🔒 Privacy policy

Last updated: October 5, 2026 — Version 1.0

1. Who is responsible for your data?

Marché Facile (Québec, Canada) is responsible for processing your personal data.

Contact for the data protection officer (DPO): info@marchefacile.com.

2. What data do we collect?

2.1 Orders (no account required)

• Buyer: name, phone, email, country of residence.
• Recipient in Côte d’Ivoire: name, phone, city, commune/neighbourhood, delivery instructions.
• Order details: products, quantities, amounts, reference, date.

2.2 Accounts (customer, supplier, courier)

• Name, email, phone, company (suppliers), encrypted password (we never know it in plain text).
• For couriers and suppliers: temporary verification codes (SMS and email, 10 minutes).

2.3 Delivery and pickup proofs

• Photos of the goods, recipient signatures, timestamps — provided voluntarily to prove proper receipt.

2.4 Messages

• Content of messages exchanged via the contact form and supplier messaging.

2.5 Technical data

• Cookies (see section 10), IP address (contact-form anti-spam security), hosting provider technical logs.

2.6 Conversational assistant “Helen”

• The site offers a virtual assistant, Helen, which is an artificial intelligence and presents itself as such. If you use it, your messages are sent to our artificial-intelligence provider (Anthropic) to generate the replies.
• The conversation is logged in our database (messages, products mentioned, baskets proposed, transfers to customer service and their reasons) for service quality, security and dispute-handling purposes. It is kept only as long as needed for those purposes, then deleted or anonymized; you may request its deletion (see your rights, section 7).
• Never share any payment details in the conversation: payment only takes place on the site's secure payment page.

3. Why do we use your data? (purposes and legal bases)

• Process and deliver your orders — performance of the sales contract.
• Send you confirmations, tracking codes and status notifications — performance of the contract.
• Manage accounts and secure access (including two-factor authentication for couriers and suppliers) — contract performance and legitimate interest (security).
• Reply to your messages — legitimate interest / consent.
• Prevent fraud and abuse (contact-form rate limiting) — legitimate interest.
• Meet our legal obligations (accounting, taxation) — legal obligation.

We do no advertising outreach based on your data without your prior consent.

4. Who receives your data?

• Partner suppliers: only the information needed to prepare your order (products, quantities, recipient contact details).
• Couriers: recipient contact details for home delivery, where applicable.
• Hosting provider (LWS, France/EU): technical storage of the site and database.
• Artificial-intelligence provider (Anthropic): only if you use the “Helen” conversational assistant (see section 2.6).
• Authorities: only if required by law.

We neither sell nor rent your personal data to third parties.

5. International transfers

Your data travels between Canada (site operation) and Côte d’Ivoire (suppliers, couriers, recipients) to fulfil your orders. Appropriate safeguards are applied: limitation to strictly necessary data, restricted access per account, encrypted passwords.

6. How long do we keep your data?

• Orders and billing: 7 years (Canadian accounting and tax obligations).
• Inactive accounts: 3 years after the last activity, then deletion or anonymization.
• Delivery proofs: 3 years (evidence in case of dispute).
• Contact-form messages: 3 years.
• Verification codes: 10 minutes, then automatic deletion.
• Anti-spam logs (IP): 1 hour.

7. Your rights

Wherever you live, you can exercise the following rights by writing to info@marchefacile.com:

• Access — obtain a copy of your data.
• Rectification — correct inaccurate data.
• Deletion — request erasure of your data (except legal retention obligations).
• Objection and withdrawal of consent — notably for non-essential cookies.
• Portability — receive your data in a common format.

Details by region

• European Union (GDPR): you also have the right to restriction of processing and the right to lodge a complaint with your national supervisory authority.
• Québec (Law 25) and Canada (PIPEDA): you can request the cessation of dissemination or the de-indexing of your personal information; the Commission d’accès à l’information du Québec is the competent authority.
• United States (CCPA/CPRA and state laws): right to know what data is collected, right to deletion, right not to be discriminated against for exercising your rights. We neither “sell” nor “share” your data within the meaning of these laws.
• Africa: your rights of access, rectification and objection are recognized in accordance with the principles of national personal-data protection laws.

We respond to any request within a maximum of 30 days.

8. Security

• Encrypted passwords (never stored in plain text); two-factor authentication (SMS + email) for couriers and suppliers.
• Prepared statements against injections; systematic data validation.
• Encrypted connections (HTTPS); secure session and sign-in cookies (HttpOnly, SameSite).
• Delivery proofs stored outside the web root, random file names, session-controlled access.
• Restricted, logged administrator access.

9. Minors

Our services are aimed at adults. We do not knowingly collect data from children under 14.

10. Cookies

We use three categories of cookies:

• Necessary (always active): sign-in session, cart, security, remembering your cookie choice. Without them, the site does not work.
• Functional (with your consent): “Stay signed in” on this device (30 days).
• Audience measurement (with your consent): if you accept, we use Google Analytics (Google) for anonymised visit statistics. Without your consent, no audience measurement tracker is loaded.

On-site searches: we anonymously record the terms you type into the catalogue search and the number of results returned, solely to improve our catalogue — for example to spot requested products we do not carry yet. This record contains no identifier, no IP address, no session identifier, and cannot be used to track an individual visitor. Raw terms are kept for at most 90 days; afterwards, only anonymous weekly totals are retained.

You can accept, refuse or customize your choice via the banner shown on your first visit, and change it at any time using the “Change my cookie consent” link in the footer.

11. Changes to this policy

In the event of a significant change, we will indicate it by the update date above and, if necessary, by email.

12. Contact us