Version dated June 17, 2026
This Privacy Policy explains how FLAG & KO collects, uses, stores, and protects the personal data of users, visitors, prospects, and customers of the ericflag.com website.
It applies to the processing of data in connection with browsing the ericflag.com website, creating a customer account, placing and tracking orders, customer service, returns, cancellations, warranties, marketing communications, and the use of the features offered on the website.
Digital programs, training courses, external platforms, or services accessible from another website or subdomain may be subject to a separate privacy policy when such a policy is posted.
The data controller is:
FLAG & KO
Simplified joint-stock company with a share capital of 1,000 euros
Registered with the Paris Trade and Companies Register (RCS) under number 851 395 335
Registered office: 229 rue Saint-Honoré, 75001 Paris, France
General contact email: boutique@ericflag.com
Customer service email: sav@ericflag.com
For any inquiries regarding your personal data, please contact us at the following email address: boutique@ericflag.com.
FLAG & KO operates the website under the Eric Flag brand.
We collect only the data necessary for the purposes described in this Privacy Policy.
Depending on how you use the site, we may collect the following categories of data:
name;
first name;
email address;
phone number;
billing address;
shipping address;
country of residence or country of delivery;
customer account information, when you create an account.
order number;
products ordered;
order amount;
selected shipping method;
order status;
purchase history;
information regarding returns, exchanges, refunds, cancellations, warranties, and after-sales service requests;
communications with our Customer Service team.
Payments are processed by secure payment service providers.
We do not store your full credit card information. Depending on the payment method used, we may receive limited information necessary to track the transaction, such as the payment status, the payment method used, the last four digits of the card, the transaction ID, or information needed for a refund.
When you visit the website, certain technical data may be collected automatically, including:
IP address;
device type;
browser used;
operating system;
pages viewed;
products viewed;
actions performed on the site;
traffic source;
cookie or tracking identifiers;
technical logs necessary for the security, diagnostics, and proper functioning of the site.
When you subscribe to our newsletter, participate in a promotional campaign, or accept certain cookies, we may process:
your email address;
your marketing preferences;
your consent history;
your email opens and clicks;
your browsing or purchasing behavior, when used to personalize our communications, subject to applicable consent rules.
We may process the data you provide to us when:
contact Customer Service;
you communicate with us via email, contact forms, WhatsApp, messaging apps, or social media;
you leave a review;
you are participating in a contest, a survey, an ambassador program, or a community initiative;
You send us photos, videos, or other content related to the use of our products.
When you exercise your right of withdrawal using the dedicated feature, we collect the data necessary to process your request, including:
name;
first name;
email;
order number;
relevant product(s);
date the order was received;
the content of your declaration;
date and time the report was submitted;
proof of sending the acknowledgment of receipt.
The data we process comes primarily from:
information that you provide to us directly;
about your browsing activity on the site;
from your customer account;
of your orders;
from your interactions with our Customer Service team;
our technical, logistics, payment, email marketing, customer review, analytics, or advertising service providers;
social media or third-party platforms when you interact with us on those platforms.
We process your personal data for the following purposes and on the following legal grounds:
| Purpose | Relevant data | Legal Basis |
|---|---|---|
| Navigation and Site Functionality | technical data, strictly necessary cookies, logs | legitimate interest and, as applicable, performance of the contract |
| Creating and Managing Customer Accounts | identification, contact information, account history | performance of the contract or precontractual measures |
| Order Processing | identification, contact, delivery, billing, order | performance of the contract |
| Payment and Transaction Security | transaction data, payment status | performance of the contract, legal obligation, legitimate interest in preventing fraud |
| Delivery and Package Tracking | name, address, phone number, email address, order number, shipping information | performance of the contract |
| Customer Service and Request Management | contact information, order history, correspondence, documents provided | performance of the contract, legitimate interest, or legal obligation, as applicable |
| Handling Returns, Exchanges, Refunds, and Warranties | order, products, after-sales service exchanges, any supporting documentation | performance of the contract, legal obligation, legitimate interest |
| Handling the Right of Withdrawal | identity, order, statement, timestamp, acknowledgment of receipt | Legal Obligation and Performance of the Contract |
| Customer Review Management | identity, order, review, rating, published content | legitimate interest or consent, depending on the method of collection |
| Sending newsletters and promotional offers | email, preferences, subscription history, email interactions | consent or legitimate interest for existing customers where permitted by law |
| Personalization of Marketing Communications | purchase history, products viewed, preferences, interactions | Consent for non-essential cookies; legitimate interest or consent, depending on the channel used |
| Targeted Advertising and Advertising Measurement | cookies, identifiers, browsing or purchase events | consent when required |
| Statistics, Audience Measurement, and Website Improvement | browsing data, page views, events, performance | consent or legitimate interest if the tool used meets the applicable exemption criteria |
| Site Security, Fraud Prevention, and Combating Abuse | logs, IP addresses, technical events, order data | legitimate interest |
| Compliance with accounting, tax, and legal obligations | invoices, orders, payments, refunds | legal obligation |
| Defending Our Rights | orders, correspondence, evidence, logs, required documents | legitimate interest |
| Management of contests, community campaigns, or ambassador programs | identity, contact, participation, submitted content | processing necessary for the performance of the transaction, consent, or legitimate interest, as applicable |
You can sign up for our newsletter to receive tips, special offers, news, sneak peeks, contests, and updates related to the Eric Flag universe.
If you are not yet a customer, we will only send you marketing communications via email or text message with your prior consent.
If you are already a customer, we may send you marketing communications regarding products or services similar to those you have previously ordered, provided that we have informed you of this practice and allowed you to opt out easily and free of charge.
You can unsubscribe at any time:
by clicking the unsubscribe link in our emails;
or by contacting us at boutique@ericflag.com.
We do not sell your personal data to third parties.
If we were to share your data with a business partner for its own marketing purposes, we would obtain your prior consent when required by law.
This site uses cookies and other tracking technologies.
Some cookies are strictly necessary for the website to function, for security, for the shopping cart, for payment, for session management, or for displaying preferences. These cookies do not require your consent.
Other cookies—including non-exempt audience measurement cookies, personalization cookies, targeted advertising cookies, social media cookies, and marketing performance measurement cookies—are placed only with your consent when such consent is required.
You can accept, reject, or configure non-essential cookies using the banner or the consent management module displayed on the website.
You can change your preferences at any time by clicking the link or using the cookie management tool available on the website.
For more information, please see our Cookie Policy.
Your personal data may be accessible, within the limits of their respective responsibilities, to the following individuals and departments:
In-house team: Eric Flag FLAG & KO;
Customer Service;
logistics team;
marketing and e-commerce team;
technical service providers;
web hosting provider and e-commerce platform;
payment service providers;
carriers and delivery service providers;
returns management service providers;
email marketing, CRM, and marketing automation providers;
customer review providers;
audience analytics providers;
advertising platforms and social media networks, when the relevant trackers or integrations have been accepted;
package tracking tools;
accounting, legal, tax, and administrative service providers;
administrative or judicial authorities when required by law.
These recipients have access only to the data necessary for their duties.
In connection with the operation of the website and the online store, we may use the following categories of service providers, among others:
| Category | Examples of service providers or services | Role |
|---|---|---|
| E-commerce platform and web hosting | Shopify | store hosting, website management, shopping cart, checkout, orders, customer data |
| Payment | Shopify Payments, Shop Pay, PayPal, Klarna, Apple Pay, Google Pay, or other available payment methods | Secure processing of payments and refunds |
| Shipping and Logistics | carriers, logistics providers, package tracking services | Shipping, Delivery, Returns, Tracking |
| Email Marketing and CRM | email marketing, newsletter, and marketing automation tools, including Klaviyo if enabled | Sending transactional or marketing emails, segmentation, automation |
| Customer Service | email, form, messaging, WhatsApp, or customer service tool | processing customer requests |
| Customer reviews | Trustpilot or another review platform | collection and display of customer reviews |
| Analytics and Performance | audience and performance measurement tools | Traffic Analysis and Website Optimization |
| Advertising and Social Media | Google, Meta, TikTok, Pinterest, or other advertising platforms, if enabled | advertising measurement, targeting, retargeting, attribution, subject to consent where required |
| Security and Fraud Prevention | security tools, anti-fraud tools, and technical logs | protection of the site, transactions, and users |
The exact list of service providers may change depending on the site’s technical and business needs. When necessary, we ensure that service providers provide appropriate safeguards regarding data protection.
The ericflag.com website is powered by the Shopify platform.
As part of your use of the site, Shopify may process certain personal data necessary for the store to function, including your account, order, payment, shipping, browsing, device, and store interaction data.
When Shopify processes data to provide us with online store services, Shopify acts primarily as a data processor for FLAG & KO.
In certain cases, particularly for certain services associated with Shopify, Shop, Shop Pay, or certain enhanced services, Shopify may process certain data as an independent data controller, in accordance with its own privacy policy.
We invite you to review Shopify’s privacy policy on Shopify’s official website for more information about the data processing activities carried out by Shopify in its capacity as a data controller.
Some of our service providers may be located outside the European Union or may process data from countries outside the European Union, particularly in connection with hosting, payment, email marketing, customer support, analytics, advertising, security, or maintenance services.
When personal data is transferred outside the European Union, we ensure that such transfers are subject to appropriate safeguards, including:
a suitability decision by the European Commission;
standard contractual clauses adopted by the European Commission;
additional contractual, organizational, or technical measures, as necessary;
or any other mechanism recognized by applicable regulations.
We retain your data only for as long as necessary to fulfill the purposes for which it was collected, and then, where necessary, for the applicable statutory periods or the time required to defend our rights.
The main durations are as follows:
| Data category | Estimated shelf life |
|---|---|
| Customer Account Information | length of time the account remains active, followed by deletion or archiving in accordance with applicable requirements |
| Order Information and Business Relationship | the duration of the business relationship, followed by archiving for as long as necessary to meet requirements related to evidence, warranties, legal obligations, and applicable statutes of limitations |
| Invoices and Accounting Documents | 10 years from the end of the relevant fiscal year |
| Payment Information | the time required for the transaction, refund, verification, and legal obligations; FLAG & KO does not retain complete credit card information |
| Shipping Information | time required for delivery, tracking, customer service, and proof of proper performance |
| Customer Service Information, Returns, Warranties, and Cancellations | the time required to process the request, followed by retention for as long as necessary to establish and defend our rights |
| Data on prospects who have never made a purchase | 3 years from the last active contact or until consent is withdrawn |
| Customer data used for marketing purposes | 3 years from the end of the business relationship or until an objection is raised, as applicable |
| Marketing Consent and Cookie Information | the period required to establish consent or refusal, in accordance with applicable rules |
| Cookies and Trackers | the period specified in the Cookie Policy or in the consent management module |
| Technical and Security Logs | a duration commensurate with security, diagnostic, and incident prevention needs |
| Customer reviews | the duration of the notice's display or until it is removed, depending on the applicable terms and conditions |
| Contests and Promotional Campaigns | the duration of the transaction, followed by the time required for verification, claims management, and legal obligations |
These retention periods may be extended when required by law, when a claim is pending, or when retention is necessary for the establishment, exercise, or defense of legal rights.
In accordance with applicable regulations, you have the following rights regarding your personal data:
right of access;
right to rectification;
right to erasure;
right to object;
right to restriction of processing;
the right to data portability, where applicable;
the right to withdraw your consent at any time for processing based on consent;
the right to set guidelines regarding what happens to your data after your death;
the right to file a complaint with the CNIL.
The exercise of these rights may be restricted in certain cases, particularly when the processing is necessary for the performance of a contract, to comply with a legal obligation, to defend our rights, or for compelling legitimate reasons.
You can exercise your rights by contacting us at the following address:
Please clearly state the purpose of your request and the data or processing operations involved.
We may ask you for additional information only if it is necessary to verify your identity or understand your request. A copy of your ID will be requested only if there is reasonable doubt regarding your identity.
We respond to requests to exercise rights within one (1) month of receiving them. This period may be extended by an additional two (2) months in the event of a complex request or a large number of requests. In such cases, you will be notified of the extension and the reasons for the delay.
We implement appropriate technical and organizational measures to protect your personal data from destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
These measures may include, among other things:
access restricted to authorized personnel;
securing internal accounts and tools;
encryption or securing of communications, where appropriate;
use of service providers that offer security guarantees;
backups and business continuity measures;
monitoring of technical incidents;
internal procedures for handling requests and incidents.
Despite our best efforts, no system is completely risk-free. In the event of an incident that could affect your personal data, we will take the necessary measures in accordance with applicable regulations.
The ericflag.com website is not specifically intended for minors.
We do not intentionally collect personal data from minors under the age of 15 without parental consent.
If you believe that a minor has provided us with personal data without proper authorization, please contact us at boutique@ericflag.com so that we can take the necessary steps.
When you interact with Eric Flag social media, the relevant platforms may process your personal data in accordance with their own privacy policies.
If you tag us, send us content, participate in a community activity, or allow us to repost content, we may process the information necessary for that interaction, including your username, your message, your content, and related information.
If the use of certain content requires specific authorization, such authorization may be requested separately.
We may ask for your feedback after you place an order in order to improve our products and services and to help future customers benefit from your experience.
Reviews can be collected directly or through a specialized service provider. The information displayed publicly depends on the settings of the service used and the content you choose to post.
Please contact us with any questions regarding a review about you.
When you choose a payment method offered by a third-party provider—such as installment payments, deferred payments, or payments via an e-wallet—that provider may process your personal data in accordance with its own terms and privacy policies.
We encourage you to review the information provided by the relevant payment service provider before selecting this payment method.
The site may contain links to third-party sites, such as social media platforms, payment platforms, digital program platforms, review platforms, partners, or external content.
We are not responsible for the privacy practices of these third-party sites. We encourage you to review their privacy policies.
If you believe that the processing of your personal data does not comply with applicable regulations, you may file a complaint with the Commission Nationale de l’Informatique et des Libertés.
CNIL
3 Place de Fontenoy
TSA 80715
75334 Paris Cedex 07
France
Website: cnil.fr
We may amend this Privacy Policy to reflect changes to the website, our tools, our data processing practices, or applicable regulations.
The applicable version is the one published on the website at the time of your visit.
In the event of a substantial change, we may notify you by any appropriate means and, when necessary, obtain your consent.
We look forward to hearing from you.
sav@ericflag.com or on WhatsApp for an even faster response!