Privacy policy
Last updated: 15 April 2026
1. Who Are We?
Oh Happy Games SASU (hereinafter "we", "our", "OHG") is a French simplified joint-stock company (SASU) with a share capital of €1,000, registered with the Paris Trade and Companies Register under number 903 832 426, with its registered office at 58 rue de Monceau, 75008 Paris, France. VAT No.: FR30903832426.
We publish and distribute board games and card games via our website ohhappygames.com, Amazon, TikTok Shop, and our distribution partners.
Data controller: Oh Happy Games SASU
Data Protection Officer (DPO): contact@ohhappygames.com
2. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identification | Last name, first name, email address, phone number | You, when placing an order or creating an account |
| Address | Delivery and billing addresses | You |
| Order | Items purchased, order history, amounts | Your activity on the website |
| Payment | Payment method used (full bank details are not stored by us — see Section 5) | Payment provider |
| Browsing | IP address, browser type, pages visited, visit duration, traffic source | Cookies and similar technologies |
| Communication | Content of your emails, support tickets, customer reviews | You |
| Marketing | Newsletter subscription preferences, advertising interactions | You + advertising platforms (with consent) |
We do not knowingly collect sensitive data (health, political opinions, religion, sexual orientation) or data from children under 16 (see Section 11).
3. Legal Bases for Processing (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Fulfilling your order (delivery, invoicing, after-sales) | Performance of contract |
| Accounting, tax, and legal warranty obligations | Legal obligation |
| Newsletters, marketing emails | Consent (revocable at any time) |
| Targeted advertising and audience analytics | Consent (via cookie banner) |
| Website improvement, fraud prevention, security | Legitimate interest |
| Responding to your requests (contact, GDPR rights) | Legitimate interest / legal obligation |
4. Purposes of Processing
We use your data to:
- process and deliver your orders;
- manage your customer account and purchase history;
- send you transactional emails (confirmation, dispatch, returns);
- send you, with your consent, our newsletters and offers;
- provide after-sales service and answer your questions;
- improve our website, products, and customer experience;
- detect and prevent fraud;
- comply with our legal and accounting obligations;
- display targeted advertising on Amazon, Meta, Google, TikTok (with consent).
5. Who Do We Share Your Data With?
We never sell your data. We only share it with service providers strictly necessary for our business:
| Category | Providers | Country / Transfer |
|---|---|---|
| E-commerce platform | Shopify International Ltd. | Ireland (EU) — EU/US servers with Standard Contractual Clauses |
| Payment | Shopify Payments, PayPal | EU / USA with adequate safeguards |
| Express payment | Apple Pay, Google Pay, Shop Pay | EU / USA with adequate safeguards |
| Delivery | La Poste, Colissimo, Mondial Relay, UPS, DPD, Amazon Logistics | Primarily EU |
| Email marketing | Shopify Email, Klaviyo | EU / USA — Standard Contractual Clauses |
| Advertising & analytics | Meta (Facebook/Instagram), Google Ads & Analytics, TikTok for Business, Amazon Ads | USA — Standard Contractual Clauses |
| Accounting | Pennylane, Qonto | France (EU) |
We may also disclose your data to competent public authorities when required by law.
6. Transfers Outside the European Union
Some of our service providers (particularly advertising and marketing platforms) are located in the United States. These transfers are governed by:
- Standard Contractual Clauses (SCCs) approved by the European Commission;
- and/or the providers' participation in the EU–US Data Privacy Framework where applicable.
You may obtain a copy of these safeguards by writing to contact@ohhappygames.com.
7. Data Retention Periods
| Data | Retention period |
|---|---|
| Customer account data | 3 years from last activity |
| Order data (accounting obligation) | 10 years |
| Prospecting data (newsletter) | 3 years from last contact / click |
| Advertising and analytics cookies | 13 months maximum |
| Support tickets | 3 years from resolution |
| Payment data (tokenised) | Stored by the payment provider, not by OHG |
After these periods, your data is deleted or anonymised.
8. Your Rights (GDPR)
Under Articles 15 to 22 of the GDPR, you have the following rights:
| Right | What it means |
|---|---|
| Access | Obtain a copy of the data we hold about you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure ("right to be forgotten") | Request deletion of your data, subject to our legal obligations |
| Restriction | Temporarily restrict processing |
| Objection | Object to processing based on legitimate interest or direct marketing |
| Portability | Receive your data in a structured, machine-readable format |
| Withdrawal of consent | At any time for newsletters and cookies |
| Automated decision-making | Not be subject to a solely automated decision producing legal effects |
To exercise your rights: send an email to contact@ohhappygames.com with the subject line "GDPR Rights" and a copy of your ID. We will respond within 1 month.
Complaint: if you believe your rights are not being respected, you may file a complaint with the CNIL (French Data Protection Authority): www.cnil.fr — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
9. Cookies and Trackers
Our website uses cookies and similar technologies to:
- ensure the technical functioning of the website (essential cookies, no consent required);
- measure audience (analytics cookies, with consent);
- personalise advertisements (marketing cookies, with consent).
On your first visit, a banner allows you to accept, refuse, or customise your choices. You can change your preferences at any time via the "Cookie settings" link in the footer.
10. Security
We implement the following technical and organisational measures:
- SSL/TLS encryption across the entire website;
- hosting with certified providers (Shopify, OVH);
- data access restricted on a need-to-know basis;
- strong authentication for administrator accounts;
- regular encrypted backups.
In the event of a data breach likely to pose a risk to your rights, we will notify the CNIL within 72 hours and inform you without undue delay, in accordance with Article 33 of the GDPR.
11. Protection of Minors
Our website is not intended for children under 16. We do not knowingly collect their data. If you are a parent and discover that a minor has provided us with data, please contact us and we will delete it.
12. Changes to This Policy
We may update this policy to reflect legal or operational changes. The date of the last update is shown at the top. In the event of a material change, we will inform you by email or via a banner on the website.
13. Contact
Oh Happy Games SASU
58 rue de Monceau, 75008 Paris, France
Email: contact@ohhappygames.com
Annex — Addendum for California Residents (CCPA/CPRA)
Applicable only to California residents.
In the past 12 months, we may have collected the following categories of data as defined by the CCPA:
| CCPA Category | Collected? | Sold? | Shared for behavioural advertising? |
|---|---|---|---|
| A. Identifiers (name, email, IP) | Yes | No | Yes (with consent) |
| B. Customer account data | Yes | No | No |
| D. Commercial information | Yes | No | Yes (with consent) |
| F. Internet/network activity | Yes | No | Yes (with consent) |
| G. Geolocation (approximate, via IP) | Yes | No | No |
| K. Inferences | Yes | No | Yes (with consent) |
Your CCPA rights: right to know, right to delete, right to correct, right to opt out of sale/sharing, right to non-discrimination. We do not sell your data. Cookie-based advertising may constitute "sharing" under the CPRA — use the "Do Not Sell or Share My Personal Information" link in the footer to opt out.
To exercise your CCPA rights: email contact@ohhappygames.com with the subject "CCPA Request". We will respond within 45 days.