Privacy policy
Article 1. Definitions
- 1 ‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter referred to as ‘data subject’); an ‘identifiable natural person’ is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity;
- 2 ‘processing’ means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- 3. ‘controller’ means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union law or by the law of a Member State, the controller may be designated or specific criteria for such designation may be laid down in Union law or in the law of a Member State;
- 4. ‘processor’ means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
- 5. ‘recipient’ means the natural or legal person, public authority, agency or any other body to whom personal data are disclosed, whether a third party or not. However, public authorities 4.5.2016 L 119/33 Official Journal of the European Union EN which may receive personal data in the context of a specific fact-finding task in accordance with Union law or the law of a Member State shall not be regarded as recipients; the processing of such data by the public authorities in question shall comply with the applicable data protection rules depending on the purposes of the processing;
- 5. ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of his wishes by which the data subject signifies his agreement, either by a declaration or by a clear positive act, to personal data relating to him being processed;
- 6. a ‘personal data breach’ means a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed;
- 7. ‘cookie’, a cookie is a text file automatically saved in the browser of any User when visiting a website. This text file may contain personal data and/or information relating to the User’s browsing.
Article 2. Subject
The purpose of this Confidentiality and Cookies Policy (hereinafter referred to as the ‘Policy’) is to define the methods for collecting, storing, processing and deleting the personal data (hereinafter referred to as ‘personal data’) of any individual (hereinafter referred to as the ‘User’) who uses or simply browses the Site. The Data Controller assures the User that it implements all the necessary means to ensure compliance with the provisions of the General Data Protection Regulation 2017/679 of the European Parliament and of the Council dated 14 April 2016 by ensuring compliance with retention periods, the need to collect the aforementioned personal data, and the confidentiality of the personal data collected (hereinafter the ‘Regulation’ or the ‘DPRG’).
Article 3. User consent
This Policy must be read and accepted by all Users visiting the Site. By clicking on the ‘read and accepted’ box referring to this Policy when entering the Site, the User acknowledges that he/she has read it and gives his/her free, informed and unambiguous consent to the processing of his/her personal data. The User may, at any time and without justification or prejudice, withdraw his/her consent to this Privacy and Cookie Policy. The User may exercise his/her right to withdraw consent to this Policy by notifying the Data Controller at the following e-mail address: contact@thebatikstore.com. This withdrawal of consent will take effect when the Data Controller receives notification of the withdrawal of the User’s consent.
Article 4. Data collected
In the context of visiting and using the Site, certain personal data of Users may be collected by the Data Controller, in its capacity as Data Controller, or by one or more subcontractors acting in the name of and on behalf of the Data Controller.
1. Collection methods
The User’s personal data is collected in the following ways:
- When communicated by the User : by filling in personal data via the customer account creation form, the newsletter registration form or the order form.
- Automated collection
During the User’s browsing of the Site , he Data Controller automatically records certain information relating to the User’s preferences and use of the Site. Cookies are used when the User browses the Site to collect this information automatically.
2. Type of data collected
The personal data that may be collected are :
- User first and last name ;
- User’s e-mail address ;
- User’s postal address ;
- User’s telephone number ;
- The User’s browsing preferences on the
3. Recipients of data
The recipients of personal data are :
- The data controller ;
- Internal employees of the Data Controller acting on its behalf;
- Any legally or administratively authorised person (e.g. judicial authorities);
- The following processors of the Data Controller:
| Subcontractor | Function |
| Hosting Site | O2Switch – 222-224 Boulevard Gustave Flaubert, 63000 Clermont-Ferrand, France |
| Delivery of orders placed on the Site | SASU MONDIAL RELAY – 1 avenue de l’horizon, 59650 Villeneuve-d’Ascq, France SA LA POSTE – 9 rue du colonel Pierre Avia – 75015 Paris, France |
Article 5. Data processing
1. Legal basis for processing
The processing of Users’ personal data via the Site must be justified by one of the conditions set out in Article 6 §1 of the Regulations. In accordance with the Regulations, Users’ personal data will only be processed if one of the following conditions is met:
- The User has given his/her consent: the User concerned has consented to the processing of his/her personal data for one or more specific purposes;
- Necessary for the performance of the contract: processing is necessary for the performance of a contract to which the User concerned is a party or for the performance of pre-contractual measures taken at the User’s request;
- Compliance with the law requires it: processing is necessary to comply with a legal obligation to which the data controller is subject;
- A legitimate interest justifies it: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the User concerned which require the protection of personal data prevail, in particular where the User concerned is a minor.
2. Purposes of processing and data retention period
In accordance with Article 13 of the Regulation, the reason for and duration of the storage and processing of personal data must be justified by a valid purpose, in addition to one of the legal bases listed above.
| Purpose of processing | Legal basis | Storage period | Archiving |
| Commercial canvassing by the Publisher and response to contact requests | Legitimate interest | 3 years | N/A |
| Management and payment for services, provision of services and invoicing | Performance of contract | 3 years | N/A |
| Fraud prevention | Legitimate interest | 3 years | 5 years |
| Accounting and tax obligations | Compliance with the law | 3 years | 7 years |
| Analysis of Site browsing data, Creation of site visit statistics, and facilitation of User browsing | Consent | 12 months from the expiry date of the cookies on the User’s browser | N/A |
Article 6. Means of data protection
In accordance with Article 5 and Article 32 of the Regulation, the Data Controller is required to guarantee the security of Users’ personal data that it stores and processes. The Data Controller keeps a register containing all the personal data collected from Users. The Data Controller affirms that it implements all necessary security measures to protect Users‘ personal data contained in this register and to prevent any violation of Users’ personal data. To this end, the Data Controller asserts to Users that it has undertaken a study of the risks associated with the storage and processing of Users’ personal data in order to put in place adequate security measures as follows:
- By allowing pseudonymisation and encryption of the User’s personal data;
- Implementing measures to guarantee the confidentiality, integrity, availability and resilience of processing systems and services at all times (e.g. anti-virus protection, secure internal servers);
- Implementing means to restore the availability of and access to personal data within an appropriate timeframe in the event of a physical or technical incident;
- By guaranteeing the use of a procedure to regularly test, analyse and evaluate the effectiveness of technical and organisational measures to ensure the security of processing.
The Data Controller assures Users that the data it stores and processes is stored within the European Union, in a Member State subject to the Regulation. In the event of a breach of the User’s personal data, the Data Controller undertakes to notify the competent supervisory authority of the breach within 72 hours in accordance with Articles 33 and 34 of the Regulation.
Article 7. Cookies
1. Purpose of using cookies
As explained above, a cookie is a text file automatically saved in the browser of any User when visiting a website. This text file may contain personal data and/or information relating to the User’s browsing. The sole purpose of the cookies used on the Site is to improve your browsing experience as a User. The cookies used facilitate your browsing by storing some of your personal data when you access and browse the Site. Three types of cookies are used on the Site, their purpose varying according to their type:
- Functional cookies: these are used to store data entered during authentication or searches on the site.
- Advertising cookies: these identify Users’ consumption and search habits and preferences in order to offer them advertising content in line with their personal preferences.
- Security cookies: these cookies ensure the security of Users’ personal data by encrypting the data contained in other cookies.
2. Cookies utilisés, durée de vie, et fonction
Each cookie used on the Site is identifiable by name. Each cookie has a lifetime, i.e. a period of time after which it disappears and ceases to be active, forgetting any personal data that it stored. Each cookie also has a function, i.e. a purpose that justifies its installation on the Site. The following is a list of the cookies used on the Site, together with their name, lifetime and function:
3. Gérer les cookies : activation et désactivation
It is possible for Users to manage Cookies at any time on the browser they use. The User may activate or deactivate them at any time. The means of managing cookies depends on each browser. To make it easier for Users to manage their cookies, below is an explanatory guide to managing cookies on the main browsers used by Users:
Google chrome : https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DDesktophl=fr
Safari : https://support.apple.com/fr-fr/guide/safari/sfri11471/mac
Mozilla Firefox : https://support.mozilla.org/fr/kb/activer-ou-desactiver-les-cookies sur-firefox-pour-android
Internet explorer : https://support.microsoft.com/fr-fr/help/17442/windows-internet-explorer-delete-manage-cookies
Article 8. Users’ rights
The User has the right to ask the Data Controller for access to his/her personal data, for it to be rectified or deleted, or for the processing of data relating to the User concerned to be restricted, or for the right to object to processing and the right to data portability.
The User has the right to withdraw his/her consent to the processing of his/her personal data at any time. This withdrawal of consent will take effect when the Data Controller receives notification of the User’s withdrawal of consent.
The User has the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) via the contact form available at the following website: https://www.cnil.fr/fr; or with the Direction Générale de la Concurrence, de la Consommation et de la répression des fraudes via the contact form available at https://www.economie.gouv.fr/dgccrf.
Users may also exercise their rights as set out above in relation to this Policy by notifying the Data Controller at the following e-mail address: contact@thebatikstore.com.
