SAWA · By your side

Privacy policy

Last updated: 23 septembre 2026

This policy explains what personal data is processed when you visit sawa.site or place an order, why, and how to exercise your rights. It applies in accordance with the European Union’s General Data Protection Regulation (GDPR) and its United Kingdom version (UK GDPR).

Data controller

MADIBA & MLK CONSULTING LTD, a private limited company incorporated under the laws of England and Wales, registered in England and Wales under company number 13238263, whose registered office is at 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, Royaume-Uni. Contact for any question about your data: contact@sawa.site.

Data processed and purposes

Situation	Data	Purpose	Legal basis
Order	First name, last name, email, telephone, delivery address, items ordered, amounts, payment reference	Delivery calculation, payment, production, shipping, tracking, customer service, returns and guarantees	Performance of the contract
Accounting	Invoices, amounts, dates, order reference	Keeping accounting and tax records	Legal obligation
Payment	Card details and payment information, processed directly by Stripe	Secure payment, fraud prevention	Performance of the contract; legitimate interest (fraud prevention)
Browsing	IP address (in hashed form, for abuse rate-limiting), technical logs	Website security, abuse prevention, troubleshooting	Legitimate interest
Contact	Name, email, subject, any order reference and the content of your message, together with our replies	Responding to your request and keeping a record of it	Legitimate interest; performance of the contract where applicable
Partner programme	Applicants and partners: name, email, profile, link to their website or social network, city, message, code, sales made with that code and commissions. Customers: code used on the order	Reviewing applications, managing codes, calculating and paying commissions	Pre-contractual measures and performance of the contract (partners); legitimate interest; legal obligation for payment records

We do not send marketing communications, we do not sell your data and we do not make any automated decisions producing legal effects concerning you. The fields in the order form are required to deliver the order; without them, the order cannot be placed.

Recipients

Your data is accessible to the SAWA team and to the following service providers, solely for the purposes described:

Stripe — payment and fraud prevention. Stripe also acts as a data controller for its own obligations (see stripe.com/privacy).
Our print-on-demand partners and their workshops — production and shipping of the items; carriers receive the name, address and, where applicable, the telephone number and email address needed for delivery. The list of these providers is available on request.
Cloudflare, Inc. — website hosting, database and security.
Resend — sending emails relating to your order (confirmation and invoice, shipping, delivery, refund) and replies to your messages.
Authorities and professional advisers (accountant, lawyer) where required by law or to defend our rights.

Transfers outside the European Union

The seller is established in the United Kingdom, which benefits from an adequacy decision of the European Commission. Some service providers (print-on-demand partners, Cloudflare, Stripe, Resend) and some production workshops are located in the United States or process data in other countries. These transfers are subject to appropriate safeguards: certification under the EU–US Data Privacy Framework where the provider participates in it, or the European Commission’s standard contractual clauses and the UK Addendum. You can obtain a copy by writing to us.

Retention periods

Unpaid delivery requests: automatically deleted approximately 24 hours after they expire.
Paid orders: kept for the duration of the relationship and the guarantees, then archived for accounting obligations, i.e. up to six years after the end of the financial year concerned; they are then deleted.
Invoices and credit notes: no more than ten years, for accounting obligations; deleted thereafter.
History of emails sent (recipient, subject, date): three years.
Abuse rate-limiting data: approximately two minutes.
Hosting provider’s technical logs: a few days.
Exchanges with customer service and partner applications: three years after the last contact.
Data relating to a partner and their sales: for the duration of the partnership, then up to six years for accounting obligations.

Cookies and local storage

SAWA uses no advertising cookies, no audience measurement tools and no embedded social networks. Your basket is saved in your browser’s local storage (key “sawa-cart-v1”) to keep your selection: this storage is strictly necessary for the service you request and does not require consent. When you arrive via a partner’s link, their code is saved in the same place (key “sawa-code”) for no more than 30 days, so that it can be applied to your basket; it remains visible in the basket, where you can remove it, and is only sent to SAWA if you place an order. The partner never has access to your contact details. You can clear this storage at any time from your browser settings. The payment page, hosted by Stripe, uses its own cookies that are necessary for payment security and fraud prevention.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (for processing based on legitimate interest), as well as the right to set out instructions regarding what happens to your data after your death (France). Write to contact@sawa.site; we will respond within one month, which may be extended by two months for complex requests. Proof of identity may be requested if there is reasonable doubt as to your identity.

You may also lodge a complaint with a supervisory authority: the Information Commissioner’s Office in the United Kingdom (ico.org.uk), the CNIL in France (cnil.fr) or the Data Protection Authority (Autorité de protection des données) in Belgium (autoriteprotectiondonnees.be).

Security

The website is served exclusively over HTTPS. Payment data does not pass through our servers. Access to management tools is protected and restricted to authorised persons.

Changes

This policy may change. The date of the last update is shown at the top of the page; in the event of a significant change, a notice will be displayed on the website.

← Back to the collection

One moment…