Privacy policy

Your data is used in connection with a particular enquiry, order or service. This page explains the information CKYSTONES uses, who receives it and how to exercise your rights.

Last updated: 9 October 2026

Your point of contact

The controller for the processing described here is Yanis Chelbi-Kariche, a sole trader trading as CKYSTONES, SIRET 83877816500020. The registered office is at 10 rue de la Paix, 75002 Paris, France. The appointment address, 29 rue de Bassano, 75008 Paris, is separate from the registered office.

For questions or requests concerning your data, contact ckystones@www.ckystones.com, or write to the registered office, marking your correspondence “Personal data”.

The information involved

Depending on your enquiry, we use your name, email address, telephone number, billing and delivery details, orders, transaction amounts and references, payment status, correspondence and appointment preferences. A course, gemmological assessment or bespoke creation enquiry may include a description, photographs and relevant documents. Please avoid attaching information unrelated to your project.

The website also processes technical information: an IP address or hashed version, depending on the form, connection information, the referring page and campaign parameters where present. Hashing does not necessarily make data anonymous.

Required fields are marked. Without them, we may be unable to reply or provide the requested service; other fields are optional. If a partner or another person gives us your details, we explain their source and intended use when we first contact you, within the applicable time limits.

Why we use it

  • Quotations, accounts, orders, delivery and follow-up: taking steps at your request before a contract or performing the contract.
  • General enquiries: CKYSTONES’ legitimate interest in responding to people who contact the business.
  • Accounting and required records: compliance with legal obligations.
  • Security, abuse prevention and evidence relating to disputes: our legitimate interest in protecting services and defending our rights, proportionately.
  • Newsletters and optional services offered in the privacy settings panel: your consent, given separately for the purposes concerned.
  • Requests concerning your rights: compliance with obligations under data protection law.

An enquiry confirmation or a message needed to fulfil an order does not constitute a marketing subscription.

The newsletter and your choices

The newsletter uses Mailchimp to manage subscriptions and send emails. The form includes email confirmation and passes information including your email address and subscription IP address to the service. You can withdraw consent using the unsubscribe link in the emails or by writing to us.

Cookie choices are separate. The permanent “Cookie choices” button lets you change them. Accepting cookies or allowing external forms to load does not subscribe you to the newsletter. See our cookie policy for the services and periods concerned.

Recipients and service providers

Relevant information is accessible to people authorised to deal with your enquiry. The following services are involved depending on the use concerned:

These recipients receive information relevant to their role. A jeweller may receive the information needed for the project you entrust to them. Competent authorities may receive data where disclosure is legally required. Third-party services may also have their own obligations and responsibilities.

Retention periods and criteria

Retention depends on the purpose. Data used to provide a current service is distinct from records needed for a legal obligation or dispute:

  • Enquiries and attachments: dealing with the question, preparing the project and follow-up correspondence determine how long they are useful. After closure, further retention must relate to a contract, legal obligation or relevant evidence.
  • Account: retention depends on maintaining the service requested, its use and any request to close it. Closing an account does not erase legally required order archives.
  • Orders and services: fulfilment, delivery, guarantees and follow-up; relevant records may then be archived for applicable obligations or legal claims.
  • Invoices and supporting accounting records: ten years. Electronic contracts with a consumer for at least €120 are retained for ten years from conclusion if performance is immediate; otherwise, until delivery or performance and for ten years from that date.
  • Newsletter: the address is used while the subscription remains valid, until consent is withdrawn. Loss of contact must lead to a review of whether retention remains useful; information used to honour an objection serves a separate purpose.
  • Technical and security records: retention depends on detecting and analysing incidents and, where relevant, preserving only pertinent evidence.

Closing an enquiry, withdrawing consent and the expiry of a legal obligation therefore do not necessarily have the same effect on all data. You can ask us about the criteria applicable to your records.

International processing

Some services used may process data, or allow access to it, from a country outside the European Economic Area. The providers’ notices linked above explain their own international practices; they do not replace information concerning your records.

You can write to ckystones@www.ckystones.com to ask about recipients, processing locations and applicable safeguards, and how to obtain the relevant documents.

Exercising your rights

Subject to the GDPR’s conditions, you can request access, rectification, erasure or restriction of processing. You can object to processing based on legitimate interests on grounds relating to your situation; no justification is needed to object to direct marketing. Portability concerns data you have provided, processed automatically on the basis of consent or a contract.

You can withdraw consent at any time without affecting earlier lawful processing, and give instructions about what happens to your data after your death under French law.

Write to ckystones@www.ckystones.com or by post to CKYSTONES, 29 rue de Bassano, 75008 Paris, France, specifying your request. Proof of identity is requested only where there is reasonable doubt. The response period is one month; an extension of two months may be necessary because of the complexity or number of requests, with notice given within the first month.

You can also lodge a complaint with the CNIL, Service des plaintes, 3 Place de Fontenoy, 75007 Paris, France. This policy is updated when the services or their processing activities change.