Privacy Policy
Last updated: 14 August 2026
STATE SASU is committed to protecting the privacy of the people who visit this website and place orders with us. This policy explains what data we collect, why, for how long, who has access to it and what rights you have over it, in accordance with the General Data Protection Regulation (EU Regulation 2016/679) and the French Data Protection Act of 6 January 1978 as amended.
Data controller
STATE SASU, 18 rue du Portail-Neuf, 83990 Saint-Tropez, France, registered under number 934 512 876. Contact for any data protection question: contact@state-care.com
Given the size of our company and the nature of our processing activities, we are not required to appoint a Data Protection Officer. Requests are handled directly by our management.
What data we collect
Data you provide directly. Surname, first name, postal delivery and billing address, email address, telephone number, order history, subscription preferences, and the content of any message you send us.
Account data. If you create a customer account: your login email address and an encrypted password, which we never see in clear text.
Payment data. Card details are collected and processed directly by our payment providers, which are PCI DSS certified. STATE SASU never stores or has access to your full card number. We only receive the transaction status, the last four digits and the card type.
Browsing data. IP address, browser type and language, device used, pages visited, time spent, referring source. This data is collected through cookies, as described below.
Data we do not collect. We do not collect health data. Our products are food supplements, not medicinal products, and we never ask you for medical information in order to sell them.
Why we process it, and on what legal basis
To process, deliver and invoice your orders. Legal basis: performance of the contract. Without this data, an order cannot be fulfilled.
To manage your customer account and your subscriptions. Legal basis: performance of the contract.
To answer your messages and provide customer support. Legal basis: performance of the contract, or our legitimate interest in responding to enquiries.
To send you our newsletter and commercial offers. Legal basis: your consent, which you may withdraw at any time through the unsubscribe link present in every email. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
To prevent fraud and secure transactions. Legal basis: legitimate interest.
To meet our accounting, tax and consumer law obligations. Legal basis: legal obligation.
To measure audience and improve the website. Legal basis: your consent for non-essential cookies.
How long we keep it
Customer and order data: for the duration of the commercial relationship, then archived for ten years from the end of the financial year, in accordance with accounting and tax obligations.
Customer account data: until you delete your account, or after three years of complete inactivity.
Prospect and newsletter data: three years from the last contact from you.
Invoices: ten years, as required by the French Commercial Code.
Cookies: thirteen months maximum from the moment consent is given.
Who has access to it
Your data is accessible to the authorised staff of STATE SASU and to the service providers acting on our instructions, each within the strict limits of their role:
- Shopify International Limited (Ireland), our e-commerce platform and host
- Our payment providers, for the processing of transactions
- Our carriers, for delivery: name, address and telephone number only
- Our email service provider, for transactional emails and the newsletter
- Our accountant, for invoicing and statutory accounts
We never sell, rent or exchange your personal data with third parties for their own commercial purposes.
Some of these providers may process data outside the European Union. In that case, transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR, in particular the standard contractual clauses adopted by the European Commission.
Cookies
Cookies are small text files placed on your device when you visit the website. We use two categories.
Strictly necessary cookies. They allow the website to function: shopping cart, session, security, language preference. They do not require your consent because the website cannot operate without them.
Audience measurement and performance cookies. They allow us to understand how the website is used and to improve it. They are only placed with your consent, which you may refuse or withdraw at any time through the cookie banner or your browser settings.
Refusing non-essential cookies does not prevent you from browsing the website or placing an order.
Your rights
In accordance with the GDPR, you have the following rights over your data: right of access, right to rectification, right to erasure, right to restriction of processing, right to object, right to data portability, and the right to withdraw your consent at any time. You may also define directives regarding the fate of your data after your death.
To exercise these rights, write to contact@state-care.com, specifying your request. We may ask for proof of identity where there is reasonable doubt. We will respond within one month, extendable to three months for complex requests.
If you consider that your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at www.cnil.fr.
Security
We implement appropriate technical and organisational measures to protect your data: encrypted connections across the entire website, restricted and traced access to personal data, hosting with a provider meeting recognised security standards, and payment processing entrusted to PCI DSS certified providers.
Minors
Our products are intended for adults. This website is not directed at children and we do not knowingly collect data relating to minors under fifteen years of age.
Changes to this policy
This policy may be updated to reflect changes in our practices or in the applicable regulations. The applicable version is the one published on this page, with its update date shown at the top.