OUR PRIVACY POLICY

Preamble

The company CALEBASSE is a simplified joint-stock company with a share capital of 10,000 euros, having its registered office at 15 rue de la Vistule 75013 in Paris and registered with the Paris Trade and Companies Register under the number 41522831100015.

In line with its values, CALEBASSE attaches great importance to respecting the protection of the Personal Data of its customers and internet users.

Thus, CALEBASSE undertakes to comply with the legislation in force in France and Europe (Regulation 2016/679 of April 27, 2016), to ensure the protection, confidentiality, and security of personal data, as well as to ensure respect for privacy.

This Protection Policy for Personal Data (hereinafter "the Policy") describes how CALEBASSE collects and processes the Personal Data of all individuals affected by the Processing operations it implements.

The Policy also specifies the legal bases on which it relies to process Personal Data, the individuals with whom this data is shared, and their retention periods.

In any case, regardless of the processing carried out, CALEBASSE undertakes to respect the following principles:

The processed Data is used only for explicit, legitimate, and determined purposes in connection with the various services offered by CALEBASSE. It is processed lawfully and fairly;
Only Data that is useful to pursue these purposes is collected;
Each Data Subject affected by the processing is informed in a clear and transparent manner about the purpose of using their Data, the optional or mandatory nature of their responses in forms, and their data protection rights.

Article 1 - Definitions

"Personal Data": Means any information relating to an identified or directly identifiable (for example, by their last name or first name) or indirectly identifiable natural person, in particular by reference to an identifier, location data, prior creations, or to one or more specific elements specific to their physical, physiological, genetic, psychic, economic, cultural, or social identity;

"Health Data": Means any information relating to the physical or mental health status of an individual, in particular the data mentioned in therapists' prescriptions transmitted to CALEBASSE by the Data Subjects;

"Processing": Means any operation or set of operations applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

"Data Subject": Means any identified or identifiable natural person whose personal data is processed by CALEBASSE in accordance with this Policy;

"Data Controller": Means any natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of Personal Data. This refers to the company CALEBASSE;

"Processor": Means any natural or legal person who processes Personal Data on behalf of the Data Controller;

"Site": Means the website accessible at the following URL address and published by CALEBASSE: https://calebasse.com/ ;

"Cookie": Means trackers that allow access to information stored in the terminal equipment of a visitor to the Site;

"Recipient": Means any natural or legal person who receives communication of personal data, whether a third party or not;

"Third Party": Means any authorized natural or legal person, public authority, agency, or body other than the data subject, data controller, processor, and persons who, under the direct authority of the data controller or processor, are authorized to process personal data.

"Personal Data Breach": Means any breach that accidentally or unlawfully results in the destruction, loss, alteration, unauthorized disclosure of personal data transmitted, stored, or otherwise processed, or unauthorized access to such data.

Article 2 – Source and categories of data likely to be processed

2.1. When a Data Subject browses and uses the features of the Site or creates a personal account on the Site, the following information is likely to be collected:

Identification data as well as contact details (email address) through the collection forms present on the Site;
Connection and audience measurement data during browsing on the Site through Cookies and trackers;
Data relating to the individual's terminal when connecting to the Site. This data may include the device applications used by the Data Subject to browse and use the Site, the browser version (or type), the plug-ins used, or the operating system.

2.2. When a Data Subject contacts CALEBASSE to order a product offered for sale on the Site, the following Personal Data is likely to be collected:

Identification data (last name, first name, marital status, etc.);
Contact details (email address, postal address, phone number, etc.);
Banking and financial data (bank details, billing address);
Data relating to order follow-up (order number, products ordered, promotional code, order history, claims, etc.)

2.3. When a Data Subject contacts CALEBASSE to request a quote or information:

Identification data (last name, first name, marital status, etc.);
Contact details (email address, postal address, phone number, etc.);
Health Data if the data subject spontaneously transmits information about their health status or various prescriptions from therapists to CALEBASSE to place an order or obtain a quote.

It is understood that CALEBASSE never requests the transmission of Health Data to respond to the various requests of the Data Subjects.

Article 3 – Legal bases for processing

In compliance with the regulations in force and its values, CALEBASSE collects and processes Personal Data only under the following conditions:

When the Data Subject gives their free, specific, and informed consent regarding the processing of their Data;
When it is necessary for the execution of a contract or within the framework of commercial relationships;
When it is necessary for compliance with legal or regulatory obligations, for example regarding payroll management, anti-fraud, and anti-corruption;
When the legitimate interests of CALEBASSE justify the processing of the Personal Data of the Data Subject.

Article 4 – Purposes of processing

The Personal Data collected from the Data Subject and processed by CALEBASSE is done so for specific, explicit, and legitimate purposes and is subject to variation depending on the context of the collection, namely for the following purposes:

Provision and improvement of the content present on the Site;
Creation of a personal account on the Site;
Development of statistics, in particular relating to Site traffic;
Development and management of communication and prospecting operations, regardless of the means used;
Management of requests for information or quotes sent via the Site or by email;
Follow-up and management of orders placed with CALEBASSE and follow-up of the contractual relationship.

Depending on the circumstances, CALEBASSE may also be required to use the Personal Data of Data Subjects for purposes imposed by the regulations in force.

In any case, the Data is directly collected from the Data Subjects affected by the Data processing.

When placing an order, certain data is mandatory, in particular to allow contractual execution as well as the delivery of the various products.

In the event of non-provision of this data, it is understood that CALEBASSE will not be able to execute the contract or respond to the request of the Data Subject.

Article 5 – Data retention period

CALEBASSE retains Personal Data only for the duration strictly necessary to achieve the purposes of the processing.

The Data of the Data Subject is likely to be kept for a longer duration only upon express authorization from the latter.

The retention period of Personal Data varies according to the purposes for which it is collected and processed:

Purposes	Collected Data	Legal Basis	Retention Period
Analysis of User interactions with the Site – Development of statistics	IP address, pages viewed, connection data	Consent	The identification data of the data subject is kept, when it results from the use of cookies, for a maximum duration of 12 months.
Development and management of communication and prospecting operations, regardless of the means used	Identification data and contact details	Consent	Up to 3 years from the last contact with the data subject/prospect.
Management of prospects via the form and/or by email and/or quote requests	Identification data, contact details, and potential health data.	Pre-contractual measures	Up to 3 years from the last contact with the data subject/prospect.
Management of contracts and the relationship with CALEBASSE	Identification, contact, and banking details, as well as potential health data.	Contract	Duration linked to that of the contract (if a contract is concluded), and during the applicable prescription periods.
Retention of accounting data	Banking data	Legal obligation	Duration of ten (10) years from the closing of the financial year.

Article 6 – Data recipients

Only persons who need to know the Personal Data in the context of their missions have access to it. These are:

Partners and Processors of CALEBASSE, including in particular IT, accounting, and financial partners;
Authorized employees of CALEBASSE;
Administrative and judicial authorities to satisfy legal and regulatory obligations.

Article 7 – Data transfers outside the European Union

In principle, no data transfer outside the European Union is carried out by the company CALEBASSE.

If a transfer of Personal Data were to involve a transfer outside the European Union, the Data Subject would be informed, and these transfers would be carried out in return for appropriate guarantees regarding data confidentiality and security, in compliance with the applicable regulations, and would not concern the Health Data of the Data Subjects.

Article 8 – Rights of the data subject

In accordance with the regulations in force, the Data Subject has a right to object and a right to restriction of the processing of Personal Data concerning them, as well as a right of access, rectification, portability, erasure of their Personal Data, and the right to provide directives relating to the fate of their Data after their death.

When the processing is based on consent, the Data Subject may withdraw their consent at any time.

In any event, the Data Subject can exercise their rights by sending their request to the following email address: contact@calebasse.fr or by post to the following address: CALEBASSE – 15 rue de la Vistule 75013 Paris.

CALEBASSE undertakes to respond to any request as soon as possible, and in any case within a period of one (1) month from receipt of the complete request.

In accordance with regulations, the response period may nevertheless be extended by two (2) months given the complexity and number of requests to exercise rights submitted to CALEBASSE.

In order to remove any doubt concerning the identity of the person exercising their right, they may be requested to include a copy of their identity document with their request.

It is understood that CALEBASSE will proceed with this request to transmit a copy of an identity document exclusively in cases where there is reasonable doubt as to the identity of the data subject and there are no other possibilities to proceed with verification.

Right to information

CALEBASSE undertakes to inform the Data Subject of the collection and use of Personal Data concerning them and thus undertakes to produce concise, transparent, and accessible information on the conditions and modalities of the collection and processing of Personal Data.

Right of access

The Data Subject has a right of access allowing them to obtain information on the existence of a Processing operation and its modalities.
They also have the right to obtain a copy of the Personal Data, by making a request to CALEBASSE following the contact methods defined above.

Right to rectification

The Data Subject may also request CALEBASSE to proceed with the rectification of their Personal Data, in particular when it is no longer up to date. This rectification can also be carried out via the personal account of the data subject accessible through the Site.

Right to object

The Data Subject has the right to object at any time, for reasons relating to their particular situation, to the processing of Personal Data concerning them.
The right to object is in particular limited by the legitimate interest of CALEBASSE to process the personal data.

In any event, the Data Subject has the right not to be subject to a decision based exclusively on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way.

Right to data erasure (or "right to be forgotten")

Subject to the regulations in force, and in particular the exceptions (for example, regarding retention necessary for compliance with a legal obligation), the Data Subject can claim the erasure of Personal Data concerning them when:

The Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
They withdraw their consent on which the processing is based and there is no other legal basis for the processing;
They consider that the processing of their Personal Data constitutes unlawful processing;
The Personal Data must be erased under a legal obligation provided for by Union law or the law of the Member State to which the Data Controller is subject, namely France.

In any case, CALEBASSE will be the sole decision-maker on the merits of the requests.

CALEBASSE may, if necessary, object to the request based on a legitimate interest or compelling grounds when the applicable legislation provides for it.

Right to restriction of processing

The Data Subject can obtain from CALEBASSE the restriction of Processing when one of the following elements applies:

When the accuracy of the Personal Data is contested, for a period allowing CALEBASSE to verify the accuracy of the Personal Data;
When the Data Subject objects to the erasure of their Data and requires instead the restriction of its Processing;
When the Data is no longer necessary in relation to the purposes for which it was collected but the Data Subject needs it for the establishment, exercise, or defense of legal claims;
When the Data Subject objects to the processing which would be based on the legitimate interest of CALEBASSE during the verification as to whether the legitimate grounds pursued by CALEBASSE prevail over those of the Data Subject.

Right to Data portability

The Data Subject can obtain, in certain situations, the Personal Data previously provided to CALEBASSE in a structured, commonly used, and machine-readable format.

They can also transmit this Data to another data controller or request that the Personal Data concerning them be directly transmitted by CALEBASSE to another data controller, if technically possible.

Right to withdraw consent

The Data Subject can, using the means implemented by CALEBASSE, withdraw their consent at any time when the Data is processed on the basis of it.

The withdrawal of consent carried out by the Data Subject applies only to the future and therefore cannot call into question the lawfulness of the processing carried out before this withdrawal.

Right to lodge a complaint with a supervisory authority

If the Data Subject considers that their rights are not respected, they benefit from the option to lodge a complaint with a supervisory authority, such as the Commission Nationale Informatique et Libertés (CNIL) in France.

Right to decide on the fate of your Data after your death

The Data Subject also has the right to organize the fate of their post-mortem Data by adopting general or specific directives.

In order to better understand their rights, the Data Subject is invited by CALEBASSE to consult the CNIL website, accessible at the following URL address: www.cnil.fr/fr/comprendre-vos-droits

Article 9 – Third-party websites

If the Data Subject uses the links present on the Site to consult third-party sites, CALEBASSE recommends that they read the data protection policies of the sites they consult as well as their policies relating to cookies and trackers.

CALEBASSE cannot be held responsible for the collection or processing of Personal Data carried out by third-party websites.

Article 10 – Security

CALEBASSE implements all necessary technical and organizational measures, given the nature, scope, and context of the collection and processing of Data, to ensure the security of the Personal Data of the Data Subject and in particular to avoid any risk of loss, destruction, disclosure, intrusion, or unauthorized access to the Personal Data concerning them.

As such, in order to perfectly secure the Data relating to Data Subjects, CALEBASSE has selected its Processors and in particular its ISO 27001 certified host.

When it uses a provider or processor, CALEBASSE communicates Personal Data to them only after having imposed compliance with these security principles.

Article 11 – Modification of the policy

CALEBASSE reserves the right to make any changes and corrections to this Policy and will notify the Data Subject of any modification made, for example by inserting a banner on the Site.

In the event of a minor modification to this Policy, CALEBASSE will inform the Data Subject through a text message on the home page of the Site.

In the event that the modifications made are substantial, the Data Subject will receive an email to inform them and to obtain their informed consent.

In any event, the Data Subject is invited to regularly consult this Privacy Policy to be fully informed of how CALEBASSE processes their Personal Data.