Account .FAQ . Contact
Best Sellers
By Material
Ear
Face
Body

Cart

Your cart is empty

Continue shopping

🎁 3+1 FREE

Buy 3 pieces and the 4th is free: the discount applies automatically to the cheapest piece, from 4 pieces in your cart. Also valid on the MOCHA collection.

Privacy policy

In force as of August 12, 2026

This Privacy Policy describes how Obsidian GB collects, uses, shares, retains and protects the personal data of visitors to and customers of the website https://obsidianpiercing.com, in accordance with the GDPR (Regulation (EU) 2016/679) and French Act No. 78-17 of January 6, 1978, as amended, known as the French Data Protection Act (loi Informatique et Libertés).

1. DATA CONTROLLER

The controller of the processing operations described below is:

Obsidian GB, SARL with a share capital of 500 euros
Registered with the Quimper Trade and Companies Register (RCS) under number 889 361 440
Registered office: 9 rue de Bel Air, 29700 Pluguffan, France
Intra-EU VAT number: FR04889361440
Email: support@obsidianpiercing.com

Any question relating to this policy, as well as any request to exercise your rights, may be sent to support@obsidianpiercing.com or by post to the address of the registered office.

2. SCOPE

This policy applies to the data collected on the website https://obsidianpiercing.com: browsing, creation of a customer account, placing and tracking an order, exchanges with customer service, newsletter sign-up, submission of a review and participation in the loyalty program.

It also covers purchases made in our stores in France. In-store payment is processed through Shopify POS, which feeds the same customer database as the website: the order, the contact details you provide at the register and your purchase history are attached to a single customer record, whatever the channel. No advertising tracker is associated with a purchase made in store.

It does not apply to third-party websites accessible from the website, nor to the social networks on which the brand is present: each has its own privacy policy, which we invite you to consult.

3. DATA COLLECTED, PURPOSES AND LEGAL BASES

We collect only the data necessary for the purposes listed below. For each of them, the data concerned and the legal basis for the processing within the meaning of Article 6 of the GDPR are specified.

  • Management of orders, delivery and invoicing. Last name, first name, email address, delivery and billing addresses, telephone number where it is required by the carrier, content and amount of the order, delivery method, tracking number, order history. Legal basis: performance of the sales contract (Article 6.1.b of the GDPR).
  • Payment of the order. Amount, date, means of payment, transaction status. Your payment card data is transmitted directly to the payment provider, in an environment compliant with the PCI-DSS standard: we never have access to your full card number and do not retain it. Legal basis: performance of the contract, and legitimate interest in preventing and detecting payment fraud.
  • Management of your customer account. Login credentials, saved addresses, purchase history, preferences. Creating an account is optional: an order can be placed without one. Legal basis: performance of the contract and consent evidenced by the voluntary creation of the account.
  • Customer service, claims, returns, withdrawal and warranties. Content of exchanges by email or through the website chat, supporting documents you send us (photographs in particular), order number, case history. Legal basis: performance of the contract and legitimate interest in handling requests and in retaining proof that they were handled.
  • Newsletter and marketing communications. Email address, first name, open and click data, purchase history used to send relevant content. Legal basis: your consent if you are not yet a customer; legitimate interest if you are a customer and the communication concerns products similar to those already purchased (Article L. 34-5 of the French Postal and Electronic Communications Code (Code des postes et des communications électroniques)). In both cases, every message includes an unsubscribe link and you may object at any time.
  • Customer reviews. Email address and order number, used to invite you to leave a review after you receive your order; content of the review, rating, first name or pseudonym and photographs that you choose to publish. Legal basis: legitimate interest in collecting and publishing genuine reviews of our products, and your consent for the publication of the content you send us.
  • Loyalty and referral program. Identity, email address, points balance, actions completed, entries and, where applicable, the email address of the referred person that you provide to us. Legal basis: performance of the program membership contract, which you are free to join.
  • Audience measurement, attribution, personalization and advertising. Cookie and tracker identifiers, IP address, pages viewed, products viewed, cart additions, source of the visit, device and browser type; and, for conversion measurement, the order data transmitted from our servers to the advertising platforms. Legal basis: your consent, obtained under the conditions described in Article 11, with the exception of the trackers strictly necessary for the operation of the website. TripleWhale, our campaign measurement tool, is subject to the same consent as advertising trackers. Polar Analytics, used for our internal performance statistics, relies on our legitimate interest; you may object to this processing under the conditions of Article 10.
  • Website security and fraud prevention. Technical logs, IP address, login attempts, fraud signals associated with an order. Legal basis: legitimate interest in ensuring the security of the website, of customer accounts and of transactions.
  • Accounting, tax and customs obligations. Invoices, supporting documents, export declarations and customs documents for shipments outside the European Union. Legal basis: compliance with legal obligations to which we are subject.
  • Management of disputes and consumer mediation. Elements of the customer file transmitted, where applicable, to the consumer mediator or to legal counsel. Legal basis: legitimate interest in asserting and defending our rights, and compliance with legal obligations.

Mandatory fields are indicated when they are collected. If they are not completed, your order can be neither processed nor delivered. The other information is optional and its absence has no effect on the processing of your order.

We neither collect nor process sensitive data within the meaning of Article 9 of the GDPR. In particular, we do not ask you for any information relating to your health; if you provide such information spontaneously in a message sent to customer service, it is used solely to respond to your request.

4. SOURCE OF THE DATA

The data we process comes:

  • from you, when you enter it on the website, in a form, in an email or in the chat;
  • from your browsing on the website, via cookies and trackers, under the conditions provided for in Article 11;
  • from your purchases in our stores in France, at the time of payment through Shopify POS;
  • from our providers, in particular our shipping solution and the carriers, which send us the delivery status of your parcel.

5. RECIPIENTS AND PROCESSORS

Your data is neither sold nor rented. It is accessible to authorized Obsidian GB staff, within the limits of their duties, and disclosed to the providers listed below, who are contractually bound to confidentiality and security.

One point calls for clarification regarding advertising. When you consent to it, advertising signals — pages viewed, products viewed, cart additions, purchases — are shared with the platforms listed below. While these platforms act in part on our instructions, they also reuse this information on their own behalf, in particular to train their audience models: they are then separate controllers, and the processing they carry out falls under their own privacy policies, which we invite you to consult. This sharing only takes place if you have accepted advertising trackers, and ceases if you withdraw your agreement.

  • Shopify International Limited (Ireland) and its group companies — hosting of the website, management of customer accounts, of orders, of card payments via Shopify Payments and of store statistics.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — processing of payments made via PayPal.
  • WEJUST, SAS with a share capital of 1,260 euros, 96 boulevard Maurice Barrès, 92200 Neuilly-sur-Seine, France, registered with the Nanterre Trade and Companies Register under number 904 505 559 — “JUST” express payment solution allowing an order to be completed in one click, when you choose this means of payment.
  • Sendcloud B.V. (the Netherlands) — preparation of shipments, printing of labels, parcel tracking and returns management. Your name, delivery address, email address and telephone number are transmitted, through this platform, to the carrier selected for your order, so that it can deliver the parcel, keep you informed of its progress and, where applicable, allow you to choose a pickup point.
  • Klaviyo, Inc. (United States) — sending of the newsletter and marketing emails and text messages, management of unsubscribes and segmentation of mailings. Klaviyo also collects, from your browser and from our servers, the browsing and order events (pages and products viewed, cart, purchases) that make it possible to personalize the content of these communications.
  • Crisp IM SAS, 2 boulevard de Launay, 44100 Nantes, France — website chat and customer service management tool; the messages you send us are stored there together with your case history.
  • Judge.me Ltd, c/o Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom — collection, moderation and display of customer reviews.
  • Loyoly — management of the loyalty and referral program.
  • Our advertising platforms: Meta Platforms Ireland Limited for Facebook and Instagram, Google Ireland Limited for Google and YouTube, Pinterest and TikTok — measurement of the effectiveness of our campaigns, remarketing and delivery of targeted advertising. Data is transmitted to them from your browser and, for conversion measurement, directly from our servers. These transmissions only take place if you have consented to them under the conditions provided for in Article 11.
  • TripleWhale — audience measurement and attribution, that is, linking a sale to the traffic source or the campaign that generated it, only if you have consented to it under the conditions provided for in Article 11. Polar Analytics — internal performance statistics for our sales channels, on the basis of our legitimate interest; you may object at any time (Article 10).
  • Our accounting firm, for accounting documents only, and our legal counsel in the event of a dispute.
  • The consumer mediator designated in our Terms and Conditions of Sale, in the event of a referral.
  • Authorized government departments and authorities (customs, judicial or administrative authorities), where the law requires us to do so or in response to a duly issued formal demand.

Each of these providers has access only to the data necessary for its assignment and may not use it for purposes other than those for which we entrust it to them.

6. TRANSFERS OUTSIDE THE EUROPEAN UNION

Some of our providers — in particular Shopify, Klaviyo, Judge.me, as well as our audience measurement, attribution and advertising tools — are established outside the European Union or use servers and teams located outside the European Union, in particular in the United States, Canada and the United Kingdom. Your data may then be transferred there.

These transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR, namely, depending on the provider: an adequacy decision of the European Commission, the recipient's participation in the EU-US Data Privacy Framework, or the signature of the standard contractual clauses adopted by Implementing Decision (EU) 2021/914, supplemented where appropriate by additional technical measures such as encryption.

You may obtain a copy of the safeguards put in place, or information on where they are available, by writing to support@obsidianpiercing.com.

7. RETENTION PERIODS

Your data is not retained beyond what is necessary for the purposes pursued:

  • Orders, invoices and accounting documents: ten (10) years from the close of the financial year, in accordance with Article L. 123-22 of the French Commercial Code (Code de commerce).
  • Customer account and commercial relationship data: for the entire duration of the relationship, then three (3) years from your last activity (last order, last login, last contact), after which the account is deleted or the data anonymized. The data necessary for invoicing remains archived for the statutory period indicated above.
  • Prospects and newsletter subscribers: three (3) years from the last contact originating from you (sign-up, open, click, request for information). An unsubscribed address is kept on a suppression list so that it is no longer contacted.
  • Exchanges with customer service: for the time necessary to handle the request, then archived for three (3) years from the last exchange, and until the expiry of the applicable limitation periods where the case is liable to give rise to a dispute.
  • Customer reviews: for as long as the review is published on the website; a request to delete a review may be sent to support@obsidianpiercing.com.
  • Loyalty program: for the duration of your membership, then three (3) years from your last activity within the program.
  • Cookies and trackers: the trackers placed on your device have a maximum lifespan of thirteen (13) months; the information collected through them is retained for a maximum of twenty-five (25) months. Your choice to accept or refuse is stored by your browser: you are asked again if you delete the website's cookies, if you change browser or device, or if we ask you again.
  • Technical logs and connection data: twelve (12) months maximum.
  • Data relating to the management of a dispute: until the end of the proceedings and the expiry of the avenues of appeal.

8. DATA SECURITY

We implement appropriate technical and organizational measures to protect your data: encryption of exchanges with the website through the HTTPS protocol, hosting with a provider that ensures redundancy and backup of the data, processing of payments by PCI-DSS certified providers with no card numbers retained on our side, named access accounts limited to authorized persons, and processing contracts imposing equivalent obligations on our providers.

As no system offers absolute security, we undertake, in the event of a data breach likely to result in a high risk to your rights and freedoms, to inform you as well as the CNIL under the conditions provided for in Articles 33 and 34 of the GDPR.

9. AUTOMATED DECISIONS AND PROFILING

We do not use any wholly automated processing producing legal effects concerning you or significantly affecting you, within the meaning of Article 22 of the GDPR.

Several processing operations do, however, involve an element of automation:

  • The segmentation of our marketing mailings, which adapts the content of emails and text messages to your browsing and purchase history.
  • The automatic analysis of fraud risk applied to orders by our platform and our payment providers. An order flagged as suspicious is subject to human review before any cancellation.
  • Advertising profiling. When you have accepted advertising trackers, conversion signals — pages and products viewed, cart additions, purchases — are transmitted to Meta, Google, TikTok and Pinterest, from your browser and from our servers. These platforms use them to measure and optimize the delivery of our campaigns, and to feed their own audience models, which determines the advertising presented to you on their services and on their partners' websites.
  • Cross-session attribution. TripleWhale and Polar Analytics match your successive visits to the website in order to link a purchase to the traffic source or the campaign that preceded it. This matching serves our internal statistics exclusively and does not feed any individual targeting.

The last two processing operations — advertising profiling and attribution — rely on your consent to the corresponding trackers, obtained under the conditions described in Article 11. You retain control category by category: refusing advertising trackers puts an end to advertising profiling, and refusing audience measurement trackers puts an end to attribution via TripleWhale. The internal statistical measurement carried out via Polar Analytics, for its part, relies on our legitimate interest and operates independently of that choice; you may object to it by writing to support@obsidianpiercing.com (Article 10). None of these refusals has any consequence on your browsing or on your order. You may contest an automated decision or obtain explanations by writing to support@obsidianpiercing.com.

10. YOUR RIGHTS

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

  • Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
  • Right to rectification: to have inaccurate or incomplete data corrected or completed.
  • Right to erasure: to request the deletion of your data, subject to the data we must retain under a legal obligation or for the establishment and defense of our rights.
  • Right to restriction of processing, in the cases provided for in Article 18 of the GDPR.
  • Right to object: to object, on grounds relating to your particular situation, to processing based on our legitimate interest; and to object to marketing communications without having to give reasons for your request.
  • Right to portability: to receive the data you have provided to us, in a structured, commonly used and machine-readable format, or to request its transmission to another controller where this is technically possible.
  • Right to withdraw your consent at any time, where the processing is based on it, without that withdrawal calling into question the lawfulness of the processing carried out beforehand.
  • Right to give directions concerning the fate of your data after your death, in accordance with Article 85 of the French Data Protection Act.

These rights are exercised free of charge by email to support@obsidianpiercing.com or by post to Obsidian GB, 9 rue de Bel Air, 29700 Pluguffan, France. Proof of identity will only be requested from you in the event of reasonable doubt as to the identity of the requester. We respond within one month of receiving your request; this period may be extended by two months in the event of a complex request or of a high number of requests, in which case you are informed of it.

Certain actions can also be carried out directly: changing your contact details from your customer account, and unsubscribing from our marketing emails via the link at the bottom of each of them.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

11. COOKIES AND OTHER TRACKERS

A cookie is a file placed on your device when you visit a website. Other technologies serve a comparable function: pixels, tags, identifiers stored locally by the browser. We refer to them collectively as “trackers”.

The website uses the following categories of trackers:

  • Strictly necessary trackers: they enable the website to operate — maintaining your session, remembering the cart, security, load balancing, storing your tracker choices. They cannot be disabled and do not require your consent.
  • Audience measurement and attribution trackers: they enable us to understand website traffic, the pages viewed and the purchase journey, and to link a sale to the traffic source or the campaign that generated it. Tool concerned: TripleWhale. Polar Analytics, used for our internal statistics, operates independently of this choice, on the basis of our legitimate interest (Articles 3 and 9).
  • Personalization and functionality trackers: they enable, in particular, the display of the chat, of the customer reviews (Judge.me), of the loyalty program, of the JUST express payment and the personalization of our communications (Klaviyo).
  • Advertising trackers: they make it possible to measure the effectiveness of our campaigns and to present you with advertising matched to your interests on other websites or social networks. Platforms concerned: Facebook and Instagram (Meta), Google and YouTube, Pinterest and TikTok.

For these advertising platforms, as well as for the sending of our communications, conversion measurement does not rely solely on trackers placed in your browser: certain information relating to your order is also transmitted directly from our servers to these recipients (a technique known as a “conversion API”). This transmission pursues the same purpose and is subject to the same consent as the corresponding trackers.

With the exception of the strictly necessary trackers, no tracker is placed without your agreement. On your first visit, a cookie management banner offers you three actions: accept all, refuse all, or open “Manage preferences” to accept or refuse each category separately. Accepting and refusing are equally simple: refusing requires neither more clicks nor more effort than accepting. Refusing does not prevent you from browsing the website or from placing an order.

You may change or withdraw your choice at any time, category by category, from that same preference management screen, or by writing to support@obsidianpiercing.com. You may also configure your browser to refuse cookies or to be notified when they are placed; this setting, specific to each browser and each device, may however impair certain features of the website.

12. MINORS

The website is intended for persons legally capable of entering into a contract. We do not knowingly collect data concerning minors under the age of fifteen (15) without the consent of the holder of parental authority, in accordance with Article 45 of the French Data Protection Act. If you hold parental authority and find that your child has provided us with data, write to us at support@obsidianpiercing.com: it will be deleted.

13. AMENDMENT OF THIS POLICY

This policy may be amended to take account of changes in our processing operations, in our tools or in the applicable regulations. The applicable version is the one published on this page, whose effective date appears at the top of the document. In the event of a substantial change affecting your rights, we will inform you by an appropriate means, for example a notice on the website or a message to the persons concerned.

14. WEBSITE TERMS OF USE

Intellectual property. All the elements reproduced on the website — trademarks, photographs, texts, illustrations, animated or still images, video sequences, sounds, as well as the software applications necessary for its operation — are protected by the French Intellectual Property Code (Code de la propriété intellectuelle). These elements are the property of Obsidian GB or of its partners, unless otherwise stated. Any reproduction, representation, use or adaptation, in any form whatsoever, of all or part of these elements, without the prior written agreement of Obsidian GB, is prohibited and is liable to constitute the offense of counterfeiting. Only use for strictly private purposes, within the family circle, is permitted. The fact that Obsidian GB does not bring proceedings as soon as it becomes aware of an unauthorized use amounts neither to acceptance of that use nor to a waiver of its right to act.

Hyperlinks. The website may contain links giving access to websites published and managed by third parties. Obsidian GB exercises no control over their content, their practices or their privacy policy and may not be held liable for them, directly or indirectly. We recommend that you consult the privacy policy of each website you visit. Creating a link to the website is free, provided that it does not infringe the rights of Obsidian GB, does not create confusion as to the origin of the content and does not display the pages of the website within a frame suggesting that they belong to another website.

Website availability. Obsidian GB uses reasonable means to ensure the accessibility of the website, without guaranteeing uninterrupted operation, in particular in the event of maintenance, of updates or of failure of the network or of the host.

The conditions of sale of the products — prices, ordering, payment, delivery, right of withdrawal, legal warranties and consumer mediation — are governed by the Terms and Conditions of Sale available on the website. Information relating to the publisher and the host of the website appears in the Legal Notice.