INTRODUCTION

Atelier Particulier, a simplified joint stock company with a share capital of €20,000, whose registered office is located at 58 rue de Monceau – 75008 Paris, registered with the Paris Trade and Companies Register under number 944 532 027, identified for VAT purposes under number FR83944532027, (hereinafter ‘PARFUMERIE PARTICULIERE’), manufacturer and seller of PARFUMERIE PARTICULIERE products,

The details given below set out the privacy policy that governs the processing of personal data that may be collected on the Site (this policy is hereinafter referred to as the Privacy Policy).

PURPOSE

With a view to establishing a transparent, trust-based relationship with all visitors to and/or users of our Site, we wish to take this opportunity to set out our commitment to protecting your privacy and personal data in accordance with EU Regulation 2016/679 (the General Data Protection Regulation, hereinafter referred to as the “GDPR“).

SCOPE

The present Privacy Policy is intended to apply with respect to the full range of processing activities involving personal data belong to data subjects.
The processing of personal data may be managed directly by PARFUMERIE PARTICULIERE, or by a sub-contractor specifically designated by PARFUMERIE PARTICULIERE.
The present Privacy Policy is independent of any other document that may apply within the context of the contractual relationship between PARFUMERIE PARTICULIERE and the data subjects.
The Site may contain links to other websites over which we have no control. We cannot be held responsible for the content or privacy policies of these sites.

DEFINITION

For the avoidance of doubt, it is hereby clarified that, for the purposes of the present Privacy Policy:

• the term “personal data” refers to any information or dataset that allows an individual to be identified either
• directly (e.g. by their surname, first name, e-mail address, personal address, etc.)
• or indirectly (e.g. by means of pseudonymised data such as a unique identification number, etc.).

Unique identifiers, such as a computer’s IP address, may also be considered to be personal data.

• the term “data controller” refers to the entity that determines the purposes and means of the processing of personal data, and that is responsible to data subjects for ensuring that data processing complies with all applicable legislation and regulations. The data controller is hereinafter referred to as “PARFUMERIE PARTICULIERE” or “we”.

PARFUMERIE PARTICULIERE has appointed a Data Protection Officer as the primary point of contact on all matters relating to the processing of personal data.

You can contact them by e-mail at contact@parfumerieparticuliere.com.

If data subjects wish to obtain specific information or to raise a specific question, they will be able to contact the Data Protection Officer, who will respond to their query within a reasonable period of time.

• The term “data processor” refers to any natural person or legal entity processing personal data on behalf of PARFUMERIE PARTICULIERE.

• The term “data subjects”, also referred to as “you”, designates visitors to and/or users of the Site.

• The term “recipients” refers to the natural or legal entities that receive personal data from PARFUMERIE PARTICULIERE. It follows, therefore, that the recipients of this personal data may be employees of PARFUMERIE PARTICULIERE and/or external organisations (partners, exhibitors, banking establishments, stakeholders, etc.).

PROCESSING OF PERSONAL DATA

The table below sets out the different types of personal data collected on the Site, the purposes for which that data is processed, the recipients of that data, applicable retention periods, and the legal basis for data processing.

RETENTION OF PERSONAL DATA

Upon the expiry of the retention periods set out in the table above, the personal data concerned will be either deleted or retained in anonymised form (specifically for statistical purposes). Data may be retained in the event of preliminary or full litigation proceedings.
Data subjects are reminded that the deletion and anonymisation of data are irreversible processes, and that PARFUMERIE PARTICULIERE is therefore unable to restore deleted or anonymised data.
Furthermore, personal data may be transmitted to any authority that is legally entitled to access it. Where data is transferred to such authorities, PARFUMERIE PARTICULIERE is not responsible for the circumstances in which the staff of the authorities concerned access or make use of the personal data.

RIGHTS OF DATA SUBJECTS

As a data subject, you have rights that govern and protect all of your personal data when it is processed and collected by PARFUMERIE PARTICULIERE. Please see below for full details of how to exercise these rights.

• Right of access: You have a right to obtain confirmation as to whether your personal data is being processed by PARFUMERIE PARTICULIERE and, if so, to access both your data and information regarding the circumstances under which it is being processed.

• Right of rectification: If your personal data is obsolete, erroneous or incomplete, you have a right to have it rectified as soon as possible. To exercise this right, you must specify the data to be corrected and the data with which we should replace it.

• Right to erasure (“right to be forgotten”): The right to erasure does not apply where processing is carried out in order to comply with a legal obligation. However, except in this specific situation, you are entitled to request the erasure of your personal data, including when:
• your personal data is no longer necessary for the purposes for which it was collected or processed;
• you object to processing we carry out on the basis of a legitimate interest, provided there are no overriding legitimate grounds for this processing;
• you object to the processing of your personal data for marketing purposes, or;
• your personal data has been processed unlawfully.

• Right to object: You may object to the processing of your personal data by PARFUMERIE PARTICULIERE at any time, unless we have legitimate and compelling reasons for processing your personal data.

Where your personal data is processed for marketing purposes, you can object to processing at any time, without stating any grounds for the objection.

• Right to restriction of processing: Within the limits set out in Law, you have the right to demand that the processing of your personal data be restricted if you contest the accuracy of the data concerned or the lawfulness of the processing, if you object to the processing of the data, or if you wish your data to be retained for evidentiary purposes.

• Right to portability: Where we process your personal data by automated means, and where you have provided the data concerned on the basis of a contract or your consent, you have a right to receive that data in a structured, commonly used and machine-readable format, or to have that data transmitted to another data controller. If you submit your request electronically, the requested information will be provided to you in a commonly used electronic format, unless otherwise requested. This right of access and to obtain a copy of your personal data cannot extend to confidential information or to data whose transmission is not permitted by law.

• Post-mortem rights: You have the right to issue instructions concerning the retention, erasure and transmission of your personal in the event of your death.

• Right not to be subjected to an automated individual decision: You have the right not to be subjected to a decision based solely on automated processing that produces legal effects concerning you, or that otherwise significantly affects you. However, an automated individual decision may be applied where:
  • it is authorised by Law;
  • the decision is based on the explicit consent of the data subject; or
  • the decision is necessary for the conclusion or performance of a contract;

and provided that the data subject is given the opportunity to contest the decision, express his or her point of view and request human intervention.

Exercising your rights

You can exercise your rights by sending an e-mail to 

• contact@parfumerieparticuliere.com
• or by writing to PARFUMERIE PARTICULIERE, 58 rue de Monceau, 75008 Paris, France

Only the data subject may exercise the rights provided for above. Consequently, if there is any doubt as to your identity, we may be required to ask you for current proof of identity. Failure to provide such proof if asked to do so may result in your request being refused.

We do our best to respond to requests within a reasonable period of time, and within a maximum of one month from the date on which we receive the request.

However, if processing a request proves complicated or we are handling a high number of requests simultaneously, the time required to process requests may be extended.

Data processors

We may need to share information about you with data processors. We select these data processors with the utmost care, and demand that they respect our commitments regarding the protection and confidentiality of personal data in compliance with the GDPR.
We have the right to involve any data processor of our choice in the processing of personal data.
Where we do so, we ensure that the data processor complies fully with all its obligations as set out in the GDPR.

Register of processing

PARFUMERIE PARTICULIERE maintains a register of all processing activities carried out.

This register takes the form of a document or application that allows us to list all the processing operations we carry out in our capacity as the data controller.

We undertake to provide the French Commission nationale de l’informatique et des libertés (National Commission for Information Technology and Civil Liberties – hereinafter “CNIL”) with information enabling it to check whether processing is compliant with the applicable regulations regarding civil liberties and information technology, and to provide this information upon the initial request without further prompting.

Security measures

PARFUMERIE PARTICULIERE undertakes to treat the personal data it collects with the utmost care and to take all necessary steps in order to guarantee the confidentiality, integrity and security of that data.

To this end, we apply technical, organisational and administrative measures appropriate to the sensitivity of the data collected. Specifically, these measures include:

– Access control: Access to personal data is strictly limited to authorised persons only. Access is granted to the extent required by each individual’s role and in compliance with rules regarding the security of data.

– Securing infrastructure:
Implementation of advanced security protocols and systems, including:
using firewalls to protect networks;
measures to control physical access to data centres; and,
ensuring that users with permission to access sensitive data are subject to strong authentication requirements and strictly limited access authorisations.

– Protection of computer systems: Pro-active monitoring to quickly detect and respond to security incidents, carrying out regular software updates, and conducting penetration testing to identify and remedy potential vulnerabilities.

– Data encryption: The use of an encryption protocol to protect sensitive data in transit. Bank details are encrypted on payment platforms.

– Auditing and monitoring: Conducting regular internal and external audits to ensure the compliance and effectiveness of the security measures in place.

SECURITY BREACHES INVOLVING PERSONAL DATA

We undertake to notify the CNIL of any security breach involving personal data, in compliance with the regulations regarding the treatment of personal data.

You will be informed of any breach affecting your personal data that could pose a high risk to your privacy.

Sale of personal data

We do not sell your personal data, and have not done so in the last 12 months.

However, our transfers of your personal information to certain third parties may be construed as “sales” under the law of the state of California. If you are a California resident, you have the right to opt-out of such sales to they extent they occur, and you also have the right to opt-out of such disclosure of your personal information for the purposes of online advertising.

TRANSFER OF PERSONAL DATA OUTSIDE THE EU

Where our data recipients or processors are located outside the European Union, and if the procedures in place to protect personal data in the countries where they are located – as governed by the local legislation applicable to the head office of the partners and service providers handling that data – do not offer sufficient protection, we require our partners and service providers to offer the same level of protection as expected within the European Union, in particular by entering into standard contractual clauses.

Complaints to the CNIL

If you are concerned about the processing of your personal data, and if you feel that the processing of your personal data does not comply with EU law regarding the protection of personal data, you have the right to lodge a complaint with a supervisory authority. In France, this authority is the CNIL. You can write to the CNIL at:

CNIL – Service des plaintes

3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07

Tél : 01 53 73 22 22

Ou via son site Internet www.cnil.fr.