Privacy Policy
Last update: June 2026
BIGBANG MEDIA, publisher of the website www.oduho.com (hereinafter "Oduho"), attaches great importance to the protection of your personal data. This policy informs you, in a transparent manner, about how we collect, use, and protect your data, in accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978, as amended.
1. Data controller
BIGBANG MEDIA
Legal form: Sole proprietorship
SIRET: 917 929 382 00013
Website: www.oduho.com
Contact : contact form
2. Data collected
We collect the following categories of data, depending on your interaction with the site:
Identification and contact details : name, surname, postal delivery and/or billing address, email address, telephone number (if provided).
Transaction data Order number, products purchased, amounts, purchase history, delivery tracking information.
Payment data This data is processed directly and exclusively by our PCI-DSS certified payment providers (Shopify Payments, PayPal). Oduho does not store your bank details or full payment card information at any time.
Navigation and technical data IP address, browser type and version, operating system, pages visited, duration of visits, traffic source, device used. This data is collected via cookies and analytics tools.
Communication data : exchanges with our customer service (requests, complaints, returns), whether they take place via contact form or any other available means.
Marketing data : email address and communication preferences, only if you have consented to receive our newsletters or promotional offers.
We do not collect data considered sensitive within the meaning of Article 9 of the GDPR (health data, ethnic origin, religious beliefs, etc.).
3. Purposes and legal basis
| finality | Legal basis (GDPR) |
|---|---|
| Order processing, shipping and tracking | Performance of the contract (art. 6.1.b) |
| Customer service, returns and complaints management | Performance of the contract (art. 6.1.b) |
| Payment management and fraud prevention | Performance of the contract / Legitimate interest (art. 6.1.f) |
| Sending newsletters and promotional offers | Consent (art. 6.1.a) |
| Website audience measurement and improvement | Consent (art. 6.1.a) for analytical cookies |
| Targeted advertising and retargeting | Consent (art. 6.1.a) |
| Accounting, tax and legal obligations | Legal obligation (art. 6.1.c) |
| Defending our rights in case of dispute | Legitimate interest (art. 6.1.f) |
4. Retention period
Order and billing data : 10 years from the end of the accounting period (legal obligation in accounting matters).
Customer account data : for the entire duration of the business relationship, then 3 years after the last activity or order.
Marketing data (newsletter) : until consent is withdrawn, or 3 years from the last click or interaction with our communications, if no unsubscription has occurred.
Customer service data : 3 years from the closing of the file or the last exchange.
Browsing data (cookies subject to consent) : 13 months maximum from the date of deposit.
Payment data : stored by payment providers according to their own policies, in compliance with PCI-DSS regulations.
5. Recipients and subcontractors
Shopify International Limited (Dublin, Ireland) - website and online store host. Shopify acts as a data processor within the meaning of the GDPR. Data may be stored on servers outside the EU but is subject to appropriate safeguards (European Commission standard contractual clauses).
Payment providers - Shopify Payments, PayPal (PCI-DSS certified). They process payment data directly and do not transmit your full bank details to us.
Logistics providers and suppliers - for the preparation and shipping of your orders. Some may be located outside the EU; transfers are governed by safeguards compliant with the GDPR.
Analytical and marketing tools - only with your prior consent (cookies). These tools allow us to measure the site's audience and the effectiveness of our campaigns.
We never sell your personal data to third parties. We do not share it for commercial purposes with external partners without your explicit consent.
6. Data transfers outside the European Union
Some of our service providers may process your data outside the European Union or the European Economic Area (EEA). In this case, we ensure that these transfers are governed by mechanisms compliant with the GDPR, such as standard contractual clauses adopted by the European Commission, adequacy decisions, or binding corporate rules (BCRs).
You can obtain information about the guarantees in place by contacting us via the contact form.
7. Your rights
Permission to access (Art. 15 GDPR): obtain confirmation that data concerning you is being processed and obtain a copy of it.
Right of rectification (Art. 16 GDPR): to have inaccurate or incomplete data corrected.
Right to erasure (Art. 17 GDPR): obtain the deletion of your data, in the cases provided for by the regulations.
Right to restriction of processing (Art. 18 GDPR): to obtain the suspension of the processing of your data in certain circumstances.
Right to portability (Art. 20 GDPR): to receive the data you have provided to us in a structured, commonly used and machine-readable format.
Right of opposition (Art. 21 GDPR): you have the right to object to the processing of your data based on our legitimate interest, or to its use for commercial prospecting purposes.
Withdrawal of consent : withdraw at any time any consent you have previously given, without affecting the lawfulness of the processing carried out before this withdrawal.
To exercise any of these rights, please use our contact formWe will respond within one month of receiving your request (this period may be extended by two additional months in the case of a complex request, in which case we will inform you).
If you believe your rights have not been respected, you can file a complaint with the CNIL: www.cnil.fr/fr/plaintes
8. Cookies
Cookies that are strictly necessary - essential for the site to function. They manage, in particular, your session, your shopping cart, and the security of your browsing. They cannot be disabled without affecting the site's functionality and do not require your consent.
Examples: Shopify session cookies, security cookie (CSRF), consent cookie.
Analytical and performance cookies - allow us to measure the site's audience and continuously improve our user experience. They are only placed with your prior consent.
Marketing and social media cookies - cookies placed by third-party partners allow us to offer you personalized advertisements and measure the effectiveness of our campaigns. They are only placed with your prior consent.
You can change your preferences at any time via our cookie management banner, configure your browser to refuse cookies, or opt out of advertising cookies via dedicated platforms (e.g., youronlinechoices.eu). Maximum lifespan of cookies subject to consent: 13 months.
9.Safety
Oduho implements appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, modification or destruction (SSL/TLS encryption, restricted access, secure Shopify infrastructure).
In the event of a personal data breach likely to pose a risk to your rights and freedoms, we undertake to notify the CNIL within 72 hours in accordance with Article 33 of the GDPR.
10. Changes to the Policy
Oduho reserves the right to modify this privacy policy at any time. The current version is always accessible on this page, along with the date of the last update. In the event of a substantial change affecting your rights, we will notify you by email or via a notice displayed on the website.
11. Contact
For any questions relating to your personal data or to exercise your rights, please use our contact form.