Privacy Policy.
1 – Parties to this instrument
Between the undersigned: 1° K-EYES, a simplified joint-stock company with share capital of 22,812.62 euros, registered with the Fréjus Trade and Companies Register under number 979923240, whose registered office is located at Rue du Liège, ZI Les Ferrières, 83490 Le Muy, FRANCE, and whose VAT number is FR44979923240. Hereinafter referred to as the “Data Controller”, on the one hand, and 2° Any natural person browsing the Data Controller's website; hereinafter referred to as the “Data Subject”, on the other hand, the following has been stated and agreed:
2 – Purpose
This Privacy Policy applies, without restriction or reservation, between the Data Subject and the Data Controller. Its purpose is to provide information about how the Data Controller collects and processes certain personal data relating to the Data Subject, in accordance with applicable legislation and, in particular, European Regulation No. 2016/679 and Law No. 78-17 (hereinafter referred to as the “Legislation”), in connection with the Data Subject's use of the website www.k-eyes.com (hereinafter referred to as the “Website”). This Privacy Policy forms an integral part of the Data Controller's General Terms and Conditions of Sale.
3 – Definitions
Supervisory Authority means the Commission nationale de l'informatique et des libertés (CNIL), the independent French public authority responsible for regulating Data protection;
Consent means any freely given, specific, informed, and unambiguous indication of the Data Subject's wishes by which they agree, through a statement or by a clear affirmative action, to the processing of Data relating to them by the Data Controller.
Cookie means a file used to track the Data Subject's activity on the Website.
Recipient means any natural or legal person, public authority, service, or other body that receives communication of the Data, whether or not it is a Third Party. However, public authorities that may receive communication of the Data, particularly in the context of an investigation, are not considered Recipients within the meaning of this definition.
Data means any information relating to the Data Subject.
File means any structured set of Data accessible according to specific criteria, whether this set is centralized, decentralized, or functionally or geographically distributed.
Legislation means any law or regulation relating to the protection of Data, in particular European Regulation No. 2016/679 and Law No. 78-17.
Browsing means the consultation, review, ordering and/or purchasing of Products on the Site by the Data Subject.
Data Subject means any natural person who browses the Site, provided that they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more specific elements relating to their physical, physiological, genetic, psychological, economic, cultural or social identity.
Products means the products offered for sale on the Site by the Controller to the Data Subject.
Pseudonymization means the processing of Data in such a manner that the Data can no longer be attributed to the Data Subject without the use of additional information.
Controller means the simplified joint-stock company K-EYES, with share capital of €22,812.62, registered with the Paris Trade and Companies Register under number 821 239 878, whose registered office is located at Rue du Liège, ZI Les Ferrières, 83490 Le Muy, FRANCE, and whose VAT number is FR59821239878, which, alone or jointly with others, determines the purposes and means of the Processing.
Site means the infrastructure developed by the Controller in computer formats usable on the Internet, comprising data of various kinds, including text, sound, still or moving images, videos and databases, intended to be accessed by the Data Subject to learn about, reserve, order and/or purchase Products (www.k-eyes.com).
Processor means any natural or legal person, public authority, department or other body, other than the Controller, that processes the Data on behalf of the Controller.
Third Party means any natural or legal person, public authority, department or other body, other than the Controller, the Processor and persons who, under the direct authority of the Controller or the Processor, are authorized to process the Data, including tour operators, travel agencies and reservation systems.
Processing means any operation or set of operations performed or not using automated processes and applied to Data or sets of Data, such as restriction, erasure, or destruction.
4 – Principles relating to processing
In accordance with the Legislation, the Data Controller undertakes to comply with the following principles for each Processing operation:
Lawfulness;
Fairness;
Transparency;
Purpose limitation; Data minimization; Accuracy;
Storage limitation; Integrity;
Confidentiality; Liability.
5 – Data processed
As part of Browsing, the Data Controller may collect and process a certain amount of Data, including:
Personal information (last name, first name, gender, postal address, email address, telephone number, date of birth, age, registration and unsubscribe dates for the customer account and the Data Controller’s newsletter, messages exchanged with the Data Controller and its customer service department).
Banking information (payment method, credit card number).
Information about your order (products ordered, delivery address, delivery tracking number, order price).
Technical information (browsing behavior on the Website, IP address, products added to the cart, consent collection).
6 – Processing context
The Data may be collected and processed by the Data Controller on various occasions, including:
Purchase of Products on the Website
Contact with the Data Controller Registration for the newsletter
Creation of a referral link
Creation of a customer account
Browsing the Website.
7 – Processing details
|
Purpose of the Processing |
Data concerned |
Legal basis for the Processing |
Data retention period |
|
Management of product purchases and deliveries |
First name, last name, email address, postal address, telephone number, delivery address, order placed, delivery tracking number, registration and unsubscribe dates, payment method, payment method, credit card number |
Contract, legal obligation, and the Data Controller’s legitimate interest in establishing, exercising, and defending its rights in legal proceedings |
10 years from the purchase of the Product EXCEPT 15 months from the purchase of the product for banking data (immediately for the visual cryptogram) |
|
Creation and management of customer accounts |
First name, last name, email address, postal address, telephone number, date the customer account was created, date the customer account was deleted, consent collection |
Consent of the Data Subject, the Data Controller’s legitimate interest in creating a customer account following the purchase of a product by the Data Subject |
3 years from the Data Subject's last login to their customer account OR immediately upon deletion of their customer account |
|
Management of commercial relations and prospecting |
First name, last name, email address, postal address, telephone number, purchase history, consent collection |
Consent of the Data Subject, the Data Controller's legitimate interest in promoting its Products |
3 years from the last contact by the Data Subject or from the end of the commercial relationship |
|
Newsletter management |
Email address, last name, first name, telephone number, consent collection |
Consent of the Data Subject |
Upon unsubscribing |
|
Site security and improvement |
IP address, Browsing Data |
The Data Controller's legitimate interest in improving and managing the Site, securing and administering the Site, and preventing fraud and malicious acts. |
13 months |
|
Complaint management Site statistics and personalized advertising |
First name, last name, email address, postal address, telephone number, IP address, Browsing Data, consent collection |
Consent of the Data Subject and its Products and customer service. |
3 years from the last consent |
|
Referral |
Email address, first and last name, consent collection |
Consent of the Data Subject |
3 years after the referral link request |
The Data Controller reserves the right to anonymize the Data subject to Processing before deleting it. The anonymized data may then be Processed for statistical purposes.
8 – Data recipients
As a general principle, the Data Controller is the sole Recipient of the Data. However, the Data Controller may need to transfer the Data to Recipients, particularly in connection with the management of purchases of Products by the Data Subject, and/or to any public authority that requests it, particularly as part of an investigation. The following Recipients may process your data as Processors on behalf of the Data Controller:
FACEBOOK FRANCE SARLU with share capital of €4,950,000, RCS Paris 630 085 802 Registered office: 6 rue Menars, 75002 Paris
GOOGLE FRANCE SARLU with share capital of €7,500, RCS Paris 443 061 841 Registered office: 8 rue de Londres, 75009 Paris
CRITEO SA with share capital of €1,677,273, RCS Paris 484 786 249 Registered office: 32 rue Blanche, 75009 Paris
OUTBRAIN UK LIMITED Foreign company registered with the RCS RCS Paris 534 895 727
AWIN SAS SASU with share capital of €58,050, RCS Paris 432 845 964 Registered office: 8 rue Saint Fiacre, 75002 Paris
TWITTER FRANCE SAS SASU with capital of €37 000, RCS Paris 789 305 596 Registered office: 10 rue de la Paix, 75002 Paris
DIDUENJOY SAS with capital of €1 000, RCS Paris 801 901 273 Registered office: 42 rue Jean Baptiste Pigalle, 75009 Paris
DATABILITY SOLUTIONS PVT LTD Company incorporated in the USA. Registered office: 2035 Sunset Lake Road Suite B2, Newark, New Jersey 19702 USA
TRADEDOUBLER SARLU with capital of €7 622,45, RCS Nanterre 431 573 716 Registered office: 8 rue Barthélémy d’Anjou, 92100 Boulogne Billancourt
SHIPUP SAS with capital of €1 258, RCS Nanterre 822 856 068 Registered office: 47 rue Marcel Dassault, 92100 Boulogne Billancourt
ALPHA DIRECT SERVICES SASU with capital of €22 912 625, RCS Beauvais 533 296 240 Registered office: rue Hyppolite Bayard, 60000 Beauvais
LA POSTE SA with capital of €3 800 000 000, RCS Paris 356 000 000 Registered office: 9 rue du Colonel Pierra Avia, 75015 Paris
UPS UNITED PARCEL SERVICE FRANCE SAS with capital of €57 069 000,00 R.C.S. Paris 334 175 221 Registered office: 20 RUE ESCOFFIER 75012 Paris
ANAFORE PTE LTD. Private limited company 10 Anson Road, #26-04, International Plaza, Singapore 07990, SINGAPORE Tel. 65 9179 1176
ZENDESK UK LTD Foreign company not registered with the RCS. Registered office: 30 Eastbourne terrace, London, UK
METAPHORA LLC Foreign company not registered with the RCS. Registered office: 347 Fifth Ave. Suite 1402, New York, NY, 10016
STRIPE FRANCE SARLU with capital of €1 000, RCS Paris 807 572 011 Registered office: 10 Boulevard Haussmann, 75009 Paris
SNAP GROUP SAS SASU with capital of €100, RCS Paris 820 920 056 Registered office: 16 rue de la Rochefoucauld, 75009 Paris
PERFMAKER SAS with capital of €30 000, RCS Paris 833 952 831 Registered office: 24 Boulevard St Denis, 75010 Paris
MONDIAL RELAY SASU with capital of €500 400, RCS Lille 385 218 631 Registered office: 5 Avenue Antoine Pinay, 59510 Hem
CYBOT A/S Danish company DK34624607 Havnegade 39, 1058 Copenhagen, Denmark
KLAVIYO, INC. Company incorporated in the USA: 125 Summer St, Floor 6 Boston, MA 02111 United States
PUSHOWL. Creatorbox Softwares Private Limited, a company incorporated at: #811, 10th A Main, Suite No. 909, 1st Floor, Indiranagar, Bangalore, Karnataka, India, 560038
RECHARGE, INC. Company incorporated in the USA: 3030 Nebraska Avenue, Los Angeles, California, US 90404
SHOPIFY INTERNATIONAL LIMITED. Attn: Data Protection Officer. c/o Intertrust Ireland: 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland
JUDGE.ME Ltd, C/O Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB
USEDROP Creative Bot, Inc., 5224 Cheryl Avenue, Glendale, CA91214.
This list of the data controller's Processors may change at any time. The data controller undertakes to require its Processors to provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the Processing complies with legal and regulatory requirements and ensures the protection of the Data Subject's rights, particularly in the event of a transfer of the Data outside the European Union. Furthermore, the data controller may disclose the Data subject to Processing to any Recipient or Third Party when there is a legal obligation to do so or when the data controller, in good faith, considers this necessary to:
Perform any contract to which the Data Subject is a party Safeguard the vital interests of any natural person The performance of a task carried out in the public interest.
If the data controller is purchased by a Third Party, the data controller reserves the right to share the Data with the purchasing Third Party, subject to that Third Party's compliance with this Privacy Policy.
9 – Rights of the Data Subject regarding the data
The Data Subject has a number of rights regarding the Data that they may exercise, unless an applicable legislative or regulatory exception applies, by submitting a request to the data controller at the following address:
K-EYES - Rue du Liège, ZI Les Ferrières, 83490 Le Muy, FRANCE - contact@k-eyes.com
The data controller will assist the Data Subject in exercising their rights regarding the Data. In the event of reasonable doubt about the identity of the Data Subject making a request to exercise their rights regarding the Data, the data controller may request a copy of an official identity document to support the request. Requests will be processed as soon as possible and no later than within the time limits set by the Legislation.
In the context of direct mail, the person concerned may register with the Robinson List; their details will appear in the file opposing unsolicited advertising by addressed mail. To register with the Robinson List, simply access its official website and register, or contact UFMD directly, Union Française du Marketing Direct – Robinson List Service – 1 rue François Vidal, CS30238, 33506 LIBOURNE CEDEX.
9.1 – Right of access
The data subject has the right to obtain from the data controller confirmation as to whether or not Data are being processed and, where they are, access to said Data and the following information:
The purposes of the Processing.
The categories of Data.
The recipients or categories of recipients to whom the Data have been or will be disclosed, in particular recipients established in third countries or international organizations.
Where possible, the retention period of the Data or, where not possible, the criteria used to determine that period.
The existence of the right to request from the data controller the rectification or erasure of Data, or restriction of Processing of the Data, or the right to object to such Processing. The right to lodge a complaint with a supervisory authority.
Where the Data are not collected from the data subject, any available information regarding their source.
The existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the underlying logic, as well as the significance and envisaged consequences of this Processing for the data subject.
The data controller shall provide a copy of the Data undergoing Processing and reserves the right to charge, in return for providing this copy, reasonable fees based on administrative costs for any additional copy requested by the data subject.
9.2 – Right to erasure and rectification
The data subject has the right to obtain from the data controller the rectification and/or erasure of inaccurate or obsolete Data without undue delay, unless a situation prevents the exercise of this right, in particular:
The exercise of the right to freedom of expression and information.
Compliance with a legal obligation.
The public interest in the areas of public health, archiving, scientific or historical research, or statistics.
The establishment, exercise, or defense of legal claims.
If K-EYES is not the data controller and processor, particularly where it is the advertiser for direct mail, the data subject may register with the Robinson List; their contact details will be included in the file for opting out of advertising solicitation by addressed mail. To register with the Robinson List, simply access its official website and register, or contact UFMD directly: French Union of Direct Marketing – Robinson List Service – 1 rue François Vidal, CS30238, 33506 LIBOURNE CEDEX.
9.3 - Right to object
The Data Subject has the right to object at any time, on grounds relating to their particular situation, to the Processing of Data based on the performance of a task carried out in the public interest or on the necessity of the legitimate interest of the Data Controller.
The Data Controller shall then no longer process the Data, unless they demonstrate that there are compelling legitimate grounds for the Processing which override the interests and rights and freedoms of the Data Subject, or for the establishment, exercise or defense of legal claims. Furthermore, the Data Subject has the right to object at any time to the Processing of Data carried out by the Data Controller for direct marketing purposes, insofar as the Data Subject is related to such marketing.
Finally, where Data are processed for scientific or historical research purposes or statistical purposes, the Data Subject has the right to object, on grounds relating to their particular situation, to the Processing of the Data, unless the Processing is necessary for the performance of a task carried out in the public interest.
9.4 - Right to restriction
The Data Subject has the right to obtain from the Data Controller the restriction of the Processing of the Data where:
The accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Data Controller to verify the accuracy of the Data. The processing is unlawful and the Data Subject objects to their erasure and requests instead the restriction of their use.
The Data Controller no longer needs the Data for the purposes of the Processing, but the Data Subject still needs them for the establishment, exercise or defense of legal claims.
The Data Subject has objected to the Processing in accordance with Article 9.3, pending verification of whether the legitimate grounds pursued by the Data Controller override those of the Data Subject.
The Data Subject who has obtained restriction of the Processing of the Data shall be informed by the Data Controller before the restriction of processing is lifted.
9.5 - Right to data portability
The Data Subject has the right to receive the Data they have provided to the Data Controller in a structured, commonly used and machine-readable format, and has the right to transmit those data to another Data Controller without the Data Controller obstructing this, where:
The Processing is based on the Consent of the Data Subject or on the performance of a contract to which the Data Subject is a party;
The Processing is carried out using automated means.
When exercising their right to data portability, the Data Subject has the right to have the Data transmitted directly from the Data Controller to another data controller, where technically feasible.
9.6 – Right to lodge a complaint with the supervisory authority
The Data Subject has the right to lodge a complaint with the Supervisory Authority if they believe they are subject to unlawful Data Processing by the Data Controller.
9.7 – Right to define directives concerning the fate of data
The Data Subject has the right to define directives concerning the fate of the Data after their death with the Data Controller, who will use all its technical means to enforce this wish.
10 – Data security
The Data Controller takes appropriate technical and organizational measures to protect the Data against destruction, loss, alteration, misuse, and unauthorized access, modification, or disclosure, whether these actions are voluntary or accidental.
These technical and organizational measures are intended to ensure the confidentiality, integrity, availability, and resilience of the Website and the information systems where the Files are stored.
To secure the Data Subject's browsing, the Website is SSL-encrypted (Secure Socket Layer).
11 – Modification of the privacy policy
The Data Controller reserves the right to occasionally modify this Privacy Policy, in particular the list of Recipients set out in Article 8.
In the event of a substantial modification to this Privacy Policy, the Data Subject will be personally informed of the new Privacy Policy.
The Data Subject is invited to regularly consult this Privacy Policy to be informed of any changes to it.
The Data Subject may send questions about this Privacy Policy to the data controller at the following address: contact@k-eyes.com
12 – Nullity of the privacy policy
If any provision of this Privacy Policy were found to be void under an applicable rule of law or a final court decision, it would be deemed unwritten, without rendering the entire Privacy Policy null and void or affecting the validity of its other provisions.
13 – Complaints
If you wish to file a complaint regarding our processing of your personal information, please contact us using the contact details provided below. Depending on your place of residence, you may have the right to challenge our decision by contacting us using the contact details provided below or by filing a complaint with the data protection authority responsible for your region. For the EEA, you will find a list of supervisory authorities responsible for data protection here.
14 – Cookie management
While browsing the Site, the Data Subject is asked to consent to the installation of Cookies on their computer.
In general, Cookies record information about computers’ browsing activity on the Site (the pages visited, the date and time of the visit, etc.), which may be read during the Data Subject’s subsequent visits to the Site, with transmission of the Data to the Data Controller. Installing these Cookies requires the Data Subject’s consent.
Some Cookies are essential for the proper functioning of the Site and do not require the Data Subject’s consent before installation; these are referred to as functional Cookies.
In accordance with Article 7. of this Privacy Policy, Cookies are automatically deleted thirteen (13) months after their installation if the Data Subject does not renew their consent before this period expires.
The Data Subject may refuse to consent to the installation of non-functional Cookies, withdraw their consent and/or configure Cookies at any time using the Data Controller’s Cookie manager below or by configuring their browser themselves as follows:
For Mozilla Firefox:
Select the “Tools” menu, then “Options”
Click the “privacy” icon
Find the “cookie” menu and select the options that suit you
For Microsoft Internet Explorer 6.0:
Select the “Tools” (or “Tools”) menu, then “Internet Options” (or “Internet Options”). Click the “Privacy” (or “Confidentiality”) tab
Select the desired level using the slider.
For Microsoft Internet Explorer 5:
Select the “Tools” (or “Tools”) menu, then “Internet Options” (or “Internet Options”). Click the “Privacy” tab
Customize the level using the slider
For Netscape 6.X and 7. X:
Select the “Edit” > “Preferences” menu, then “Privacy and Security.”
Cookies
For Opera 6.0 and later:
Select the “File” > “Preferences” menu, then “Privacy.”