Skip to content
En Coton — organic cotton bag manufacturer
Quote00

Privacy policy

This English translation is provided for convenience. In case of discrepancy, the French version prevails.

Last updated: 13 November 2026.

This policy explains how your personal data is processed when you use encoton.com, in accordance with Regulation (EU) 2016/679 ("GDPR") and the French Data Protection Act of 6 January 1978 as amended.

1. Data controller

The data controller is SWP SARL, trading as "En Coton", 111 Boulevard Soult, 75012 Paris, France (SIRET 522 343 821 00016).

For any question about your data or to exercise your rights: contact@encoton.com or by post at the address above.

2. Data we collect

The site is intended for business customers. We only collect the data you give us and the data strictly necessary for the site to work:

  • Quote request: name, email address, company, telephone, message, products and quantities requested.
  • Trade customer account: name, company, email address, password (stored in encrypted form, which we cannot read), account approval status.
  • Correspondence: the content of messages you send us by email, telephone or WhatsApp.
  • Technical data: connection logs (IP address, date and time, pages requested) generated by our hosting provider to keep the site secure and working properly.
  • Browsing data, only if you consent: pages viewed, visit duration, device and browser type, referrer, approximate location, collected by Google Analytics.

We do not collect any sensitive data and do not use any advertising tool.

3. Purposes and legal bases

  • Answering your quote and contact requests — pre-contractual steps taken at your request (Article 6(1)(b) GDPR).
  • Creating and managing your customer account and giving access to trade prices — performance of a contract or pre-contractual steps (Article 6(1)(b)).
  • Processing your orders, invoicing and accounting — performance of the contract (Article 6(1)(b)) and legal obligations (Article 6(1)(c)).
  • Sending service emails (address verification, password reset, quote acknowledgement, account approval) — performance of the contract (Article 6(1)(b)).
  • Keeping the site secure and preventing abuse — legitimate interest (Article 6(1)(f)).
  • Measuring traffic and improving the site (Google Analytics) — your consent (Article 6(1)(a)), which you can withdraw at any time from the "Manage cookies" link at the bottom of the page.
  • Sending you commercial information about similar products, in a strictly professional context — legitimate interest (Article 6(1)(f)). You may object at any time, free of charge.

The information requested in the forms is needed to deal with your request; without it we cannot respond.

4. Recipients

Your data is intended only for the people at SWP SARL in charge of customer relations and site administration. It is neither sold nor rented.

It is hosted or processed on our behalf by the following processors, bound by a contract compliant with Article 28 GDPR:

  • Vercel Inc. (United States) — website hosting;
  • Convex, Inc. (United States) — database, customer accounts and quote requests;
  • Resend, Inc. (United States) — sending service emails;
  • Google Ireland Limited (Ireland) and its parent company Google LLC (United States) — Google Analytics audience measurement, only if you have consented.

Your data may also be passed to our carriers and manufacturing partners to fulfil an order, to our accountant, and to the authorities where the law requires it.

5. Transfers outside the European Union

As the processors listed above are established in the United States, your data may be transferred there. These transfers are covered by the standard contractual clauses adopted by the European Commission and, for providers that have signed up to it, by the EU–US Data Privacy Framework. You can obtain a copy of the applicable safeguards by writing to us.

6. Retention periods

  • Quote and contact requests that are not followed up: three (3) years from your last contact with us.
  • Customer account: for the duration of the business relationship, then three (3) years after the last contact; the account is deleted earlier on request.
  • Orders, contracts and business correspondence: five (5) years from the end of the relationship, the limitation period for commercial matters.
  • Invoices and accounting records: ten (10) years, in accordance with the French Commercial Code.
  • Technical logs: twelve (12) months at most.
  • Audience-measurement data: fourteen (14) months in Google Analytics; the corresponding cookies expire after thirteen (13) months at most.

At the end of these periods the data is deleted or anonymised.

7. Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and the right to object to its processing, in particular for marketing purposes. You may also give instructions about what happens to your data after your death.

To exercise these rights, write to us at contact@encoton.com. We will reply within one month; proof of identity may be requested where there is reasonable doubt.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr — or with the supervisory authority of your country of residence.

8. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), encrypted passwords, administration area restricted to authorised people, manual approval of trade accounts.

9. Cookies

The site uses cookies and local storage that are strictly necessary for it to work and, only with your agreement, audience-measurement cookies. Details are in our cookie policy.

10. Changes to this policy

This policy may be updated to reflect changes to the site or to the law. The date of the last update is shown at the top of the page.