Privacy policy

Last updated June 1, 2026

TWINSSHELLS respects your concerns regarding the protection of your privacy and your personal data.

This policy describes how TWINSSHELLS uses the information concerning you that is collected when you use the online store www.duallis.com published by TWINSSHELLS (hereinafter the "Site").

1. Who is the controller of your data?

For any question relating to data processing or to the exercise of your rights, you can contact us by email at: contact@duallis.com.

2. What personal data is collected?

We collect information that you provide to us directly when you use our Site.

This is the case in particular when you make an online purchase on the Site, where the following information is collected:

• Identification data: title, last name, first name, delivery and billing postal address, email address, telephone number;
• Order data: order number, products purchased, amount, terms and history of your purchases, any returns or complaints;
• Data relating to the commercial relationship and to marketing: communication preferences, history of marketing messages received, any associated loyalty or promotional operations;
• Connection and browsing data strictly necessary for the operation and security of the site (technical logs, account identifier), as well as data collected via cookies subject to consent where you have previously given such consent (see our Cookie Policy).

Payment card data is collected by our certified payment provider, solely for the purposes of carrying out the transaction, and is not retained by TWINSSHELLS beyond the period strictly necessary for the payment operation, in accordance with the requirements limiting the retention of payment data.

3. What is the collected data used for?

In the context of the online sale of products, we process only those categories of data that are strictly necessary for the purposes described below, in accordance with the principles of data minimization and proportionality.

Your data is processed for the purposes of:

• Processing and tracking your orders: order management, payment, invoicing, delivery, handling of complaints and after-sales service, bookkeeping and prevention of any fraud connected with the order;
• Marketing relating to our products: sending you, by electronic or postal means, commercial offers relating to products similar to those already purchased or connected with your previous purchases, carrying out loyalty, promotional or simple segmentation operations in order to adapt our communications to your profile (without any automated decision-making producing legal effects concerning you);
• Commercial statistics for the purpose of steering the performance and activity of TWINSSHELLS.

You may at any time object to marketing communications or withdraw your consent, as applicable, by using the unsubscribe links included in our emails or by contacting us in accordance with the terms set out in section 6 below.

4. Who is the data intended for?

In strict compliance with the purposes set out above, your data may be disclosed:

• to the internal departments of TWINSSHELLS authorized to access it for the needs of their duties (sales department, customer service, invoicing/accounting, IT and security departments);
• to our transport and logistics partners;
• to our contractually bound processors, for the exclusive needs of the services they perform on our behalf (hosting, payment providers, delivery providers, marketing providers, customer support, etc.);
• where applicable, to administrative or judicial authorities, solely where required by law or ordered by a court decision.

We do not sell or rent your personal data to third parties for their own marketing purposes.

In principle, your data is hosted and processed within the European Union. If some of our providers are located in countries that do not offer an adequate level of protection within the meaning of the GDPR, we frame such transfers with appropriate legal mechanisms (in particular the standard contractual clauses adopted by the European Commission), in order to guarantee a level of protection essentially equivalent to that guaranteed within the EU, in accordance with the requirements set out by the CNIL (the French data protection authority) regarding international transfers.

Information about these transfers and the associated safeguards can be obtained by contacting us using the details given in section 1 above.

5. What are your options and your rights over this data?

In accordance with the applicable personal data protection regulations, and in particular Regulation (EU) 2016/679 and French Act No. 78-17 of January 6, 1978 as amended, you have the following rights over your data:

• Right of access: to obtain confirmation that data concerning you is being processed and to receive a copy of it, together with information about the processing (purposes, categories of data, recipients, retention periods, etc.).
• Right to rectification: to request the correction or updating of your data where it is inaccurate or incomplete.
• Right to erasure ("right to be forgotten"): to obtain the erasure of your data where one of the grounds provided for in Article 17 of the GDPR applies, in particular where the data is no longer necessary in relation to the purposes for which it was collected or where you withdraw your consent when this constituted the sole legal basis for the processing, subject to the legal retention obligations which may require us to keep certain data in intermediate archiving.
• Right to restriction: to obtain the temporary suspension of processing in certain cases provided for by the GDPR.
• Right to object:
  • at any time, to marketing communications, including to profiling where it is related to such marketing;
  • on grounds relating to your particular situation, to processing based on our legitimate interest.
• Right to data portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, where the processing is based on your consent or on a contract and is carried out by automated means.

You also have the right to set out directives concerning what happens to your personal data after your death.

You may exercise these rights by contacting us in accordance with the terms described in section 6 below. In the event of reasonable doubt as to your identity, proof of identity may be requested from you, which will be retained only for as long as necessary to process your request.

Finally, you have the right to lodge a complaint with the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL) if you consider that the processing of your data does not comply with the applicable rules.

6. How can you exercise your rights?

To exercise your rights or for any question relating to this privacy policy or to your personal data, you can:

• Write to us by post: 40, rue Martin Brignaudy – Marseille (13007), France;
• Contact us by email: contact@duallis.com.

Your request will be handled as soon as possible and, in any event, within one (1) month of its receipt, extendable by two (2) months given the complexity or the number of requests, under the conditions provided for by the applicable rules.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL (www.cnil.fr).

7. How long is your data kept?

In accordance with the storage limitation principle, your personal data is kept for periods not exceeding those necessary in relation to the purposes pursued:

• Account and order data (identity, contact details, order data): this data is kept in the active database for the duration of the contractual relationship, then for up to two (2) years after the user's last order, in order to manage the commercial relationship and any complaints or marketing follow-ups appropriate to the length of the relationship.
• Marketing: data used for marketing purposes is kept for the duration of the commercial relationship, then for a maximum of two (2) years from the last order, from your last positive action (for example, clicking a link in a marketing message) or from your last significant interaction, within the limit of the period we have set at two (2) years after the last order. Beyond that, the data is deleted or irreversibly anonymized and no longer allows you to be re-identified.
• Data necessary to comply with legal obligations: irrespective of the retention period in the active database, certain data (in particular accounting documents and invoices) may be kept in intermediate archiving for a period corresponding to the legal retention obligations (in particular accounting and tax obligations) and/or the applicable limitation periods, on a separate database to which access is restricted to the departments with a strictly justified need.

The exact retention periods and criteria are detailed in our internal records of processing activities.

8. How do we protect your data?

We implement appropriate technical and organizational measures in order to guarantee a level of security appropriate to the risks:

• securing access to systems and data;
• encryption or hashing of passwords;
• restricting access to authorized persons only, on the basis of their duties (access rights management, access traceability);
• backup and restoration procedures;
• a security incident management policy and, where applicable, notification to the CNIL and to the data subjects where required by law.

Our processors are also contractually required to ensure a level of security that complies with legal and regulatory requirements.

It should nevertheless be noted that, despite all the reasonable precautions taken by TWINSSHELLS to ensure that user data is secure and that users are protected, a risk always remains. The internet as a whole can at times be insecure, and we are therefore unable to guarantee the security of user data beyond what is reasonably practicable.

9. How does this privacy policy change?

This privacy policy may change, in particular in order to take account of legislative and regulatory amendments, of CNIL recommendations, or of any change in the organization or the processing activities of TWINSSHELLS.

In the event of a substantial change, you will be informed by any appropriate means (information banner, email, etc.) and the new version will apply from its date of publication on the Site.