Privacy policy

2The data we collect

We collect only what we need, and most of it comes straight from you: you give it to us when you place an order, create an account or write to us. Here is the complete list.

When you order

• Title, first and last name, email address, telephone number.
• Billing address and delivery address (including the company name if you are ordering for a business).
• The pickup point you selected, where applicable.
• Your order details: products, colours, finishes, quantities, amounts, delivery and payment method.
• Any delivery instructions you leave.

We never see your card number. Payment is handled end to end by our provider Mollie; if you choose to save a card, we keep only the encrypted reference Mollie gives us, the card brand, its last four digits and its expiry date - enough for you to recognise it in your account, and nothing more.

When you create an account

• Your name, your email address and your password, which is never stored in plain text but as an irreversible cryptographic hash.
• If you sign in with Google, the Google account identifier that service passes us, your name and your email address. We receive neither your Google password nor the contents of your Google account.
• Your saved addresses, favourite colours, wishlists, saved baskets and any notes you add.

When you open a trade account

• Your company details: registered name, address, contact details, registration numbers, line of business.
• The team members you invite: name and email address, supplied by you.
• Your referral codes, your commission and your invoices.

When you write to us or subscribe

• Contact form: name, email address, order number if you give one, the content of your message, the site language and your IP address at the time of sending.
• Newsletter: email address, first and last name if you provide them, language, the page you signed up from, your IP address and the date of signup.

In both cases the IP address is kept only as evidence of consent and to block automated submissions. It is used neither to track nor to profile you.

When you use the room visualiser

This service deserves its own section: see the room visualiser and your photos below.

When you scan a Mylands QR code

Our printed materials - colour cards, displays, trade shows - carry QR codes. A scan records the date, the IP address, the browser used, the page you came from and an approximate location derived from the IP address: country, region and city, never a precise position. This tells us which materials work and in which areas; we build no individual profile from it.

Automatically, as you browse

Like any website, ours technically logs the requests it receives - IP address, date, page requested, browser - in its security logs. Audience-measurement and advertising cookies, by contrast, fire only after you agree: the detail is in our cookie policy.

What we do not collect

We collect no special category data within the meaning of GDPR article 9 - racial or ethnic origin, political or religious beliefs, health, sexual orientation, biometric data. Please do not send us any in a free-text message. We take no automated decisions producing legal effects concerning you, and we do not buy marketing lists.

3Why we use it, and on what basis

The GDPR requires every use to rest on a specific legal basis. The table below sets out, for each purpose, the legal basis that permits it and how long we keep the data.

Where we rely on legitimate interest, we have balanced that interest against your rights, and you may object at any time: see your rights.

4The room visualiser and your photos

The visualiser lets you photograph a room in your home and try our colours on it. It is the most intrusive processing we carry out, and we would rather describe it precisely than bury it in a list.

What happens when you send a photo. The image is stored on our servers, then sent to an artificial-intelligence service that automatically detects walls and paintable surfaces - which is what saves you from masking them by hand. That processing is carried out by fal.ai and, as a fallback, Replicate, which host the SAM 2 image segmentation model. Both providers are established in the United States: your photo therefore leaves the European Union for the duration of that computation. See transfers outside the European Union.

What we keep. The original photo, a resized working copy, the selection masks computed from it, the points you clicked and the colours you applied. If you are signed in, all of that is attached to your account so you find it again under "My rooms"; if not, it stays attached to your session and you can retrieve it through the QR code or share link the visualiser offers you.

What you should know before sending. A photo of an interior says a great deal: it may show people, personal belongings, post, documents. Photograph only what you are willing to entrust to us, and avoid including other people who have not asked to be there. A share link you generate is accessible to anyone who has it: do not circulate it more widely than you intend.

What we do not do. Your photos are not used for advertising, not used to train our own models, and not used to identify anyone. They are neither sold nor disclosed to any third party other than the computation provider described above.

Deletion. You can delete a room at any time from "My rooms" if you have an account; otherwise write to us at privacy@mylands.fr with the share link concerned and we will delete it. Deletion requests are handled within one month.

5Who has access to your data

Your data is first accessible to our own teams, and only to those who need it: customer service for your orders and messages, the warehouse for dispatch, accounts for invoicing.

Beyond that we use the providers below. Each acts on our instructions, under a processing agreement compliant with GDPR article 28, and may use your data only for the service entrusted to it.

The audience-measurement and advertising providers - Google, Meta, Pinterest and Awin - receive nothing until you have accepted the corresponding trackers. If you refuse, or for as long as you have not answered, no data is sent to them, including from our own servers.

We may finally be required to disclose data to an administrative or judicial authority that lawfully requests it. We do so only to that extent, and never on our own initiative.

We do not sell your data, and we neither rent nor exchange it for third-party marketing.

6Transfers outside the European Union

Some of the providers listed above are established in the United States, or transfer data there: Google, Meta, Pinterest, fal.ai and Replicate. Using their services means data about you is transferred there.

Those transfers are framed by:

• for providers certified under the EU–US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023;
• for the others, the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical measures.

You can obtain a copy of the safeguards applying to a given transfer by writing to privacy@mylands.fr.

Two points of honesty. First, these safeguards do not make US law identical to European law: they frame it. Second, you keep control of what matters - refusing advertising and audience-measurement trackers removes the transfers to Google, Meta and Pinterest, and not using the visualiser removes those to fal.ai and Replicate. None of it is necessary in order to buy from the site.

7How long we keep it

The period applying to each purpose is in the table above. The principle is simple: we keep a piece of data for as long as it serves the purpose it was collected for, then for as long as the law requires us to keep it, and no longer.

Once those periods expire, data is deleted or irreversibly anonymised - anonymised data no longer identifying you, it may be kept for statistical purposes without a time limit.

Two useful clarifications:

• Deleting your account does not delete your invoices: the law requires us to keep them for ten years. They are then archived with restricted access and serve no purpose other than that obligation.
• An account left inactive for three years is flagged and then deleted. We email you before that happens.

8Your rights, and how to exercise them

The GDPR gives you the following rights over your data:

• Access - confirmation of whether we process data about you, and a copy of it.
• Rectification - correction of inaccurate data, or completion of incomplete data.
• Erasure - deletion of your data, subject to what we are legally required to keep.
• Restriction - freezing of a processing operation while we examine a challenge to it.
• Portability - receipt, in a machine-readable format, of the data you provided to us, and transmission of it to another organisation at your request.
• Objection - objection to processing based on our legitimate interest. For direct marketing this right is absolute: you need only ask, with no reason given.
• Withdrawal of consent - withdrawal at any time of an agreement you gave (newsletter, trackers), without calling into question what was done before.
• Post-mortem directives - instructions on what becomes of your data after your death, under article 85 of the French Data Protection Act.

The quickest route

Much of this needs no message to us: your account lets you change your details, addresses and preferences, and delete your saved rooms. Every newsletter carries an unsubscribe link that takes effect immediately. Your tracker choices can be changed at any time through "Manage cookies" at the foot of every page.

For everything else

Write to privacy@mylands.fr, or by post to 39 Rue des Tournesols, 31290 Villefranche-de-Lauragais, France. Say which right you want to exercise and the email address linked to your account or your orders - it saves us a round trip.

We respond within one month. If your request is complex that period may be extended by two months, and we will tell you, with reasons. Exercising your rights is free. We will ask for proof of identity only where we have a genuine doubt about who you are - never as a matter of routine.

If our answer does not satisfy you

You may lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL):

3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Telephone: +33 1 53 73 22 22
https://www.cnil.fr

You may also go directly to the courts. We would obviously rather you gave us a chance to put things right first.

9Cookies and trackers

Cookies strictly necessary for the site to work - your basket, your session, your language - are set without your agreement, as the law permits, because the site cannot function without them.

Everything else - audience measurement and advertising - is set only after your explicit agreement. Refusing is as easy as accepting, and you can change your mind at any time through the "Manage cookies" link at the foot of every page. Your choice, including a refusal, is kept for 6 months before you are asked again.

The detail - each tracker's name, who sets it, its purpose and its lifetime - is in our cookie policy.

10How we protect it

We apply the technical and organisational measures expected of an online shop of this size:

• end-to-end encryption of traffic between your browser and the site (HTTPS/TLS);
• passwords stored as an irreversible cryptographic hash, never in plain text;
• no full card data on our servers - payment is isolated at our provider;
• access to data limited to those who need it, through named accounts;
• regular backups and security updates kept current.

No system is infallible, and we would rather say so. In the event of a data breach likely to result in a high risk to your rights, we notify the CNIL within 72 hours and inform you directly, promptly and in plain terms.

11Minors

This site is aimed at adults. We do not knowingly collect data concerning children under 15 - the age below which, in France, a holder of parental responsibility must consent on a child's behalf for online services.

If you hold parental responsibility and find that a child has given us their data, write to us at privacy@mylands.fr and we will delete it.

12Changes to this policy

This policy will change: new features, a change of provider, a change in the law. The date it was last updated is at the top of this page.

Where a change genuinely alters what we do with your data - a new purpose, a new recipient - we will tell you visibly, and we will ask for your agreement again where consent is the basis for the processing concerned. A change of wording alone will simply update the date.

13Contacting us

For any question about your personal data:

By email: privacy@mylands.fr
By post: Peinture Shop - 39 Rue des Tournesols, 31290 Villefranche-de-Lauragais, France
For anything not related to your data: our contact form