Privacy policy

Data controller

KYRENA, SAS with a share capital of €10,000, registered in the Paris trade and companies register (RCS) under number 498 850 643, registered office 231 rue Saint-Honoré, 75001 Paris, France, publishes www.kyrena.com and is the controller of the personal data described here.

KYRENA has not appointed a data protection officer; questions about this policy can be sent by post or through the contact form (see Your rights).

Data processed: purpose, legal basis, retention

KYRENA processes personal data only for the purposes below, each with its legal basis and retention period.

Visits to the site. Each visit leaves a line in the server log: IP address, date and time, page requested, referring page and browser identification. Purpose: to serve the site and keep it secure. Legal basis: legitimate interest (art. 6(1)(f) GDPR). Retention: one year at most.

Contact form. Name, e-mail address, company if given and message. Purpose: to answer the message and follow it up. Legal basis: legitimate interest (art. 6(1)(f) GDPR). Retention: three years at most after the last exchange. Messages are stored on the site’s server and forwarded to KYRENA’s mailbox, which an e-mail service provider hosts.

Customers. When a Cellublue product is bought on an online marketplace or in an online shop, KYRENA processes only the data needed to deliver the order and handle customer service, returns and warranty, which the platform passes on to it or the customer sends it: name, delivery address, contact details given for the order, its contents, exchanges with customer service. Payment is handled by the platform or its payment provider: KYRENA never receives card details. The platform is the controller of the customer account and of the payment, under its own privacy policy. Legal basis: performance of the contract (art. 6(1)(b) GDPR) and legal obligations (art. 6(1)(c) GDPR). Retention: for as long as the order, its after-sales service and its warranty run, then archived for the periods the law requires (accounting records: ten years).

Business contacts. The people KYRENA works with at suppliers, service providers, partners and customers: name, position, professional contact details and exchanges. Purpose: to manage the business relationship. Legal basis: legitimate interest (art. 6(1)(f) GDPR), or the contract (art. 6(1)(b) GDPR). Retention: for the relationship, then three years.

Recipients

Personal data is available only to the people at KYRENA who need it for these purposes.

Depending on the case, it may also be processed on KYRENA’s behalf and only on its instructions by:

• the host of the site, ILIONA;
• its e-mail service provider;
• the companies of the ILIONA group, logistics providers and carriers that prepare and deliver orders;
• the marketplaces and online shops that sell its products, for the orders placed with them;
• its accountants and advisers, bound by professional secrecy.

It is passed to public authorities only when the law requires it, and it is never sold or rented.

Outside the European Union

Some providers may process data outside the European Union. Any such transfer is covered by an adequacy decision of the European Commission or by its standard contractual clauses.

Cookies

This site sets no cookies and uses no analytics, advertising or social-media tools. It loads nothing from a third party: its text, images, fonts and code are all served from www.kyrena.com.

Security

KYRENA protects personal data with technical and organisational measures suited to the risks, including access limited to the people who need it and encrypted connections.

Your rights

Under the GDPR and the French Data Protection Act, everyone has the right of access to their personal data, and to its rectification, erasure, restriction and portability, and the right to object to its processing. Everyone may also give instructions on what becomes of their data after their death.

These rights are exercised by writing to KYRENA, 231 rue Saint-Honoré, 75001 Paris, France, or through the contact form. An answer is given within one month; proof of identity may be requested if there is reasonable doubt about who is making the request.

A complaint may also be lodged with the CNIL, the French data protection authority, or with the supervisory authority of the EU country of residence.

Changes

This policy is updated when the processing it describes changes; the date of the last update is below.

Last updated: 3 October 2026.