Privacy policy

Article 1

Data controller

The controller of personal data is Onyx Forged SAS, whose registered office is at 173 rue de Courcelles, 75017 Paris, France. Contact: contact@onyxforgedwheels.com.

Article 2

Personal data collected

In the course of the business relationship and of the use of the site, Onyx Forged collects the following categories of data:

• Identification data: surname, first name
• Contact details: email address, telephone number, delivery and billing addresses
• Data relating to the vehicle: make, model, generation, registration number if necessary
• Order data: purchase history, quotations, invoices
• Connection data: IP address, logs, browsing data, cookies

Article 3

Purposes and legal bases

The data is processed for the following purposes:

• Performance of the contract: processing and follow-up of orders, delivery, invoicing, after-sales service and warranty.
• Legal obligations: retention of accounting and tax documents.
• Legitimate interest: site security, fraud prevention, improvement of services, audience measurement, personalisation of the experience, marketing to our customers for products or services similar to those already purchased (article L.34-5 of the French Post and Electronic Communications Code).
• Consent: registration for the Onyx Academy, sending of marketing communications to prospects (newsletter, new products, private offers, invitations to events), non-essential cookies, placing of advertising pixels.

Article 4

Marketing communications and the Onyx Academy

When you register for the Onyx Academy or when you pay for your order, you may consent, through a dedicated box that is not pre-ticked, to receive our marketing communications. This consent, freely given, covers in particular:

• The sending of our editorial newsletter (technical guides, educational content, brand news)
• The announcement of new models, finishes, limited series and exclusive configurations
• The sending of private commercial offers, promotions and invitations to events (shows, open days, presentations)
• The personalisation of the content sent to you, based on your declared interests, your vehicle, your browsing and purchase history, and your activity within the Academy
• The carrying out of satisfaction surveys, polls and market research
• The sending of targeted product recommendations and of reminders linked to your configurator or basket
• The building of lookalike audiences with advertising networks (Google, Meta), from hashes of your email address, for advertising targeting purposes

In accordance with the legal exemption provided for by article L.34-5 of the French Post and Electronic Communications Code, we may also send our existing customers, on the basis of our legitimate interest and without prior consent, information about products or services similar to those already supplied (in particular: accessories, additional finishes, after-sales services, new forged wheel models compatible with their vehicle).

You may withdraw your consent or object to these communications at any time via the unsubscribe link in each message, from the “My account” area of the Academy, or by writing to contact@onyxforgedwheels.com. This withdrawal does not affect the lawfulness of processing carried out beforehand.

Proof of your consent (date, source, version of the form) is kept for the whole duration of the processing and three years beyond, in order to meet the legal obligations to demonstrate consent.

Article 5

Recipients of the data

The data may be passed on to the following recipients:

• Authorised internal staff of Onyx Forged
• Partner production workshops (only the data needed for manufacture)
• Carriers and logistics providers responsible for delivery
• Payment service providers (Shopify Payments, PCI DSS Level 1 service provider)
• Host of the site (Lovable) and of the shop (Shopify)
• Audience measurement of the site, provided by the host (Lovable), and Shopify Analytics for the shop
• Platform for sending transactional emails (Resend)
• Technical subcontractors (cloud infrastructure, artificial intelligence tools used to generate visuals and for customer service)
• Administrative or judicial authorities on legal requisition

Onyx Forged ensures that its subcontractors comply with the GDPR and provide sufficient security guarantees.

Article 6

Retention periods

• Order and invoicing data: 10 years (accounting obligation)
• Active customer data: for the whole duration of the business relationship
• Inactive customer data: 3 years from the last contact
• Prospecting and Academy registration data: 3 years from the last active contact (email opened, click, Academy login, identified visit to the site)
• Proof of marketing consent: duration of the processing + 3 years
• Warranty data: 5 years (duration of the commercial warranty)
• Cookies and other trackers: 13 months at most (details for each tracker in section 10)

Article 7

Transfers outside the European Union

Some of our service providers and partners (in particular Shopify, Google and our partner production workshops) may process data outside the European Union. In that case, Onyx Forged ensures that these transfers are governed by appropriate safeguards (standard contractual clauses of the European Commission or adequacy decisions), a copy of which may be obtained on request from contact@onyxforgedwheels.com.

Article 8

Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:

• Right of access
• Right to rectification
• Right to erasure (subject to legal conditions)
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw your consent at any time
• Right to set guidelines for your data after your death

To exercise these rights, contact us at contact@onyxforgedwheels.com. Proof of identity may be requested in order to verify your identity.

In the event of difficulty, you may lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr.

Article 9

Data security

• Secure hosting (Shopify and Lovable)
• Encryption of payments (PCI DSS)
• Access to data restricted to authorised staff only
• Regular backups
• Internal incident management procedures

Article 10

Cookies and other trackers

A cookie is a small file placed in your browser; other trackers (local browser storage, pixels) work in the same way. Here are those of the site onyxforgedwheels.com.

Without your consent

• Operation of the site: the basket, the car and the settings you have entered, the language of the checkout, kept in your browser's storage so that the site remembers them. The content of the basket is sent to Shopify for the order.
• Audience measurement by the host: Lovable, which hosts the site, counts visits (pages viewed, origin, type of device) with a session-id cookie that expires 30 minutes after your last page. It is used only for the site's visit statistics.
• Payment: the payment page is served by Shopify, which places its own cookies there, described in its privacy policy.

With your consent

Today, the site uses no cookie or tracker subject to your consent: no third-party audience measurement, and no advertising pixel (Meta, Google). That is why no cookie banner is shown to you. If we add any, they will be placed only after your consent, collected by a banner where refusing is as simple as accepting, and they will be described here.

You can also set your browser to block or delete cookies; the basket and the saved settings would then no longer be remembered.

Article 11

Trying wheels on a photo

The page See wheels on your car lets you see a preview of our wheels on a photo of your car. This processing is based on your request: it takes place only if you send a photo.

• Purpose: to calculate the preview requested and then, if you wish, to answer your request for a quotation.
• Photo: it is reduced in size and re-encoded in your browser before it is sent (EXIF data, including the GPS position, are removed), transmitted for the time of the calculation, then forgotten: we do not store it and do not log it.
• Subcontractor: the calculation is made by an artificial intelligence model from Google (Gemini family), via the AI gateway of our host (Lovable), which process it under their own terms, where applicable outside the European Union (see the section Transfers). The image calculated by Google bears its invisible SynthID watermark; the preview displayed bears the visible mention “Aperçu IA” (AI preview).
• Preview attached to a request for a quotation: only if you tick the box provided (never ticked in advance). It is then kept for 30 days, the time it takes customer service to reply to you, then deleted automatically. We never publish it.
• Measurement and usage limits: for each try, we keep a non-reversible hash of the IP address, the model and finish of the wheel, the date, the outcome (preview successful or not), your opinion (“Ressemble”, looks like it, or “Ne ressemble pas”, doesn't look like it) if you give one, and your clicks to the quotation or to the model's page; neither photo nor image. These lines are used to limit abuse and to measure the quality of the tool; they are deleted after 13 months.

Article 12

Changes to the policy

Onyx Forged reserves the right to change this privacy policy at any time in order to adapt it to legal, regulatory or technical developments. The applicable version is the one in force at the time of your visit.