Article 1 - Personal Data Controller

EKLOZION, a simplified joint-stock company with a sole shareholder and a share capital of €150, registered in the Trade and Companies Register (RCS) of Versailles under 834 234 619, whose registered office is located at 62, boulevard Jean Jaurès in Chatou (78400), France, records and uses the personal data provided by users (hereinafter the "User(s)") of the "groupeklozion" website (hereinafter the "Website").

Article 2 - Personal data subject to processing

The personal data processed are:

- data requested from the User and provided by him or her when registering on the "Website", placing orders or as part of the after-sales service and the order numbers;
- data published by the User when completing any form on the Website;

or the following personal data:

- the User's contact details (surname, first name, e-mail address, postal address, telephone number, e-mail address, telephone number;
- purchases made, donation made to an association;
- banking details, in case of subscription to a paid service;
- information about the User's connection (IP address, browser);

hereinafter the "Personal Data").

The User is informed on each Personal Data collection form of the mandatory or optional nature of the information via an asterisk.

Article 3 - Purposes of the Personal Data processing

Personal Data is collected and processed on the basis of (i) the User's consent – he or she ticks a box to this effect when registering on the Website, or (ii) the service provision contract for purposes of managing orders placed on the Website and, if the User has consented to it, for purposes of providing the User with information on EKLOZION's offers.

Article 4 - Recipients of Personal Data

The Personal Data collected is reserved for the use of EKLOZION and its contracting partners who are involved in the management of the Website and services (Website host, payment service providers, financial advisors, partners).

Article 5 - Period of Personal Data retention

EKLOZION keeps the Personal Data for the period necessary to perform the services provided by it and for a period of 5 (five) years from the last service provided, except for (i) login information, which is kept for 13 months and (ii) banking details, which are deleted immediately unless a transaction is challenged, in which case they are archived for 13 months.

Personal Data may be retained for longer periods of time in the event of a dispute.

Once these time limits have expired, the Personal Data are deleted or anonymised.

Article 6 - Personal Data Transfer and Security

EKLOZION may transfer Personal Data to subcontractors or partners located outside the European Union. In such a case, it shall always ensure that the processing is legally supervised to guarantee an adequate level of protection of the privacy and basic rights of individuals.

As controller, EKLOZION takes all measures to guarantee the security and confidentiality of Personal Data and, in particular, to prevent such data from being damaged or accessed by unauthorised third parties.

To this end, it ensures the physical security of the buildings housing its computer systems, the security of its information system, and the monitoring of personal data flows. In addition, it ensures that its subcontractors comply with the measures aimed at protecting the Personal Data they process in the name and on behalf of EKLOZION.

Article 7 - Rights of the User and exercise of these rights

In accordance with the applicable legal and regulatory provisions, the User has:

- a right to information on how EKLOZION processes its Personal Data and regarding his or her rights;
- a right to access his or her Personal Data held by EKLOZION, it being specified that clearly unsubstantiated, excessive or repeated requests are likely to receive no reply;
- a right to rectify inaccurate or outdated Personal Data;
- the right to withdraw his or her consent to process Personal Data;
- a right to Personal Data portability, i.e. the right to copy or transmit Personal Data from EKLOZION's database to another company, but only with regard to the Personal Data he or she has provided EKLOZION with his or her consent and which has undergone automated processing;
- a right to request the limitation of processing in the cases provided for by regulations, i.e. when:
- the User challenges the accuracy of the Personal Data for a period of time allowing EKLOZION to check the accuracy of the Personal Data;
- the processing is unlawful and the User objects to their deletion but instead demands that their use be limited;
- EKLOZION no longer needs the Personal Data for the purposes of processing, but they are still necessary for the establishment, exercise or defence of the User's legal rights;
- a right to define general and/or specific guidelines regarding the fate of his or her Personal Data and how the User would like his or her rights to be exercised after their death. In this respect, in the event of death brought to the attention of EKLOZION, the Personal Data will be deleted, unless it is necessary to keep it for a specific period of time for reasons relating to our legal and regulatory obligations and/or legal limitation periods, and after having been communicated, where applicable, to a third party possibly designated by the User.

The User may exercise his or her rights as defined in this article by sending an e-mail thanks to our contact form.

In the event of a dispute, the User is informed that he or she may file a complaint with the Commission nationale de l'informatique et des libertés (CNIL).