PRIVACY POLICY

Object

This Policy is established by JELIC, whose registered office is 66 Avenue des Champs-Élysées, 75008 Paris under Siren number: 447 820 150

(hereinafter referred to as "the controller").

The purpose of this Policy is to inform visitors to the website hosted at the following address: https://cristina-paris.com/fr/

(hereinafter referred to as the "website") of the way in which the data is collected and processed by the data controller.

This Policy is in line with the wish of the controller to act in full transparency, in compliance with its national provisions and with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (hereinafter referred to as the "General Data Protection Regulation").

The data controller pays particular attention to the protection of the privacy of its users and therefore undertakes to take the reasonable precautions required to protect the personal data collected against loss, theft, disclosure or unauthorized use.

“Personal data” is defined as all personal data relating to the user, that is to say any information which allows him to be identified directly or indirectly as a natural person.

If the user wishes to react to one of the practices described below, he can contact the data controller at the postal address or at the email address specified in the "contact details" point of this Policy.

What data do we collect?

The controller collects and processes, according to the methods and principles described below, the following personal data:

its domain (automatically detected by the controller server), including the dynamic IP address;
his e-mail address if the user has previously disclosed it, for example by sending messages or questions on the website, by communicating with the controller by e-mail, by participating in discussion forums, by accessing the restricted part of the website by means of identification, or by transmitting it voluntarily when subscribing to the newsletter. ;
all the information concerning the pages that the user has consulted on the website;
Any information that the user has given voluntarily, for example in the context of information surveys and / or registrations on the website, or by accessing the restricted part of the website by means of identification. (Email addresses)
ïThe data necessary for carrying out loyalty, prospecting, study, survey, product testing and promotion actions;
ïData relating to the contributions of people who post opinions on products, services or content, in particular their pseudonym;

It is possible that the controller is also required to collect non-personal data. These data are qualified as non-personal data because they do not directly or indirectly identify a particular person. They can therefore be used for any purpose whatsoever, for example to improve the website, the products and services offered or the advertising of the data controller.

In the event that non-personal data is combined with personal data, so that the identification of the data subjects is possible, these data will be treated as personal data until their reconciliation with a particular person is made impossible.

Collection methods

The data controller can collect personal data as follows:

Web form (registration, purchase, contact etc.)
Email contact

Purposes of processing

Personal data is only collected and processed for the purposes mentioned below:

Regarding simple Internet users:

Carry out operations relating to prospecting:

the management of technical prospecting operations (which notably includes technical operations such as standardization, enrichment and deduplication);

the selection of people to carry out loyalty, prospecting, survey, product testing and promotion actions;

carrying out solicitation operations;

The development of trade statistics;
The transfer, rental or exchange of its customer files and its prospect files;
The updating of its prospecting files by the body in charge of managing the list of opposition to canvassing, in application of the provisions of the Consumer Code;
The organization of contests, lotteries or any promotional operation, excluding online gambling and games of chance subject to the approval of the Regulatory Authority for Online Games;
Invitations to institutional greetings ceremonies, to events organized by JELIC (conference room, etc.)
Sending the newsletter,
The management of requests for the right of access, rectification and opposition;
Managing people's opinions on products, services or content.
Management of requests made on the Jelic site via the contact form

Regarding customers:

Carry out operations relating to customer management concerning: contracts; the orders ; the deliveries ; the bills ; accounting and in particular the management of customer accounts; a loyalty program within one or more legal entities; monitoring customer relations such as carrying out satisfaction surveys, managing complaints and after-sales service; the selection of customers to carry out studies, surveys and product tests.
Newsletter management (Subscription management)
The management of requests for the right of access, rectification and opposition;
The management of unpaid debts and litigation, provided that it does not relate to infringements and / or that it does not lead to the exclusion of the person from the benefit of a right, a service or a contract ;

The controller may be required to carry out processing operations that are not yet provided for in this Policy. In this case, he will contact the user before reusing his personal data, in order to inform him of the changes and give him the possibility, if necessary, to refuse this reuse.

Legitimate interests

Some of the processing carried out by the controller is based on the legal basis of the latter's legitimate interests. These legitimate interests are proportionate to respect for the rights and freedoms of the user. If the user wishes to be informed of the details of the purposes based on the legal basis of legitimate interests, it is recommended that they contact the data controller (see point relating to "contact data").

Consent

Some of the treatments carried out by the controller are based on the legal basis of consent. In this case, the newsletter. At any time you have the possibility to withdraw this consent either by unsubscribing directly in the emails you receive or by contacting us (cf. Contact details)

Contract

Some of the processing carried out by the data controller is based on the legal basis of the contract. In this case, the creation of an account on the website.

The duration of the conversation

In general, the data controller only keeps personal data for the time reasonably necessary for the purposes pursued and in accordance with legal and regulatory requirements.

Regarding customers (see customer information)

The personal data of a customer are kept for a maximum of 10 years after the end of the contractual relationship between this customer and the controller.

At the end of the retention period, the data controller does everything to ensure that the personal data has indeed been made unavailable and inaccessible.

Regarding prospects

Personal data relating to a non-client prospect may be kept for a period of three years from their collection by the data controller or from the last contact from the prospect.

At the end of this three-year period, the data controller may contact the data subject again in order to find out whether they wish to continue to receive commercial requests. In the absence of a positive and explicit response from the person, the data must be deleted or archived in accordance with the provisions in force, and in particular those provided for by the Commercial Code, the Civil Code and the Consumer Code.

In the event of exercise of the right of access or rectification, data relating to identity documents may be kept for the period provided for in Article 9 of the Code of Criminal Procedure (i.e. one year). In the event of exercise of the right of opposition, this data may be archived during the limitation period provided for in Article 8 of the Code of Criminal Procedure (i.e. three years).

Regarding the retention period of cookies

The consent to be monitored may be forgotten by the people who have expressed it at a given moment, the CNIL considers it necessary to limit the scope of the latter in time.

It recommends that the period of validity of consent to deposit Cookies be extended to a maximum of 13 months. At the end of this period, consent must be obtained again.

Consequently, cookies must therefore have a lifetime limited to thirteen months after their first deposit in the user's terminal equipment (following the expression of consent).

Their lifespan should not be extended during new visits to the site.

Regarding data relating to bank cards:

The data relating to bank cards are deleted once the transaction has been carried out, that is to say upon its actual payment, which may be deferred upon receipt of the goods, increased, if necessary, by the withdrawal period provided for the contracts. concluded remotely and off premises, in accordance with Article L. 221-18 of the Consumer Code.
In the case of payment by bank card, the card number and its validity date may be kept for the purpose of proof in the event of a possible dispute of the transaction, in intermediate archives, for the duration provided for in Article L. 133-24 of the Monetary and Financial Code, in this case thirteen months following the debit date. This period may be extended to fifteen months in order to take into account the possibility of using deferred debit payment cards. These data are used only in the event of a dispute about the transaction.
Data relating to bank cards may be kept longer, subject to obtaining the express consent of the customer, previously informed of the objective pursued (for example, to facilitate payment for regular customers). The retention period cannot then exceed the period necessary for the accomplishment of the purpose of the processing.
In general, the data relating to the visual cryptogram are not kept beyond the time necessary for the completion of each transaction, including in the event of successive payments or retention of the card number for subsequent purchases.
When the expiration date of the bank card is reached, the data relating to them is deleted.

Application of rights

For all the rights listed below, the data controller reserves the right to verify the identity of the user for the application of the rights listed below.

This request for additional information will be made within one month of the request being made by the user.

Data access and copying

The user can obtain free of charge the written communication or a copy of the personal data concerning him which have been collected.

The controller may require payment of a reasonable fee based on administrative costs for any additional copies requested by the user.

When the user submits this request electronically, the information is provided in a commonly used electronic form, unless the user requests otherwise.

Unless otherwise provided for by the general data protection regulation, the copy of his data will be communicated to the user no later than one month after receipt of the request.

Right of rectification

The user can obtain free of charge, as soon as possible and at the latest within one month, the rectification of his personal data which would be inaccurate, incomplete or irrelevant, as well as supplement them if they prove to be incomplete. .

Unless otherwise provided for by the general data protection regulation, the request for the application of the right to rectification is processed within one month of its introduction.

Right to object to processing

The user may at any time, for reasons relating to his particular situation, object free of charge to the processing of his personal data, except when:

the processing is necessary for the performance of a task of public interest or relating to the exercise of public authority vested in the controller;
the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject which require protection of personal data (in particular when the affected person is a child).

The controller may refuse to implement the user's right of opposition when he establishes the existence of compelling and legitimate reasons justifying the processing, which take precedence over the interests or rights and freedoms of the user. , or for the establishment, exercise or defense of legal claims. In the event of a dispute, the user can lodge an appeal in accordance with the point “complaints and complaints” of this Policy.

The user can also, at any time, oppose, without justification and free of charge, the processing of personal data concerning him when his data is collected for the purposes of commercial prospecting (including profiling).

When personal data is processed for scientific or historical research purposes or for statistical purposes in accordance with the general data protection regulation, the user has the right to object, for reasons relating to his particular situation , to the processing of personal data concerning him, unless the processing is necessary for the performance of a task of public interest.

Unless otherwise provided for by the general data protection regulation, the data controller is required to respond to the user's request as soon as possible and at the latest within one month and to justify his response when he intends not to act on such a request.

Right to restriction of processing

The user can obtain the limitation of the processing of his personal data in the cases listed below:

when the user disputes the accuracy of a data and only the time that the controller can control it;
when the processing is unlawful and the user prefers the limitation of processing to erasure;
when, although no longer necessary for the pursuit of the purposes of the processing, the user needs it for the establishment, exercise or defense of his rights in court;
for the time necessary to examine the merits of a request for opposition submitted by the user, in other words the time for the controller to verify the balance of interests between the legitimate interests of the user controller and those of the user.

The controller will inform the user when the restriction of processing is lifted.

Right to erasure (right to be forgotten)

The user can obtain the erasure of personal data concerning him, when one of the following reasons applies:

the data are no longer necessary for the purposes of the processing;
the user has withdrawn their consent to their data being processed and there is no other legal basis for the processing;
the user objects to the processing and there are no compelling legitimate grounds for the processing and / or the user exercises his specific right of opposition in direct marketing (including profiling);
the personal data have been the subject of unlawful processing;
the personal data must be erased in order to comply with a legal obligation (under Union law or the law of the Member State) to which the controller is subject;
the personal data have been collected in the context of the offer of information society services aimed at children.

However, the erasure of data is not applicable in the following cases:

when the processing is necessary for the exercise of the right to freedom of expression and information;
when the processing is necessary to comply with a legal obligation which requires the processing provided for by Union law or by the law of the Member State to which the controller is subject, or to perform a task of public interest or relevant the exercise of public authority vested in the person responsible;
when the processing is necessary for reasons of public interest in the field of public health;
when the processing is necessary for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes and insofar as the right to erasure is likely to make impossible or seriously jeopardize the achievement of the purposes of the processing in question;
when the processing is necessary for the establishment, exercise or defense of legal claims.

Right to "data portability"

The user may at any time request to receive their personal data free of charge in a structured, commonly used and machine-readable format, in particular with a view to transmitting them to another controller, when:

the data processing is carried out using automated processes; and when
the processing is based on the user's consent or on a contract concluded between the user and the controller.

Under the same conditions and according to the same modalities, the user has the right to obtain from the controller that the personal data concerning him be transmitted directly to another person responsible for the processing of personal data, insofar as this is technically possible.

The right to data portability does not apply to processing which is necessary for the performance of a task of public interest or relating to the exercise of public authority vested in the controller.

Data recipients and disclosure to third parties

Internal recipients

The recipients of the data are only the personnel authorized by the JELIC company in charge of security and the “commercial” relationship.

Subcontractors

The people outside the company who have access to the data are the various hosting providers as well as our IT service providers.

As part of the promotional mailings (newsletter) we call on MAILCHIMP which certifies its compliance with the privacy shield.

The recipients of the data collected and processed are, in addition to the data controller himself, his employees or other subcontractors, his carefully selected business partners, located in France or in the European Union, and who collaborate with the data controller. processing in connection with the marketing of products or the provision of services.

In the event that the data is disclosed to third parties for direct marketing or commercial prospecting purposes, the user will be informed beforehand so that they can choose to accept the transfer of their data to third parties.

As soon as this transfer is based on the user's consent, the user can, at any time, withdraw his consent for this specific purpose.

The data controller complies with the legal and regulatory provisions in force and will in all cases ensure that its partners, employees, subcontractors or other third parties having access to this personal data comply with this Policy.

The data controller discloses the user's personal data in the event that a law, legal proceedings or an order of a public authority would make this disclosure necessary.

Security

The data controller implements the appropriate technical and organizational measures to guarantee a level of security for the processing and the data collected with regard to the risks presented by the processing and the nature of the data to be protected adapted to the risk. It takes into account the state of knowledge, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risks to the rights and freedoms of users.

The data controller always uses encryption technologies that are recognized as industry standards within the IT sector when transferring or receiving data on the website.

The controller has implemented appropriate security measures to protect and prevent the loss, misuse or alteration of information received on the website.

In the event that the personal data that the controller controls should be compromised, he will act quickly to identify the cause of this violation and take the appropriate remedial measures.

The data controller informs the user of this incident if the law requires it.

Complaint and complaint

If the user wishes to react to one of the practices described in this Policy, it is advisable to contact the data controller directly.

The user can also lodge a complaint with his national supervisory authority, you can send a complaint online to the CNIL or by post:

National Commission for Informatics and Freedoms (Cnil)

3 Place de Fontenoy

TSA 80715

75334 Paris cedex 07

Phone: +33 1 53 73 22 22

In addition, the user has the possibility of lodging a complaint before the competent national courts.

Contact details

For any questions and / or complaints relating to this Policy, the user can contact the data controller:

By email: RGPD@cristina-paris.com

By mail :

JELIC

66 Avenue des Champs-Élysées

75008 Paris

Modification

The data controller reserves the right to modify the provisions of this Policy at any time. The changes will be published directly on the website of the data controller.

Applicable law and competent jurisdiction

This Policy is governed by the national law of the main place of establishment of the controller.

Any dispute relating to the interpretation or execution of this Policy will be submitted to the jurisdictions of this national law.

This version of the Policy dates from 06/01/2019.

PRIVACY POLICY

CONTACT