This policy explains how personal data is used on fournisseur-musc-tahara.com, the FMT Fragrances — Fournisseur Musc Tahara shop. It covers browsing, customer accounts, orders, quote requests and contact form messages.
Who processes the data?
The data controller is COSMY LLC, a US company registered in New Mexico. Address provided by the company: 8206 Louisiana Blvd NE, Ste A #1247, Albuquerque, New Mexico 87113, United States. For questions or requests concerning your data, email [email protected].
Data used and purposes
- Account and order: identity, company where applicable, contact details, billing and delivery addresses, purchases, invoices and customer service correspondence. This data is used to create the account, fulfil the sale, deliver, prepare accounting documents and handle after-sales requests. The legal bases are the contract and applicable legal obligations.
- Contact and quotes: name, email, company and phone if provided, subject, message and project details. This data is used to respond and, if the project proceeds, prepare a quote. The legal basis is the pre-contractual step requested by the person or our legitimate interest in responding to a non-contractual request. The contact form does not create a request record in WordPress; its contents are sent by email.
- Payment: amount, status and transaction reference needed to manage an order. When electronic payment is activated, card details are entered with the relevant payment provider; COSMY LLC does not need to receive the full card number or security code.
- Security and operation: technical connection data, logs and cookies required for sessions, carts and authentication. Processing is based on our legitimate interest in operating and securing the website.
- Newsletter, if activated: email address and evidence of the subscription choice. Sending relies on consent where required; every message offers an unsubscribe option.
Fields marked as required in a form are needed to handle the request or order. Other fields are optional. We do not ask for sensitive data or bank details through the contact form.
Recipients and service providers
Data is accessible to authorised COSMY LLC personnel and, as needed for their work, providers of website hosting, transactional email, payments, transport and invoicing. The project currently plans Gandi for hosting, Brevo for email, Stripe and PayPal for payments, and Boxtal or carriers for shipping; the services actually enabled must be confirmed before opening. Carriers receive the details needed to deliver. Data is not sold.
International transfers
Because COSMY LLC is established in the United States and some orders may be delivered outside the European Economic Area, data may be accessible or transferred outside that area. Before enabling providers that involve such transfers, COSMY LLC must check the destination country, the applicable transfer basis and the contractual or other safeguards required. The arrangements actually adopted will be specified here: [TRANSFERS AND SAFEGUARDS TO BE CONFIRMED].
Retention periods
Order and billing data is kept for the period needed for the commercial relationship, then archived under applicable accounting and tax obligations. Contact or quote requests that do not lead to an order are kept for no more than three years after the last exchange, subject to a retention obligation or dispute. Marketing data is kept until consent is withdrawn or, as applicable, during the commercial relationship and for no more than three years after the last relevant contact. Technical logs are kept for a limited period justified by security. Exact periods and deletion of old customer data must be checked in the website settings before opening.
Cookies and analytics
Cookies needed for the cart, session, security and website preferences may be stored without prior consent when the legal exemption conditions are met. A self-hosted Matomo analytics tool is being considered; it is exempt from consent only if configured in line with CNIL criteria. Any non-exempt tracker, especially for advertising, will require appropriate information and a choice before it is set. Active trackers must be checked after plugins are enabled.
Your rights
Depending on the circumstances, you may request access to, correction or deletion of your data, restriction of processing, data portability, or object to processing. You may withdraw consent at any time for processing based on it, without retroactive effect. Send requests to [email protected]. Proportionate identity verification may be requested where there is reasonable doubt. You may also complain to the CNIL if you believe your rights have not been respected.
Changes
This policy will be updated if tools, retention periods or data flows change significantly. The update date appears below.
Last updated: 26 September 2026. Official details, enabled providers and transfers must be confirmed before sales open.