Privacy Policy
Consolidated version dated 15 October 2026
1 Who is responsible for your personal data
Under Regulation (EU) 2016/679 of 27 April 2016, the General Data Protection Regulation (GDPR), and the French Data Protection Act, personal data collected and processed through www.otimox.com (the Website) is handled by Gioia Diomede, a sole trader registered in France under SIRET number 940 864 275 00026, whose registered business address is 27 bis rue de la Forêt, 45120 Cepoy, France.
If you have a question about how your personal data is handled, or wish to exercise your rights, you can contact the Data Controller:
by email at contact@otimox.com;
by post at the business address above.
No Data Protection Officer (DPO) has been appointed, as the processing carried out does not require one under Article 37 of the GDPR.
2 Definitions
The following terms have the meanings set out in the GDPR:
Personal data: any information relating to an identified or identifiable individual.
User: any individual browsing the Website, whether as a visitor or a customer.
Cookies and other trackers: technologies stored on or accessed from the User’s device, including for website functionality, security or audience measurement.
The terms Data Controller, Processing and Processor are used as defined in Article 4 of the GDPR. In this policy, the Data Controller is the person identified in Section 1.
3 The data we collect
The Data Controller processes only the personal data needed for the purposes described in this policy, in line with the principle of data minimisation.
3.1 Information you provide
This includes information you provide directly, in particular when:
creating and managing an account, such as identity and contact details;
placing and tracking an order, such as delivery and billing information;
sending an enquiry through a contact form or contacting customer service.
Payments are handled by secure payment service providers in accordance with applicable regulations. No banking information is stored on the Website.
3.2 Information collected automatically
When you browse the Website, some technical information about its use may be collected through cookies or similar technologies, subject to the conditions in Section 10.
3.3 Fair collection of personal data
Personal data comes from information you provide or information collected when you browse the Website.
The Data Controller does not buy or rent third-party databases for commercial or advertising purposes as part of operating the Website. If data were to be collected from external sources in future, this would be done in accordance with applicable law and after the individual concerned had been informed.
4 Why we use your data and our legal grounds
Personal data is collected and processed for specific, clearly stated and legitimate purposes under the GDPR. These purposes and their legal grounds are:
Managing enquiries before a contract is entered into and managing the contractual relationship, including orders, invoicing, delivery and after-sales service: performance of the contract between the User and the Data Controller, under Article 6(1)(b) of the GDPR.
Managing accounts when Users choose to create a personal account on the Website: performance of a contract, under Article 6(1)(b).
Responding to Users’ enquiries, including those sent through contact forms or customer service: the Data Controller’s legitimate interest in maintaining and improving the relationship with Users, under Article 6(1)(f).
Meeting the Data Controller’s legal and regulatory obligations, particularly accounting, tax and administrative requirements: compliance with a legal obligation, under Article 6(1)(c).
Operating, securing and improving the Website, including fraud prevention, information security and technical optimisation: the Data Controller’s legitimate interest in providing a secure and effective service, under Article 6(1)(f).
Measuring and analysing Website traffic to improve the services offered: legitimate interest or the User’s consent, depending on the trackers used and subject to Section 10.
Sending marketing communications, such as news or offers: the User’s prior consent, under Article 6(1)(a).
5 How long we keep your data
Under Article 5(1)(e) of the GDPR, personal data is kept in a form that identifies individuals for no longer than is necessary for its intended purpose. The retention periods are:
Contractual relationship data: for the duration of the relationship, then archived for five years as evidence, in line with the ordinary civil limitation period. Accounting and tax documents, including invoices, are kept for ten years in accordance with the French Commercial Code.
Account data: while the account is active, then deleted or anonymised after three years of inactivity.
Correspondence with Users: for as long as needed to deal with the enquiry, then archived for five years as evidence.
Marketing data: until consent is withdrawn and, in any event, for no longer than three years after the last active contact initiated by the User.
Cookie and tracker data: for as long as needed for its purpose. A cookie’s lifetime on your device is separate from the retention period for the data it collects. Wix’s technical cookies may last from a browser session to twelve months, depending on their function, as explained in Section 10.
At the end of the applicable retention period, data is deleted or anonymised, unless it must be kept to meet a legal obligation or to establish, exercise or defend legal claims.
6 Who receives your data
Personal data is intended for the Data Controller and duly authorised people acting under her authority. For the purposes described above, it may be shared with:
technical service providers responsible for hosting, maintaining, securing and developing the Website;
banks and payment service providers, to handle transactions securely;
logistics providers and carriers responsible for dispatching and delivering orders;
external advisers, including accountants, auditors and lawyers, to meet legal and regulatory obligations.
Depending on their role, these providers act as processors or as separate data controllers under the GDPR. They are subject to obligations intended to protect the confidentiality and security of personal data.
Data may also be disclosed to the relevant administrative or judicial authorities where required by law or as part of legal proceedings.
Outside the circumstances described above, personal data is not sold, rented or passed to third parties for commercial or advertising purposes.
7 Transfers outside the European Economic Area
The Website is hosted on Wix. To provide its services, Wix may process visitors’ and customers’ personal data outside the European Economic Area (EEA).
Wix’s Data Processing Addendum provides for an initial transfer to Wix.com Ltd. in Israel under the European Commission’s adequacy decision. Depending on the destination country, onward transfers rely on an adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses.
The applicable safeguards are described in Wix’s Data Processing Addendum: https://www.wix.com/about/privacy-dpa-users. You can also request information about the safeguards, or a copy of them, by emailing contact@otimox.com.
Any transfers made by other service providers must comply with Articles 44 onwards of the GDPR. General commitments to compliance alone do not provide a valid safeguard for a transfer.
Using service providers does not relieve the Data Controller of her own data protection obligations.
8 Data security
The Data Controller implements technical and organisational measures appropriate to the risks, in accordance with Article 32 of the GDPR.
These measures aim to preserve confidentiality, reduce the risk of unauthorised access, disclosure, alteration or accidental loss, and secure access to the tools and interfaces used.
Technical, hosting and payment service providers have their own security measures and must meet the obligations that apply to them as processors or separate data controllers. Each party remains responsible for its own obligations. Using these providers does not remove the Data Controller’s obligations.
9 Your rights and how to exercise them
Under the GDPR and the French Data Protection Act, individuals have rights of access, rectification, erasure, restriction of processing, data portability and objection, including to direct marketing, subject to the conditions set out in applicable law. Where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew consent.
French law also allows individuals to give instructions about what should happen to their personal data after their death.
How to make a request
You can exercise your rights by contacting the Data Controller, whose full identity and contact details are given in the Website’s Legal Notice:
by email at contact@otimox.com;
or by another method that allows receipt of the request to be established.
How requests are handled
Response time: a response will be provided without undue delay and, in any event, within one month of receiving your request. This may be extended by two further months, taking into account the complexity and number of requests. If an extension is needed, you will be informed of it and the reasons within the first month after your request is received.
Fees: exercising these rights is generally free. For manifestly unfounded or excessive requests, the Data Controller may charge a reasonable fee or refuse to act, under Article 12(5) of the GDPR.
Identity checks: additional information needed to confirm your identity may be requested only where there is reasonable doubt about it. Checks will remain proportionate. Any supporting document requested for this purpose will be deleted once the check is complete.
You can lodge a complaint with a competent supervisory authority, particularly in the EU Member State where you normally live or work, or where the alleged infringement occurred. In France, you can contact the Commission nationale de l’informatique et des libertés (CNIL) through www.cnil.fr.
10 Cookies and other trackers
The Website uses Wix. Technical cookies support Website functionality, security, session management, member identification and ordering features. Cookies that are strictly necessary to provide a service you expressly request do not require prior consent under Article 82 of the French Data Protection Act.
Wix lists the following lifetimes for some of its technical cookies: XSRF-TOKEN and hs, the browser session; SSR-caching and bSession, twenty-four hours; svSession and wixSession, twelve months. The list and functions may change as Wix’s services evolve. Wix provides more information at https://support.wix.com/en/article/cookies-and-your-wix-site.
Cookies or trackers that are not strictly necessary, including advertising cookies and audience measurement cookies that do not qualify for an exemption, require prior consent. If they are used, you must be able to refuse them and withdraw consent as easily as you gave it. Audience measurement can be exempt from consent only if it meets all the conditions set by the CNIL.
You can change your browser settings to limit or block cookies. Doing so may affect essential Website features.
11 Changes to this privacy policy
This policy may be updated to reflect changes in legislation, regulation, case law, technology or the processing carried out.
Any material change will be published on the Website. Users will also be informed where required by applicable law.
The applicable version is the one in effect when you visit the Website. Please check this policy regularly for updates.