Privacy policy

ETABLISSEMENTS MORA SARL (ETS MORA), a French simplified joint-stock company (SAS) with capital of €10,000, registered with the Meaux trade register under number 316780626, Acep 77, 113 avenue du Général Leclerc, 77400 Lagny-sur-Marne, France, is responsible for the processing described here. For privacy enquiries and rights requests, email morastylos@wanadoo.fr or write to that address. No data protection officer has been appointed.

Identity and contact: names, email, delivery and billing addresses, and telephone numbers needed for delivery or supplied in enquiries. Account: identifier, password hash, sessions, last sign-in, saved addresses and order history.

Orders: items, quantities, prices, delivery and tracking, invoices, payment references and status, correspondence, withdrawal declarations, returns and refunds. Stripe processes payment; MORA STYLOS does not retain the full card number or security code. We also retain accepted terms, their version and acceptance date, documents and separately accepted product characteristics.

Pen-sale proposals: contact details, description, brands and uploaded photographs or files. The initial form does not request identity documents. If a purchase proceeds, identity information needed for the statutory second-hand-goods register is collected separately with appropriate information. The register format and procedure remain to be confirmed before that collection.

Preferences: marketing choices, the wording shown, version, timestamp and source of consent or withdrawal. Browsing and security: IP address, browser, requests, technical Turnstile signals and the cookies described in section 11. Do not submit sensitive information or identity documents in free-text fields.

Required fields are necessary for the request concerned; without them it cannot be processed. Optional fields are your choice. The site does not offer business-to-business sales or personalised engraving.

Accounts and orders: pre-contractual steps and performance of the contract. Account data is retained until deletion or three years of inactivity, measured from the last sign-in or order. Information needed for contract follow-up and guarantees then moves to restricted archives for five years after the relationship ends.

Invoices and accounting records: legal obligation, ten years from the financial year end. Electronic contracts of at least €120 and their evidence are retained for ten years after conclusion if delivery is immediate; otherwise they are retained from conclusion until delivery and for ten years after delivery. Account deletion does not remove those records.

Contact enquiries and pen-sale proposals: pre-contractual steps for proposed sales or purchases, and our legitimate interest in replying to other enquiries. Retained during handling and for no more than three years after the last exchange initiated by the sender, unless a contract, legal obligation or dispute requires separate archiving. Mailbox messages and attachments are included in that review.

Withdrawal, returns and guarantees: performance of the contract and legal obligations; declarations and acknowledgements are retained with the contract file for the periods above. Complaints and disputes: our legitimate interest in defending rights until the dispute and appeal periods end.

Email offers: optional consent. Permission collected on this site expires no later than three years after its last explicit renewal. Withdrawal immediately excludes the address from the eligible-recipient list. Evidence of choices and the minimum suppression information are retained with restricted access for three years after withdrawal or expiry.

Security and fraud prevention: legitimate interest in protecting the service. Transaction information needed for challenges is retained for up to thirteen months, subject to contractual and legal archives. Technical logs are limited to the time needed for diagnosis or an incident; hosting-provider settings are reviewed with the providers.

Privacy-rights requests: legal obligation, during handling followed by five years in a limited evidence archive. Audience measurement: consent; the verified Analytics property retains events for two months and user data for fourteen months, resetting user retention on new activity. These settings do not limit most aggregated statistical reports.

Atlas backups are stored in Paris and retained for seven days, with a seven-day point-in-time recovery window. They support service continuity and do not extend commercial use of deleted information. Archived records remain separate from marketing lists.

An account, order, enquiry or acceptance of sales terms does not subscribe you to offers. A separate, optional, unchecked choice is used for email offers from MORA STYLOS about its pens and accessories.

Change your choice in your account, use the unsubscribe link in each offer or email morastylos@wanadoo.fr. Messages needed for orders, security and withdrawal remain independent. Offers may be sent manually using the list of current permissions. No dedicated email-marketing platform is used at this stage.

MORA STYLOS does not use telephone numbers for marketing. Personal information is not sold or rented to third parties.

Access is limited to André Mora, the accountant for accounting work and One Glance Studio for technical support, according to their needs. Providers, contact addresses and purposes are listed below. Authorised public authorities may receive information where required by law.

Providers receive information needed for their function. Some, including Stripe and carriers, also determine their own regulatory or security processing and therefore do not act exclusively on our instructions. The accountant’s identity and address remain pending.

The site uses HTTPS, password hashes, limited sessions, access controls, form protection and rate limits. New customer passwords use scrypt; imported legacy hashes are upgraded on successful sign-in. Order documents are restricted to the customer concerned and authorised administrators.

MongoDB Atlas manages regular database backups. Passwords, tokens and form contents are not intended for application diagnostic logs. Personal-data breaches are notified to the CNIL and, where there is a high risk, the affected people, as required by the GDPR.

The o2switch application server is hosted in France, and Atlas data and backups in AWS Paris. This does not make all processing exclusively European. Cloudflare, MongoDB, Stripe and Google also use international infrastructure or staff, including in the United States. One Glance Studio may access information from Malaysia for technical support. International delivery requires sharing necessary details with carriers and destination-country participants.

Recipients, countries and transfer mechanisms are detailed below with direct links to the safeguards. Copies of applicable safeguards are available free of charge at morastylos@wanadoo.fr, with only the redactions needed to protect third-party data and confidential information. The Data Privacy Framework covers transfers to certified US organisations for the processing concerned; standard contractual clauses refer to Decision (EU) 2021/914.

For delivery outside the EEA, only names, addresses and contact details needed for carriage are shared. The GDPR article 49(1)(b) contractual derogation applies only to strictly necessary occasional transfers where its conditions are met; it does not justify regular transfers by technical services. Carrier mechanisms appear below.

Public information was reviewed on 29 October 2026. It does not by itself prove acceptance of an agreement for the MORA STYLOS account. Unverified safeguards, including those for technical access from Malaysia, remain explicitly pending.

Cloudflare, Inc.

Global network, including United States

The DPA provides for the EU–US Data Privacy Framework for data transferred to Cloudflare, Inc. in the United States. Sections 6.2 and 6.3 provide standard contractual clauses for transfers not covered by an adequacy decision.

• Cloudflare — DPA and transfers

Stripe Payments Europe / Stripe Technology Europe / Stripe, LLC

Ireland, United States and international network

Stripe’s transfer addendum gives priority to the Data Privacy Framework for Stripe, LLC in the United States. Its standard contractual clauses apply when that framework does not cover a transfer. Stripe also acts as a separate controller for certain checks and obligations.

• Stripe — transfer addendum
• Stripe — data processing

MongoDB, Inc. — Atlas

Data and backups in Paris; international support

Atlas data and backups are stored in AWS Paris (eu-west-3). DPA section 9.3 provides the Data Privacy Framework for covered US transfers and Schedule 1 standard contractual clauses for destinations without adequacy. French storage does not exclude international support access.

• MongoDB — DPA, section 9 and Schedule 1

Google — Gmail

Ireland, United States and Google network

Gmail sends website emails. Google states that it applies the Data Privacy Framework to covered transfers to Google LLC in the United States and standard contractual clauses to transfers without an adequacy decision. This mailbox is not represented as a Google Workspace account with a verified service-specific agreement.

• Google — transfer safeguards

Google — Google Analytics

Ireland, United States and Google network; after consent

Google Analytics is enabled only after consent. Google relies on the Data Privacy Framework for covered transfers to Google LLC; its processing terms provide standard contractual clauses for other transfers requiring safeguards. These terms are separate from Gmail’s terms.

• Google Analytics — processing terms
• Google — transfer safeguards

o2switch

France

The application server is hosted in France. No transfer outside the EEA was identified for this hosting in the verified configuration. Processing terms and any provider changes require review.

• o2switch — processing agreement

Orange — Wanadoo

France; any other processing locations to be confirmed

Wanadoo receives enquiries and correspondence. The provider’s French address does not establish exclusively French processing. Subprocessor access locations and any service-specific transfer mechanism remain to be confirmed with Orange.

• Orange — privacy information

La Poste / Colissimo

EU or EEA; delivery countries and international subprocessors

La Poste’s policy provides standard contractual clauses, with additional measures where needed, or binding corporate rules for its non-EEA subprocessors. Delivery data is limited to what is necessary for carriage.

• La Poste — transfers, section VI

Chronopost

France and delivery countries; Madagascar, Senegal, Togo, Mauritius and Côte d’Ivoire depending on processing

Chronopost identifies standard contractual clauses for address correction and geocoding in Madagascar and certain customs processing in Togo and Mauritius. Its policy provides standard contractual clauses or binding corporate rules for complaints handled in Senegal, Togo, Mauritius, Madagascar and Côte d’Ivoire. Shared data remains limited to transport needs.

• Chronopost — sender and recipient data

United Parcel Service France SAS / UPS group

France, United States and delivery countries

UPS describes binding corporate rules for intra-group transfers and standard contractual clauses for transfers requiring them. Its EEA addendum and privacy code provide details.

• UPS — transfers and EEA addendum

One Glance Studio Sdn. Bhd.

Malaysia — remote technical access

Maintenance access from Malaysia is a transfer outside the EEA. The processing agreement and appropriate standard contractual clauses, with the necessary assessment and supplementary measures, remain to be finalised. They are not represented as already signed.

• One Glance Studio — provider information

Accountant

Identity, address and access country to be confirmed

The accountant’s identity and access locations remain to be supplied. Any transfer outside the EEA must be identified and supported by an appropriate mechanism before data is shared.

You may request access, correction, deletion, restriction and, where applicable, portability. You may object to legitimate-interest processing under the applicable conditions and to all marketing at any time without giving a reason. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal, and give instructions about your information after death. Deletion remains subject to legal retention and the defence of rights.

Email morastylos@wanadoo.fr or write to the address in section 1. We respond within one month; a reasoned extension of two months is possible for complex requests, with notice during the first month. Proportionate identity evidence may be requested where there is reasonable doubt. You can complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

MORA STYLOS does not make decisions with legal or similarly significant effects based solely on automated processing. Site security and Stripe fraud checks may be automated; Stripe explains its own processing in its privacy policy.

Purchases are intended for adults with contractual capacity. We do not knowingly collect children’s information; contact us if such a situation needs correcting.

Necessary cookies support the bag, sign-in, form security, explicit language choice and preference storage. They do not require the permission used for optional trackers. Names, purposes and lifetimes appear in the cookie policy.

Google Analytics stays disabled before permission. Accept and Refuse have equal prominence, and preferences can be changed in the footer. Choices and Analytics cookies last up to 180 days. Account, bag, checkout, contact, pen-sale, unsubscribe and withdrawal pages are excluded from measurement. Advertising features are disabled.

Turnstile protects contact and pen-sale forms from bots using technical security signals, separately from Google Analytics. Stripe supplies information on its own payment page. The site embeds no advertising tracker or social-network widget.

Turnstile · Cookie policy

The date and version appear at the start of this policy. Important changes to purposes or choices will be announced on the site or by email, with renewed consent where required.