Cookie consent

We use cookies that the shop needs to work and, only with your consent, statistics and marketing cookies.

Learn more

Privacy policy

Last updated: 10 October 2026.

This policy explains how we process your personal data when you visit www.kitoffgrid.com, create a customer account or place an order. It is the information required by Articles 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and by French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (the "Loi Informatique et Libertés").

1. Data controller

The controller is Marny Energy, a French simplified joint-stock company (société par actions simplifiée) with a share capital of EUR 10,000, registered office at Bel Air Industrie, Bel Air 2, 7 rue Alfred de Musset, 69100 Villeurbanne, France, registered with the Lyon Trade and Companies Register under number 951 903 210, EU VAT number FR57951903210 (see the legal notice).

For any question or request about your personal data, write to contact@kitoffgrid.com (subject: "Personal data"), call +33 6 33 60 16 59 or write to the registered office address above.

2. Data we process, purposes, legal bases and retention periods

  • Customer account: account type (private or business), first name, last name, e-mail address, password (stored in encrypted form), billing address, telephone and, for businesses, the company name and identifiers. Purpose: creating and managing your account and giving you access to your order history. Legal basis: performance of the contract or of steps taken at your request before entering into it (Article 6(1)(b) GDPR). Retention: as long as your account exists; you can ask us to delete it at any time. The data of your orders is then kept as described below.
  • Orders: products ordered, delivery and billing addresses, telephone, delivery and payment method, shipment tracking, messages about the order. Purpose: concluding and performing the sales contract, delivery, the right of withdrawal, the legal guarantees and after-sales service. Legal basis: performance of the contract (point (b)). Retention: for the duration of the contractual relationship and of the guarantees, then archived for the applicable limitation periods; where the order amounts to EUR 120 or more, the contract concluded electronically is kept for 10 years, as required by the French Consumer Code.
  • Invoicing and accounting: invoices and payment information (for a bank transfer: account holder's name, amount, date and reference). Purpose: complying with our accounting and tax obligations. Legal basis: legal obligation (point (c)). Retention: 10 years (Article L123-22 of the French Commercial Code).
  • Communication with us (e-mail, telephone, WhatsApp if you use it, withdrawal, return or warranty requests). Purpose: answering and handling your requests. Legal basis: performance of the contract (point (b)) or our legitimate interest in answering you (point (f)). Retention: as long as needed to handle the request, then for the limitation periods, to defend our rights.
  • Service e-mails: order confirmation, status changes, parcel tracking number and link. Purpose: keeping you informed about your order. Legal basis: performance of the contract (point (b)). We do not send you marketing e-mails without your prior consent.
  • Technical security data: IP address, number of sign-in, registration or order attempts, anti-bot checks of the forms. Purpose: protecting the website, accounts and orders against attacks and fraud. Legal basis: our legitimate interest (point (f)). Retention: from a few minutes to a few hours for the counters; the server's technical logs are kept for a limited period, as needed for security.
  • Record of your cookie choice: a random identifier (stored in encrypted form), the choice made, version and date; no IP address and no identity. Purpose: being able to demonstrate your choice. Legal basis: legal obligation (Article 7(1) GDPR and Article 82 of the Loi Informatique et Libertés). Retention: 36 months.
  • Cookie-free audience measurement: aggregated visit statistics. Purpose: knowing the number of visits and the pages viewed, to improve the website. Legal basis: our legitimate interest (point (f)). Retention: at most 13 months. Details are in our cookie policy.

Fields marked with an asterisk in the forms are needed to conclude and perform the contract: without them we cannot process your order. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

3. Recipients

Your data is accessible to our authorised staff (sales, logistics, accounting) and is disclosed, only as far as necessary, to the following recipients:

  • the carriers that deliver your order (FedEx, or a private carrier for pallets and heavy parcels): name, delivery address, telephone and e-mail for delivery notifications;
  • where applicable, the service providers that store, prepare or ship orders on our behalf;
  • our bank, for payments by bank transfer;
  • our IT service providers (website hosting, e-mail, maintenance), which act only on our instructions as processors (Article 28 GDPR);
  • the manufacturer or distributor of the product, only as far as needed to handle a warranty claim;
  • our advisers bound by professional secrecy (accountant, lawyer), where necessary;
  • WhatsApp Ireland Limited, only if you write to us on WhatsApp or if we exchange messages with you on WhatsApp about your order;
  • public or judicial authorities, where the law requires it.

We do not sell your personal data.

4. Transfers outside the European Union

Where a service provider processes data outside the European Economic Area (for example an international carrier or an IT service provider), the transfer is based on an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework) or on the standard contractual clauses adopted by the European Commission. You can ask us for information about these safeguards.

5. Your rights

You have the right of access, rectification and erasure, the right to restriction of processing, the right to data portability, the right to object (in particular, at any time, to direct marketing), the right to withdraw your consent at any time (without affecting the processing carried out before) and the right to give instructions on what happens to your data after your death (Article 85 of the Loi Informatique et Libertés). Some rights are limited by law: for example, we cannot erase invoices that we are required to keep.

You can view and change your account data at any time in "My account". To exercise your other rights, in particular to have your account deleted or to receive a copy of your data, write to contact@kitoffgrid.com or to our registered office. If we have reasonable doubts about your identity, we may ask you for additional information. We reply within one month of receiving your request; this period may be extended by two further months for complex or numerous requests (Article 12 GDPR). Exercising your rights is free of charge.

If you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the supervisory authority of the Member State where you live or work.

6. Security

We use an encrypted connection (HTTPS), passwords are stored in encrypted form, access to data is limited to the people who need it and our service providers offer security guarantees. If you receive a confirmation e-mail for an account you did not create, write to contact@kitoffgrid.com and we will delete it.

7. Cookies

The cookies and other trackers used on the website, and how to manage your choices, are described in our cookie policy.

8. Changes

We may change this policy, in particular when the law or our services change. The version in force is published on this page, with the date of its last update.