Privacy Policy

MIKA, a simplified joint-stock company registered with the Paris RCS under number 989 321 658, whose registered office is at 60 rue François 1er, 75008 Paris, operates My Mika Shop.

For processing for which MIKA determines the purposes and means, MIKA acts as data controller.

Contact for any question or request relating to personal data: mikaorganisationai@gmail.com.

No Data Protection Officer has been formally appointed. Edwin Audebert is internally responsible for data protection.

When a seller uses My Mika Shop to process the orders of their own TikTok Shop store, the seller remains the controller of their buyers' data. The seller determines, in particular, the products sold, the conditions of sale, the commercial purposes and the management of the customer relationship.

In that context, MIKA processes order data on behalf of the seller in order to provide the My Mika Shop service.

Where MIKA itself operates the selling store used during the private V0, MIKA may also act as controller for the fulfilment of the orders concerned.

My Mika Shop may process the following categories:

User account data: - email address; - internal identifier; - data required for authentication; - information relating to the use and administration of the account.

The password is managed by Supabase Auth in a protected form. My Mika Shop does not store it in clear text.

Third-party connection data: - store identifiers; - technical identifiers; - authorisations and access scopes; - TikTok Shop tokens; - identifiers or keys required for the CJ Dropshipping connection; - connection status and technical history.

Sensitive access credentials are encrypted before storage.

Product data: - supplier references; - descriptions, images and variants; - supplier prices; - estimated fees; - the selling price prepared by the seller; - estimated margin; - publication status on TikTok Shop.

Order data: - order identifier; - products and quantities ordered; - amounts and currency; - order status; - shipping and tracking information; - technical events associated with the order.

Recipient data: - name; - postal address; - telephone number; - any other delivery instructions transmitted by TikTok Shop.

Technical and security data: - error logs; - dates and statuses of operations; - connection events; - events received by webhook; - information necessary for security, diagnostics and the prevention of duplicate processing.

Data may come from:

- the My Mika Shop user directly; - TikTok Shop, after authorisation by the seller; - CJ Dropshipping, when the supplier account is connected; - the technical operation of My Mika Shop.

Buyer data is obtained indirectly from TikTok Shop solely for the fulfilment of their order.

Data is processed to:

- create, authenticate and administer the My Mika Shop account; - connect a TikTok Shop store and a supplier account; - prepare and transmit product listings; - import, display and track orders; - transmit to the supplier the information strictly necessary for shipment; - retrieve and return tracking information; - secure the service; - prevent duplicates, errors, unauthorised access and fraudulent use; - respond to support requests and requests to exercise rights; - comply with applicable legal obligations.

Depending on the processing concerned, the legal bases are:

- performance of the contract or pre-contractual measures; - performance of the seller's instructions where MIKA acts as processor; - MIKA's legitimate interest in securing, administering and improving the technical operation of the service; - compliance with a legal obligation.

My Mika Shop does not use buyers' data for prospecting, advertising, commercial profiling or the resale of data.

Account identification data is necessary to access the service.

Order and delivery data is necessary to transmit the order to the supplier and enable its shipment.

Without this information, certain features cannot be provided.

Data is accessible only to the extent necessary to:

- MIKA, for the operation of My Mika Shop; - TikTok Shop, the platform of origin of the store and the order; - Yiwu Cu Jia Trade Co., Ltd. and the relevant CJ Dropshipping entities, for the supply and shipment of the products; - Vercel, for hosting and running the application; - Supabase, for authentication and the database; - the carriers chosen to deliver the orders; - legally authorised authorities, where required by law.

Internal access to the data is currently limited to Edwin Audebert.

My Mika Shop's primary database is deployed in the AWS eu-west-3 region, in Paris.

Some providers or their subcontractors may nevertheless be established or operate outside the European Economic Area, in particular Vercel in the United States, Supabase in Singapore and CJ Dropshipping in China.

Delivery information is transmitted to CJ Dropshipping because it is necessary for the preparation and shipment of the order.

Where data is transferred outside the European Economic Area, MIKA relies on the contractual mechanisms and safeguards made available by the providers concerned and limits the data transmitted to what is necessary for the service.

Professional users must also verify that their own contractual relationships with TikTok Shop, CJ Dropshipping and their other providers are appropriate for their business.

The following periods constitute My Mika Shop's operational policy:

- account data: for the lifetime of the account, then deletion within 30 days of its closure, unless a legal obligation requires otherwise; - TikTok Shop or CJ Dropshipping credentials and tokens: for the duration of the connection to the service concerned, then immediate deletion or deactivation upon disconnection or deauthorisation; - store metadata that is no longer needed after disconnection: deletion or anonymisation within 30 days; - recipient name, address and telephone number: deletion or anonymisation 90 days after delivery or cancellation of the order; - raw webhook events and content containing order data: 30 days; - technical and security logs necessary for diagnostics and protection of the service: 12 months; - technical evidence of deletion: 12 months, without retaining the deleted personal data; - MIKA's own accounting documents: 10 years once billing of the service is activated.

After anonymisation, technical or statistical information that no longer identifies a person may be retained.

My Mika Shop applies, in particular, the following measures:

- communications protected by HTTPS/TLS; - provider-managed encryption for stored data; - application-level AES-256-GCM encryption of sensitive third-party credentials; - separation of data per user at database level; - access limited to operational need; - no secret credentials in the public source code or the web client; - authorisation checks before sensitive operations; - limitation of the data and API permissions requested.

No system can guarantee absolute security. MIKA progressively adapts its measures to the evolution of the service and of the risks.

Under the conditions provided for by the GDPR, any data subject may request:

- access to their data; - rectification; - erasure; - restriction of processing; - portability where that right applies; - objection to certain processing.

Requests may be sent to mikaorganisationai@gmail.com.

A response is provided as soon as possible and, in principle, within a maximum of one month. This period may be extended by two months where the request is complex or numerous, after informing the person concerned.

Reasonable verification of identity may be requested where necessary.

Where a buyer's request mainly concerns processing decided by a seller using My Mika Shop, MIKA forwards or helps forward the request to the seller concerned and assists in handling it.

Anyone may also lodge a complaint with the French supervisory authority, the Commission nationale de l'informatique et des libertés: https://www.cnil.fr.

My Mika Shop takes no decision producing legal effects on a person based on fully automated processing.

Buyers' data is not used to build an advertising or commercial profile.

The public site sets no advertising or audience-measurement cookies.

The authenticated areas use only the strictly necessary cookies described in the Cookie Policy.

This policy may change to reflect changes to the service, its providers or the applicable regulations.

The update date shown at the top of the page identifies the applicable version.