## Objective The objective of S3DEL's privacy policy is to: - Provide you with information related to personal data that is processed by our services; - Inform you about your rights and how you can exercise them. This Policy was drafted in compliance with the provisions of the General Data Protection Regulation ("GDPR"), the amended French Data Protection Act of 1978. It may evolve depending on the regulations, case law, and doctrine of supervisory authorities. ## Who is responsible for processing your data? The company S3DEL and its service providers, responsible for processing personal data on the sites, collect information about you, particularly during the creation of your Customer Account or during your purchases. As the person determining the purposes and means of processing, the data controller is the S3DEL company and various service providers such as: - S3DEL RCS of Macon: 793 203 035 Headquarters: 356 rue du Bessey - 71570 La Chapelle de Guinchay Phone numbers: 03 85 38 69 35 E-mail address: contact@s3del.com - M2B INFORMATIQUE RCS of Bourg-En-Bresse: 479 021 990 Headquarters: 19 RTE DE MARCHON - 01100 OYONNAX Phone numbers: 04 74 12 19 40 E-mail address: contact@m2b.fr ## What type of data do we collect? We collect data necessary to achieve a specific purpose. The data we collect may have as legal basis: - Your consent (Article 6.1.a of the GDPR), which can be withdrawn at any time; - The execution of our contractual relationship or pre-contractual measures (Article 6.1.b of the GDPR); - Compliance with a legal obligation to which we are subject (Article 6.1.c of the GDPR); - Legitimate interest pursued by the data controller (Article 6.1.f of the GDPR), respecting your interests and rights. The following table presents the information to be provided when the data is collected from the concerned person (Article 12 of the GDPR).

Types of processing	Data concerned by the processing	Purposes of processing	Legal bases for processing	Recipients
Commercial and marketing prospecting actions	Identity, Contact details, Exchanges related to project implementation, Statistics	The processing aims to enable prospecting operations, including: - Production of statistics - Site improvement - Development of commercial strategy - Satisfaction survey	Consent Legitimate interest, namely informing and promoting similar products and services and rewarding our best customers	Internally: the communication and marketing departments Externally, our IT service providers
Customer management	Identification data	The processing aims to enable prospecting operations, including: - Management of contractual relationship - Production of statistics - Carrying out satisfaction and customer surveys - Management of complaints, after-sales service, and warranties	Consent Execution of a contract Compliance with a legal obligation	Internally: the departments responsible for processing your request
Purchase management	Identification data, Payment data, Transaction data	The processing aims to enable prospecting operations, including: - Management of contractual relationship - Management of complaints, after-sales service, and warranties - Management of accounting - Improvement of offers	Execution of the contract Compliance with a legal obligation	Internally: the department in charge of commercial management
Management of individual rights	Identification data	The processing aims to ensure the management of your rights as covered by the GDPR and the Data Protection Act	Compliance with a legal obligation	Internally, the DPO and those authorized to ensure the management of your rights. Externally, certain regulated professions (lawyers), our providers and subcontractors
Management of unpaid debts and disputes	Identification data, Payment data, Transaction data,	The processing aims to: - Management of contractual relationship - Management of accounting - Management of data controller's rights	Execution of the contract Compliance with a legal obligation Legitimate interest, namely debt recovery	Internally: the accounting department. Externally: authorized service providers, including regulated professions (lawyers, auditors), our providers and subcontractors
Fraud management	Identification data, Payment data, Transaction data, Navigation and connection data.	The processing aims to: - Prevention and fight against illegal or unauthorized activities by the terms of use - Listing of proven unpaid debts - Identification of persons in a situation of unpaid debts in order to exclude them from future transactions	Compliance with a legal obligation Legitimate interest of the site	Internally: Our accounting department Externally: financial, judicial, or state agencies, public bodies upon request and within the limits of what is permitted and justified by the regulations, our providers and subcontractors
Management of promotional operations	Identification data	The processing aims to: - Selecting suppliers - Develop our commercial strategy - Production of statistics	Consent	Internally: the commercial management department. Externally: authorized providers capable of processing the data you provide us and allowing us to offer you the proposed services
Online browsing (cookies)	Navigation data, Duration of your visit, Technical information (IP address, browser used, etc.)	The processing aims to: \- Ensure the maintenance of the site and its features \- improving the site's interactivity (services offered by third-party websites, such as sharing buttons). \- Disseminating appropriate content depending on the device used.	Consent Legitimate interest, namely the operation of the site for functional cookies	Internally: the communication services. Externally, our providers and subcontractors

## Who are the recipients? In addition to the recipients mentioned above, and in order to achieve the aforementioned purposes, we disclose your personal data only to: - The company S3DEL, which needs to know them to ensure their management - Service providers and subcontractors carrying out services on our behalf; they are carefully selected and act in accordance with our instructions, including: logistics and transport providers, payment service providers, banks, etc. - Financial, judicial or state agencies, public bodies upon request and within the limits permitted by the regulations - Credit assessment and collection agencies in the context of creditworthiness assessment or debt collection in case of unpaid invoices - Certain regulated professions such as lawyers, notaries, auditors. ## What are the retention periods? ### General rules S3DEL retains personal data for a period that does not exceed the length necessary for the purposes for which they are collected, in accordance with the provisions of the amended French Data Protection Act of January 6, 1978 and the GDPR. Data may be retained afterward in the following cases when conservation is necessary: - For the exercise of the right to freedom of expression and information, - To comply with a legal obligation, - For the performance of a public interest mission or exercise of public authority with which the data controller is invested, - For reasons of public interest in the field of public health, - For archiving purposes in the public interest, - For scientific, historical, or statistical research purposes, - Or for the establishment, exercise, or defense of legal rights. The criteria for determining retention periods are as follows: - Legal or regulatory provisions - The doctrine and case law of supervisory authorities - Sectoral references ### Specific rules **Bank cards** are only saved after an explicit request from the client, on the payment page (if this option is available to you). They are kept for a future order to improve your shopping experience on our websites. The cards saved for a future purchase are stored in a secure area at our payment provider ([STRIPE](https://stripe.com/fr)). S3DEL does not store this information. You have the option to delete your saved card at any time, on the payment page. **Cookies** have a limited lifespan of thirteen months after their initial deposit in the user's terminal equipment (following the expression of consent), as recommended by the CNIL. You can change your preferences at any time via the cookie manager whose link is present at the bottom of our website pages. To learn more about cookies and how we commit to using them, please visit [this page](/cookies). **Commercial management** : Your data is stored for the duration of the contractual relationship and according to the prescription periods for storage or protection of the rights of the data controller. **Commercial operations management** : The data is kept until the withdrawal of consent or 3 years from the last contact. They can also be stored: - For a duration of 3 years from the last contact that the people they relate to had with our company; - After the execution of the contract, in intermediate archiving, to comply with accounting or tax obligations or to provide evidence in case of litigation and within the applicable limitation period. The customer account data, created by the user, is intended to be stored until the account is deleted by the user. However, the account may be considered inactive due to no usage for 2 years and could be subject to deletion. **People's rights management** : When a person exercises their right to object to receiving prospecting, in order to guarantee its effectiveness, the information allowing for this right to be taken into account is kept for a minimum of 3 years from the exercise of the right. **Unpaid bills management** : In cases of unpaid bills, the data is removed from the file listing people in unpaid situations no later than 48 hours after the unpaid amount has been effectively settled. Exceptionally, and when necessary and proportionate circumstances justify it, the data can be stored to prevent renewal. In the event of non-regulation, the information may be kept in the file listing individuals for up to 3 years from the occurrence of the unpaid amount. They can then be archived to meet accounting and tax obligations or serve as evidence in case of litigation within the applicable statute of limitations. **Supporting documents sent to Customer Relations** : The processing related to the request for supporting documents aims at combating fraud and unpaid amounts. The data is stored for 30 days from the month following their receipt and 24 months from the date of the transaction in case of dispute. Supporting documents containing copies of bank cards are immediately deleted. ## Who has access to personal data? Internally, some employees may have access to the data necessary for their job functions. Our various partners and service providers may have access to the data for the execution of their contract, in accordance with the purposes outlined above and regulations. The different categories of recipients are: - Carriers, - Banks, payment service providers, and credit institutions, - IT providers, hosting and telephony services, - Providers in charge of combating fraud and recovering unpaid bills, - "Authorized third parties" (public authorities or judicial auxiliaries) are organizations that can access certain data contained in public and private files, based on a text authorizing them, for example, the tax administration, administrations of justice, police and gendarmerie, bailiffs. The data can be transmitted in the context of business operations (mergers, acquisitions, disposals, restructurings, etc.). ## Do we transfer data abroad? Your data is not transferred to third countries and remains hosted within the European Union. ## Security The data controller implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, taking into account the state of knowledge, implementation costs, and the nature, scope, context, and purposes of the processing as well as the risks, which vary in likelihood and severity, for the rights and freedoms of individuals. When assessing the appropriate level of security, particular consideration is given to the risks presented by the processing, particularly those arising from the destruction, loss, alteration, unauthorized disclosure of personal data transmitted, stored, or otherwise processed, or unauthorized access to such data, whether accidental or unlawful. ## People's rights / your rights The concerned individuals have the following rights, which they exercise under the conditions provided by the GDPR: - Right to object, to withdraw their consent at any time. When the processing of your personal data is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent carried out before the withdrawal of consent. - Right of access to personal data concerning you (Article 15 of the GDPR) - Right to rectify data concerning them if it is inaccurate (Article 16 of the GDPR) - Right to erasure of data concerning them, subject to the conditions for exercising this right in accordance with the provisions of Article 17 of the GDPR - Right to restrict processing (Article 18 of the GDPR) - Right to data portability (Article 20 of the GDPR) - Right to object (Article 21 of the GDPR) - Right to define directives regarding the fate of your personal data (storage, deletion, and communication of data) after your death (Article 85 of the amended Data Protection Act) - Right to lodge a complaint with a supervisory authority (Article 104.4 of the amended Data Protection Act) - Automated decision-making. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. The data subject has the right to obtain human intervention on the part of the data controller, to express their point of view and to contest the decision. Please visit [cnil.fr](https://www.cnil.fr/) for more information on your rights. These rights can be exercised directly with the data controller. ## Exercising your rights To exercise these rights or for any questions about the processing of your personal data, we invite you to contact us: - Head office address: 356 rue du Bessey - 71570 La Chapelle de Guinchay - Phone number: 03 85 38 69 35 - Email address: contact@s3del.com ## Complaint If you believe, after contacting us, that your "Data Protection and Freedom of Information" rights are not respected, you may lodge a complaint with a supervisory authority. The French supervisory authority is the [Commission Nationale de l'Informatique et des Libertés (CNIL)](https://www.cnil.fr/). *Date of last update: 06/01/2023*

Request for password resets