Privacy policy

Privacy Policy — MATIRŌ

Last updated: March 17, 2026

In accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data (GDPR) and Law No. 78-17 of 6 January 1978 as amended relating to information technology, files and freedoms (French Data Protection Act), this Privacy Policy aims to inform users, prospects and customers of the website https://matiro.co (hereinafter the “Site”) about the way in which MATIRŌ collects, processes and protects their personal data.

MATIRŌ, a French premium brand of food supplements specialised in collagen and wellness, is committed to processing your data in a transparent, confidential and secure manner, in full compliance with applicable regulations.

Article 1 — Data Controller The controller of personal data is the company PHARMATIRO, operating under the brand MATIRŌ, whose registered office is located at 78 Avenue des Champs-Élysées, Bureau 326, 75008 Paris, France. SIREN number: 992 187 906 Contact email: contact@matiro.co

MATIRŌ has not appointed a Data Protection Officer (DPO). Requests relating to your personal data may be addressed directly to the data controller at the contact details above.

Article 2 — Definitions For the purposes of this Policy:

  • “Personal data”: any information relating to an identified or identifiable natural person (hereinafter “Data Subject”);
  • “Processing”: any operation or set of operations performed on personal data, whether or not by automated means;
  • “Data Subject”: the user, prospect or customer who browses the Site or places an order;
  • “Controller”: MATIRŌ which determines the purposes and means of the processing;
  • “Processor”: any natural or legal person who processes data on behalf of MATIRŌ;
  • “Consent”: any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which he or she agrees to the processing of personal data;
  • “Cookies”: small text files placed on the user’s browsing device.

Article 3 — Purposes of processing and legal bases MATIRŌ processes your personal data solely for the following purposes:

Purpose Legal basis Main data concerned Mandatory / Optional
Creation and management of customer account Performance of the contract First name, last name, email, password Mandatory (to create an account)
Processing of orders, payment and delivery Performance of the contract First name, last name, postal address, telephone, payment details (via provider) Mandatory (to place an order)
Customer service and after-sales support Performance of the contract Purchase history, email, telephone Mandatory
Sending newsletters and marketing communications Consent Email, first name Optional
Personalised beauty & nutrition diagnosis Explicit consent (health data) or legitimate interest First name, email, questionnaire responses (lifestyle and health data if provided) Optional
Personalised product recommendations Legitimate interest or consent Purchase history and browsing data Optional
Statistical analysis and Site optimisation Legitimate interest IP address, browsing data, cookies Optional
Compliance with legal obligations (invoicing, fraud prevention, GDPR rights) Legal obligation Identity, supporting documents Mandatory when required by law


Article 4 — Categories of data collected and sources MATIRŌ collects only data strictly necessary for the purposes described above. Data are collected:

  • Directly from you: via registration forms, order forms, personalised diagnosis questionnaires, newsletter subscription forms;
  • Indirectly: during your browsing on the Site (technical and browsing data collected via your device, cookies and analytics tools).

Categories of data collected:

  • Identification and contact data (first name, last name, email address, telephone, postal address);
  • Order and payment data (processed securely by providers);
  • Personalised diagnosis data (health data only with your explicit and revocable consent at any time);
  • Technical and browsing data (IP address, browser type, cookies, pages viewed);
  • Authentication data (hashed password).

Fields marked with an asterisk (*) in forms are mandatory. Failure to provide them may prevent account creation, order processing or access to certain services.

Article 5 — Recipients of the data and processors Data are accessible only to the following recipients, all bound by data processing agreements compliant with Article 28 GDPR:

  • Technical providers: Shopify (hosting and e-commerce platform);
  • Payment providers: Shopify Payments and Stripe;
  • Logistics providers (order preparation and shipping);
  • Marketing and email service providers (only with your consent);
  • Public authorities or courts when required by law.

MATIRŌ does not sell or rent your data to third parties for commercial purposes.

Article 6 — Security measures and data protection MATIRŌ implements appropriate technical and organisational measures: SSL/TLS encryption across the entire Site, secure payment protocols, restricted access on a need-to-know basis, regular audits and staff training. You are responsible for the confidentiality of your password and any activity on your account.

Article 7 — Transfers of data outside the European Union Data are primarily hosted within the European Union or in countries offering an adequate level of protection. Certain processors (notably Shopify in Canada and the United States) may involve transfers outside the EEA. Such transfers are governed by Standard Contractual Clauses adopted by the European Commission or any other appropriate safeguard ensuring an equivalent level of protection.

Article 8 — Data retention periods Data are retained only for the period necessary to achieve the purposes pursued:

  • Customer account: until deletion by the user or 3 years of inactivity;
  • Order and invoicing data: duration of the contractual relationship + 10 years for accounting and tax obligations;
  • Newsletter and commercial prospecting: 3 years from the last contact or until withdrawal of consent;
  • Personalised diagnosis: duration of consent or maximum 3 years;
  • Cookies and browsing data: maximum 13 months.

Beyond these periods, data are irreversibly anonymised or deleted.

Article 9 — Rights of data subjects In accordance with the GDPR, you have the following rights:

  • Right of access (Art. 15);
  • Right to rectification (Art. 16);
  • Right to erasure (“right to be forgotten”) (Art. 17);
  • Right to restriction of processing (Art. 18);
  • Right to data portability (Art. 20);
  • Right to object, in particular to commercial prospecting (Art. 21);
  • Right to withdraw consent at any time (when processing is based on consent);
  • Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you (Art. 22);
  • Right to define directives concerning the fate of your personal data after your death (Art. 85 of the French Data Protection Act).

You also have the right to lodge a complaint with the French supervisory authority, the Commission Nationale de l’Informatique et des Libertés (CNIL): www.cnil.fr.

Article 10 — How to exercise your rights To exercise your rights, contact MATIRŌ:

  • By email: contact@matiro.co
  • By post: 78 Avenue des Champs-Élysées, Bureau 326, 75008 Paris, France

Any request must be accompanied by proof of identity in case of reasonable doubt as to the identity of the requester. MATIRŌ will respond within one month (extendable by two months in case of complexity). The exercise of rights is free of charge, except for manifestly unfounded or excessive requests.

When MATIRŌ carries out rectification or erasure of data, it notifies such update to the recipients to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Art. 19 GDPR).

Article 11 — Cookies and tracking technologies During your browsing, cookies and trackers may be placed on your device. They enable shopping cart management, experience personalisation, statistical analysis and, with your consent, targeted advertising.

You may at any time accept, refuse or configure your preferences via the consent banner or the cookie manager accessible at the bottom of the page. Some cookies are strictly necessary for the operation of the Site and cannot be refused. The lifespan of cookies is limited to a maximum of 13 months.

Article 12 — Changes to the privacy policy MATIRŌ reserves the right to amend this Policy to reflect changes in legislation or practices. Any changes will be posted on the Site with the new update date. Your continued browsing or use of the Site after publication constitutes acceptance of the new provisions.