Personal data protection
Your rights
Personal data protection: your rights, how to exercise them
Last updated: 24 September 2026
This page explains how to exercise your rights in practice over your personal data at Mush n Go: what you can ask for, how to do it, and what happens next.
To find out which data we collect, why, with whom we share it and how long we keep it, see our privacy policy.
Our commitments
- We do not sell your data.
- We never have access to your full bank card details.
- We do not send you marketing SMS or WhatsApp messages without your agreement.
- We answer any request about your data within one month, free of charge.
1. What you can do yourself, right away
| I want to… | How to do it |
|---|---|
| Stop receiving the newsletter and our offers by e-mail | Click “Unsubscribe” at the bottom of any e-mail |
| Stop receiving SMS | Reply STOP to any of our text messages |
| Stop receiving WhatsApp messages | Reply STOP in the conversation |
| Change my cookie choices | Click “Manage my cookies” at the bottom of every page of the website |
| Change my address, my name, my date of birth | From my account, under “Profile” |
| Change my subscription payment method | From my account, under “Subscriptions” |
| Cancel my subscription | From my account, under “Subscriptions”, “Cancel” button |
| Refuse the sharing of data for advertising purposes | Through the Data sharing opt-out page or the cookie settings |
2. Your rights, in plain terms
| Right | What it means for you |
|---|---|
| Access | Know whether we process data about you, and obtain a copy of it |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure (“right to be forgotten”) | Have your data deleted, other than data the law requires us to keep (see part 5) |
| Objection | Refuse processing based on our legitimate interest. For marketing, this right is absolute: we stop, unconditionally |
| Withdrawal of consent | Change your mind at any time about an agreement you gave (newsletter, SMS, cookies, diagnostic) |
| Restriction | Temporarily freeze the use of your data, for example while a dispute is being checked |
| Portability | Retrieve the data you provided to us in a readable file (CSV or JSON), or ask for it to be sent to another organisation |
| Post-mortem directives | Tell us what you would like us to do with your data after your death |
| Human review | Ask for a person to review an order blocked by our automated fraud detection tools |
These rights are provided for by Articles 15 to 22 of the GDPR and by Article 85 of the French Informatique et Libertés Act.
3. How to make a request
By e-mail (recommended): contact@mushngo.com, subject “Personal data”
By post: MNG SUPPLEMENTS, données personnelles, 99 boulevard de la Reine, 78000 Versailles, France
So that we can deal with your request quickly, please state:
- the right you wish to exercise;
- the e-mail address linked to your account or to your orders;
- if possible, an order number.
Verifying your identity. To protect your data, we have to make sure the request really comes from you. Write to us from the e-mail address linked to your account. If that is not possible, or in the event of reasonable doubt, we will ask you for additional information (for example the number and date of an order). We will ask for identity documents only as a last resort, and we will delete them as soon as the check is done.
Request made by a third party. Someone may act on your behalf, on production of a written, signed authorisation, together with a copy of your identity document and of theirs.
4. What happens next
- Acknowledgement of receipt within 72 working hours.
- Reply within one month of receiving your request. For a complex request, or where requests are numerous, this period may be extended by two months: we then tell you within the first month, explaining why.
- Free of charge. Exercising your rights is free. A manifestly unfounded or excessive request (in particular because it is repetitive) may be refused or may give rise to a reasonable fee. We then explain the reasons for our answer.
- Informing our service providers. When you obtain the rectification, erasure or restriction of your data, we pass the request on to the providers that hold it on our behalf (e-mailing tool, loyalty programme, customer service, and so on).
5. What we are legally required to keep, even after an erasure request
Erasure has limits set by law. Even if you ask us to delete your data, we must keep, in restricted-access archives:
- invoices and accounting records: 10 years (French Commercial Code);
- proof of orders of €120 including VAT or more: 10 years (French Consumer Code);
- the material needed for an ongoing dispute or to defend our rights, for the limitation period;
- the record of your objection to marketing, in the form of your e-mail address or your number on a suppression list, so that we never write to you again.
Everything else (account, browsing history, preferences, marketing profile, loyalty points, diagnostic answers) is deleted. Erasure means your customer account is closed and your loyalty points are lost, and any subscription is cancelled.
6. Your data and our service providers
Our e-mailing, loyalty, subscription, review and customer service tools are operated by providers acting on our behalf. You do not have to contact them one by one: a single request to us is enough, and we take care of passing it on. The list of these providers is set out in Article 7 of our privacy policy.
Exception: PayPal, Klarna and the social networks (Meta, TikTok, Google and others) are also controllers of their own processing. For the data they hold about you independently of Mush n Go, contact them directly.
7. After your death
You may send us specific directives about the storage, erasure and communication of your data after your death, and appoint a person to carry them out (Article 85 of the French Informatique et Libertés Act). In the absence of directives, your heirs may ask us to close your account, on production of supporting evidence.
8. Security: good habits
- Mush n Go will never ask you for your full bank card details, a password or a code received by SMS, whether by e-mail, by SMS, on WhatsApp or by telephone.
- Our only official channels are the mushngo.com domain, the address contact@mushngo.com and the WhatsApp number +33 7 56 91 31 89.
- A suspicious message claiming to be from Mush n Go? Do not click, forward it to us at contact@mushngo.com and report it on cybermalveillance.gouv.fr or to 33700 (for text messages).
9. If you are not satisfied with our answer
You may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority:
- online: cnil.fr/plaintes;
- by post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
If you live in another European Union country, you may also contact the data protection authority in your country. Finally, you have the right to a judicial remedy.
Data controller: MNG SUPPLEMENTS, a simplified joint-stock company with share capital of €10,000, Versailles trade register 994 172 898, 99 boulevard de la Reine, 78000 Versailles, France. Contact: contact@mushngo.com