Privacy Policy
At SHARKZ, respecting your privacy and protecting your personal data are our priority.
This privacy policy (the "Privacy Policy") aims to inform you about how your personal data is processed in connection with your use of the site Vibram Five Fingers (the "Site"), in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "GDPR") and French legislation on data protection, as currently in force (together, the "Applicable Regulations").
1. Who is the Data Controller?
When you browse and/or register on our Site, or more generally, in the context of managing our contractual relations with you, the data controller is:
SHARKZ, simplified joint-stock company (SAS)
SIREN: 991 493 362
SIRET: 991 493 362 00016
Intra-community VAT number: FR27 991493362
NAF / APE code: 4791A – Mail order and internet retail sale
Registered office: 58 rue de Monceau, 75008 Paris, France
Email address: contact@vibram-fivefingers.fr
(hereinafter "We", "Us" or "Our").
2. What Data Do We Collect?
Personal data is data that can be used to identify, directly or indirectly, a natural person, notably by combining it with other data.
We may collect the following categories of personal data:
- Identification data: first name, last name, email address, postal address, and phone number;
- Data relating to your orders, purchases, deliveries, and returns;
- When you choose to log in using a third-party authentication service, for example Shop, certain data such as your name and email address may be provided to us by that service. We do not collect the password of your third-party account;
- Browsing data: IP address, pages viewed, date and time of connection, browser used, operating system, technical identifiers, and, where applicable, advertising identifiers.
Mandatory data is identified as such at the time of collection.
3. Details on the Processing of Your Personal Data
3.1 Provision of Services Available on the Site
Purpose: To provide the services offered on the Site and enable the use of your customer account.
Legal basis: Performance of the contract entered into with you.
Retention period:
Where you have created an account, your data is retained for the entire period the account is in use.
In the event of an inactive account for a period of 3 years, your personal data may be deleted in the absence of a response to a possible reactivation request.
Data necessary for evidentiary purposes may then be archived for a period of 5 years.
3.2 Order and Customer Relationship Management
Purpose: To manage orders, payments, deliveries, returns, refunds, customer requests, and to follow up on the contractual relationship.
Legal basis: Performance of the contract entered into with you.
Retention period:
Personal data is retained for the entire duration of the contractual relationship.
It may then, with the exception of banking data, be archived for a period of 5 years for evidentiary purposes and to comply with our legal obligations.
Payment data is processed by our secure payment providers.
We do not store the visual cryptogram (CVV/CVC) on your bank card.
3.3 Managing Reviews of Our Products
Purpose: To collect, manage, and publish reviews relating to our Products.
Legal basis: Our legitimate interest in collecting and displaying customer reviews.
Retention period: Up to 10 years from the publication of the review.
3.4 Newsletters and Commercial Communications
Purpose: To send newsletters, commercial offers, information, and promotional messages by email.
Legal basis:
For our customers: our legitimate interest in informing and building loyalty among our customers, under the conditions provided by applicable regulations.
For prospects: your consent.
Retention period: Data is retained for 3 years from your last contact with us, or until you withdraw your consent where processing is based on it.
3.5 Handling Contact Requests
Purpose: To respond to your requests for information, contact, or assistance.
Legal basis: Performance of pre-contractual measures taken at your request and/or our legitimate interest in responding to requests received.
Retention period: 3 years from your last contact with us.
3.6 Contests and Promotional Operations
Purpose: To organize and manage contests and other promotional operations.
Legal basis: Performance of the rules or contract relating to the operation concerned.
Retention period: For the entire duration of the contest or promotional operation. Certain data may then be archived for 5 years for evidentiary purposes.
3.7 Advertising Cookies and Audience Measurement
Purpose: To measure use of the Site, personalize your experience, and, subject to your consent where required, use cookies or similar technologies for advertising purposes.
Legal basis: Your consent where required by applicable regulations.
Retention period: Data associated with cookies is retained in accordance with applicable periods and, for processing covered by this policy, for a period of up to 13 months.
You can withdraw your consent or change your cookie preferences at any time using the cookie management tool available on the Site.
3.8 Handling Requests to Exercise Rights
Purpose: To respond to requests to exercise your rights regarding the protection of personal data.
Legal basis: Compliance with our legal and regulatory obligations.
Where we need to request proof of identity due to reasonable doubt about your identity, it is retained only for the time necessary for verification and then deleted.
4. Who Are the Recipients of Your Data?
The following may have access to your personal data, to the extent necessary for their tasks:
- Authorized SHARKZ staff;
- Our subcontractors and providers, including our hosting, e-commerce, payment, email and newsletter, audience measurement and analysis, advertising, after-sales service, invoicing, delivery, and cookie management providers;
- Judicial, administrative, police, or other legally authorized authorities where regulations require us to provide them with certain information.
Our providers may only process the data entrusted to them within the scope of the tasks assigned to them and in accordance with applicable data protection requirements.
5. Is Your Data Likely to Be Transferred Outside the European Union?
We notably use Shopify's services to operate our online store.
In connection with the use of Shopify and certain of our other providers, your personal data may be subject to international transfers, including to countries located outside the European Economic Area.
Where such transfers take place, they are governed in accordance with applicable regulations, notably:
- where the country concerned benefits from an adequacy decision from the European Commission under Article 45 of the GDPR;
- by means of appropriate safeguards under Article 46 of the GDPR, including standard contractual clauses approved by the European Commission where applicable;
- or on the basis of another transfer mechanism provided for in Chapter V of the GDPR.
You may contact us for more information regarding the safeguards applicable to international transfers of your data.
6. What Are Your Rights Over Your Data?
In accordance with applicable regulations, you notably have the following rights regarding your personal data:
- Right to information: you have the right to be informed about how your personal data is used;
- Right of access: you can request access to the personal data we hold about you;
- Right to rectification: you can request the correction of inaccurate, incomplete, or outdated personal data;
- Right to erasure: under the conditions set out in Article 17 of the GDPR, you can request the deletion of your personal data;
- Right to restriction: you can request the restriction of the processing of your data in the cases provided for in Article 18 of the GDPR;
- Right to portability: under the conditions set out in Article 20 of the GDPR, you can receive certain data you provided to us in a structured, commonly used, machine-readable format and request its transmission to another data controller;
- Right to object: under the conditions set out in Article 21 of the GDPR, you can object to certain processing of your personal data;
- Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal;
- Right to set post-mortem directives: you can set directives regarding the retention, deletion, and disclosure of your personal data after your death, in accordance with applicable French law.
How to Exercise Your Rights?
You can exercise your rights by contacting us at:
To protect your personal data, we may ask you for additional information where we have reasonable doubt about your identity.
Complaint to the CNIL
If, after contacting us, you believe that your rights relating to your personal data are not being respected, you have the right to file a complaint with the competent supervisory authority.
In France, the competent authority is the National Commission for Information Technology and Civil Liberties (CNIL).
7. Data Security
SHARKZ implements appropriate technical and organizational measures to protect personal data against, in particular, destruction, loss, alteration, disclosure, or unauthorized access.
We also ensure that access to personal data is limited to only those individuals and providers who need it to carry out their tasks.
8. Cookies
The Site may use cookies and other similar technologies necessary for its operation, as well as, subject to your choices and consent where required, cookies intended in particular to:
- measure the Site's audience and performance;
- improve the user experience;
- remember certain preferences;
- measure the effectiveness of our campaigns;
- personalize content and advertising.
Where required by regulations, cookies that are not strictly necessary are only placed after obtaining your consent.
You can accept, refuse, or change your cookie preferences via the consent management tool available on the Site.
9. Changes
We may modify this Privacy Policy at any time, notably to take into account legal, regulatory, case law, or technical developments, or changes to our practices.
In the event of a significant change, we may inform you by any appropriate means.
We invite you to regularly review the latest version of this Privacy Policy.
Effective date: 08/10/2026