PRIVACY POLICY — KHAOS THEORY

1. Data controller

The data controller for personal data collected through the Khaos Theory website is:
EI – Vincent GÉRARD
Trading name: Khaos Theory
231 Rue Saint-Honoré
75001 Paris
France

SIREN: 928 374 297
SIRET: 928 374 297 00028

Email: contact@khaostheoryparis.com

2. Purpose of this policy

This policy explains which personal data may be processed when using the Khaos Theory website, placing and performing orders, making payments, invoicing, processing refunds and managing customer relations.

Khaos Theory seeks to limit collection and processing to information necessary for the purposes described below.

3. Data processed

Depending on how the site is used and which operations are performed, the following categories of data may be processed in particular:

- identity: first and last name;
- contact details: email address and, when provided or necessary, telephone number;
- delivery and billing addresses;
- country, city and postal code;
- order information: products, references, sizes, quantities, prices, delivery charges and total amount;
- payment and refund information, such as technical transaction, payment-session or refund identifiers;
- information needed for invoicing and any credit notes;
- technical information needed to operate, secure and administer the service.

Khaos Theory does not receive or directly store the full card numbers entered in the Stripe payment interface.

4. Purposes and legal bases

Data may be processed in order to:

- enable the creation, payment and performance of an order;
- manufacture and dispatch ordered products;
- manage payments, refunds, returns and claims;
- issue and manage invoices and credit notes;
- manage accounting and comply with applicable legal, tax and regulatory obligations;
- communicate with the customer about the order;
- operate, secure and technically administer the site and prevent abuse;
- enable the exercise and defence of Khaos Theory’s rights where necessary.

Depending on the purpose, processing is based in particular on performance of the contract or pre-contractual measures, compliance with a legal obligation or, where applicable, Khaos Theory’s legitimate interest in securing and operating the service and defending its rights.

5. Necessity of data

Certain information is necessary to conclude and perform an order, including the customer’s identity, email address, delivery information and information needed for payment.

The absence of some of this information may prevent Khaos Theory from processing or performing the order.

Optional information is identified as such when offered.

6. Payments — Stripe

Payments are processed using Stripe services.

For a payment, certain data necessary for the transaction is transmitted directly to Stripe. Khaos Theory may receive information needed to track the transaction, including payment-session and PaymentIntent identifiers, amounts, currency, payment status and references needed to reconcile the order.

Full card data is not received or directly stored by Khaos Theory.

Stripe processes the data transmitted to it in accordance with its own applicable obligations and terms.

7. Invoicing and accounting — Pennylane

Khaos Theory uses Pennylane for certain invoicing and accounting operations.

Information needed for these operations may include the customer’s first and last name, email address, billing address, telephone number where available, ordered-product information, prices, delivery charges, currency and references needed to reconcile the corresponding transactions.

This data may also be used to issue invoices and credit notes.

8. Infrastructure — Cloudflare

Khaos Theory uses Cloudflare services to host and run certain site functions, as well as technical services including storage of certain data, event-queue processing and protection of administrative interfaces.

In this context, technical data and certain information needed to process orders may transit or be stored within this infrastructure.

Technical logs may also be generated to operate, secure and diagnose the service.

9. Cart and local storage

The site cart is stored locally in the user’s browser using localStorage.

This storage may contain selected products, their reference, name, price, size and quantity.

This information remains in the browser’s local storage until removed by the site, the user or browser mechanisms.

The arrangements for cookies and similar technologies are described in Khaos Theory’s Cookies Policy:
/en/cookies

10. Contacting Khaos Theory

The Contact page currently has no form that directly collects data on the site.

When someone contacts Khaos Theory by email, the information they voluntarily provide is used to answer the request and, where necessary, follow up the related relationship or order.

11. Payment and refund data

Khaos Theory retains or uses technical references needed to track payments and refunds, such as Checkout Session, PaymentIntent or Refund identifiers provided by Stripe.

These references help reconcile payment operations, orders, refunds, invoices and credit notes.

They are not the customer’s full card number.

12. Recipients and providers

To the extent necessary for their respective tasks, data may be processed by Khaos Theory and by providers used to deliver the services necessary to operate the site and perform orders.

The main providers currently used include:

- Stripe for payment and refund processing;
- Pennylane for invoicing, credit notes and certain accounting operations;
- Cloudflare for technical infrastructure, site execution and certain storage and security functions.

Khaos Theory does not sell its customers’ personal data.

13. International data transfers

Some technical providers used by Khaos Theory may process data from or allow access to data in countries outside the European Economic Area (EEA).

Where required by law, these operations must be governed by a mechanism recognised under applicable data-protection law, including an adequacy decision or appropriate safeguards.

Data subjects may contact Khaos Theory for further information about processing concerning them.

14. Retention periods

Personal data is retained only for as long as necessary for the purposes for which it is processed, subject to periods required or permitted by applicable laws and regulations.

Data needed for day-to-day order management is retained for the time necessary to process and perform the order and follow the customer relationship.

Documents and data that must be retained for accounting and tax obligations may be archived for the legally required period, including ten years for the relevant accounting documents.

Certain data may also be retained for as long as necessary to establish, exercise or defend legal claims where justified.

Data processed by providers such as Stripe, Pennylane or Cloudflare may be subject to their own retention periods under their respective obligations and policies.

15. Security

Khaos Theory implements technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, disclosure or unlawful use.

Access to administrative interfaces is subject to access-control mechanisms.

As no information system can guarantee absolute security, measures are adapted and reassessed according to risks and service changes.

16. Data subject rights

Under applicable personal-data protection law, data subjects may, subject to the conditions provided by law, have in particular the following rights:

- right of access to their personal data;
- right to rectification of inaccurate or incomplete data;
- right to erasure where provided by law;
- right to restriction of processing;
- right to object where the relevant processing allows it;
- right to data portability where legal conditions are met.

The exercise of certain rights may be limited where processing or retention is necessary to comply with a legal obligation, perform a contract or establish, exercise or defend legal claims.

17. Exercising rights

Requests concerning personal data may be sent to:

contact@khaostheoryparis.com

Khaos Theory may request information reasonably necessary to verify the requester’s identity where this is necessary to avoid disclosing data to an unauthorised person.

18. Complaint to the CNIL

Data subjects also have the right to lodge a complaint with the competent supervisory authority.

In France, the competent authority is the Commission nationale de l’informatique et des libertés (CNIL), the French data-protection authority.
https://www.cnil.fr/

19. Commercial prospecting and audience analysis

As of this version, Khaos Theory does not use the site to deploy advertising pixels or audience-analysis tools such as Google Analytics, Meta Pixel, TikTok Pixel or Hotjar.

Khaos Theory does not use order data to carry out automated decision-making producing legal or similarly significant effects for the customer.

If these practices change, this policy and, where necessary, the site’s consent mechanisms will be adapted before implementation.

20. Changes to this policy

Khaos Theory may amend this Privacy Policy to reflect changes to the site, its services, providers or applicable legal obligations.

The version published on the site is the version currently applicable.

Last updated: September 2026.