Date: July 24, 2020
Our data protection policy (hereafter to as " Policy ") describes the way Arc France, a simplified joint stock company, whose registered office is located at 104, avenue du Général de Gaulle - 62510 Arques, handles, as data controller, the personal data of its customers (hereafter referred to as " Customer(s) ").
Arc France, owner of the website www.latabledarc.com (hereinafter referred to as " Site "), collects, stores and processes personal data concerning the Customer when the latter uses the Site. This Policy is therefore intended to exclusively manage the processing of data collected directly on the Site.
Data may be transferred to certain entities of the ARC Group, namely any entity, in whatever form, of which Arc Holdings (575 680 350 RCS Boulogne-sur-Mer) holds, directly or indirectly, links in capital or voting rights (hereinafter referred to as " ARC ").
Concerned to ensure the best level of protection for your personal data, ARC undertakes to take all necessary measures to process your personal data in accordance with the provisions of the amended Act No. 78-17 of January 6, 1978 on Data Processing, Data Files and Individual Liberties and with the provisions of Regulation (EU) No. 2016/679 of April, 27 2016 on the protection of personal data (GDPR).
This Policy describes how the Customer's personal data is collected and processed by ARC on the Site.
What personal data do we collect and by what means?
ARC may process, collect all or part of the following personal data for the purposes described below:
- First name(s);
- Telephone number(s);
- Email address(es);
- Billing or delivery address(es);
- Username(s) and password(s);
- Purchase and order information;
ARC does not process data relating to the racial or ethnic origin, political or religious opinions, philosophical beliefs or trade union membership, the processing of genetic data, life or sexual orientation of the Customer.
Customer's personal data is collected when:
- Customer creates his customer account on the Site;
- Customer registers on the Site and gives his explicit consent to receive newsletters and commercial communications;
- Customer places an order on the Site and proceeds to payment;
- Customer contacts customer service.
Information relating to children under 16 years of age
Our services are intended for adults and ARC does not wish to collect or process personal data relating to children under the age of 16.
If it appears that data from children under 16 years of age have been transmitted to us via our Site or by telephone, we will not be able to process the order unless we have confirmation from the holders of parental authority.
In any case, parents or holders of parental authority have the possibility to object by contacting us at the following address: firstname.lastname@example.org.
Children who are minors at the time of collection of their personal data can have them deleted as soon as possible at the same address.
Why does ARC collects your data ?
ARC collects Customer's personal data for the following purposes:
Processing made on the basis of the performance of contractual obligations:
The processing of personal data is necessary for the execution of the contract between the Customer and ARC. In general, the personal data collected for the purposes of distance selling is required for the confirmation and validation of the Customer's order as well as its tracking and shipping. Without it, the Customer's order could not be processed. Mandatory data is identified by an asterisk on the form filled out at the time of the order; the other data is optional and allows ARC to improve communications and services to the Customer. This data may be transmitted to ARC's service providers for the sole purpose of the proper execution of the order and in particular its payment and delivery, according to the options selected by the Customer at the time of the order.
The personal data information also allows ARC to communicate with the Customer about the Customer's account or contractual relationship (for example, to inform the Customer of changes to the Site, the Policy or any other updates). In summary, the purposes of the processing carried out on the basis of the contract are as follows:
- Customer account, shopping cart and order management;
- Management of delivery operations;
- Management of payment operations: when the Customer makes a payment on the Site, payments are secured by our banking service provider: Customer's credit card details are encrypted using SSL protocol and never pass in clear on the network. No banking data is kept by ARC. Banking transactions are made directly between the Customer and ARC's banking service provider. Payment can also be made by Paypal account. If the Customer has a Paypal account, the payment will be made through the process set up by this company: payment with email address and password entered during the creation of the Paypal account. Customer's full bank details are collected only by our certified payment service provider to ensure the security of payments;
- Customer relationship management by phone or email, after-sales service follow-up, product returns and refunds;
- After-sales service management.
Processing made on the basis of ARC's legal obligations:
ARC uses the Customer's personal data to meet its legal obligations and/or defend its interests in court, in particular for the purposes of:
- Proof of transactions or operations;
- Legal or administrative requirements incumbent on ARC, needs of its insurers, or for audit purposes;
- Management of requests to exercise the rights of data subjects.
Processing performed with your consent:
The Customer has agreed to the processing of his personal data by ARC by means of an express consent (opt-in) in particular when:
- Registering your accounts online;
- The deposit of cookies to provide content and targeted advertising tailored to your interests, to carry out measures to improve your experience on the Site and to share on social networks;
- Sending targeted commercial offers by email and on social networks;
- The organization of game contests.
The Customer has the possibility to withdraw his consent at any time.
Processing made on the basis of the legitimate interest pursued by ARC:
ARC has a commercial interest in processing the Customer's data that is justified, balanced and does not tend to infringe the Customer's privacy. Where ARC's processing is based on the Customer's legitimate interest, Customer may object to such processing if its interests or fundamental freedoms are found to take precedence over ARC's legitimate interests.
Such treatment may be performed on occasion:
- Commercial canvassing operations with our Customers for the purpose of advertising our similar or identical products;
- Sending satisfaction surveys to our Customer to improve our services;
- Statistical analysis for management purposes and to improve our services;
- Managing social networks for the purpose of advertising our products and customer service;
- Management of client litigation for the defence of our interests in court.
Who are the recipients of Customer’s personal data ?
ARC undertakes not to sell the Customer's personal data to partner companies for commercial purposes. Customer's personal data remains the exclusive use of ARC. In order to fulfill the above-mentioned purposes, ARC discloses the personal data only to:
- ARC Group Entities: Only authorized ARC personnel whose activities justify access to information for internal audit, administrative or billing purposes, but also to ensure that the Customer receives the same quality of service regardless of the country in which they make a purchase.
- Subcontractors: Service providers and subcontractors performing services according to the instructions and on behalf of ARC only, in particular in the context of payment, delivery of the order and hosting of the Site.
ARC also uses commercial and technical sub-contractors to whom the data may be transmitted on a temporary and secure basis such as:
- Those who assist us and help us manage loyalty programs, customer relationship management and sales follow-up (CRM);
- Those who assist us and help us provide IT services, for the maintenance of our database and related software and applications, these services may have access to your data to perform the requested tasks;
- Third parties to ARC in connection with a restructuring, reorganization or transfer, in any form and for any reason (including, without limitation, assignment of business, dissolution, liquidation, amalgamation, etc.) of the entities within the ARC Group.
Other third parties:
- ARC shares your personal data with other third parties only if (i) ARC is compelled to do so under its legal obligations (e.g., upon application to the relevant courts), or (ii) if the sharing is lawful under applicable law.
- Certain regulated professions such as lawyers, notaries, auditors in the execution of their mandate or directly to judicial or administrative authorities pursuant to legal provisions.
Data transfer outside the European Union
Customer's personal data collected on the Site by ARC may be accessed or transferred outside the European Union (list annexed within the general terms and conditions of sale) and may be accessible there by ARC staff or by one of its subcontractors.
ARC undertakes to take the necessary measures to ensure that its staff and subcontractors acting on its instructions and on its behalf only adhere to the commitments set out in this Policy, in particular by entering into suitable contracts in accordance with the models adopted by the European Commission or any other valid transfer mechanism that may be put in place in the future.
How long the Customer's personal data will be kept?
ARC takes care to keep the personal data of its prospects and Customers for a period of time necessary for the purposes of the processing carried out or for a period of time fixed by law.
- Prospects: The personal data of prospects are kept for a period of three (3) years from the last positive and explicit contact from the prospect (the prospect has not made a purchase on the Site, but remains interested in ARC news, logs on to the Site or subscribes to newsletters).
- Customers: Customer's personal data is kept for a period of four (4) years following the last purchase.
Contractual data is kept and archived for the time necessary to meet contractual obligations (warranty, compliance, etc.) as well as legal, accounting and tax obligations and/or during the applicable prescription periods. Customer's data are then archived, and may be used in the context of a dispute, action or litigation, during the applicable prescription period.
In the event of legal action, the data may be retained until all legal remedies have been exhausted, and will then be deleted or archived to the extent permitted by law. The data will then be destroyed or made anonymous.
In accordance with the amended law n°78-17 of January 6, 1978, relating to data processing, data files and liberties, as well as the (EU) regulation n°2016/679 of April 27, 2016 on data protection, Customer has the following rights:
- Right of access: Customer may obtain information about the processing of his personal data and a copy of his personal data.
- Right of rectification: if Customer believes that his personal data is inaccurate or incomplete, he can demand that the personal data be modified accordingly.
- Right of deletion: Customer may demand the deletion of his personal data to the extent permitted by law.
- Right to limitation of processing: Customer may request the limitation of the processing of his personal data.
- Right of opposition: Customer may object to the processing of his/her personal data for reasons related to a particular situation. Customer has the absolute right to object to the processing of his personal data for commercial prospecting purposes, including profiling related to such prospecting.
- Right to data portability: where this right is applicable, Customer has the right to have the personal data provided to ARC returned to him or, where technically possible, transferred to a third party;
- The right to define guidelines for the storage, deletion or communication of personal data, applicable after his death.
- Right to withdraw consent: if Customer has given his consent to the processing of his personal data, he has the right to withdraw his consent at any time via the unsubscribe link, which will not affect the legitimacy of the processing operations carried out prior to the withdrawal of his consent.
Customer may at any time exercise the above rights by sending a request to the email address of ARC Group’ DPO at email@example.com
Or by mail at the following address:
ARC MANAGEMENT & SERVICES,
104 avenue du Général de Gaulle 62510 Arques, France
Attn: the Data Protection Officer
In accordance with the applicable regulations, Customer may lodge a complaint with a competent control authority such as the CNIL in France.
Data Protection Officer
ARC has appointed a Data Protection Officer. He can be reached at the following coordinates:
E-mail address: firstname.lastname@example.org
ARC MANAGEMENT & SERVICES,
104 avenue du Général de Gaulle 62510 Arques, France
Attn: the Data Protection Officer
Amendment of the Policy
The Policy is subject to change to reflect, among other things, any changes in the way ARC processes and collects Customer data on the Site. Customer may review any updates to this Policy on the Site (the date of any updates will be indicated at the top of this Policy) and any material changes to this Policy may be communicated to the Customer through the Site or through normal communication channels.
Any additional questions relating to the management of the Customer's personal data may be sent by email to the following address: email@example.com.
Customer also has the possibility of consulting the site of the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.