Privacy policy

1. INTRODUCTION

Maison Crivelli, a simplified joint stock company under French law (société par actions simplifiée – SAS) that has been registered on the Paris Trade and Companies Register under registration number 833 175 029, and whose registered office is located at 280 rue Saint Honoré, 75001 Paris (hereinafter referred to as “Maison Crivelli”), welcomes you to its website www.maisoncrivelli.com (hereinafter referred to as the “Site“).

The details given below set out the privacy policy that governs the processing of personal data that may be collected on the Site (this policy is hereinafter referred to as the Privacy Policy).

2. PURPOSE

With a view to establishing a transparent, trust-based relationship with all visitors to and/or users of our Site, we wish to take this opportunity to set out our commitment to protecting your privacy and personal data in accordance with EU Regulation 2016/679 (the General Data Protection Regulation, hereinafter referred to as the “GDPR“).

3. SCOPE

The present Privacy Policy is intended to apply with respect to the full range of processing activities involving personal data belong to data subjects.

The processing of personal data may be managed directly by Maison Crivelli, or by a sub-contractor specifically designated by Maison Crivelli.

The present Privacy Policy is independent of any other document that may apply within the context of the contractual relationship between Maison Crivelli and the data subjects.

The Site may contain links to other websites over which we have no control. We cannot be held responsible for the content or privacy policies of these sites.

4. DEFINITION

For the avoidance of doubt, it is hereby clarified that, for the purposes of the present Privacy Policy:

the term “personal data” refers to any information or dataset that allows an individual to be identified either
directly (e.g. by their surname, first name, e-mail address, personal address, etc.)
or indirectly (e.g. by means of pseudonymised data such as a unique identification number, etc.).

Unique identifiers, such as a computer’s IP address, may also be considered to be personal data.

the term “data controller” refers to the entity that determines the purposes and means of the processing of personal data, and that is responsible to data subjects for ensuring that data processing complies with all applicable legislation and regulations. The data controller is hereinafter referred to as “Maison Crivelli” or “we”.

Maison Crivelli has appointed a Data Protection Officer as the primary point of contact on all matters relating to the processing of personal data.

You can contact them by e-mail at info@maisoncrivelli.com.

If data subjects wish to obtain specific information or to raise a specific question, they will be able to contact the Data Protection Officer, who will respond to their query within a reasonable period of time.

The term “data processor” refers to any natural person or legal entity processing personal data on behalf of Maison Crivelli.

The term “data subjects”, also referred to as “you”, designates visitors to and/or users of the Site.

The term “recipients” refers to the natural or legal entities that receive personal data from Maison Crivelli. It follows, therefore, that the recipients of this personal data may be employees of Maison Crivelli and/or external organisations (partners, exhibitors, banking establishments, stakeholders, etc.).

5. PROCESSING OF PERSONAL DATA

The table below sets out the different types of personal data collected on the Site, the purposes for which that data is processed, the recipients of that data, applicable retention periods, and the legal basis for data processing.

DATA CATEGORY	WHERE DATA IS COLLECTED	PURPOSES OF PROCESSING	INTERNAL RECIPIENTS	THIRD-PARTY RECIPIENTS	RETENTION PERIOD FOR PERSONAL DATA	LEGAL BASIS
Surname, given name(s), telephone number, e-mail address, date and month of birth, gender	On the Site	Account creation	Maison Crivelli staff	None	5 years from last login	Consent
Surname, given name(s), company, telephone number, delivery address, gender	On the Site	Delivery of products	Maison Crivelli staff	Duhamel (logistics provider)	Time required to process your order.	Execution of our contract with you
E-mail address, surname, given (names), company details, billing address, phone number, gender	On the Site	Invoicing products	Maison Crivelli staff	None	5 years from your last purchase.	Execution of our contract with you
Bank details	On the Site	Paying for orders	None	Stripe, PayPal (service providers responsible for banking transactions)	Your data is kept for the duration of the transaction.	Execution of our contract with you
E-mail address	On the Site	Newsletters, customer relationship management (CRM) campaigns	Maison Crivelli staff	Mailchimp (a technical service provider used to send e-mails)	Until such time as the data subject withdraws their consent by clicking the “unsubscribe” link included in the e-mail newsletters.	Consent
Surname, given name(s), e-mails	On the Site	Customer satisfaction analysis or participation in surveys	Maison Crivelli staff	None	5 years from the date of the survey or the contribution.	Legitimate Interest
Surname, given name(s) and e-mail address	During events organized by Maison Crivelli	CRM campaigns	Maison Crivelli staff	None	5 years from the date of the event.	Consent

Additional details:

Neptune Internet Services is involved in the storage of product, catalogue, customer and order data on the maisoncrivelli.com website. This data is kept indefinitely until such time as a deletion request is received.
Data security: Data for transactions on the Site is protected by TLS encryption, and 3D Secure is used for payments.

6. RETENTION OF PERSONAL DATA

Upon the expiry of the retention periods set out in the table above, the personal data concerned will be either deleted or retained in anonymised form (specifically for statistical purposes). Data may be retained in the event of preliminary or full litigation proceedings.

Data subjects are reminded that the deletion and anonymisation of data are irreversible processes, and that Maison Crivelli is therefore unable to restore deleted or anonymised data.

Furthermore, personal data may be transmitted to any authority that is legally entitled to access it. Where data is transferred to such authorities, Maison Crivelli is not responsible for the circumstances in which the staff of the authorities concerned access or make use of the personal data.

7. RIGHTS OF DATA SUBJECTS

As a data subject, you have rights that govern and protect all of your personal data when it is processed and collected by Maison Crivelli. Please see below for full details of how to exercise these rights.

Right of access: You have a right to obtain confirmation as to whether your personal data is being processed by Maison Crivelli and, if so, to access both your data and information regarding the circumstances under which it is being processed.

Right of rectification: If your personal data is obsolete, erroneous or incomplete, you have a right to have it rectified as soon as possible. To exercise this right, you must specify the data to be corrected and the data with which we should replace it.

Right to erasure (“right to be forgotten”): The right to erasure does not apply where processing is carried out in order to comply with a legal obligation. However, except in this specific situation, you are entitled to request the erasure of your personal data, including when:
your personal data is no longer necessary for the purposes for which it was collected or processed;
you object to processing we carry out on the basis of a legitimate interest, provided there are no overriding legitimate grounds for this processing;
you object to the processing of your personal data for marketing purposes, or;
your personal data has been processed unlawfully.

Right to object: You may object to the processing of your personal data by Maison Crivelli at any time, unless we have legitimate and compelling reasons for processing your personal data.

Where your personal data is processed for marketing purposes, you can object to processing at any time, without stating any grounds for the objection.

Right to restriction of processing: Within the limits set out in Law, you have the right to demand that the processing of your personal data be restricted if you contest the accuracy of the data concerned or the lawfulness of the processing, if you object to the processing of the data, or if you wish your data to be retained for evidentiary purposes.

Right to portability: Where we process your personal data by automated means, and where you have provided the data concerned on the basis of a contract or your consent, you have a right to receive that data in a structured, commonly used and machine-readable format, or to have that data transmitted to another data controller. If you submit your request electronically, the requested information will be provided to you in a commonly used electronic format, unless otherwise requested. This right of access and to obtain a copy of your personal data cannot extend to confidential information or to data whose transmission is not permitted by law.

Post-mortem rights: You have the right to issue instructions concerning the retention, erasure and transmission of your personal in the event of your death.

Right not to be subjected to an automated individual decision: You have the right not to be subjected to a decision based solely on automated processing that produces legal effects concerning you, or that otherwise significantly affects you. However, an automated individual decision may be applied where:
- it is authorised by Law;
- the decision is based on the explicit consent of the data subject; or
- the decision is necessary for the conclusion or performance of a contract;

and provided that the data subject is given the opportunity to contest the decision, express his or her point of view and request human intervention.

8. Exercising your rights

You can exercise your rights by sending an e-mail to

info@maisoncrivelli.com
or by writing to MAISON CRIVELLI SAS, 23 rue Louis-Le-Grand, 75002 Paris, France

Only the data subject may exercise the rights provided for above. Consequently, if there is any doubt as to your identity, we may be required to ask you for current proof of identity. Failure to provide such proof if asked to do so may result in your request being refused.

We do our best to respond to requests within a reasonable period of time, and within a maximum of one month from the date on which we receive the request.

However, if processing a request proves complicated or we are handling a high number of requests simultaneously, the time required to process requests may be extended.

9. Data processors

We may need to share information about you with data processors. We select these data processors with the utmost care, and demand that they respect our commitments regarding the protection and confidentiality of personal data in compliance with the GDPR.

We have the right to involve any data processor of our choice in the processing of personal data.

Where we do so, we ensure that the data processor complies fully with all its obligations as set out in the GDPR.

10. Register of processing

Maison Crivelli maintains a register of all processing activities carried out.

This register takes the form of a document or application that allows us to list all the processing operations we carry out in our capacity as the data controller.

We undertake to provide the French Commission nationale de l’informatique et des libertés (National Commission for Information Technology and Civil Liberties – hereinafter “CNIL”) with information enabling it to check whether processing is compliant with the applicable regulations regarding civil liberties and information technology, and to provide this information upon the initial request without further prompting.

11. Security measures

Maison Crivelli undertakes to treat the personal data it collects with the utmost care and to take all necessary steps in order to guarantee the confidentiality, integrity and security of that data.

To this end, we apply technical, organisational and administrative measures appropriate to the sensitivity of the data collected. Specifically, these measures include:

– Access control: Access to personal data is strictly limited to authorised persons only. Access is granted to the extent required by each individual’s role and in compliance with rules regarding the security of data.

– Securing infrastructure:
Implementation of advanced security protocols and systems, including:
using firewalls to protect networks;
measures to control physical access to data centres; and,
ensuring that users with permission to access sensitive data are subject to strong authentication requirements and strictly limited access authorisations.

– Protection of computer systems: Pro-active monitoring to quickly detect and respond to security incidents, carrying out regular software updates, and conducting penetration testing to identify and remedy potential vulnerabilities.

– Data encryption: The use of an encryption protocol to protect sensitive data in transit. Bank details are encrypted on payment platforms.

– Auditing and monitoring: Conducting regular internal and external audits to ensure the compliance and effectiveness of the security measures in place.
We regularly review our security policies and practices to ensure they are appropriate in light of the latest technological developments and complaint with current regulations.

In the event of a proven or suspected security breach affecting personal data, Maison Crivelli undertakes to inform the data subjects affected within the time limits stipulated by applicable regulations, and to take all necessary measures to remedy the situation.

12. SECURITY BREACHES INVOLVING PERSONAL DATA

We undertake to notify the CNIL of any security breach involving personal data, in compliance with the regulations regarding the treatment of personal data.

You will be informed of any breach affecting your personal data that could pose a high risk to your privacy.

13. Sale of personal data

We do not sell your personal data, and have not done so in the last 12 months.

However, our transfers of your personal information to certain third parties may be construed as “sales” under the law of the state of California. If you are a California resident, you have the right to opt-out of such sales to they extent they occur, and you also have the right to opt-out of such disclosure of your personal information for the purposes of online advertising.

14. TRANSFER OF PERSONAL DATA OUTSIDE THE EU

Where our data recipients or processors are located outside the European Union, and if the procedures in place to protect personal data in the countries where they are located – as governed by the local legislation applicable to the head office of the partners and service providers handling that data – do not offer sufficient protection, we require our partners and service providers to offer the same level of protection as expected within the European Union, in particular by entering into standard contractual clauses.

15. Complaints to the CNIL

If you are concerned about the processing of your personal data, and if you feel that the processing of your personal data does not comply with EU law regarding the protection of personal data, you have the right to lodge a complaint with a supervisory authority. In France, this authority is the CNIL. You can write to the CNIL at:

CNIL – Service des plaintes [Complaints Department]

3 Place de Fontenoy – TSA 80715 – 75334 PARIS, FRANCE CEDEX 07

Tel: +33 (0) 153 73 22 22

or via its website at www.cnil.fr.

16. MISCELLANEOUS

This policy may be modified or amended at any time in the event of legal or jurisprudential developments, rulings and recommendations from the CNIL, or applications of the law.

Any updated version(s) of this policy will be brought to the attention of customers and contacts by all means identified by Maison Crivelli, including electronically (for instance, by distributing it by e-mail or online).

If you require further information, you can contact us at info@maisoncrivelli.com

For more general information on the protection of personal data, you can consult the CNIL website atwww.cnil.fr.

*********************