PRIVACY POLICY

This Privacy Policy is entered into between:

On the one hand,

BERENGERE LEROY, a société par actions simplifiée with a sole shareholder and share capital of €52,000.00, registered with the TARASCON Trade and Companies Register under number 798 319 091, whose registered office is at 3 avenue Albert Schweitzer – 13210 ST REMY DE PROVENCE and whose VAT number is FR28798319091 (hereinafter referred to as the “Data Controller”)

AND

On the other hand,

Any natural person who is of legal age or holds parental authorisation, has full legal capacity to enter into a contract and wishes to make a purchase via on the website www.shop-berengereleroy.com (hereinafter referred to as the “Data Subject”).

The Consumer and the Professional are hereinafter jointly referred to as the “Customers”, and the Customers and BERENGERE LEROY are hereinafter jointly referred to as the “Parties”.

- Purpose

This Privacy Policy applies, without restriction or reservation, between the Data Subject and the Data Controller.

Its purpose is to provide information about how the Data Controller collects and processes certain Personal Data relating to the Data Subject, in accordance with the legislation in force and, in particular, European Regulation No. 2016/679 and Law No. 78-17 (hereinafter referred to as the “Legislation”), in connection with the Data Subject’s use of the website www.shop-berengereleroy.com (hereinafter referred to as the “Site”).

Access to and use of the website are subject to compliance with the General Terms and Conditions of Sale, the Legal Notice and this Privacy Policy.

- Definitions

- Supervisory Authority means the Commission nationale de l’informatique et des libertés (CNIL), the independent French public authority responsible for regulating data protection;

- Consent means any freely given, specific, informed and unambiguous indication of the Data Subject’s wishes by which they agree, by means of a statement or a clear affirmative action, to the processing of Personal Data relating to them by the Data Controller.

- Cookie means a file that makes it possible to track the Data Subject’s journey through the Site.

- Recipient means any natural or legal person, public authority, service or other body that receives the Data, whether or not it is a Third Party. However, public authorities that may receive the Data, particularly as part of an investigative task, are not considered Recipients within the meaning of this definition.

- Data means any information relating to the Data Subject.

- Filing System means any structured set of Data that is accessible according to specific criteria, whether that set is centralised, decentralised or distributed on a functional or geographical basis.

- Legislation means any law or regulation relating to data protection and, in particular, European Regulation No. 2016/679 and Law No. 78-17.

- Browsing means viewing, learning about, ordering and/or purchasing Products on the Site by the Data Subject.

- Data Subject means any natural person who browses the Site and can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, psychological, economic, cultural or social identity.

- Products means the products and services offered for sale on the Site by the Data Controller to the Data Subject.

- Pseudonymisation means the processing of Data in such a way that it can no longer be attributed to the Data Subject without the use of additional information.

- Data Controller means BERENGERE LEROY, a société par actions simplifiée with a sole shareholder and share capital of €52,000.00, registered with the TARASCON Trade and Companies Register under number 798 319 091, whose registered office is at 3 avenue Albert Schweitzer – 13210 ST REMY DE PROVENCE, which alone determines the purposes and means of the Processing.

- Site means the infrastructure developed by the Data Controller in computer formats usable on the Internet, comprising data of various kinds, including text, sound, still or moving images, videos and databases, intended to be accessed by the Data Subject to learn about, reserve, order and/or purchase Products (www.shop-berengereleroy.com).

- Processor means any natural or legal person, public authority, service or other body, other than the Data Controller, that processes Data on behalf of the Data Controller.

- Third Party means any natural or legal person, public authority, service or other body, other than the Data Controller, the Processor and persons who, under the direct authority of the Data Controller or the Processor, are authorised to process the Data, including tour operators, travel agencies and booking systems.

- Processing means any operation or set of operations performed, with or without the aid of automated processes, on Data or sets of Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

AGREEMENT

- Principles relating to Processing

In accordance with the Legislation, the Data Controller undertakes to comply with the following principles for each Processing operation:

- Lawfulness;

- Fairness;

- Transparency;

- Purpose limitation;

- Data minimisation;

- Accuracy;

- Storage limitation;

- Integrity;

- Confidentiality;

- Accountability.

- Data processed

In the course of Browsing, the Data Controller may collect and process a certain amount of Data relating to the Data Subject, including:

- Personal information (surname, first name, postal address, email address, telephone number, date of birth, date of registration and deregistration for the Data Controller’s customer account and newsletter, messages exchanged with the Data Controller);

- Banking information (payment method, credit card number);

- Order information (product ordered, delivery address, delivery tracking number, order price, purchase and delivery history);

- Technical information (browsing behaviour on the Site, IP address, products added to the basket, recording of Consent).

- Context of Processing

Data may be collected and processed by the Data Controller on various occasions, including:

- Purchase of Products on the Site;

- Contact with the Data Controller;

- Newsletter registration;

- Creation of a customer account;

- Browsing the Site.

- Details of Processing

Purpose of Processing	Data concerned	Legal basis for Processing	Data retention period
Managing Product orders and deliveries	First name, surname, email address, postal address, telephone number, delivery address, order placed, delivery tracking number, Products and services purchased, payment method, order and delivery history, customer ID, credit card number, IP address	Contract	Duration of the contractual relationship EXCEPT Immediately for the card security code
Accounting and tax obligations	First name, surname, email address, postal address, telephone number, delivery address, order placed, delivery tracking number, Products purchased, invoices, payment method	Legal obligation	10 years from the date of purchase of the Product
Management of pre-litigation matters and litigation	First name, surname, email address, postal address, telephone number, delivery address, order placed, delivery tracking number, Products purchased, payment method, order and delivery history, customer ID, credit card number, IP address	Legitimate interest of the Data Controller in establishing proof of a right or contract	5 years from the date of purchase of the Product EXCEPT 13 months following the debit date for payment data
Creation and management of customer accounts	First name, surname, email address, postal address, telephone number, sizes, date the customer account was created, payment method, invoices, delivery address, order placed, delivery tracking number, baskets, Products purchased, order and delivery history, customer ID, collection of Consent	Consent of the Data Subject	3 years from the date the Data Subject last logged in to their customer account
Retention of the bank card number to facilitate future purchases	First name, surname, customer ID, credit card number, collection of consent	Consent of the Data Subject	Until the bank card expires
Electronic marketing and newsletter	First name, surname, email address, collection of consent	Consent of the Data Subject	3 years from the date of the last contact by the Data Subject
Postal marketing	First name, surname, email address, postal address	Legitimate interest of the Data Controller in promoting its Products	3 years from the date of the last contact by the Data Subject
Electronic marketing for similar goods and services	First name, surname, email address, , telephone number, purchase history,	Legitimate interest of the Data Controller in promoting its Products	3 years from the date of the last contact by the Data Subject
Securing and improving the Site	IP address, Browsing Data	Legitimate interest of the Data Controller in improving and managing the Site, securing and administering the Site, and preventing fraud and malicious acts	13 months
Management of complaints and customer service	First name, surname, email address, postal address, telephone number, purchase history, correspondence, customer ID, IP address	Legitimate interest of the Data Controller in improving its Products and customer service	3 years from the date of the last contact by the Data Subject
Management of the marketing opt-out list	Email address	Legitimate interest of the Data Controller in monitoring its marketing campaigns	3 years from the date the right is exercised
Site statistics and personalised advertising	IP address, Browsing Data, collection of Consent	Consent of the Data Subject	6 months

The Data Controller reserves the right to anonymise Data subject to Processing before deleting it.

Anonymised Data may then be subject to Processing for statistical purposes.

- Recipients of the Data

As a rule, the Data Controller is the sole Recipient of the Data.

However, the Data Controller may transfer Data to Recipients and Sub-processors, particularly in connection with the management of the purchase of Products by the Data Subject, and/or to any public authority that requests it, particularly in the context of an investigation.

The Data Controller undertakes to require its Sub-processors to provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures, so that the Processing complies with legal and regulatory requirements and guarantees the protection of the Data Subject’s rights, particularly in the event of a transfer of Data outside the European Union.

Furthermore, the Data Controller may disclose Data subject to Processing to any Recipient or Third Party where there is a legal obligation to do so or where the Data Controller considers in good faith that this is necessary to:

- Respond to any claim made against it ;

- Comply with the requirements of the judicial and/or administrative authorities and/or the Supervisory Authority ;

- Perform any contract to which the Data Subject is a party ;

- Safeguard the vital interests of any natural person ;

- Perform a task carried out in the public interest.

In the event that the Data Controller is purchased by a Third Party, the Data Controller reserves the right to share the Data with the purchasing Third Party, subject to that Third Party’s compliance with this Privacy Policy.

- Rights of the Data Subject in relation to the Data

The Data Subject has a number of rights in relation to the Data which they may exercise, subject to any applicable legislative or regulatory exception, by submitting a request to the Data Controller at the following address:

BERENGERE LEROY

3 avenue Albert Schweitzer – 13210 ST REMY DE PROVENCE

[email protected]

If there is reasonable doubt as to the identity of the Data Subject making a request to exercise their rights in relation to the Data, the Data Controller may ask them to attach a copy of an official identity document to support the request.

Requests will be processed as soon as possible and no later than within the time limits set by the Legislation.

- Right of access

The Data Subject has the right to obtain from the Data Controller confirmation as to whether or not Data are being Processed and, where they are, access to that Data and the following information:

- The purposes of the Processing ;

- The categories of Data ;

- The Recipients or categories of Recipients to whom the Data have been or will be disclosed, particularly Recipients established in third countries or international organisations ;

- Where possible, the period for which the Data will be stored or, where this is not possible, the criteria used to determine that period;

- The existence of the right to request that the Data Controller rectify or erase Data, or restrict the Processing of Data, or the right to object to such Processing;

- The right to lodge a complaint with a Supervisory Authority ;

- Where the Data have not been collected from the Data Subject, any available information as to their source;

- The existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of this Processing for the Data Subject.

The Data Controller shall provide a copy of the Data subject to Processing and reserves the right to charge reasonable fees based on administrative costs for any additional copy requested by the Data Subject.

- Right to erasure and rectification

The Data Subject has the right to obtain from the Data Controller the rectification and/or erasure of inaccurate or outdated Data as soon as possible, except where circumstances prevent the exercise of this right, including in particular:

- The exercise of the right to freedom of expression and information ;

- Compliance with a legal obligation ;

- The public interest in the areas of public health, archiving, scientific or historical research, or statistics ;

- The establishment, exercise or defence of legal claims.

- Right to object

The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the Processing of Data based on the performance of a task carried out in the public interest or the necessity of the legitimate interests of the Data Controller.

The Data Controller then undertakes to cease Processing the Data, unless it demonstrates compelling legitimate grounds for the Processing which override the interests, rights and freedoms of the Data Subject, or for the establishment, exercise or defence of legal claims.

Furthermore, the Data Subject has the right to object at any time to the Processing of Data by the Data Controller for marketing purposes, where the Data Subject is subject to such marketing.

Lastly, where Data are processed for scientific or historical research purposes or for statistical purposes, the Data Subject has the right to object to the Processing of the Data on grounds relating to their particular situation, unless the Processing is necessary for the performance of a task carried out in the public interest.

- Right to restriction

The Data Subject has the right to obtain from the Data Controller restriction of the Processing of Data where:

- The accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Data Controller to verify the accuracy of the Data;

- The Processing is unlawful and the Data Subject opposes their erasure and requests the restriction of their use instead;

- The Data Controller no longer needs the Data for the purposes of the Processing, but the Data Subject still requires them for the establishment, exercise or defence of legal claims;

- The Data Subject has objected to the Processing in accordance with Article 9.3, pending verification as to whether the legitimate grounds pursued by the Data Controller override those of the Data Subject.

The Data Subject who has obtained restriction of the Processing of Data shall be informed by the Data Controller before the restriction of Processing is lifted.

- Right to data portability

The Data Subject has the right to receive the Data they have provided to the Data Controller in a structured, commonly used and machine-readable format, and has the right to transmit those Data to another data controller without hindrance from the Data Controller, where:

- The Processing is based on the Data Subject’s Consent or on the performance of a contract to which the Data Subject is a party;

- The Processing is carried out by automated means.

When exercising their right to data portability, the Data Subject has the right to have the Data transmitted directly from the Data Controller to another data controller, where technically feasible.

- Right to lodge a complaint with the Supervisory Authority

The Data Subject has the right to lodge a complaint with the Supervisory Authority if they consider that they are subject to unlawful Processing of Data by the Data Controller.

- Right to set instructions regarding the fate of Data

The Data Subject has the right to set instructions regarding the fate of their Data after their death with the Data Controller, which will use all available technical means to ensure that these wishes are respected.

- Data Security

The Data Controller takes appropriate technical and organisational measures to protect Data against destruction, loss, alteration, misuse and unauthorised access, modification or disclosure, whether these actions are intentional or accidental.

These technical and organisational measures are intended to ensure the confidentiality, integrity, availability and resilience of the Site and the information systems on which the Files are stored.

To secure the User’s browsing, the Site is encrypted using SSL (Secure Socket Layer).

- Amendments to the Privacy Policy

The Data Controller reserves the right to amend this Privacy Policy from time to time, in particular the list of Recipients set out in Article 8.

In the event of a material amendment to this Privacy Policy, the Data Subject will be personally informed of the new Privacy Policy.

The Data Subject is invited to consult this Privacy Policy regularly to be informed of any amendments to it.

The Data Subject may send any questions about this Privacy Policy to the Data Controller at the following address: [email protected].

- Invalidity of the Privacy Policy

If any provision of this Privacy Policy is found to be invalid under any applicable rule of law or a final court decision, it shall be deemed unwritten, without rendering the Privacy Policy as a whole invalid or affecting the validity of its other provisions.

- Cookie Management

When browsing the Site, the Data Subject is asked to consent to or object to the installation of Cookies on their device.

In general, non-functional Cookies record information about computers’ browsing activity on the Site (pages viewed, date and time of viewing, etc.), which may be read during the Data Subject’s subsequent visits to the Site, with the Data being transmitted to the Data Controller. The installation of these Cookies requires the Data Subject’s Consent.

Some Cookies are essential to the proper functioning of the Site and do not require the Data Subject’s Consent before installation; these are known as functional Cookies.

In accordance with Article 7 of this Privacy Policy, non-functional Cookies are automatically deleted within six (6) months of their installation if the Data Subject does not renew their Consent before this period expires.

The Data Subject may refuse to give Consent to the installation of non-functional Cookies, withdraw their Consent and/or configure Cookies at any time using the Data Controller’s Cookie manager below or by configuring their browser as follows:

For Mozilla Firefox: