Last updated: 15 September 2026
1. Who we are
The website https://ebr.fr is published and operated by Éditions Bourgès R., a French limited company (SARL) with share capital of €8,000.
- SIRET: 429 976 202 00037 — Toulouse Trade and Companies Register
- APE code: 5920Z
- EU VAT number: FR17429976202
- Data Controller: Patrice Bourgès-Rouhaut, General Manager
- Registered address: 20 rue des Paradoux, 31000 Toulouse, France
- Contact email: editions.bourges@ebr.fr
2. What personal data we collect, and why
A. Order processing and customer relationship management
Data collected: full name, shipping and billing postal addresses, email address, telephone number.
Purpose: processing, packing, dispatch and tracking of your orders, delivery of the digital sheet music purchased, issuing invoices, and after-sales correspondence.
Legal basis: performance of the sales contract (Art. 6(1)(b) GDPR).
B. Customer account management
Data collected: username, encrypted password, order history, access to downloadable files.
Purpose: giving you access to your secure customer area, where you can track your purchases, retrieve your digital files and update your details.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
C. Secure payment
Data collected: payment transaction details.
Security: your card details are never entered on, nor stored by, our servers. All transactions are handled in full security by our payment service providers: Axepta BNP Paribas (BNP Paribas group) for card payments, and PayPal.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
D. Contact form
Data collected: your name, email address and the content of your message.
Purpose: answering your enquiry. This information reaches us by email and is used for nothing else.
Legal basis: our legitimate interest in replying to those who write to us (Art. 6(1)(f) GDPR).
E. Newsletter
Data collected: your email address, and only if you enter it yourself in the sign-up form.
Purpose: keeping you informed of our new publications and of news from Éditions Bourgès R.
Legal basis: your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time, using the unsubscribe link included in every mailing or simply by email.
3. How long we keep your data
Your data is kept only for as long as is strictly necessary for the purpose concerned:
- Customer account and customer relationship: for as long as your account remains active, then archived for three years from the last contact.
- Invoicing and accounting: ten years, in order to meet statutory legal, tax and accounting obligations.
- Messages received through the contact form: three years from the last exchange.
- Newsletter: until you unsubscribe. Your address is then removed from the mailing list.
4. Recipients and transfers of your data
Your personal data is never sold or rented to third parties.
It may be passed on only to the processors essential to the running of the shop:
- Carriers and delivery services (including Chronopost, Mondial Relay and UPS): to deliver your parcels to the address given.
- Payment service providers (Axepta BNP Paribas, PayPal): to authorise financial transactions.
- Site hosting (Syntis, France): to provide the technical hosting of the shop.
- Newsletter delivery service (Mailchimp): the email addresses of subscribers only.
Transfers outside the European Union
Order, invoicing and delivery data is hosted and processed in France and within the European Union.
One exception: the newsletter is managed by Mailchimp (Intuit Inc., United States). Only your email address is transferred, and only if you signed up yourself. This transfer is governed by the Data Privacy Framework EU–US and by the European Commission's standard contractual clauses. If you would rather your address did not leave the European Union, simply do not sign up for the newsletter, or unsubscribe from it.
5. Cookies
This website sets no analytics, advertising, profiling or social-network trackers. There is therefore no tracking of your browsing and no sharing of your habits with third parties — which is precisely why no consent banner is forced upon you when you arrive on the site.
The only ones set are strictly necessary for the shop to work and are, as such, exempt from the consent requirement under the regulations:
- Cart and session: keep the contents of your basket and your shopping session for the duration of your visit.
- Wishlist: remembers the items you add to it.
- Recently viewed products: lets us show you again the pages you have just viewed.
- Verification cookie: if you visit the login page, a temporary one checks whether your browser accepts them. It is deleted when you close your browser.
- Login cookies: if you have an account, they keep you signed in for two days, or two weeks if you tick “Remember me”.
You may delete them at any time from your browser settings. The basket and the login to your account will then stop working for as long as you refuse them.
YouTube videos
Some product pages include a video hosted on YouTube (Google Ireland Limited). As long as you do not click the play button, no YouTube player is loaded and no cookie is set: only a preview image is displayed, served by Google's servers, which receive your IP address on that occasion.
When you start a video, the player is loaded in "privacy-enhanced" mode (youtube-nocookie.com). YouTube may then store information in your browser and process playback data under its own rules: by clicking play, you accept this loading. To find out more, see Google's privacy policy.
6. Your rights over your personal data
Under the General Data Protection Regulation, you have the following rights:
- Access and rectification: to view or correct your information, either from your customer area or by writing to us.
- Erasure: to request the deletion of your personal data, except where the law requires invoices to be kept.
- Portability: to obtain a machine-readable copy of the data you have provided to us.
- Objection and restriction: to object to a processing operation or to request that it be restricted.
- Withdrawal of consent: to unsubscribe from the newsletter at any time.
To exercise these rights, write to us at editions.bourges@ebr.fr. We reply within one month at the latest.
If you believe your rights have not been respected, you may lodge a complaint with the CNIL (the French data protection authority), www.cnil.fr.