Privacy policy
Last updated: 16 October 2026.
This policy explains what personal data we collect when you visit tomo-clothing.com, place an order or get in touch with us, why we collect it, who we share it with, how long we keep it and how to exercise your rights.
WHO IS RESPONSIBLE FOR YOUR DATA?
Z.A.C.J. SAS (TOMO Clothing brand), 1-3 rue d'Enghien, 75010 Paris, RCS Paris 891 117 079.
Contact for any question about your data: hello@tomo-clothing.com.
WHAT DATA?
- Identity and contact details: surname, first name, email, phone number, delivery and billing addresses.
- Orders: items purchased, amounts, delivery method, history, returns and exchanges.
- Payment: payment method used and transaction status. Your bank details are processed directly by our payment providers: we never have access to them.
- Communications with us: messages by email, form, chat or WhatsApp, return reasons, photos sent.
- Preferences: newsletter or SMS sign-up, gender stated at sign-up (optional), loyalty points.
- Reviews that you post.
- Browsing: pages viewed, device, IP address, cookies and trackers, depending on your choices.
WHY AND ON WHAT LEGAL BASIS?
| Purpose | Legal basis |
|---|---|
| Processing your order: payment, preparation, delivery, invoice, tracking emails | Performance of the contract |
| Handling your exchanges, returns, refunds and guarantees | Performance of the contract and legal obligations |
| Answering your questions (customer service) | Performance of the contract or legitimate interest |
| Managing your customer account and the loyalty programme | Performance of the contract |
| Managing the ambassador programme (affiliation, commissions) | Performance of the contract |
| Sending you our email newsletters, if you are already a customer, about products similar to those you have bought | Legitimate interest (you can object at any time) |
| Sending you our email newsletters if you are not a customer, and our text messages | Consent |
| Sending you reminders about an abandoned basket | Legitimate interest or consent, depending on your status |
| Collecting and publishing your reviews of our products | Legitimate interest |
| Measuring website traffic and showing you tailored ads on other websites and social networks | Consent (cookies) |
| Preventing fraud and securing the website | Legitimate interest |
| Keeping our accounts and responding to the authorities | Legal obligation |
MANDATORY DATA, PROFILING.
The fields marked as mandatory when you order are necessary to conclude the contract: without them, we cannot process your order. Our payment providers use automated fraud analysis tools; a flagged order may be put on hold and then checked by our team. With your consent, your browsing data is used to personalise ads (profiling). Where it is the basis for processing, our legitimate interest is to sell our products, build customer loyalty, secure our sales and improve our services.
WHO DO WE SHARE IT WITH?
Your data is never sold. It can be accessed by the TOMO Clothing team and, to the extent relevant to them, by our service providers, who act on our instructions:
- Online shop and hosting: Shopify.
- Payment: Shopify Payments, PayPal, Alma (payment in instalments), BitPay (cryptocurrencies). These providers may also act as data controllers for their own obligations (fraud prevention, banking regulations).
- Order management, logistics and delivery: our order management tool (ShippingBo), our logistics provider, and the carriers (Mondial Relay and its partners, Colissimo, GLS).
- Returns: our returns portal (Baback), its return shipping service and the carrier Chronopost.
- Emails and text messages: Klaviyo.
- Customer service: Gorgias (email, chat) and WhatsApp.
- Loyalty: Rivo. Ambassador programme: BixGrow. Customer reviews: Judge.me.
- Audience measurement and advertising, only if you accept it: Google, Meta (Facebook, Instagram), Pinterest. These platforms may act as joint or separate controllers for their own processing.
- Accounting: our accounting firm and our accounting tools.
- Authorities: where required by law.
DOES YOUR DATA LEAVE THE EUROPEAN UNION?
Some of our service providers are based outside the European Union, in particular in Canada and the United States. These transfers are covered by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or by the European Commission's standard contractual clauses. You can ask us for more information about these safeguards.
HOW LONG DO WE KEEP IT?
- Order and customer relationship data: for the duration of the relationship, then 3 years after your last purchase so that we can send you our offers. It is then archived for the limitation periods (5 years) where necessary to assert our rights.
- Prospects (newsletter subscribers who have not made a purchase): 3 years after your last contact with us (click, reply, sign-up).
- Invoices and accounting records: 10 years.
- Contracts of €120 or more: 10 years.
- Communications with customer service: 3 years after the last exchange.
- Customer account: until it is deleted, and at the latest 3 years after your last login.
- Cookies and trackers: 13 months maximum; your choices are stored for 6 months.
COOKIES AND TRACKERS.
Some cookies are essential for the website to work (basket, payment, security, remembering your choices): they do not require your consent. Audience measurement and advertising cookies are only placed with your consent. You can accept, refuse or customise your choices in the banner displayed on your first visit, and change them at any time by reopening the cookie management banner. These include, in particular, trackers from Google, Meta and Pinterest and Klaviyo's browsing tracking. Refusing has no effect on your access to the website or on your orders.
NEWSLETTER AND TEXT MESSAGES.
You can unsubscribe at any time, free of charge, using the link in every email, by replying STOP to a text message, or by writing to us. Emails relating to your orders (confirmation, shipping, return) will still be sent, as they are necessary for the contract.
YOUR RIGHTS.
You have the right of access, rectification, erasure, restriction, objection (including, at any time and without giving a reason, to direct marketing), data portability, and the right to withdraw your consent at any time. You can also set instructions on what happens to your data after your death.
To exercise your rights, write to us at hello@tomo-clothing.com or to Z.A.C.J. SAS – TOMO Clothing, 1-3 rue d'Enghien, 75010 Paris. We will reply within one month. We may ask you for proof of identity if we have reasonable doubts.
If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
SECURITY.
We choose service providers that protect your data (payment encryption, restricted access, data processing agreements). Our team's access is personal and limited to what is necessary.
MINORS.
Our services are intended for adults. We do not knowingly collect data relating to children under 15.
CHANGES.
We may update this policy, for example if we change tools. The date of the last update is shown at the top of the page.
