Privacy policy

Privacy policy

1. Data protection

The General Data Protection Regulation of 27 April 2016 (referred to below as the GDPR) has applied since 25 May 2018. To protect the privacy of customers and prospective customers, it sets out strict requirements for how businesses and retailers process their personal data.

2. The data controller

The "data controller" responsible for your personal data is SARL DAGDA — Citron Safran, which operates the Citron Safran website you are visiting and to which you provide your data.

• 22 Grand rue, 67000 Strasbourg
• Email: contact@citronsafran.com

3. Legal basis for processing and use of your data

We may only use your personal data for purposes that are both legitimate and necessary (Article 6 of the GDPR). These purposes include:

• Processing your orders and fulfilling our contractual obligations;
• Managing your account and our business relationship with you;
• Sending you commercial, promotional or advertising information;
• Communicating with you in connection with the performance of a contract;
• Improving the website's design, layout and overall functionality;
• Analysing data for statistical purposes.

4. What is personal data?

Personal data means any information relating to you that can be used to identify you. Your personal data may include:

• Identity details (surname, first name, address, VAT number, etc.);
• Personal contact details (telephone number, personal email address, etc.);
• Financial and transaction data (payment method, bank account number, billing details, etc.);
• Information relating to the performance of a contract (billing address, professional details, etc.);
• Data relating to the use of electronic equipment (password, log data, electronic identification data, etc.).

Sensitive data: Processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, as well as genetic and biometric data, is strictly prohibited. We undertake to comply strictly with this prohibition.

5. Where does your personal data come from?

We generally collect your data directly from you when you complete a form. If you choose not to provide mandatory or necessary information, you may lose access to certain benefits and/or we may decide to stop providing our services to you.

6. Access to data — who do we share your information with?

In accordance with applicable regulations, data may be disclosed to the competent authorities upon request, including public bodies, solely to meet legal obligations.

Your data is primarily used internally. We may share it with third-party companies to fulfil a contract (technical services, payment services, deliveries, direct marketing communications, etc.). We share only the data they need to provide their services.

7. How long do we keep your data?

We take the necessary steps to ensure that personal data kept for the purposes described above is not retained beyond the periods permitted by law.

8. What are your rights?

Under applicable data protection laws and regulations, you have the following rights:

• Right of access (Article 15 of the GDPR): You have the right to be informed about how your data is processed and to obtain a copy of it.
• Right to rectification (Article 16 of the GDPR): You have the right to have inaccurate data about you corrected.
• Right to erasure, or the right to be forgotten (Article 17 of the GDPR): You may request the deletion of your personal data in the circumstances provided for by law.
• Right to restriction of processing (Article 18 of the GDPR).
• Right to data portability (Article 20 of the GDPR): You have the right to receive your data in a structured, machine-readable format.
• Right to withdraw consent at any time (Article 7 of the GDPR).
• Right to lodge a complaint (Article 77 of the GDPR): You may lodge a complaint with the CNIL, the French data protection authority, if you believe that the processing of your data infringes the GDPR.

9. Our commitment

We aim to implement security measures to protect stored data against unauthorised access, improper use, alteration, unlawful or accidental destruction, and accidental loss.

10. Data breach procedure

If a breach poses a high risk to an individual's rights and freedoms, we will immediately inform them of what has happened and the measures taken. We will ensure that the breach is reported to the CNIL within 72 hours of becoming aware of it (Articles 32–34 of the GDPR).

11. Consent

You give your express, informed and unambiguous consent to the processing of your personal data as described in this privacy policy. You have the right to withdraw your consent at any time by making a written request.

12. Changes to our privacy policy

We may occasionally amend this privacy policy, in particular to reflect changes in regulations, case law, editorial content or technology.

13. Contact

If you have any questions about this privacy policy or wish to make a request concerning your data, you can contact us:

• By email: contact@citronsafran.com
• By post: Citron Safran — SARL DAGDA — 22 Grand rue, 67000 Strasbourg