Privacy Policy

The purpose of this privacy policy is to help you understand how your personal data is collected, processed and stored by CROSS SPIRIT via the Site.

CROSS SPIRIT understands that data protection and privacy is an issue for all users visiting the Site.

CROSS SPIRIT is committed, in accordance with the RGPD regulations, to respecting your privacy and protecting your personal data, i.e. data likely to identify you directly or indirectly as a person.

The purpose of this privacy policy is to present CROSS SPIRIT’s commitments in this regard.

Definition

When you use our Site, we may ask you to provide us with personal data about yourself.

The term “personal data” refers to all data that can be used to identify an individual, including your surname, first names, pseudonym, photograph, postal and e-mail addresses, job title, telephone numbers, date of birth, data relating to your transactions on the Site, details of your purchases, credit card numbers, SIRET, VAT registration number, IP address, and any other information you may choose to give us about yourself.

Purpose

The purpose of this charter (hereinafter the “Charter”) is to inform you of the means we use to collect your personal data, in strict compliance with your rights.

In this regard, we inform you that we comply, in the collection and management of your personal data, with Law No. 78-17 of January 6, 1978 relating to information technology, fichiers and freedoms, in its current version (hereinafter: the “Data Protection Act”), as well as Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: the “RGPD”).

Identity of the data controller

The company responsible for collecting your personal data is GHECNT, a SAS with share capital of 1,000 euros, registered in the Pontoise Trade and Companies Register under no. 930 237 623, with its registered office at 40 rue du Val de Glatigny, 95280 Jouy le Moutier (hereinafter referred to as “We”).

Collection of personal data

The legal basis for our collection of your personal data is as follows:
– this collection is necessary afin order to perform the contract entered into when you use our services on our Site;
– legitimate interest when you voluntarily provide us with personal data during your visit to our Site, the data then being collected to enable us to better respond to your requests for information about our services.

Your personal data is collected for one or more of the following finalities:
– Managing your access to and use of certain services accessible on the Site,
– Effect operations relating to Customer management concerning contracts, invoices, Customer relationship follow-up,
– Constitute a fichier of users, customers and prospects,
– Send newsletters, solicitations and promotional messages. If you do not wish us to do so, we give you the option of expressing your refusal in this respect when your data is collected,
– To compile commercial and visitor statistics for our services,
– Organize contests, lotteries and all other promotional operations, with the exception of online games of chance subject to approval by the Autorité de Régulation des Jeux en Ligne.
– Manage people’s opinions on products, services or content,
– To manage any unpaid invoices and disputes relating to the use of our products and services,
– Personalize responses to your requests for information,
– Comply with our legal and regulatory obligations. When we collect your personal data, we inform you whether certain information is mandatory or optional (by means of asterisks visible on the Site).

When we collect your personal data, we inform you whether certain information is mandatory or optional.

Recipients of personal data

The following will have access to your personal data:
– Our company staff;
– Control services (lawyers, accountants, etc.);
– Our subcontractors (communication service providers, productivity software providers, data hosting service providers, payment service providers, billing service providers, audience analysis and measurement service providers, customer relationship management service providers);
– Public bodies may also be recipients of your personal data, exclusively to meet our legal obligations, court officers, officiers ministériels and bodies responsible for effecting debt collection.

Retention period for personal data

Concerning data relating to the management of customers and prospects :

Your personal data will not be kept beyond the period strictly necessary to manage our commercial relationship with you.

However, data required to establish proof of a right or contract, or to comply with a legal obligation, will be kept for the period stipulated by the law in force.

With regard to any prospecting operations aimed at customers, their data may be kept for a period of three (3) years from the finding of the commercial relationship.

Personal data relating to non-customer prospects may be kept for a period of three (3) years from the date of collection or last contact with the prospect.

At the end of this period of three (3) years, we may contact you again to find out whether you wish to continue to receive commercial solicitations.

If the right of access or rectification is exercised, data relating to identity documents may be kept for the period stipulated in article 9 of the French Code of Criminal Procedure, i.e. one (1) year. If the right of opposition is exercised, such data may be archived for the limitation period stipulated in article 8 of the French Code of Criminal Procedure, i.e. three (3) years.

The financial transactions relating to the payment of purchases and fees via the Site are confined to a payment services provider, which ensures their smooth and secure processing.

For the purposes of our services, this payment service provider may receive personal data relating to your credit card numbers, which it collects and stores in our name and on our behalf. We do not have access to this data.

In order to enable you to make regular purchases or pay charges afférents on the Site, your credit card details are kept for the duration of your registration on the Site and, at the very least, until you make your last transaction.

The data relating to the visual cryptogram or CVV2, written on your bank card, is not stored.

If you do not wish your personal data relating to your credit card numbers to be stored under the conditions specified above, we will not store this data beyond the time required to complete the transaction.

In any event, the data relating to these may be kept, for finality of proof in the event of a possible challenge to the transaction, in intermediate archives, for the period stipulated in article L 133-24 of the French Monetary and financial Code, in this case thirteen (13) months following the debit date. This period may be extended to fifteen (15) months afin to take into account the possibility of using payment cards with différé debit.

Concerning the management of lists of opposition to receive prospecting:

The information used to take into account your right to object is kept for a minimum of three (3) years from the date you exercise your right to object.

Concerning audience measurement statistics:

Information stored in users’ terminals or any other element used to identifier users and enabling their traceability or frequentation will not be kept beyond thirteen (13) months.

Security

We inform you that we take all necessary precautions and appropriate organizational and technical measures to preserve the security, integrity and confidentiality of your personal data, and in particular to prevent it from being distorted, damaged or accessed by unauthorized third parties. We also use secure payment systems that comply with the state of the art and applicable regulations.

Hosting

We inform you that your data is kept and stored, for as long as it is required, on the servers of OVH, located in the European Union.

Transfers outside the European Union

Your data may be transferred outside the European Union as part of the tools we use and our relations with our subcontractors.

This transfer is secured using the following tools:
– Either this data is transferred to a country that has been deemed to offrant an adequate level of protection by a decision of the European Commission ;

– Or we have entered into a specific contract with our subcontractors governing transfers of your data outside the European Union, based on the standard contractual clauses between a data controller and a subcontractor approved by the European Commission.

Access, rectification, limitation and deletion of your personal data

In accordance with European regulations on the protection of personal data, you have the following rights:

– A right of access enabling you at any time to find out whether or not your personal data is being processed by our services, and when it is, to have access to said personal data and to the information required by law concerning the way in which said data is processed,

– A right of rectification enabling you to request that any inaccuracies in your personal data be corrected as soon as possible,

– A right to erasure, enabling you to request as soon as possible that your personal data be erased, provided that this request for erasure complies with the conditions required by the applicable law,

– A right to limit the processing of your personal data, provided that this request for limitation complies with the conditions required by the applicable law,

– A right to portability enabling you to receive your personal data in a structured, commonly used and machine-readable format, or to request that such personal data be transmitted to another data controller, provided that such request for portability complies with the conditions required by applicable law,

– The right to object to the processing of your personal data for reasons relating to your particular situation, provided that such objection complies with the conditions required by the applicable law,

– The right to withdraw at any time the specific consent given to the collection of your personal data, in particular when the processing of your personal data is used for commercial prospecting purposes,

– The right to define directives concerning the conservation, deletion and communication of your personal data after your death.

You have the right to obtain limitation of the processing of your personal data, in the cases definis in Article 18 of the RGPD:

– During the vérification period that we implement, when you dispute the accuracy of your personal data, – When the processing of this data is unlawful, and you wish to limit this processing rather than delete your data,
– When we no longer need your personal data, but you wish us to keep it in order to exercise your rights,
– During the period of verifification of legitimate reasons, when you have objected to the processing of your personal data.

Persons whose data is collected on the basis of our legitimate interests are reminded that they may object to the processing of their data at any time. We may, however, continue to process data if there are legitimate grounds for the processing which override your rights and freedoms, or if the processing is necessary to establish, exercise or defend our legal rights.

You can unsubscribe from our promotional emails via the link provided in the emails. Even if you choose to stop receiving promotional messages from us, you will continue to receive our administrative messages.

Portability of your personal data

You have a right to the portability of the personal data you have provided to us, understood as the data you have actively and consciously declared in the course of accessing and using the services, as well as the data generated by your activity in the course of using the services.

We remind you that this right does not apply to data collected and processed on a legal basis other than consent or the performance of the contract binding us.

This right may be exercised free of charge, at any time, and in particular when you close your account on the Site, afin order to recover and store your personal data.

To this end, we will send you your personal data, by any means deemed useful, in a standard open format that is commonly used and readable by computer, in accordance with the state of the art.

Making a complaint to a supervisory authority

You are also informed that you have the right to lodge a complaint with a competent supervisory authority, (the Commission Nationale Informatique et Libertés for France), in the Member State in which you have your habitual residence, your place of work or the place where the violation of your rights would have been committed, if you consider that the processing of your personal data subject to the present charter constitutes a violation of the applicable texts.

This recourse may be exercised without prejudice to any other recourse before an administrative or jurisdictional court. In effet, you also have the right to an administrative or judicial effectif appeal if you consider that processing of your personal data subject to this charter constitutes a violation of the applicable texts.

Modifications

We reserve the right, at our sole discretion, to modifier this Charter in whole or in part at any time.

These modifications will take effect as of the publication of the new charter