Privacy policy
This policy explains what personal data we collect, why, with whom it is shared and what your rights are. It complies with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
The data controller is NVH GROUP (SASU), whose registered office is at 6 rue d'Armaillé, 75017 Paris, France, represented by its President. For any question about your data: contact@profitbox.shop.
2. Data we collect
- When you place an order: name, e-mail address, country, order details (chosen pack, amount). Payment information (card, etc.) is collected and processed directly by our payment provider and is never stored by us.
- When you contact us: your e-mail address and the content of your message.
- Delivered documents: to deter unauthorised sharing, the documents provided (sheets, training) are watermarked with your identifiers (name, e-mail, order number, country); the training PDF is additionally protected by a personal password.
- Affiliate programme: if you take part, your sign-up and commission tracking are handled by our provider Lemon Squeezy (see §4).
- Browsing: the site does not set tracking cookies or advertising analytics tools. Only the host's technical logs may be generated, for security and proper operation of the site.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Process your order and deliver your pack of sheets by e-mail | Performance of the contract |
| Answer your requests and provide support | Legitimate interest |
| Issue invoices and meet our accounting and tax obligations | Legal obligation |
| Prevent fraud and secure the service | Legitimate interest |
4. Recipients and processors
Your data is never sold. It may be shared with the providers strictly necessary to the service:
- Lemon Squeezy (Lemon Squeezy, LLC — United States): payment processing and invoicing, as reseller / party liable for VAT (Merchant of Record).
- Transactional e-mail provider: routing of delivery and contact e-mails, via the Seller's messaging provider. to be specified: provider name — e.g. Brevo (Sendinblue SAS, France)
- Site host: Cloudflare, Inc. (Cloudflare Pages — United States).
5. Transfers outside the European Union
Some providers (notably Lemon Squeezy and the host Cloudflare) are located in the United States. These transfers are framed by appropriate safeguards within the meaning of the GDPR: the European Commission's standard contractual clauses and/or membership of the Data Privacy Framework. Where e-mail routing is handled by a provider established in the European Union, no transfer outside the EU takes place on that account.
6. Retention period
- Order and billing data: for the duration of the commercial relationship, then archived in accordance with accounting and tax obligations (up to 10 years).
- Contact e-mails: 3 years after the last exchange.
7. Your rights
Under the GDPR, you have the following rights over your data:
- Right of access and rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of and objection to processing
- Right to data portability
To exercise them, write to contact@profitbox.shop. You may also lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
8. Security
We implement reasonable technical and organisational measures to protect your data against loss, unauthorised access or disclosure. Order data is kept on private, restricted-access storage.
9. Changes
This policy may be updated to reflect legal or service changes. The date of the last update appears at the top of the page. We invite you to review it regularly.
10. Contact
For any question about this policy or your personal data: contact@profitbox.shop.