PRIVACY POLICY
1. Preamble
The purpose of this Privacy Policy is to inform Internet users about how their Personal Data is collected from the Site, how it is processed by the Publisher and finally the rights that Internet users have with regard to this processing as defined below.
2. Definitions
The following terms, whether used in the singular or plural in this Privacy Policy, shall have the following definitions:
Intermediate Archiving: refers to the transfer of Personal Data that still has administrative value for the Publisher (such as in the event of litigation and/or a legal obligation) to a separate database, logically or physically separated, and whose access is restricted in any case. This archive is an intermediate step before the deletion of the Personal Data concerned or its anonymization;
Privacy Policy: refers to this privacy and personal data protection policy for Internet users implemented by the Publisher;
Personal Data: refers to the personal data of the Internet user collected and processed by the Publisher and as defined in the Privacy Policy;
Specific Rights: Refers to the rights granted by the Personal Data Regulations to Internet users regarding the processing of their Personal Data;
Regulations on Personal Data: refers to Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms, amended by Law No. 2018-493 of 20 June 2018 relating to the protection of personal data, in application of the Community Regulation of 27 April 2016 published in the Official Journal of the European Union on 4 May 2016 relating to the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as "GDPR" for General Data Protection Regulation);
Terminal(s): refers to the hardware (computer, tablet, smartphone, telephone, etc.) used by the Internet user to consult or view the Site and/or any other digital medium published by a third party;
Internet user: refers to all internet users, visitors to the Site.
3. The legal basis for the processing carried out by the Publisher
In accordance with the Personal Data Regulations, the processing operations described in this Privacy Policy are supported by a specific legal basis.
The use of the website is necessarily governed by a contractual relationship between the Internet user and the Publisher, which serves in particular as the legal basis for the collection and processing of the Internet user's Personal Data by the Publisher for the proper functioning of the Site and the provision of the associated services.
The processing of Personal Data may also be necessary to comply with a legal obligation to which the Publisher is subject.
The processing of the Internet user's Personal Data may finally be necessary for the purposes of the legitimate interests pursued by the Publisher or by a third party, unless the interests or fundamental rights and freedoms of the Internet user which require protection of Personal Data prevail, in particular when the Internet user is a child.
The processing of the Internet user's personal data strictly necessary for the purposes of fraud prevention constitutes, for example, a legitimate interest of the Publisher.
In the event of processing based on the legitimate interest of the Publisher or a third party, the Publisher shall ensure that the processing in question is indeed necessary to achieve its legitimate interest and shall assess the consequences of this processing on the Internet user, in particular taking into account the nature of the Personal Data processed, and the way in which it is processed.
The Publisher ensures in all circumstances that it does not disregard the interest or the fundamental rights and freedoms by allowing the Internet user, at any time, to object to all or part of the processing described in this Privacy Policy, as well as to implement their Specific Rights, and this under the conditions of Article 9 below.
4. The purposes of the processing carried out by the Publisher
The Internet user's Personal Data is necessary to allow them access to the Site, its use and improvement, and to allow the Publisher to provide any services detailed on the Site.
The operations described below are not used to create profiles that could reveal sensitive Personal Data such as racial or ethnic origin, philosophical, political, trade union, religious opinions, sexual life or health, nor are they used to produce automated decisions by the Publisher.
5. Storage of Personal Data
The Site is hosted by AWS, whose contact details are available by clicking here *|LEGAL_TERMS|*.
Every precaution has been taken to store users' personal data in a secure environment and to prevent it from being altered, damaged, or accessed by unauthorized third parties. Information transmitted by users will never be shared with third parties for commercial purposes, nor sold or exchanged.
6. Collection of Personal Data on the Site
The Publisher collects the Personal Data that the Internet User spontaneously enters on the Site.
This Personal Data is kept by the Publisher for a period of two (2) years, in an active database, from the date of its communication from the Site.
The Personal Data concerned is then kept in Intermediate Archiving for an additional period of three (3) years in accordance with the common limitation period.
Where applicable, the Publisher may decide to keep this Personal Data for a longer period in Legal Intermediate Archiving, to meet a legal obligation (for example Article L.123-22 of the Commercial Code which provides that "Accounting documents and supporting documents are kept for ten years") or to allow it to establish proof of a right or a contract.
Only the Personal Data designated on the Site as mandatory is essential to benefit from the services provided by the Site.
7. Recipients or categories of recipients of Personal Data
The Internet user's Personal Data is communicated to the Publisher's subcontractors, namely:
AYS (klixi), a simplified joint-stock company with a capital of 50,000 Euros, whose registered office is located at 18, rue de Londres, 75009 Paris, France, registered with the Paris Trade and Companies Register under number 535 351 472 - https://www.klixi.io/fr/mentions-legales
Functionality: Developer and tool for managing and administering the Site by the Publisher
Data transfer outside the EU and specific safeguards: No
----
Amazon Web Services LLC (AWS) P.O. Box 81226 Seattle, WA 98108-1226 - https://aws.amazon.com
Functionality: Website Host
Data transfer outside the EU and specific safeguards: Yes – Privacy Shield
----
Si applicable - Stripe Payments Europe, Ltd 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Irelande - https://www.stripe.com/fr
Functionality: Payment module
Data transfer outside the EU and specific safeguards: No
----
Si applicable – Mandrill - The Rocket Science Group, LLC 675 Ponce de Leon Ave NE Suite 5000 Atlanta, GA 30308 USA - https://mailchimp.com/
Functionality: Allows the Publisher to send email campaigns to Internet users who have provided their email address.
Data transfer outside the EU and specific safeguards: Yes – Privacy Shield
----
Si applicable – TextMagic - TEXTMAGIC LTD, Salisbury House Station Road Cambridge CB1 2LA United Kingdom, VAT Reg No: GB851556810, Company No: 05286521 - https://www.textmagic.com
Functionality: Allows the Publisher to send SMS campaigns to Internet users who have provided their phone number
Data transfer outside the EU and specific guarantees: No
----
If applicable – Stuart - SRT GROUP, 8 avenue des Ternes, 75017 Paris - https://stuart.com/fr/
Functionality: Allow the Publisher to use Stuart as an expedited delivery method
Data transfer outside the EU and specific guarantees: Not applicable
----
If applicable – TacTill, 8 Bis Chemin de la Justice, 91940 Gometz le Châtel - https://www.tactill.com
Functionality: Allows the Publisher to receive e-commerce orders placed on the Website directly on their TacTill cash register
Data transfer outside the EU and specific guarantees: No
----
Si applicable – Fülle - SARL FULLE, 85 Impasse Leydier, 34130 Candillargues - https://fulleapps.com/cgu/
Functionality: Allows the Publisher to receive e-commerce orders and online reservations made on the Klixi website directly on their Fulle cash register
Data transfer outside the EU and specific guarantees: No
----
Si applica – SMSFactor - Infomotiv SASU, 126 avenue Léon Bérenger 06700, St Laurent du Var - https://www.smsfactor.com
Functionality: Enables sending SMS messages related to booking services on the Publisher's website
Data transfer outside the EU and specific guarantees: No
----
Si applicable – Vivawallet - VIVA PAYMENT SERVICES SINGLE MEMBER S.A, 18-20,AMAROUSIOU - CHALANDRIOU AVE, GRECE - https://www.vivawallet.com/
Functionality: Payment module
Data transfer outside the EU and specific guarantees: Yes
----
If applicable – Paygreen, 17 rue du Colisée, 75008 Paris - https://www.paygreen.io
Functionality: Payment module
Data transfer outside the EU and specific safeguards: not disclosed
8. Internet Users' Rights
In accordance with the Personal Data Regulations, the Internet user may, at any time, exercise the following Specific Rights:
* access (article 39 of Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms),
* rectification (article 40 of Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms),
* erasure (Article 40 of Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms),
* limitation of processing (Article 40 of Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms),
* portability (Article 20 of the GDPR),
* opposition (article 38 of Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms),
* post-mortem directives (article 40-1 of Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms),
8.1 Access rights
The user has the option to obtain from the Publisher confirmation as to whether or not their personal data is being processed and, if so, access to said personal data as well as the following information:
* the purposes of the processing;
* categories of Personal Data;
* the recipients or categories of recipients to whom the Personal Data have been or will be communicated;
* where possible, the envisaged period for which the Personal Data will be retained or, where this is not possible, the criteria used to determine this period;
* the existence of the right to request from the Publisher the rectification or erasure of Personal Data, or a limitation of the processing of his Personal Data, or the right to object to this processing;
* the right to lodge a complaint with the CNIL;
* when Personal Data is not collected from the Internet user, any available information regarding its source;
* the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the user;
When Personal Data is transferred to a third country or an international organization, the Internet user has the right to be informed of the appropriate safeguards relating to this transfer.
The Publisher provides a copy of the Personal Data being processed.
The Publisher may require payment of reasonable fees based on administrative costs for any additional copies requested by the User.
When the Internet user submits their request electronically, the information is provided in a commonly used electronic form, unless they request otherwise.
The Internet user's right to obtain a copy of their Personal Data must not infringe on the rights and freedoms of others.
8.2 Right of rectification
Users have the right to obtain from the Publisher, as soon as possible, the rectification of any inaccurate Personal Data concerning them. They also have the right to have incomplete Personal Data completed, including by providing a supplementary statement.
8.3 Right to erasure
The user has the right to obtain from the Publisher the deletion, as soon as possible, of Personal Data concerning him/herself when one of the following reasons applies:
* Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed by the Publisher;
* The user has withdrawn their consent for the processing of this Personal Data and there is no other legal basis for the processing;
* The Internet user exercises their right to object under the conditions recalled below and there is no overriding legitimate reason for the processing;
* The Personal Data has been processed unlawfully;
* Personal Data must be erased to comply with a legal obligation;
* The Personal Data was collected from a child.
8.4 Rights to limitation
The user has the option to obtain from the Publisher a restriction on the processing of their Personal Data when one of the following grounds applies:
* The Publisher verifies the accuracy of Personal Data following a dispute by the User regarding the accuracy of the Personal Data,
* The processing is unlawful and the Internet user objects to the erasure of Personal Data and demands instead the limitation of its use;
* The Publisher no longer needs the Personal Data for the purposes of processing, but this data is still necessary for the Internet user for the establishment, exercise or defense of legal rights;
* The Internet user objected to the processing under the conditions recalled below and the Publisher verifies whether the legitimate grounds pursued prevail over the grounds alleged.
8.5 Right to Data Portability
The user has the option to receive their personal data from the publisher in a structured, commonly used, and machine-readable format when:
* The processing of Personal Data is based on consent, or on a contract and
* The processing is carried out using automated processes.
When the Internet user exercises their right to data portability, they have the right to have their Personal Data transmitted directly by the Publisher to another data controller they designate, where technically feasible.
The right to data portability of the Internet user must not infringe on the rights and freedoms of others.
8.6 Right to object
The user may object at any time, for reasons relating to their particular situation, to the processing of their personal data based on the legitimate interest of the publisher. The publisher will then no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the user, or may retain the data for the establishment, exercise or defense of legal claims.
8.7 Directives post-mortem
Users have the option of providing the Publisher with instructions regarding the retention, deletion, and disclosure of their Personal Data after their death. These instructions can also be registered with a certified digital trusted third party. These instructions, or a kind of "digital will," may designate a person responsible for their execution; otherwise, the user's heirs will be designated.
In the absence of any instructions, the Internet user's heirs may contact the Publisher in order to:
* access to the processing of Personal Data enabling "the organisation and settlement of the deceased's estate";
* receive communication of "digital assets" or "data resembling family memories, transmissible to heirs";
* to proceed with the closure of the User's account on the Site where applicable and to object to the continued processing of their Personal Data.
In any event, the Internet user has the option to indicate to the Publisher, at any time, that he does not wish, in the event of his death, for his Personal Data to be communicated to a third party.
9. Exercising the Specific Rights of Internet Users
These rights can be exercised at any time with the Publisher whose contact details are indicated in the legal notices *|LEGAL_TERMS|*.
In order to assert its rights under the conditions referred to above and in the event that the Publisher has doubts about the author of the request, the Publisher may ask the latter to prove his identity by stating his surname, first name, email address and to accompany his request with a copy of a valid identity document.
A response will be sent to the Internet user within a maximum period of one (1) month following the date of receipt of the request.
If necessary, this period may be extended by two (2) months by the Publisher, who will notify the Internet user, taking into account the complexity and/or number of requests.
In the event of a request from the Internet user to delete their Personal Data and/or in the event of exercising their right to request the erasure of their Personal Data, the Publisher may nevertheless retain them in the form of Intermediate Archiving, for the period necessary to satisfy its legal obligations, or for evidentiary purposes during the applicable limitation period.