, your place of work or the place where the alleged violation of your rights took place, if you consider that the processing of your personal data covered by this charter violates the applicable texts.

This remedy may be exercised without prejudice to any other administrative or judicial remedy. You also have the right to an effective administrative or judicial remedy if you consider that the processing of your personal data covered by this charter violates the applicable texts.

Changes

We reserve the right, at our sole discretion, to change this Charter in whole or in part at any time.

These changes will take effect upon publication of the new charter.