PRIVACY POLICY
Publication date: January 20, 2025
At Hervé Chapelier, protecting your personal data is a priority.
During your use of the website https://www.hervechapelier.com (the “Website”) and as part of the management of our contractual relations with our customers, we collect personal data about you.
The purpose of this policy is to inform you about the ways in which we process this data in compliance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the “GDRP”) and Law No. 78-17 of January 6, 1978 on Information Technology and Liberties (together the “Applicable Regulations”).
1. Data controller
The data controller, who collects the personal data and implements the processing of such data, is Hervé Chapelier, a French “société par actions simplifiée” with a share capital of 305,000 euros, whose commercial name is Hervé Chapelier, registered with the Paris Company and Trade Register under no. 313 485 344 and having its registered office at 40, avenue Edouard Vaillant - 92100 Boulogne Billancourt - France (“Us” or “Hervé Chapelier”).
2. Data collection
Personal data is data that can be used to identify an individual, either directly or by cross-referencing with other data.
We collect personal data in the following categories:
-
Identification data (surname, first name, -mail and postal address, telephone number, gender);
-
Data relating to your orders;
-
Connection data (connection logs, encrypted passwords);
-
Browsing data (IP address, pages viewed, date and time of connection, browser used, operating system, user ID);
-
Location data.
Order payment data (title, first name, surname, e-mail address, telephone number, billing address, credit card number, expiration date, authorization number, and security code) are collected directly by Hervé Chapelier’s payment service providers, under their respective terms, conditions and confidentiality policies. We shall not have access to this Data.
When you use the Website, we may also collect geolocation data about you. This data is only collected with your express consent via the checkbox available on the Website. You may withdraw your consent at any time by writing to us using the contact details given in article “Contact details to exercise your rights” below.
Mandatory information is indicated on the Website, by any means.
3. Data collection: purposes, legal basis and retention term
|
Purposes
|
Legal basis |
Retention term |
|
Purchasing and order management (including retractions, returns and refunds)
|
Sales contract performance and legal obligations |
Duration of contractual relationship and applicable legal guarantees
Archiving for evidential purposes for 5 years
Sales contract data: 10 years from conclusion of sales contract |
|
Account creation and management Account
|
Legitimate interest |
3 years after last contact by Customer
|
|
Create a file of customers and prospects
|
Legitimate interest |
For customers: duration of contractual relationship
For prospects: 3 years from last contact
|
|
To send newsletters, solicitations and promotional messages by email. |
For customers: legitimate interest in building loyalty and informing our customers of our latest news
For prospects : consent
|
Until consent is withdrawn |
|
Managing requests to exercise rights
|
Legal and regulatory obligations |
If you exercise your right to object to receiving prospecting, we keep this information for 3 years.
|
4. Data recipient
The following may have access to your personal data:
-
Our company staff;
-
Our subcontractors: hosting service provider, newsletter sending service provider, audience measurement and analysis service provider, email service provider, secure payment service provider, invoicing tool, cookie management tool, stock availability management service provider, payment service provider, CRM tool, delivery service provider;
-
Where applicable: public and private bodies (exclusively to meet our legal obligations).
5. Data transfer outside EU
Your data is kept and stored on OVH servers, located in the European Union, for the duration of processing.
Within the framework of the tools we use (see article on recipients concerning our subcontractors), your data may be transferred outside the European Union within the framework of the standard contractual clauses of the European Commission and the adequacy decision set up between the countries of the European Union and the United States (Data Privacy Framework).
You can obtain a copy of the tools enabling your data to be transferred outside the European Union by contacting us using the details given in article “Contact details to exercise your rights” below.
6. Your rights over your Data
You have the following rights with regard to your personal data:
-
Information right: this is precisely why we have drawn up this policy. This right is provided for in Articles 13 and 14 of the GDRP.
-
Access right: you have the right to access all your personal data at any time, under Article 15 of the GDRP.
-
Rectification right: you have the right to rectify inaccurate, incomplete or outdated personal data at any time pursuant to Article 16 of the GDPR.
-
Limitation right: you have the right to obtain the limitation of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
-
Erasing Right: you have the right to demand that we erase your personal data, and to prohibit any future collection on the grounds set out in Article 17 of the GDPR.
-
Right to introduce a complaint with a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data constitutes a breach of the applicable texts, in accordance with Article 77 of the GDRP.
-
Right to define directives relating to the retention, deletion and communication of your personal data after your death.
-
Right to withdraw your consent at any time: for purposes based on consent, Article 7 of the GDRP states that you may withdraw your consent at any time. This withdrawal will not call into question the lawfulness of the processing carried out prior to the withdrawal.
-
Portability: under certain conditions specified in Article 20 of the GDRP, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to demand its transfer to the recipient of your choice.
-
Objection right: under Article 21 of the GDRP, you have the right to object to the processing of your personal data. Please note, however, that we may continue to process them despite this objection, for legitimate reasons or the defense of legal rights.
You can exercise these rights by writing to us using the contact details below. We may ask you to provide additional information or documents to prove your identity.
7. Cookies
To find out more about the cookies we use, please consult our Cookie Policy available on the Website.
8. Contact details to exercise your rights
You can reach us using the following contact details:
-
Email: online@hervechapelier.com
-
Address: 40, avenue Edouard Vaillant - 92100 Boulogne Billancourt - France
-
Phone: +33 1 46 08 22 35
9. Modifications
We may modify this policy at any time, in particular in order to comply with any regulatory, legal, editorial or technical developments. These modifications will apply as of the effective date of the modified version. You are therefore invited to consult the latest version of this policy on a regular basis. Nevertheless, we will keep you informed of any significant changes to this privacy policy.
