(« GDPR Policy »)
Privacy policy
PREAMBLE
Terms beginning with a capital letter are defined and have the same meaning as those used in the General Terms of Services.
In the context of implementing the Services offered by the Site, the Publisher will process personal data (‘Personal Data’), and hereby commits to respecting the privacy of its Users and processing Personal Data confidentially. These Personal Data are collected in accordance with the provisions of European Regulation 2016/679 on the protection of personal data (GDPR) and French law no. 78-17 of January 6, 1978, relating to information technology, files, and freedoms. The terms defined in Article 4 of the GDPR apply to this GDPR Policy and are themselves mentioned with the initial capital letter. The Publisher is designated as the ‘Data Controller’ and referred to as such herein.
As a reminder, Personal Data refers to any information relating to “an identified or identifiable natural person (‘Data Subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.”
Article 1 – SUBJECT
The purpose of this RGPD Policy is to provide information on the manner in which the Data Controller collects and processes Users’ Personal Data and on the means available to Users to control this use and exercise the rights pertaining thereto.
By using the Site, the User attests to having read and understood this RGPD Policy and accepts its terms.
The RGPD Policy may be updated from time to time. In the event of significant modifications to this policy, the User must express his clear consent concerning these changes, failing which he must cease to use the Site.
Article 2 – PERSONAL DATA COLLECTED AND PROCESSED WHEN USING THE WEBSITE
Article 2.1 – Personal data collected
The Personal Data collected in the context of User activity is as follows:
Identification data: Surnames, first names, title, date of birth, e-mail address, telephone number;
Encrypted login and password used to identify the User on the Site;
Information relating to the history of the commercial relationship with the Publisher: subscriptions taken out, orders for products and services, invoicing and payment where applicable;
Requests made to customer service or incidents reported, for example concerning the performance of services;
Any other information that the User wishes to bring to the attention of the Publisher,
Identifiers of the equipment used (IP address of your computer, Android identifier, Apple identifier, etc.), type of operating system (Microsoft Windows, Apple Os, Linux, Unix, BeOS, etc.) and type and version of browsing software used by the terminal (Microsoft Internet Explorer, Apple Safari, Mozilla Firefox, Google Chrome, etc.), dates and times of connection to the Site, address of the Internet page of origin (“referrer”) and browsing data on the Site, content viewed. The Publisher may also use standard Internet technologies such as scripts, pixels and redirects.
Personal Data essential to the provision of Services are indicated by an asterisk.
Article 2.2: Legal basis, purpose of collection and processing and retention period for Personal Data
Purpose | Legal basis | Data retention periods |
---|---|---|
Provide the Site Services via the User’s Account | Execution of the General Terms of Service as accepted by the User | Personal Data is kept for the entire duration of the Account. If the Account is inactive for 2 years, the Personal Data will be deleted in the absence of a response from the User to a reactivation email. In addition, Personal Data may be archived for evidential purposes for a period of 5 years. |
Execute Subscription orders, carry out operations relating to the management of Users concerning orders, invoices, loyalty programmes and monitoring the contractual relationship with Users | Fulfilment of orders and subscriptions taken out by the User with the Data Controller | Personal Data is kept for the duration of the contractual relationship. Invoices are archived for a period of 10 years. In addition, Personal Data (with the exception of bank details) is archived for evidential purposes for a period of 5 years. Bank card details are kept by the payment service provider Stripe until the last payment due date for the Subscription and in order to comply with its legal and regulatory retention obligations. For further information, please consult Stripe’s Privacy Policy. |
Build up a file of customers and prospects | Legitimate interest of the Data Controller in developing and promoting its activity | For Users: Personal Data is kept for the duration of the contractual relationship. For prospective customers: Personal Data is kept for a period of 3 years from the last contact, for prospecting purposes. |
Send newsletters, requests and promotional messages to Users | Legitimate interest of the Data Controller in building loyalty and informing the public of its latest news | Personal Data is kept for 3 years from the last contact with the Data Controller. |
Send newsletters, requests and promotional messages to prospects | Non-professional prospects: consent expressed by ticking a box Professional prospects: legitimate interest of the Data Controller in building loyalty and informing prospects of its latest news | Data is kept for 3 years from the Prospect’s last contact with the Data Controller or until consent is withdrawn. |
Responding to requests for information and support | Legitimate interest of the Data Controller in responding to requests | Personal Data is kept for the time required to process the request and is deleted once the request has been processed. |
Managing requests to exercise rights | Legitimate interest of the Data Controller in responding to requests and keeping track of them | Personal Data is kept for the time required to process the request and is deleted once the request has been processed. |
Improving Users’ experience of the Site | Legitimate interest of the Data Controller in improving the experience of its Users on the Site | Personal Data is kept for as long as is necessary for the intended improvement. |
Article 2.3: Recipients of Personal Data
The following are recipients of Personal Data:
(i) The Publisher’s staff ;
(ii) Its subcontractors, namely :
- Site hosting: Interface: Vercel Inc. – 340 S Lemon Ave #4133 Walnut, CA 91789 – privacy@vercel.com
- Server hosting: Amazon Web Services, Services EMEA SARL 38 AV JOHN F KENNEDY L 1855 99137 LUXEMBOURG – http://aws.amazon.com
- Payment provider: Stripe, 10 Boulevard Haussmann 75009 Paris – Stripe Privacy Policy.
- Analysis solution: Mixpanel, Avenida Diagonal, 442 – P. 3 PTA. 1 08037, Barcelona, Spain – Mixpanel Privacy Policy
- Analytics solution: Hotjar Dragonara Business Centre 5th Floor Dragonara Road Paceville St Julian’s STJ 3141 Malta – Hotjar Privacy Policy
- Audience analysis solution: Vercel Web Analytics & Speed Insight – Vercel Inc. – 340 S Lemon Ave #4133 Walnut, CA 91789 – Vercel Privacy Policy
- Error tracking and performance monitoring solution: Sentry Functional Software, Inc, 45 Fremont Street, 8th Floor, San Francisco, CA 94105 – Sentry Privacy Policy
- Customer Service Solution: Crisp IM SAS, 2 boulevard de Launay in Nantes 44100 – Crisp Privacy Policy
(iii) Where applicable: public and private bodies, exclusively to meet the Publisher’s legal obligations.
Article 2.4 : Cookies policy
A cookie is a text file deposited when a site, application or online advertisement is consulted, and stored in a specific space on the hard disk of the user’s computer or mobile device. Cookies are managed by the Internet browser, and only the issuer of a cookie can decide whether to read or modify the information contained in it.
Cookies have a limited validity period. It is deposited and stored on the user’s terminal in compliance with applicable legislation and subject to the choices expressed by the user, which the latter may modify at any time, under the conditions specified in Article 4 below.
A cookie does not personally identify a user. It enables its issuer to recognize the user’s terminal and to collect a certain amount of information relating to the browsing carried out from this terminal.
Cookies have a number of functions, such as enabling users to navigate a site or application efficiently, remembering their choices, and offering them advertising content relevant to their centers of interest as they navigate the site. Further information on cookies is available on the following website: www.cnil.fr
Subject to the choices indicated by the User, the cookies placed by the Publisher are used for the following purposes:
-
- Operation and optimization of navigation on the Site/application;
- Adaptation of the presentation of the Site and applications to the display preferences of the terminal (language used, display resolution, operating system, etc.) during visits, according to the hardware and viewing or reading software that the terminal has;
- Memorization of information relating to a form filled in by the User on the Site (registration or access to the Account) or to products, services or information selected on the Site (service subscribed to, content consulted, purchase made, etc.);
- Automatic connection to reserved or personal areas of the Site, such as the Account, using identifiers or data previously entrusted to the User;
- Provision of sharing tools on social networks;
- Management and performance of internal technical operations for problem-solving, data analysis, tests, research, analysis, studies and surveys;
- Implementation of security measures;
- Quality measures to ensure that the display of content is adapted to the User’s device.
Article 2.5: Transfers outside the European Union
Your data is kept and stored for the duration of the processing on the servers of Amazon Web Services EMEA SARL 38 AV JOHN F KENNEDY L 1855 99137 LUXEMBOURG – http://aws.amazon.com
As part of the tools used (see article 2.3), Personal Data may be transferred outside the European Union. The transfer of Personal Data in this context is secured using the following tools:
-
- either Personal Data is transferred to a country that has been the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the RGPD: in this case, this country ensures a level of protection deemed sufficient and adequate to the provisions of the RGPD;
- or the data is transferred to a country whose level of data protection has not been recognized as adequate to the RGPD: in this case such transfers are based on appropriate safeguards indicated in Article 46 of the RGPD, tailored to each provider, including but not limited to the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rule types or under an approved certification mechanism.
- or the data is transferred on the basis of one of the appropriate guarantees described in Chapter V of the RGPD.
Article 3 – PERSON RESPONSIBLE FOR DATA PROCESSING
The Data Controller is KERMATE TECH, SAS – with capital of 5,000 euros, registered in the Saint-Malo Trade and Companies Register under number 983 594 060, with registered office at 13 Rue Hippolyte de la Morvonnais, 35400 Saint-Malo, represented by Guillaume Chantreau, duly authorized.
The Data Controller can be contacted as follows:
-
- By post at the following address: 13 Rue Hippolyte de la Morvonnais, 35400 Saint-Malo, France.
- By phone on 09 83 21 09 66
- By e-mail: contact@cazmate.com
Article 4 – THE USER’S RIGHTS WITH RESPECT TO PERSONAL DATA
All Users are entitled to the following rights, pursuant to European Regulation 2016/679 and the French Data Protection Act (Law 78-17 of 6 January 1978):
-
- Right to information (articles 13 and 14 RGPD);
- Right of access, rectification and deletion of data (articles 15, 16 and 17 of the RGPD);
- Right to data portability (article 20 of the GDPR);
- Right to restrict (article 18 of the GDPR) and object to data processing (article 21 of the GDPR);
- Right to withdraw consent at any time (Article 7 GDPR);
- Right not to be subject to a decision based exclusively on an automated process;
- Right to determine the fate of data after death;
- Right to have recourse to the competent supervisory authority (article 77 of the GDPR).
To exercise these rights, please contact the Data Controller using the contact details given in article 3 above.
In order for the Data Controller to comply with the request, the User may be required to provide certain information such as: surnames and forenames, e-mail address and account, personal space or subscriber number.
Visit www.cnil.fr for more information about your rights.
Article 5 – CONDITIONS FOR CHANGING THE PRIVACY POLICY
The Cazmate Website Editor reserves the right to modify this Policy at any time in order to comply with any regulatory, legal, editorial or technical developments.
These modifications will apply from the date on which the modified version comes into force. Users are therefore invited to consult the latest version of this Policy on a regular basis. Nevertheless, the Publisher will keep Users informed of any significant changes to this RGPD Policy.
This RGPD Policy was published on 23 January 2024.