- Parties
Between the undersigned:
1° The simplified joint stock company WORK/SHOP with a capital of 8 000 Euros, registered in the Paris Trade and Companies Register under number 833 786 189, whose registered office is located 94 avenue Henri Martin 75016 Paris, and whose VAT number is FR 82 833786189.
Hereinafter referred as the"Data controller",
On the one hand,
And
Hereinafter referred ast he "Data subject",
On the other hand,
It has been agreed as follows:
This Privacy Policy applies, without restriction or reservation between the Data Subject and the Data Controller.
The purpose of this Privacy Policy is to provide information about how the Data Controller collects and processes the Data of the Data Subject in the context of his or her browsing through the Website.
The Privacy Policy is part of the General Terms and Conditions of Sale and cannot be interpreted and/or applied independently.
Data controller refers to the simplified joint stock company WORK/SHOP with a capital of 8 000 Euros, registered in the Paris Trade and Companies Register under number 833 786 189, whose registered office is located 94 avenue Henri Martin 75016 Paris, and whose VAT number is FR 82 833786189, which determines, on its own or jointly with others, the purposes and means of the Processing.
Data subject refers to any individual who browses, acquires, orders and/or purchases a Product on the Website provided that he/she can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more elements specific to his/her physical, physiological, genetic, psychological, economic, cultural or social identity.
Navigation or Browsing refers to the consultation, review, order and/or purchase of Products on the Website.
Website refers to the infrastructure developed by the Data controller in accordance with the IT formats that can be used on the Internet, including data of various kinds, and in particular texts, sounds, static or animated images, videos, databases, intended to be consulted by the Data subject to know, book, order and/or purchase Products (townhouseworkshop.com).
Product means any product presented on the Website.
Data means any information relating to the Person concerned.
File means any set of Data structures accessible in accordance with specified requirements, whether centralized, decentralized or distributed in a functional or geographical manner.
Processing means any operation or set of operations performed or not performed using automated processes and applied to the Data or sets of Data, such as collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, consulting, using, communicating by transmission, distributing or otherwise making available, matching or interconnecting, limiting, deleting or destroying.
Data processor means any individual or entity, public authority, service or other body than the Data controller who processes the Data on behalf of the Data controller.
Receiver means any individual or entity, public authority, service or other body that receives communication of the Data, whether it is a Third Party. However, public authorities likely to receive communication of the Data, in particular in the context of a fact-finding mission, shall not be considered as Receivers within the meaning of this definition.
Third partymeans any individual or entity, public authority, service or other body than the Data controller, the Data processor and the persons who, under the direct authority of the Data controller or the Data processor, are authorised to process the Data.
Consent means any free, specific, informed and unambiguous expression of will by which the Data subject accepts, by a declaration or by a clear positive act, that Data concerning him/her may be processed by the Data controller.
Cookie means a computer file made of text and used to personalise the experience of the Data subject when using the Website and notably to find out if the Data subject has already visited the Website.
Supervisory Authority refers to the Commission Nationale de l'Informatique et des Libertés (CNIL), an independent French public authority regulating data protection, or any other equivalent national authority.
Data collected
When the Data subject browses the Website, the Data Controller may collect and process a certain number of Data detailed below.
Data directly transmitted by the Data subject
While browsing the Website, the Data subject is led to directly transmit a certain number of Data to the Data controller in order to, notably:
- Submit online forms;
- Report malfunctions;
- Ordering on the Website;
- Make an appointment;
- Create a profile;
- Participate in games, contests, promotional offers, studies or surveys;
- Contact the Data controller;
The following Data are concerned:
- Gender;
- Full name and surname;
- Email address;
- Postal address;
- Press card number;
- Phone number;
- Personal commentary;
- Personal password;
- Copy of the exchanges between the Data subject and the Data controller;
- Details of the financial or accounting transactions carried out on the Website, containing Data relating to the payment card of the Person concerned and his/her bank details;
- Details of the Data subject's visits to the Website and the content to which he or she has accessed;
- Data subject's answers to surveys and questionnaires carried out by the Data controller.
All these Data are transmitted by the Data subject to the Data controller by a systematic, clear and unambiguous positive act.
Data automatically transmitted by the Data subject
While browsing the Website, the Data Subject is led to automatically transmit a certain number of Data to the Data controller in order to, notably:
- Perform statistics of the Navigation on the Website;
- Improve the website and the Data controller services;
- Personalise the Data subject's experience;
The following Data are concerned:
- IP address;
- Connexion Data;
- Types and versions of web browsers used;
- Types and versions of plugins used;
- Operating systems and platforms;
- Browsing on the Website (browsing on the different URL pages, content consulted, search terms used, page consultation time …).
All these Data are automatically transmitted by the Data subject to the Data controller by a clear and unequivocal positive act of acceptance of the Cookies banner, in particular by the continuation of navigation after the appearance of the information banner on the Site.
Data retention period
As a matter of principle, unless there is a derogatory legal obligation to keep the Data, all the Data are deleted or anonymised by the Data controller within 3 years from the last contact with the Data subject or within 3 years from the end of the contractual relationship between the Data subject and the Data controller.
The Data referred to in Article 4.2shall be deleted or anonymised by the Data controller, unless there is an overriding legal obligation to retain them, within 13 months from their automatic transmission by the Data subject to the Data controller.
Data Processing Purposes
Each Data Processing is carried out by the Data controller on the grounds of the legal bases detailed below.
Execution of contracts
The Data processing carried out by the Data controller in order to execute the contracts concluded with the Data subject is strictly necessary for the execution of these contracts.
Profile creation
The Data Processing carried out by the Data controller so that the Data subject can create an account and make orders is:
- Strictly necessary for the performance of the contract to which the Data subject is party
OR
- Carried out on the basis of the consent of the Person concerned.
- Execution of payments
The Data processing carried out by the Data controller in order to receive payments from the Data subject in connection with the sales contract concluded with the Data subject is strictly necessary for the performance of the contract to which the Data subject is party.
The Data Processing carried out by the Data controller so that the Data controller can send information to the Data subject is:
- Strictly necessary for the performance of the contract to which the Data subject is party
OR
Carried out on the basis of the consent of the Person concerned.
The Data Processing carried out by the Data controller so that the Data controller car send advertising to the Data subject is:
- Strictly necessary for the legitimate interest pursued by the Data controller.
OR
Carried out on the basis of the consent of the Person concerned.
The Data processing carried out by the Data controller so that the Data subject can contact the Data controller is:
- Strictly necessary for the performance of the contract to which the Data subject is party
OR
Carried out on the basis of the consent of the Person concerned.
The Data processing carried out by the Data controller to secure the Website is:
- Strictly necessary to comply with legal obligations
OU
- Strictly necessary for the legitimate interest pursued by the Data controller
The Data processing carried out by the Data controller to optimise the Website is strictly necessary for the purposes of the legitimate interest pursued by the Data controller
The Data Processing carried out by the Data controller to allow the Data subject to participate in games, contests, promotional offers, studies or surveys organised by the Data controller is carried out on the basis of the consent of the Data subject.
As a matter of principle, the Data controller is the sole Receiver of the Data.
However, the Data controller may transfer the Data processed to any partners and Data processor to perform the contracts to which the Data subject is a Party.
The Data controller undertakes to require from any partners and Data processors sufficient guarantees as to the use of appropriate technical and organisational measures to ensure that the Processing operation complies with legal and regulatory requirements and guarantees the protection of the Data subject's rights.
The Data controller may communicate to any Receiver or Third party the Data being processed when a legal requirement exists or when the Data controller considers in good faith that it is necessary to do so in in order to:
- Reply to any claim against him;
- Comply with judicial and/or administrative requirements;
- Enforce any contract to which the Person concerned is party;
- Protect the vital interests of any individual;
- The performance of a public interest mission.
In case of purchase of the Data controller by a Third party, the Data controller may share the Data with the Third-party purchaser provided that this Privacy Policy is respected by the Third party.
The Data controller stores all the Data on secured servers located within the European Union.
No transfer of Data outside the European Union will be carried out by the Data controller without the express and prior authorisation of the Data subject
The Data subject has several rights over the Data that he/she can exercise, unless otherwise provided by laws or regulations, by making a formal request to the Data controller at the following address:
WORK/SHOP
94 avenue Henri Martin
75016 Paris
FRANCE
hello@townhouseworkshop.com
The Data subject has the right to obtain from the Data controller confirmation that Data are or are not being processed and, when they are, access to the said Data and to the following information:
- The purposes of the Processing operation;
- Data categories;
- The Receivers or categories of Receivers to which the Data have been or will be transmitted, in particular Receivers who are established in third countries or international organisations;
- When possible, the retention period of the Data or, when this is not possible, the criteria used to determine this period;
- The existence of the right to request the Data controller to rectify or delete Data, or to limit the Processing of Data, or the right to object to such Processing;
- The right to file a complaint before a supervisory authority;
- When the Data are not collected from the Data subject, any available information as to their source;
- The existence of an automated decision-making, including profiling, and, at least in such cases, relevant information concerning the subjacent logic, as well as the importance and the expected consequences of such processing for the Data subject.
The Data controller shall provide a copy of the Data being processed and shall be entitled, in consideration of the provision of such copy, to payment of a reasonable fee based on the administrative costs for any additional copy requested by the Data subject.
The Data subject has the right to obtain from the Data controller the rectification and/or deletion of inaccurate or obsolete Data without undue delay, unless a contrary situation impedes the exercise of this right, and in particular:
- The exercise of the freedom of expression and information;
- Compliance with a legal obligation;
- Public interest in the field of public health, archives, scientific or historical or statistical research;
- The establishment, exercise or defence of legal rights in court.
The data subject has the right to object at any time, for his or her particular situation, to a Data Processing operation based on the performance of a task in the public interest or on the need of the legitimate interest of the Data controller.
The Data controller shall then undertake to no longer process the Data, unless it can be demonstrated that there are legitimate and imperative for the Processing that override the interests and rights of the Data subject, or for the recognition, exercise or defence or rights in court.
In addition, the Data subject has the right to object at any time the Processing carried out for the purposes of commercial prospection, to the extent that the Data subject is related to such commercial prospection.
When Data is processed for scientific or historical research purposes or for statistical purposes, the Data subject has the right to oppose, for reasons related to its particular situation, the processing of the Data, unless Treatment is necessary for the performance of a public interest mission.
The Data subject has the right to obtain from the Data controller the limitation of Data Processing when:
- The accuracy of the Data is disputed by the Data subject for a period of time allowing the Data controller to verify the accuracy of the Data.;
- The Processing is illegal, and the Data subject opposes their erasure and instead requires the limitation of their use;
- The Data controller no longer needs the Data to be processed but the Data is necessary to the Data subject in order to exercise or defend its rights in court;
- The Data subject object the Processing of the Data in accordance with Article 9.3during the verification as to whether the legitimate grounds pursued by the Data controller take precedence over those of the Data subject.
The Data subject who has obtained the Data Processing limitation is informed by the Data controller before the end of the limitation.
The Data subject has the right to receive the Data provided to the Data controller in a structured, commonly used, machine-readable format, and has the right to transmit the Data to another Data controller when:
- Processing is based on the consent of the Data subject or on the performance of a contract to which the Data subject is party;
- Processing is done using automated processes.
The Data subject, while exercising its right to portability, has the right to have the Data directly transmitted form the Data controller to another Data controller, when it is technically possible.
The Data subject has the right to lodge a complaint before the Supervisory Authority when it considers the Data being processed illegally by the Data controller
The Data subject has the right to set guidelines on the fate of the Data after his death to the Data controller who shall use all the technical means to enforce the Data subject will.
The Data controller reserves the right to modify this Privacy Policy from time to time.
In the event of a substantial change to this Privacy Policy, the Data subject will be personally notified of the new Privacy Policy.
The Data subject is invited by the Data controller to regularly review this Privacy Policy for any changes.
The Data subject can send questions about this Privacy Policy to the following email address: hello@townhouseworkshop.com.
- Invalidity of one of the provisions of the Privacy Policy
If any one of the terms of this Privacy Policy is invalid in light of an applicable law or definitive judicial decision, it will be considered as unwritten, and will have no effect on the validity of the other Privacy Policy terms.