Privacy Policy

PRIVACY POLICY

We are very happy to welcome you to our site and thank you for your interest in our store! Respecting your privacy and protecting your personal data is particularly important to us, so please read the charter below carefully. You will find all the necessary information regarding the processing of your collected data.

1. IDENTITY OF THE DATA CONTROLLER

Within the framework set by the General Data Protection Regulation (GDPR), by the laws in force in the Member States, as well as by other legal provisions relating to privacy, personal data is collected by the company.

1. PERSONAL DATA PROTECTION OFFICER

The personal data protection officer can be contacted at the following address:

III. DATA PROCESSING: GENERAL INFORMATION

1. Nature of the data collected and purpose of the processing

Only personal data that contributes to ensuring the functionality of our website, including content and services, will be collected and processed. The collection and use of personal data takes place at regular intervals and is always subject to the user's consent. Exceptions to this principle will only be made in cases where prior consent is fundamentally impossible or where data processing is permitted by law.

2. Scope of the charter and applicable law

Obtaining consent to the collection and processing of personal data is done on the basis of Union law, in accordance with Art. 6 (1) lit. a GDPR (General Data Protection Regulation).

The processing of personal data necessary for the performance of a contract to which the data subject is a party is carried out in accordance with European law pursuant to Art. 6 (1) lit. b GDPR. This also applies to processing operations necessary for the implementation of pre-contractual measures.

The processing of personal data carried out within the framework of a legal obligation to which our company is subject is carried out in accordance with Art. 6 (1) lit. c GDPR.

The processing of personal data for the purpose of protecting the vital interests of the data subject or another natural person is carried out in accordance with Art. 6 (1) lit. d GDPR.

Unless the interests or fundamental rights and freedoms of the data subject prevail, the processing of personal data necessary for the purposes of a legitimate interest pursued by our company is carried out in accordance with Art. 6 (1) lit. f GDPR.

3. Duration of storage and deletion of personal data

The personal data collected shall be deleted or blocked as soon as they are no longer necessary in relation to the purposes for which they were collected. Any storage beyond this period shall be lawful if provided for by Union or Member State law, in the respective regulations, laws or other directives to which the controller is subject. Data shall also be blocked or erased when the storage period provided for by the aforementioned standards expires, unless the extension of storage is necessary for a new contract or the performance of a given contract.

1. SITE ACCESSIBILITY AND CREATION OF LOG FILES
2. Scope of processing of personal data

Every time you visit our website, data and information about the source computer system are automatically collected.

This involves the following data:

• Information about the browser type and version used
• The user's operating system
• The user's Internet Service Provider (ISP)
• The user's IP address
• The time and date of the visit
• The websites from which the user's system accesses our site

This data is also recorded in our system log files. It is never stored together with other data relating to the user's person.

2. Legal framework for data processing

The temporary storage of data and log files is in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

Temporary storage of the IP address is a necessary prerequisite for the client computer to access our website. To do this, the user's IP address must be stored for the duration of the current session.

The storage of log files serves to ensure the functionality of the website for the user. This data also contributes to the optimization of the website and the security of our IT systems.

The aforementioned purposes justify our legitimate interest in data processing, pursuant to Art. 6 (1) lit. f GDPR.

4. Retention period

Data is deleted as soon as it is no longer necessary for the purposes for which it was collected. For data collection related to website accessibility, the purpose is achieved when the Internet session is closed. Furthermore, altering users' IP addresses prevents tracking of customers accessing the website.

5. Right to object and erasure of data

The collection of data used to establish the connection with the website, as well as the storage of data in log files, are essential for the proper functioning of the website in question. The user will therefore not be able to exercise their right to object in this regard under any circumstances.

1. USE OF COOKIES
2. Scope of processing of personal data

Our website uses cookies. Cookies are text files that are stored in or by the Internet browser on the user's computer system. When a user visits a website, a cookie may be stored on their operating system. This cookie contains a specific string of characters that allows a specific browser to be uniquely identified when the same website is subsequently visited.

We use cookies to improve the design of our website, with a view to perfecting the customer experience. Some elements of our web page require the identification of the customer's browser, even beyond their visit to the site.

Cookies record and transmit the following data:

• Items placed in a shopping cart
• The comfort of browsing the different sections of the store
• Recognition of a given user when they return to the store
• Considered purchases
• The last articles consulted

The cookies placed on our site also allow the analysis of the browsing behavior of the users concerned.

In this context, the data listed below are transmitted:

• The search terms entered
• Traffic statistics for the different pages
• Use of features available on the Website

For further information regarding the issue of analytical cookies, please refer to the following chapters:

• Google Analytics
• Google AdWords
• Google Remarketing
• Bing Ads (Universal Event Tracking) and
• AWIN.

2. Legal framework for data processing

The use of cookies in the context of the processing of personal data is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

The installation of technically necessary cookies aims to improve the browsing experience on our website. Without cookies, certain features would not be available. These features require the identification of the client's browser, even beyond their visit to the website.

The features listed below require the use of cookies:

• Items placed in a shopping cart
• The comfort of browsing the different sections of the store
• Recognition of a given user when they return to the store
• Considered purchases
• The last articles consulted

The data collected by technically necessary cookies are not used for profiling purposes.

The purpose of implementing analytical cookies is to improve the quality of our website and its content. Analytical cookies allow us to better understand how our website is used; they thus contribute to the constant optimization of the content offered.

This purpose constitutes our legitimate interest in processing users' personal data, pursuant to Article 6 (1) lit. f GDPR.

4. Retention period, right to object and deletion of data

Cookies are stored on the client's computer and transmitted to our website. You, as the user, therefore have full control over the use of cookies. You can change your browser settings to disable or restrict the transmission of cookies. Previously stored cookies can be deleted at any time. This process can be fully automated. If you disable cookies for our website, you may no longer be able to use all of the features offered.

1. GOOGLE ANALYTICS
2. Nature and scope of data processing

We use Google Analytics (with anonymized data) on our website. This web analytics service collects, among other things, information about (a) the website from which a user accessed a given website, (b) the subpages of the website that they visited, or (c) the frequency and duration of visits to a given subpage. Web analytics are primarily used for website optimization and cost-benefit analysis in digital marketing.

The operating company of Google Analytics is Google, LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

For web traffic analysis via Google Analytics, we use the extension "_gat._anonymizeIp". With the help of this extension, Google shortens and anonymizes the IP address of the Internet access of the data subject, when accessing our website from a Member State of the European Union or from another Contracting State to the Agreement on the European Economic Area.

The use of cookies allows Google to analyze the use of our website. Each time you visit a subpage of the website, the Google Analytics tool requests the Internet browser installed on your terminal to transmit data to Google, in order to contribute to the analysis of web traffic. During this technical process, Google accesses personal data, such as the IP address, which allows Google to trace the origin of visitors and clicks, and thus to carry out the implicit counts.

Cookies contribute to the storage of personal information, such as access time, the location from which a consultation was initiated or the frequency of visits to our site. Each time you visit our site, the aforementioned data (including the IP address of your internet access) is sent to Google in the United States. Google stores this personal data in the United States. Google reserves the right to disclose personal information collected by the web traffic analysis tool to third parties.

2. Legal framework for data processing

The legal basis for data processing lies in our legitimate interests, in accordance with Art. 6 (1) lit. f. GDPR.

3. Purpose of data processing

The Google Analytics tool measures the number of visits to our website. Google uses the collected data and information to evaluate interactions with our website and to provide online reports displaying the events taking place on our pages. This collection also allows Google to provide other services related to the use of our website.

The aforementioned purposes constitute our legitimate interest and thus provide the legal basis for the processing of personal information pursuant to Art. 6 (1) lit. f GDPR.

4. Right to object and erasure of data

You can prevent the storage of cookies at any time by selecting the appropriate settings on your computer, and thus permanently object to the storage of cookies. This browser configuration prevents Google from storing cookies on your connection device. Furthermore, any cookies already stored by Google Analytics can be deleted at any time via your Internet browser or other corresponding software programs.

You can also exercise your right to object to Google Analytics and thus prevent the recording or use of data relating to this website. To do this, you must download and install the tool available at the following address: https://tools.google.com/dlpage/gaoptout?hl=fr . This add-on sends a Java script to Google Analytics, containing a ban on the transmission of data or information relating to the consultation of websites. By installing the add-on, you expressly object to the storage of cookies on your connection terminal. In the event of a reset, formatting or new installation of the computer system, a reinstallation of the add-on is necessary to deactivate Google Analytics. If you uninstall or deactivate Google Analytics yourself, you can reinstall or reactivate the add-on.

Additional information and Google's privacy policy are available at: https://policies.google.com/privacy?hl=fr&gl=fr and https://marketingplatform.google.com/about/analytics/terms/fr/ . For a more detailed description of Google Analytics, please click on the following link: https://marketingplatform.google.com/intl/fr/about/

VII. NEWSLETTER

1. Nature of the processing of personal data

You have the option to subscribe to our newsletter free of charge. When you subscribe, the data entered in the corresponding form will be transmitted to us. This includes the following information:

Mandatory field:

• E-mail address

Optional fields:

• Civility
• First and last name
• Street
• Street number
• Postal code
• Place of residence

The following data will also be collected:

• Date and time of subscription

During the subscription process, you will be expressly asked to consent to the processing of data; reference will be made to this privacy policy.

Subscription to our newsletter is done through a double opt-in procedure. As soon as a user registers on our site, a confirmation request is sent to them via email. This procedure is intended to prevent subscriptions from third-party email addresses.

If you provide your email address when purchasing products or services on our site, it may subsequently be used to send you one of our newsletters. In such a case, you will only receive advertisements directly related to your previous purchases, with the aim of informing you of other comparable products or services.

2. Using the MailChimp service

Our newsletters are sent via MailChimp, an email marketing service. This is a newsletter delivery platform owned by the American company The Rocket Science Group LLC, 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA.

All data we collect is stored on MailChimp's servers. MailChimp uses this data to send and analyze newsletters. MailChimp may also use this data to optimize its own service (presentation of newsletters, determining the origin of recipients, etc.). However, MailChimp does not use this data to contact recipients itself or to pass the collected information on to third parties.

MailChimp is certified under the EU-US Privacy Shield. Through this certification, MailChimp commits to complying with the European Union's privacy policy. In addition, we have entered into a data processing agreement with MailChimp. This is a contract that commits MailChimp to protect user data, to use it only within the framework of our privacy policy, and not to share the collected data with third parties.

3. Statistical developments and analyses

Every newsletter contains web beacons. These are very small files (1 pixel), which MailChimp consults each time a newsletter is opened. This allows MailChimp to obtain technical information about:

• the IP address
• the browser and operating system
• the date of consultation of the newsletter.

This data contributes to the technical improvement of the service.

Furthermore, web beacons can be used to determine whether the user has opened the newsletter, when they viewed it, and which links they clicked on. It is theoretically possible to assign the data to specific users; however, neither MailChimp nor we aim to track individual users. We seek to determine reading habits in order to tailor content to users. The goal is to send content tailored to the respective interests of individual subscribers.

4. Legal framework for data processing

The processing of data after the user has subscribed to the newsletter and after obtaining their consent is carried out in accordance with the legislation set out in Art. 6 (1) lit. a GDPR.

The newsletter is sent after purchasing products or services on our website in accordance with Art. 7 (3) UWG (French law against unfair competition), if the products and services are comparable to the previous purchases.

The use of MailChimp and the creation of statistical analyses are based on our legitimate interests in accordance with Art. 6 (1) lit. f GDPR. Our legitimate interest lies in providing a secure and user-friendly newsletter. This contributes to our economic interests on the one hand, and to meeting user expectations on the other.

5. Purpose of data processing

The registration of a given user's email address is necessary for sending the newsletter. The other personal data collected during the registration process are intended to counteract misuse of the services offered or the specified email address.

6. Retention period

Data is deleted when it is no longer necessary for the purposes for which it was collected. The retention period for a given user's personal information corresponds to the validity period of the newsletter subscription.

7. Right to object and erasure of data

The user can unsubscribe from the newsletter at any time by clicking on the link provided in each newsletter. Such unsubscription is accompanied by the revocation of consent to the storage of personal data collected during the subscription process.

VIII. REGISTRATION

1. Nature and scope of processing of personal data

Users can register on our website by providing us with certain personal data. This data is entered into an entry mask before being transferred to us for registration. This information is not transferred to third parties under any circumstances. The following data is collected during registration:

• Private client or professional client
• First and last name
• E-mail address
• Street name and number
• Postal code
• City
• Country
• VAT number (for business customers only)
• Business (for business customers only)

At the time of registration, the information listed below will also be recorded:

• Date and time of registration

2. Legal framework for data processing

Where the data subject has given consent, the processing of data is carried out in accordance with the legislation established in Art. 6 (1) lit. a GDPR.

If registration is necessary for the performance of pre-contractual measures, Art. 6 (1) lit. b GDPR serves as an additional legal basis for data processing.

3. Purpose of data processing

User registration is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures. Registration is therefore used to conclude sales contracts on our website, as well as to obtain specific quotes.

4. Retention period

The data is deleted from the moment it is no longer necessary for the purposes for which it was collected or in the event of cancellation of registration.

5. Right to object and erasure of data

As a user, you can cancel your registration at any time. You can request a change to the data stored about you at any time.

If the information is necessary for the performance of a given contract or pre-contractual measures, its early deletion is only possible in the absence of a contractual or legal commitment opposing it.

1. CONTACT BY EMAIL AND CONTACT FORM
2. Nature and scope of processing of personal data

Our website contains a contact form that allows you to contact us electronically. When using this service, the data entered by the user in the form provided for this purpose will be transferred to us and then stored. This information includes the following:

• Civility
• First name
• Name
• E-mail address
• Phone number (optional field)

When sending the message, the following data is also recorded:

• Date and time

Alternatively, you can contact us via the email address provided on our website. In this case, the personal data provided by email will be stored.

In this context, no transfer of data to third parties takes place. The information concerned is used exclusively for processing the conversation in question.

2. Legal framework for data processing

Where the data subject has given consent, the processing of data is carried out in accordance with the legislation established in Art. 6 (1) lit. a GDPR.

With regard to data processing in connection with the sending of e-mails, Art. 6 (1) lit. f GDPR serves as an additional legal basis.

3. Purpose of data processing

The use of personal data from the online form is exclusively for the processing of the contact in question. In such a case, contact by email constitutes the legitimate interest justifying the processing of the data in question.

4. Retention period

Data is deleted when it is no longer necessary for the purposes for which it was collected. For personal data from the contact form or communicated by email, this is the case when the conversation with the data subject reaches its end. This term is reached when the circumstances reveal that the fact in question has been fully clarified.

5. Right to object and erasure of data

If contacted by email, the user has the right to object at any time to the processing of their personal data. In such a case, the conversation is terminated and cannot be extended beyond this.

All data recorded around the contact is then erased.

1. RATING AND COMMENT FEATURES
2. Nature and scope of processing of personal data

Every user has the opportunity to comment on contributions appearing on our blog, as well as to evaluate the products we offer. In this context, the data entered in the input mask is transferred to us. In this case, this information is listed below:

• Name
• E-mail address
• Summary
• Assessment

In addition, the following data is collected in connection with the rating and commenting functions:

• Date and time

The user's email address does not appear on our website. The user does not have to provide their real name and can choose a pseudonym.

2. Spam protection

Before submitting a comment or rating, the user must enter a string of characters in the provided field (the "captcha"). This process allows us to verify that the user is a human being and not a robot.

Providing your email address helps protect us from spam.

3. Legal framework for data processing

The processing of personal data is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

4. Purpose of data processing

We use this data to display comments and ratings on our website. In doing so, we strive to ensure maximum user comfort on the website and to combat spam. This also constitutes our legitimate interest in data processing, in accordance with Art. 6 (1) lit. f. GDPR.

5. Retention period

The comment and the corresponding personal data are stored permanently. Without this, it would be impossible to display a given user's comment or rating under the relevant article on our website.

6. Right to object and erasure of data

When a user deletes their comments or ratings, we promptly delete the relevant personal data.

1. ONLINE CHAT
2. Nature and scope of processing of personal data

We offer users browsing our site the ability to communicate with us in real time. To do this, we have installed a live chat plugin called "Userlike."

When our online chat is available, only the time and date of the chat are recorded. When the chat is offline, we offer the user the option to leave us a message. In this context, we collect the following data:

• Name
• E-mail address
• Time and date

None of this data will be transferred to third parties. The data is only used for processing the conversation in question.

2. Legal framework for data processing

The processing of personal data is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

The data will be used exclusively for the processing of the relevant contact. This is where our legitimate interest lies in processing the data in question.

4. Retention period

Data is deleted when it is no longer necessary for the purposes for which it was collected. This is the case when the conversation with the user concerned reaches its end. This term is reached when the circumstances reveal that the fact in question has been fully clarified.

5. Right to object and erasure of data

When contacting us via online chat, you have the right to object to the storage of your personal data at any time. You can exercise your right to object by email or by using another form of communication. In such a case, the conversation is over and cannot be continued beyond this point.

All personal data recorded around the contact will then be deleted.

XII. PROMOTIONAL GAMES

1. Nature and extent of personal data

From time to time, we invite customers to participate in competitions. In the context of this participation, the following information, necessary for the conduct of the promotional competition, will be collected and processed (in addition to the data stored when using our website or comparable services such as Facebook):

• First name
• Name
• If applicable (via Facebook for example), a different username
• Addresses such as postal addresses, email addresses or other contact details
• Possibly additional data, depending on the design of the contact form

In this context, no data transfer to third parties takes place. The information concerned is used exclusively for the conduct of the respective promotional game.

Provided that the user's prior consent has been obtained, their name and place of residence may also be published on one of our platforms, such as our website or Facebook, for example.

2. Legal framework for data processing

The processing of information in connection with the organization of a particular promotional game is carried out in accordance with the legislation established in Art. 6 (1) lit. b GDPR. The publication of data after obtaining the consent of the user concerned is carried out in accordance with the legislation established in Art. 6 (1) lit. a GDPR.

3. Purpose of data processing

The processing of personal data is used exclusively for the conduct of the promotional game in question, as well as for the awarding of the prize, in the event of a win. The publication of the name and place of residence serves the public presentation of the promotional game.

4. Retention period

Data will be deleted as soon as it is no longer necessary for the purposes for which it was collected. An exception to this rule is made when, for commercial or tax reasons, data retention is essential (for example, during a prize award). In such a case, the current data retention legislation applies. The winning user's data will remain visible on the website for a specific period (for example, from 04.06.2019 to 11.06.2019).

5. Right to object and erasure of data

During the duration of a given promotional game, the user may not exercise his right to object or request the deletion of information concerning him, as this would prevent the proper conduct of the game in question. Consent to the publication of the name and place of residence may be revoked at any time; such revocation immediately puts an end to the public display in question.

XIII. PAYMENT SERVICE PROVIDERS

1. Nature and scope of processing of personal data

When a customer purchases one of the products offered on our site, we collect, during the purchasing process, the information listed below:

• Private client or professional client
• First and last name
• E-mail address
• Street name and number
• Postal code
• City
• Country
• VAT number (for business customers only)
• Business (for business customers only)

The following data is also collected at the time of ordering:

• Date and time

If the customer chooses one of the four payment methods listed below, their data will not be passed on to third parties: advance payment, invoice, cash or bank transfer.

However, if the user decides to pay via PayPal, credit card or debit card, the respective data will be transmitted to the relevant payment service providers. Please refer to the following points in this privacy policy:

• Heidelpay (credit card or bank card)
• PayPal
• SOFORT banking
• Payone (credit card or bank card)

2. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. b GDPR.

3. Purpose of data processing

The payment process is necessary for the execution of a contract concluded with the user, or for the execution of pre-contractual measures. The payment process therefore serves to conclude sales contracts on our website.

4. Retention period

The data is deleted when it is no longer necessary for the purposes for which it was collected.

With regard to the execution of existing contracts or pre-contractual measures, such a case occurs when the data is no longer necessary for the execution of the contract. Even after conclusion of a given contract, the retention of personal information concerning the contracting party may be necessary due to legal or contractual obligations. In this case, for tax reasons, we are obliged to retain your data for a period of ten years.

5. RIGHT TO OBJECT AND DELETION OF DATA

At any time, you can request a modification of the data recorded about you.

If the data is necessary for the performance of an ongoing contract or pre-contractual measures, early deletion of the data is only possible if there are no contractual or legal obligations to the contrary.

XIV. HEIDELPAY

1. Nature and scope of processing of personal data

During the ordering process, if the user chooses the payment method "credit card" or "bank card", the transaction is carried out through the payment service provider Mollie.

We transmit the data collected during the ordering process to Mollie. This includes the following data:

• First and last name
• Street
• Street number
• Postal code
• City
• E-mail address

2. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. b GDPR.

3. Purpose of data processing

The purpose of the data transfer is to execute the payment transaction.

4. Right to object and erasure of data

The user cannot under any circumstances demand the deletion of the data concerned; their use and transmission are absolutely necessary for the payment transaction, carried out in accordance with the terms of the concluded contract.

If the user does not consent to transmitting their data to Heidelpay, they will then have to choose another payment method.

1. PAYPAL
2. Nature and scope of processing of personal data

The PayPal payment service is integrated into our website. Payments are made through PayPal accounts; these are virtual accounts, either private or business. In addition, PayPal allows users without a PayPal account to make virtual payments by credit card. A PayPal account is linked to an email address; therefore, there is no account number in the traditional sense. PayPal allows you to make online payments to third parties, or to receive payments. PayPal also performs fiduciary functions and offers buyer protection services.

In Europe, the operating company of PayPal is SARL & Cie PayPal (Europe), 22–24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If you select "PayPal" as your payment method during the ordering process, certain data will be automatically transmitted to PayPal. By selecting this payment method, you consent to the transfer of personal data required for the transaction.

2. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. b GDPR.

3. Purpose of data processing

The transfer of data serves the purpose of the transaction and the prevention of payment fraud. In this case, the data controller transmits personal information to PayPal whenever a legitimate interest justifies such a transfer. In some cases, the data exchanged between PayPal and the controller is transferred to credit agencies. This transfer is intended to verify the identity and creditworthiness of the data subject.

Where appropriate, PayPal may transfer personal data to affiliated companies and service providers, or even to subcontractors. This is the case if the transfer is necessary for the performance of contractual obligations or if the processing of the information is to be carried out on a subcontracted basis.

4. Right to object and erasure of data

The data subject may contact PayPal at any time and revoke their consent to the use of personal data. This does not affect personal data whose use or transfer is essential for the respective payment transaction.

PayPal's current privacy policy can be viewed at https://www.paypal.com/fr/webapps/mpp/ua/privacy-full .

XVI. SOFORT BANKING

1. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. b GDPR.

3. Purpose of data processing

The data transfer serves to carry out the payment transaction.

4. Right to object and erasure of data

The data of the user concerned may not be deleted under any circumstances, as the processing, use and transfer thereof are necessary for the payment transaction in accordance with the terms of the respective contract.

If the user does not consent to transmitting their data to Sofort GmbH, they must choose another payment method.

XVIII. GOOGLE ADWORDS

1. Nature and scope of processing of personal data

We use the Google AdWords service on our website. Google allows advertisers to place ads in Google's search results, as well as on Google's partner websites. With Google AdWords, the advertiser can pre-select keywords, based on which a given ad will appear alongside the search results, only if the user views a result directly related to these keywords. For Google's partner websites, the distribution of ads on the relevant web pages is carried out using an automatic algorithm, taking into account the previously established keywords.

The operating company of Google AdWords services is Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

If a person reaches our website by clicking on a Google ad, a conversion cookie is placed on their computer. A conversion cookie is valid for 30 days and does not contribute to the identification of the person concerned. Provided it has not expired, the conversion cookie makes it possible to track visits to sub-pages of our website, such as opening the shopping cart in our online shop. With the help of the conversion cookie, Google and we can check whether a specific person who reached our website from an AdWords ad generated sales – in other words, whether they completed or discontinued the purchase of the product in question.

The data collected when using a conversion cookie is processed by Google, which compiles visitor statistics for our website. We, in turn, use these statistics to determine the total number of users who have been referred to us via AdWords ads; this is used to measure the success or failure of the respective AdWords ads in order to optimize our future AdWords ads. Google does not provide any information – either to us or to other advertising clients using Google AdWords – that could allow the identification of the data subject.

Conversion cookies are associated with the storage of personal data, such as the websites visited by the data subject. For example, with each visit to our website, personal data (including the IP address of the Internet connection used by the data subject) is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may transfer this automatically collected personal data to third parties.

2. Legal framework for data processing

The legal basis for data processing lies in our legitimate interests in accordance with Art. 6 (1) lit. f. GDPR.

3. Purpose of data processing

Google AdWords is used to promote our website by displaying targeted advertising on third-party websites and in Google search results, as well as by showing third-party advertising on our website.

4. Retention period

Data is deleted after 30 days.

5. Right to object and erasure of data

As already mentioned, you can prevent the use of cookies by our website at any time by configuring your internet browser accordingly; this allows you to permanently object to the storage of cookies. Such a configuration would also prevent Google from placing a conversion cookie on your connection terminal. Furthermore, you can delete a cookie placed by Google AdWords at any time by using your browser or other software programs provided for this purpose.

Additionally, you have the option to opt out of Google's targeted advertising. To do so, on each browser you use, simply open the link www.google.fr/settings/ads and select the appropriate settings.

For more information about Google's privacy policy, please visit https://policies.google.com/privacy?hl=fr&gl=fr .

XIX. GOOGLE REMARKETING

1. Nature and scope of processing of personal data

Our website uses the Google Remarketing service. This is a feature integrated into Google AdWords, which allows a company to target advertisements to a user who has previously visited the website. With Google Remarketing, a company can therefore create targeted advertisements by displaying ads tailored to the particular interests of a given user.

In this context, Google Remarketing places a cookie on the user's login device. The function of cookies has already been explained above (see Chapter V.). With the help of the placed cookie, Google can track a visitor to our website and recognize them when they visit Internet pages that are also part of the Google advertising network. Each time the data subject accesses a website into which the Google Remarketing service has been integrated, their browser automatically authenticates itself as such to Google. As part of this automated process, Google gains knowledge of personal data, such as the IP address or the surfing behavior of the user in question – data that Google uses, among other things, to display relevant advertisements.

This cookie generates the recording of personal information, such as, for example, the websites visited by the user. Thus, with each visit to our web pages, personal data (including the IP address of the user's Internet connection) is sent to Google in the United States of America. Google stores this personal data in the United States of America. Google may pass the personal data collected during this automatic process to third parties.

The operating company of the services from Google Remarketing is Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

2. Legal framework

The legal basis for data processing lies in our legitimate interests, in accordance with Art. 6 (1) lit. f. GDPR.

3. Purpose of data processing

Google Remarketing is used to display targeted advertising. Google Remarketing allows us to display ads through the Google advertising network or on other websites; these ads are tailored to the needs and interests of Internet users.

4. Retention period

Data is deleted after 30 days.

5. Right to object and erasure of data

As already mentioned, you can prevent the use of cookies by our website at any time by configuring your internet browser accordingly; this allows you to permanently object to the storage of cookies. Such a configuration would also prevent Google from placing a cookie on your connection terminal. Furthermore, you can delete a cookie placed by Google at any time by using your browser or other software programs provided for this purpose.

Additionally, you have the option to opt out of Google's targeted advertising. To do so, on each browser you use, simply open the link www.google.fr/settings/ads and select the appropriate settings.

For more information about Google's privacy policy, please visit https://policies.google.com/privacy?hl=fr&gl=fr .

1. BING ADS (UNIVERSAL CONVERSION TRACKING)
2. Nature and scope of data processing

Our website includes the "Bing ads Universal Event Tracking" component. The operating company is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Microsoft Corporation is certified under the EU-US Privacy Shield. Through this certification, Microsoft commits to complying with the European Union's privacy policy.

When a user accesses our website after clicking on an ad displayed on Bing, a cookie is placed in the user's browser. In addition, we have inserted a code snippet on our website, which, in combination with the placed cookie, allows certain data to be recorded in relation to the use of the website. In this case, this information concerns:

• time spent on the site
• the sections of our web page that were consulted
• the advertisement from which the user accessed our website.

Through cross-device tracking, Microsoft can track users across multiple devices. This allows for targeted advertising to be displayed – both on Microsoft websites and in the applications they use.

For more information about the tracking services used by Bing, please visit https://help.ads.microsoft.com/#apex/3/en/53056/2 . Microsoft's privacy policy is available at https://privacy.microsoft.com/en-us/privacystatement .

2. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

The purpose of using Bing Ads is to promote our website, on the one hand, through the display of targeted advertisements, broadcast on the Internet pages of third-party companies and in the results lists provided by the Google search engine, and, on the other hand, through advertisements from third-party advertisers displayed on our website.

This is the purpose where our legitimate interests lie, in accordance with the legislation established in Article 6 (1) lit. f GDPR.

4. Retention period

Microsoft will retain the relevant data for a maximum period of 180 days.

5. Right to object and erasure of data

Cookies are stored on the user's computer and then transmitted from that computer to our website. You therefore have full control over the placement of cookies. By changing your internet browser settings, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This regular deletion can be automated. Disabling cookies on our website may result in a limitation of the available features.

You can opt out of Microsoft's cross-device tracking at https://account.microsoft.com/privacy/ad-settings/signedout?lang=en-US .

XXII. FACEBOOK PIXEL

1. Nature and scope of processing of personal data

On our website, we use the Facebook Pixel tool, which was developed by Facebook. The operating company is Facebook Inc., Hacker Way, Menlo Park, CA 94025, USA. Facebook Inc. is certified under the EU-US Privacy Shield.

The Facebook pixel is an analytics tool that allows us to measure the effectiveness of our advertising.

When a user browses our website and performs a specific action (e.g., completing a purchase), the Facebook pixel is triggered and this action is communicated to Facebook. This process allows us to retarget these users later when we display our ads on Facebook. If the user is logged in to Facebook when visiting our website, then the visit to our website will be associated with their Facebook user account.

Facebook also provides us with statistical data each time a user clicks on one of our ads displayed on Facebook.

This process allows us to use certain parameters (such as age or interests, for example) to target our ads on Facebook. We use the Facebook pixel without the existing advanced setting features. Therefore, we do not obtain any other information (such as phone number or email address) about the user.

2. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

Data processing serves to target our advertisements. We also use the Facebook pixel to analyze the respective browsing behavior on our website.

This is where our legitimate interest in data processing lies, in accordance with the legislation established in Article 6 (1) lit. f GDPR.

XXIII. INSTAGRAM

1. Nature and scope of processing of personal data

Instagram components have been installed on our website. Instagram is an audiovisual platform that allows its users to share photos and videos, which can also be shared on other social networks.

The operating company is Instagram LLC, 1601 Willow Rd, Menlo Park CA 94025, USA. Instagram is owned by Facebook and is therefore certified under the EU-US Privacy Shield.

When a user accesses our website, a connection is established between the client browser and one of Instagram's servers. Instagram receives the information that the user visited our page; Instagram is also informed which subpages were visited. If the user has an Instagram account and is logged in at the time of visiting our page, their visit to our website is linked to their Instagram account. This is the case regardless of whether they click on Instagram components or not.

For more information about Instagram's privacy policy, please visit https://help.instagram.com/519522125107875?helpref=page_content .

2. Legal framework for data processing

Data processing is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

The Instagram component allows us to assign our Instagram ads to certain user segments (based on age groups, interests, etc.) and subsequently display these segments.

This purpose also constitutes our legitimate interest in data processing, in accordance with Art. 6 (1) lit. f. GDPR.

4. Right to object and erasure of data

The user can prevent the transfer of data to Instagram by logging out of their Instagram account before visiting our website. Furthermore, the user can also prevent the transmission of information to Instagram by activating certain browser add-ons.

XXIV. GOOGLE FONTS

1. Nature and scope of processing of personal data

We have integrated the Google Fonts component into our website. This component is used to standardize the display of fonts. When a user visits our website, their browser downloads the necessary fonts (= "fonts") into a cache (= buffer memory).

When downloading fonts stored on Google servers, the client browser connects to Google, which then receives the information that the IP address of the user concerned has accessed our website.

The operating company of the Google Fonts component is Google LLC, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Google LLC is certified under the EU-US Privacy Shield.

For more information about the Google Fonts service, please visit https://developers.google.com/fonts/faq . Google's privacy policy is available at https://policies.google.com/privacy?hl=en .

If the browser is incompatible with Google Fonts, a standard font will be used by default.

2. Legal framework for the processing of personal data

The use of the Google Fonts component is carried out in accordance with the legislation established in Art. 6 (1) lit. f GDPR.

3. Purpose of data processing

We have integrated Google Fonts to ensure the correct display of fonts used on our site. It is for this purpose

This purpose also constitutes our legitimate interest in data processing, in accordance with Art. 6 (1) lit. f. GDPR.

4. Right to object and erasure of data

The user can deactivate the Google Fonts component by using the “opt-out” option via the link https://adssettings.google.com/authenticated .

XXVI. TEAMVIEWER – CUSTOMER SERVICE

1. Nature and scope of data processing

As part of our customer service, we use certain features of the TeamViewer program. You have the option to download this program and authorize our technical support to access your computer.

The operating company is TeamViewer GmbH, Jahnstr. 30, 73037 Göppingen, Germany.

Further information regarding the privacy policy and the Team Viewer Support tool can be found at https://www.teamviewer.com/en/privacy-policy/ and https://www.teamviewer.com/fr/trust-center/securite/ .

You can download the TeamViewer remote maintenance tool by clicking the corresponding "Download" button. After downloading and installing the execution file (Teamviewer*.exe), you can provide one of our technical assistants with the ID appearing on your screen and thus allow our assistant to connect to your computer and access your computer system.

Licentech's technical assistants responsible for remote maintenance are required to comply with the privacy policy and the protection of your personal data. They have been duly informed in writing of the rights and obligations resulting from the legal provisions regarding data protection.

During remote maintenance services, our technical assistants view your screen, including all available information. It is therefore in your best interest to first close all programs and displays unrelated to the remote maintenance service. In this context, it is your responsibility to take the necessary precautions to ensure that our technical assistants do not access any personal data.

We implement the necessary technical and organizational measures to ensure compliance with data protection requirements; our external service providers undertake to comply with them as well.

Data acquired during a Team Viewer session will not be shared with third parties under any circumstances without your express prior consent. Your data may be shared with third parties only if you have expressly consented to this or if we are authorized or required to do so by statutory provisions or other legal or administrative requirements. This may include the exchange of information for the purpose of legal proceedings, the protection against and prevention of threats to public security, or the enforcement of intellectual property rights.

During the TeamViewer session, data transmission takes place via the Internet. TeamViewer carries out the transfer using a secure connection. However, it is not possible to reliably exclude the possibility of unauthorized third parties viewing and/or accessing the transferred information. We invite you to take this into account when deciding whether or not to use a remote maintenance service.

2. Legal framework for data processing

Your consent provides the legal basis for data processing, in accordance with the legislation established in Art. 6 (1) lit. a. GDPR. In the event of the existence of a contractual clause regarding technical support, the legal basis is that established in Art. 6 (1) lit. b GDPR.

3. Purpose of data processing

As part of the processing of information, certain contractual data, as well as the name of the contact person concerned, are recorded.

The collection, storage and processing of this data is carried out exclusively for the purpose of performing the technical services provided for in the terms of the contract existing between you and the person concerned, or agreed beyond it. During the technical services described above, your data will not be transmitted to third parties.

When we use external service providers to provide a given technical service, their access to information is used exclusively for the provision of services. The service providers concerned are all verified by us and undertake to act in accordance with our privacy policy.

4. Retention period

Data is deleted as soon as it is no longer necessary for the purposes for which it was collected – in this case, once the technical support has ended. If the technical support was provided as part of the performance of a given contract, the deletion will take place within a period in accordance with the legislation on retention periods.

5. Right to object and erasure of data

If you wish to avoid using the Team Viewer tool, you can use our telephone support or our online chat available on the website. Furthermore, you can unilaterally terminate the TeamViewer session at any time; to do so, simply close the connection window.

You may also revoke your consent to the processing of personal data. You can do so using the various means of communication made available to you on the website (see above). In such a case, the technical service via TeamViewer will be interrupted. In the absence of legal obligations justifying prolonged storage, all personal data stored around the contact will then be deleted.

XXVII. RIGHTS OF THE PERSONS CONCERNED

From the moment personal data concerning you is processed, you are the “data subject” within the meaning of the GDPR and you can assert the following rights against the data controller:

1. Right of access

As a data subject, you have the right to obtain confirmation from the controller as to whether or not personal data concerning you are being processed by us.

Where they are, you have the right to obtain from the data controller access to the following information:

(1) the purposes of the processing;

(2) the categories of personal data concerned;

(3) the recipients or categories of recipients to whom the personal data have been or will be communicated;

(4) where possible, the envisaged period for which the personal data will be stored or, where not possible, the criteria used to determine that period;

(5) the existence of the right to request from the controller rectification or erasure of personal data concerning you, or restriction of processing of data relating to you or the right to object to such processing;

(6) the right to lodge a complaint with a supervisory authority;

(7) where the personal data are not collected from the data subject, any available information as to their source;

(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Where personal data is transferred to a third country or to an international organisation, you have the right, as a data subject, to be informed of the appropriate safeguards, pursuant to Article 46, relating to that transfer.

2. Right of rectification

As a data subject, you have the right to obtain from the controller that inaccurate or incomplete personal data be rectified or completed without undue delay.

3. Right to restriction of processing

As a data subject, you have the right to obtain from the controller restriction of processing where one of the following applies:

(1) you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;

(2) the processing is unlawful and you, as the data subject, oppose the erasure of the personal data and request instead the restriction of their use;

(3) the controller no longer needs the personal data for the purposes of the processing, but you, as the data subject, still require the data for the establishment, exercise or defence of legal claims; or

(4) as the data subject, you have objected to processing pursuant to Article 21(1) GDPR and the verification whether the legitimate grounds of the controller override those of the data subject has not been completed.

Where the processing of personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent, as the data subject, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

If processing has been restricted on the grounds mentioned above, as the data subject, you will be informed by the controller before the restriction of processing is lifted.

4. Right to erasure (“right to be forgotten”)
5. a) Obligation to erase

As a data subject, you have the right to obtain from the controller the erasure, without undue delay, of personal data concerning you and the controller has the obligation to erase this personal data without undue delay, where one of the following grounds applies:

(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

(2) You revoke the consent on which the processing is based, in accordance with Art. 6 (1) lit. a GDPR, or Art. 9 (2) lit. a GDPR, and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Art. 21 (1) GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) GDPR.

(4) The personal data concerning you have been unlawfully processed.

(5) The personal data concerning you must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

(6) The personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

1. b) Information of third parties

(1) Where the controller has made personal data concerning you public and is obliged pursuant to Art. 17 (1) GDPR to erase them, the controller, taking into account available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that you, as the data subject, have requested erasure by such controllers of any links to, or copies or replications of, those personal data.

1. c) Limitations

The right to erasure does not apply to the extent that such processing is necessary:

(1) the exercise of the right to freedom of expression and information;

(2) to comply with a legal obligation which requires processing by Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the area of ​​public health, in accordance with Art. 9 (2) lit. h and i GDPR, as well as Art. 9 (3) GDPR;

(4) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 (1) GDPR, to the extent that the right referred to in paragraph (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or

(5) to the establishment, exercise or defense of legal rights.

5. Notification obligation

The controller shall notify each recipient to whom the personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out pursuant to Art. 16, Art. 17(1), and Art. 18 GDPR, unless such communication proves impossible or requires disproportionate effort. The controller shall provide the data subject with information about these recipients upon request.

6. Right to data portability

As a data subject, you have the right to receive the personal data concerning you which you have provided to a controller, in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

(1) the processing is based on consent pursuant to Art. 6 (1) lit. a GDPR, or Art. 9 (2) lit. a GDPR, or on a contract pursuant to Art. 6 (1) lit. b GDPR; and that

(2) the processing is carried out using automated processes.

When, as a data subject, you exercise this right to data portability, you have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This right must not, under any circumstances, adversely affect the rights and freedoms of third parties.

The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

As a data subject, you have the right to object at any time, for reasons relating to your particular situation, to processing of personal data concerning you which is based on Art. 6 (1) lit. e or f GDPR, including profiling based on these provisions.

The controller shall no longer process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms as a data subject, or for the establishment, exercise or defence of legal claims.

Where personal data concerning you are processed for direct marketing purposes, you have the right, as the data subject, to object at any time to the processing of personal data concerning you for such marketing purposes, including profiling to the extent that it is related to such marketing.

Where, as a data subject, you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by means of automated procedures using technical specifications.

8. Right to revoke data protection consent

You have the right to revoke your data protection consent at any time. Such revocation shall not affect the legality of the processing previously carried out with the data subject's consent.

9. Automated individual decision-making, including profiling

As a data subject, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

This does not apply where the decision:

(1) is necessary for entering into, or the performance of, a contract between the controller and you as the data subject,

(2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(3) is based on your explicit consent.

However, the decisions referred to above may not be based on the special categories of personal data referred to in Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g GDPR applies and suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject are in place.

In the cases referred to in (1) and (3), the controller shall implement suitable measures to safeguard your rights and freedoms and your legitimate interests as a data subject, at least your right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right, as a data subject, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.