Privacy policy

Last updated: May 8, 2026

1. Preamble

This Privacy Policy describes how Amplitude SAS (hereinafter “Amplitude”, “we”) collects, uses, retains and shares personal information about you when you visit the website amplitudewatches.co (hereinafter the “Site”), make a purchase, subscribe to our newsletter, or contact us through any other channel.

Amplitude is the controller of your personal data within the meaning of Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and French Law no. 78-17 of 6 January 1978, as amended (the “Data Protection Act”).

Contact details of the data controller

Amplitude SAS
10, rue de la Paix
75002 Paris
France
RCS Paris 982 698 102 — VAT no. FR90982698102
E-mail: contact@amplitudewatches.co

2. Personal data we collect

We collect three categories of personal data:

2.1 Browsing data (collected automatically)

When you browse the Site, we automatically collect certain information about your device and your browsing: IP address, browser type and version, time zone, operating system, browsing language, pages viewed, duration of visit, referring site (if any), search terms used to reach the Site, and interactions with content.

This data is collected by means of cookies, pixels and electronic tags described in article 5 of this Policy.

2.2 Order data (when you place an order)

We collect the information strictly necessary to process your order: surname and first name, e-mail address, billing and delivery postal address, telephone number, and history of your orders.

Payment information (credit card number, expiry date, security code) is collected and processed directly by our payment provider (Shopify Payments); Amplitude only has access to the data strictly necessary (last 4 digits of the card, card type, transaction status) and does not store any complete banking data.

2.3 Communication data

When you contact us by e-mail, contact form, WhatsApp, telephone or Instagram messaging, we collect your contact identifier, the subject of your request, and the content of our exchanges. When you subscribe to our “Friends of Amplitude°” newsletter, we collect your e-mail address and, where applicable, your first name.

When you offer us a watch for sale or consignment, we collect the elements you send us (photographs, descriptions, history, invoices, certificates of origin) as well as the contact details necessary for the continuation of our relationship.

3. Purposes, legal bases and retention periods

We process your personal data for the following purposes:

3.1 Management and execution of your orders

This includes payment processing, shipment, issuing invoices, after-sales service, management of returns, warranties and any complaints.
Legal basis: performance of the sales contract (GDPR art. 6.1.b).
Duration: 5 years from the end of the commercial relationship, then archiving for evidentiary purposes during the legal limitation period.

3.2 Management of your customer account

Legal basis: performance of the contract (GDPR art. 6.1.b).
Duration: as long as your account is active. An account is considered inactive after 5 years without login; it is then automatically closed and the data archived for an additional 5 years.

3.3 Sending our newsletter and commercial communications

Legal basis: your explicit consent (GDPR art. 6.1.a) if you are not a customer; legitimate interest (GDPR art. 6.1.f) for products or services similar to those you have purchased from us (article L. 34-5 of the French Postal and Electronic Communications Code).
Duration: 3 years from your last contact with us (order, e-mail open, click), or until you unsubscribe.

3.4 Audience measurement and improvement of the Site

This includes analysing Site traffic, optimising the user experience, identifying the most consulted content and products.
Legal basis: your consent (GDPR art. 6.1.a) when this involves non-essential cookies; legitimate interest (GDPR art. 6.1.f) for anonymised statistics strictly necessary for the operation of the Site.
Duration: 13 months for audience measurement cookies; 25 months for the anonymised statistical data derived from them.

3.5 Personalisation and online marketing

This includes the display of targeted advertisements on third-party sites (notably Google) and the measurement of their performance.
Legal basis: your consent (GDPR art. 6.1.a).
Duration: 13 months maximum for advertising cookies.

3.6 Fraud prevention and Site security

This includes detecting suspicious transactions, protecting against computer attacks, and securing our systems.
Legal basis: Amplitude’s legitimate interest in protecting its systems and customers (GDPR art. 6.1.f).
Duration: 6 months for connection logs; until resolution of fraud incidents.

3.7 Compliance with our legal obligations

Retention of invoices, tax and accounting declarations, traceability of second-hand goods (police register for second-hand trading).
Legal basis: Amplitude’s legal and regulatory obligations (GDPR art. 6.1.c).
Duration: 10 years (accounting invoices, art. L. 123-22 of the French Commercial Code); 5 years (register of second-hand items).

3.8 Management of requests to exercise your rights

Legal basis: legal obligation (GDPR art. 6.1.c).
Duration: 5 years from closure of the request.

3.9 Management of any disputes

Legal basis: Amplitude’s legitimate interest in asserting or defending its rights (GDPR art. 6.1.f).
Duration: until resolution of the dispute and expiry of appeal channels; settlement protocols and court decisions are archived in accordance with the law.

4. No automated decisions or profiling producing legal effects

Amplitude does not make any decisions producing legal effects concerning you or significantly affecting you on the sole basis of automated processing, within the meaning of article 22 of the GDPR.

Audience measurement and session replay tools (article 6) may constitute profiling within the meaning of article 4.4 of the GDPR, but without any associated automated decision. You may object to this at any time via the cookie management banner (article 5).

5. Cookies and other trackers

5.1 Consent management banner

In accordance with the recommendations of the CNIL (the French data protection authority) and the GDPR, on your first visit a banner is displayed allowing you to accept, refuse or configure non-essential cookies. You can change your choices at any time by clicking on the “Manage cookies” link accessible at the bottom of every page.

Cookies strictly necessary for the operation of the Site (session identification, basket, security, language and currency preferences) are placed without prior consent because they are essential for the provision of the service you have requested.

5.2 Cookies placed

Functional cookies (no consent required)

— _shopify_essential, _secure_session_id, _session_id: security and management of your session on the Site (duration: session or 1 year).
— cart, cart_currency, localization: storage of your basket, currency and language (duration: 1 year).
— storefront_digest, shopify_pay_redirect: security and payment processing (duration: 30 days to 1 year).

Audience measurement cookies (consent required)

— _shopify_y, _shopify_s, _y, _s (Shopify Analytics): measurement of Site traffic (duration: 30 minutes to 1 year).
— _ga, _gid, _gat, _ga_* (Google Analytics 4): visit statistics (duration: 13 months maximum).

Advertising and marketing cookies (consent required)

— Cookies placed by Google Ads and the Google & YouTube channel (Shopify) for conversion measurement and advertising personalisation (duration: 13 months maximum).

Session replay cookies (consent required)

— Cookies and identifiers placed by Lucky Orange for the recording of browsing sessions and the creation of heat maps (duration: 30 days).

5.3 Retention period of consent

Your consent choices are retained for a maximum period of 6 months, in accordance with the recommendations of the CNIL. Beyond this period, the banner will be presented to you again.

6. Recipients of your data and processors

Your personal data is never sold. It is accessible only to authorised persons within Amplitude, and to our technical processors, within the strict limits of their assignments:

E-commerce platform and hosting

— Shopify International Limited (Ireland) and Shopify Inc. (Canada): hosting of the Site, order management, payment processing (Shopify Payments), transactional e-mails, native statistics. Data hosted in European Union data centres (Google Cloud Platform — Europe). Safeguards for transfers outside the EU: adequacy decision of the European Commission for Canada; standard contractual clauses.

Audience measurement and advertising

— Google LLC (United States) — Google Analytics 4, Google Ads, Google Merchant Center: audience measurement, conversions, advertising personalisation. Safeguards for transfers outside the EU: membership of the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) and standard contractual clauses.

Behavioural analysis tools

— Lucky Orange LLC (United States) — session recording and heat maps, for the purpose of improving the user experience. Safeguards for transfers outside the EU: membership of the Data Privacy Framework and standard contractual clauses.

Security and infrastructure

— Cloudflare, Inc. (United States): protection against attacks, loading acceleration (CDN). Safeguards: standard contractual clauses; ISO 27001 certification.

Internal management tools

— Airtable Inc. (United States): internal tool used to manage our catalogue, our commercial follow-up and our customer relations. The following may be recorded there: your contact details (name, e-mail, telephone, address), the history of our exchanges and your orders, as well as any information relating to a sale or consignment you offer us. Safeguards for transfers outside the EU: membership of the EU-US Data Privacy Framework and standard contractual clauses.
— Make (formerly Integromat — Czech Republic): internal automations between our tools; data processed transits there without being retained beyond the time strictly necessary for the operation.
— Powerful Form Builder (Globo, Vietnam): personalised forms on the Site (watch valuation, contact requests). Safeguards for transfers outside the EU: standard contractual clauses.

Legal obligations

Your data may also be communicated to administrative or judicial authorities when required by law, as well as to our advisors (lawyers, accountants, statutory auditors) bound by professional secrecy.

7. Data transfers outside the European Union

Since some of our processors are established outside the European Union (notably in Canada and the United States), your personal data may be transferred to these countries. These transfers are governed by:

— the adequacy decisions of the European Commission (Canada — decision 2002/2/EC; United States — Data Privacy Framework decision of 10 July 2023, for organisations adhering to it);
— failing this, standard contractual clauses adopted by the European Commission (decision 2021/914);
— where applicable, additional technical and organisational measures.

You can obtain a copy of these safeguards by contacting us at the address indicated in article 11.

8. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding the personal data concerning you:

— Right of access (GDPR art. 15): obtain confirmation that your data is being processed and receive a copy of it.
— Right of rectification (GDPR art. 16): have inaccurate or incomplete data corrected.
— Right to erasure (GDPR art. 17): request the deletion of your data in the cases provided for by law.
— Right to restriction of processing (GDPR art. 18): request the temporary freezing of processing.
— Right to data portability (GDPR art. 20): receive your data in a structured, machine-readable format, or have it transmitted to another controller.
— Right to object (GDPR art. 21): object to processing based on legitimate interest or for prospecting purposes.
— Right to withdraw your consent at any time (GDPR art. 7) when processing is based on consent, without calling into question the lawfulness of processing carried out before such withdrawal.
— Post-mortem directives (Data Protection Act art. 85): define directives relating to the fate of your data after your death.

How to exercise your rights?

You can exercise your rights at any time by contacting us:
— by e-mail: contact@amplitudewatches.co;
— by post: Amplitude SAS, 10, rue de la Paix, 75002 Paris, France.

We may ask you for proof of identity in order to verify your request. We will respond within one month of receipt, extendable by two months in the event of a complex request or large volume.

Complaint to the CNIL

If, after contacting us, you consider that your rights under data protection law are not being respected, you may lodge a complaint with the French data protection authority (CNIL):

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr

9. Security of your data

Amplitude implements appropriate technical and organisational measures to protect your data against any unauthorised access, alteration, disclosure or destruction: TLS encryption of communications, hosting on certified infrastructure (Shopify, Google Cloud), strict management of internal access, strong authentication for administrators, regular backups.

In the event of a personal data breach likely to give rise to a risk to your rights and freedoms, Amplitude will notify the CNIL within 72 hours and, when the risk is high, will inform you as soon as possible.

10. Modifications to this Policy

We may need to update this Privacy Policy to reflect a change in our practices, our processors, or for operational, legal or regulatory reasons. The date of the last update appears at the top of this Policy. In the event of a substantial modification, we will inform you by any appropriate means.

11. Contact us

For any question relating to this Privacy Policy or to the processing of your personal data:

Amplitude SAS
10, rue de la Paix
75002 Paris
France
E-mail: contact@amplitudewatches.co