PERSONAL DATA PROTECTION POLICY

Version in force on 04/02/2021

1. Purpose

Personal data is information that may allow, directly or indirectly, the identification of a natural person. This includes, for example, surnames, first names, email addresses, telephone numbers, user names, IP addresses, cookies, etc.

This Personal Data Protection Policy applies to personal data collected by Gattefossé directly from users (the “Users”) of the website www.gattefosse.com (the “Website”).

In its capacity as data controller, Gattefossé undertakes to collect, process and store the personal data of Users in complete confidentiality and in accordance with the provisions of this Policy.

By accessing the Website, the User acknowledges having read and accepted, without reservation, the terms of this Personal Data Protection Policy.

2. Purposes of processing

Gattefossé collects the personal data that Users agree to provide. Data is collected and processed for the following purposes:

• Contact form
  • Management, processing and response to Users’ enquiries and requests for information and/or samples;
  • Management and processing of requests for information, access, rectification, deletion or portability of personal data or requests to oppose or restrict data processing.
• Cookies
  • Facilitation of browsing on the Website;
  • Sharing of videos, animated and interactive content;
  • Statistics (analysis of traffic on the Website for example);
  • Analyses to develop and improve browsing on the Website and/or the content of the Website.
• Registration form for the Members’ Section of the Website
  • Validation and management of access to the Members’ Section of the Website;
  • Commercial prospecting;
  • Management and processing of requests for information, access, rectification, deletion or portability of personal data or requests to oppose or restrict data processing.

• Request form for samples in the Website’s Members’ Section
  • Management, processing and response to Users’ enquiries and requests for information and/or samples.

The User is hereby informed of the purpose of processing prior to any collection of personal data and has the opportunity to oppose it.

3. Duration of storage

In accordance with legal requirements, the personal data of Users collected on the Website will be stored by Gattefossé only for the time required to fulfil the intended purpose, namely:

• Contact form: time required to process the enquiry or request plus two (2) years
• Cookies:  two (2) years
• Registration form for the Website’s Members’ Section: period of validity of access to the section plus two (2) years
• Request form for samples in the Website’s Members’ Section: time required to process the request plus (2) years

The personal data collected will be deleted:

• At the end of the term stipulated above; or
• At the User’s request, in accordance with the applicable regulations and the procedures provided for in Article 7 below (subject to any legal retention obligation).

 

4. Transmission

Should it prove necessary, personal data collected on the Website may be communicated to other Gattefossé Group entities worldwide. The latter must comply with the processing purposes defined for this data.

This data may not be sent to third parties for commercial and/or promotional purposes without the User’s prior consent.

On the other hand, this data may be sent to certain service providers/technical subcontractors of Gattefossé (hosting company or audience analysis service in particular) bound to the confidentiality and security of this data and exclusively for the purposes described in Article 2 above.

In the event that the data is transferred to a country that is not a member of the European Union and is not subject to an Adequacy Decision, Gattefossé will take all necessary measures to ensure that the data is protected with an appropriate level of confidentiality and security.

Gattefossé may be required to send the data to the competent administrative or judicial authorities, at their request.

5. Confidentiality and security

Gattefossé undertakes to set up all necessary technical and organisational measures to preserve the confidentiality and security of the personal data collected on the Website.

However, Gattefossé cannot be held liable for a security failure attributable to the User.

6. Cookies

When browsing the Website, cookies may be placed on the User’s device (computer, tablet, smartphone). A cookie is a small computer file deposited on the User’s device through their internet browser that allows certain data to be stored in order to facilitate browsing on a website and enable certain functionalities.

The User is informed of the use of cookies by a banner that appears when connecting to the Website. The User may choose to authorise or prohibit all or some of the cookies by clicking on the “Customise” button on the banner.

The disabling of certain cookies may alter the operation of the Website. The User is informed of this when personalising cookies. In the event that the User decides to prohibit a cookie necessary for the optimal operation of the Website, Gattefossé cannot under any circumstances be held liable for the consequences relating to the altered or impaired running of the Website.

Cookies can be deposited by Gattefossé partners (such as Google Analytics for example). These partners may also use the information contained in cookies.

The User is entitled to withdraw their consent and/or their choice to personalise cookies at any time.

Information on the User’s consent and choice of personalising cookies will be retained by Gattefossé for thirteen (13) months.

7. User Rights

In accordance with the provisions of Law no. 7817 of 6 January 1978 on Technology, Files and Civil Liberties (known as “Loi Informatique & Libertés”) and European Regulation 2016/679 of 27 April 2016 (General Data Protection Regulation), the User has the following rights with regard to their personal data:

• Right to information;
• Rights of access and rectification;
• Right of deletion;
• Right to oppose processing for legitimate reasons;
• Right to oppose, without reason, the processing of data for marketing purposes;
• Right to personal data portability;
• Right to restrict processing.

These rights may be exercised at any time by the User by sending an email to: dataprotection@gattefosse.com, provided that proof of identity is attached.

In the event of an unsatisfactory response from Gattefossé in exercising the rights mentioned below, the User may lodge a complaint with the French National Commission for Data Protection and Liberties (“CNIL”).

8. Amendments

This Personal Data Protection Policy may be updated at any time by Gattefossé without any formality other than the online publication of a new amended version, the latter prevailing over any previous version.