Privacy policy
Last updated: 11 August 2026
This policy explains what personal data we collect when you use littlepeashop.com, why we collect it, who we share it with, and the rights you have over it. We've tried to write it in plain language rather than legal boilerplate.
Who is responsible for your data
The data controller is SGS ECOM (trading as Little Pea Shop), a SARL registered at 8 Chemin de l'Essertillet, 74360 Bonnevaux, France, SIREN 927 869 883.
For any question about your data, or to exercise the rights below, email hello@littlepeashop.com.
What we collect
When you place an order
- Your name, email address, delivery address and billing address
- A telephone number, where the carrier requires one
- What you ordered, when, and for how much
- Payment confirmation — we never see or store your full card number
When you contact us
- Your email address and whatever you tell us in your message
When you subscribe to our newsletter
- Your email address, and whether you open or click our emails
When you browse the site
- Pages viewed, approximate location, device and browser type, and how you arrived
- Cookie and similar identifiers — see our Cookie Policy
You do not need an account to shop with us, and we do not ask you to create one.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Taking payment, fulfilling and delivering your order, handling returns | Performance of a contract |
| Answering your questions and providing support | Performance of a contract, or our legitimate interest in helping you |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud and keeping the site secure | Legitimate interest |
| Marketing emails and SMS | Your consent, which you can withdraw at any time |
| Analytics and advertising measurement | Your consent, given through the cookie banner |
| Product reviews you choose to leave | Your consent |
We do not make decisions about you by automated means, and we do not profile you in any way that produces legal effects.
Who we share it with
We share only what is necessary, and only with organisations that process data on our instructions:
- Shopify — our e-commerce platform and host
- Payment providers — Shopify Payments, PayPal, Apple Pay and Google Pay, which handle your payment details directly
- CJ Dropshipping — our fulfilment partner, which receives the name and delivery address needed to ship your order
- Carriers — for delivery and tracking
- Klaviyo — email and SMS, where you have subscribed
- Reviews, support and analytics providers — including our reviews app, our helpdesk, Google Analytics and Meta, where you have consented
We do not sell your personal data, and we never will.
Transfers outside the European Economic Area
Some of our providers are outside the EEA. In particular, fulfilment of your order involves sending your name and delivery address to CJ Dropshipping, which operates from China. Certain analytics and marketing providers are based in the United States.
Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, together with appropriate safeguards. You can ask us for details of the safeguards that apply.
How long we keep it
- Order and transaction records — 10 years, as required by French commercial and tax law
- Support correspondence — 3 years from our last contact
- Marketing consent and subscriber data — until you unsubscribe, and 3 years after your last interaction
- Analytics data — up to 25 months
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased, where we have no overriding obligation to keep it
- Restrict or object to how we use it, including for marketing
- Receive your data in a portable format
- Withdraw consent at any time, without affecting what we did before you withdrew it
- Give instructions about what happens to your data after your death
Email hello@littlepeashop.com and we'll respond within one month.
Complaints
If you think we've handled your data badly, please tell us first — we'd rather fix it. You also have the right to complain to the French data protection authority:
CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr
If you live elsewhere in the EU or in the UK, you may complain to your own national authority instead.
Security
Our site runs over an encrypted connection and payments are handled by certified providers. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data, and we will tell you and the CNIL promptly if a breach is likely to affect you.
Children
We sell products for babies and children, but we sell them to adults. This site is not directed at children and we do not knowingly collect data from anyone under 15.
Changes
We may update this policy. The date at the top shows when this version took effect, and we'll flag anything significant.