Personal data protection policy 

1. Who we are?

The following information are provided so that you can review commitments on the personal data protection of SAS NAILMATIC, a simplified joint-stock Company with sole shareholder, located at 320, rue Saint-Honoré 75001 Paris, France that acts as a data controller for the processing of personal data referred to herein.

2. The personal data that we process

As part of the personal data processing, SAS NAILMATIC collects and processes the following categories of customer data:

- your first and last names;
- your mailing address;
- your telephone number;
- your email address;
- your date of birth;
- certain marketing information (for example your registration date, date of your last visit, the history of your orders, your browsing history).

Your personal data may be collected as follows:
- via our Web site ;
- thouhg orders placed;
- via social media and brand communication channels (e.g. : Facebook, Twitter) ;
- or when you provide it to us voluntarily, especially for our loyalty program.

3. The purposes and legal bases of our data processing

3.1.The purposes of our processing

The processing is implemented for the following purposes:
- the management and follow-up of requests for information by users and answers to be made;
- the management and follow-up of orders ;
- the management of after-sales service;
- the reporting of site access;
- the measure of quality, satisfaction and attendance;
- registration to the newsletter and prospecting, e.g. commercial;
- participation in contests.

3.2.The legal bases of our processing

Data processing is implemented only if at least one of the following conditions is met:

- your consent to the processing operations has been collected;
- the existence of our legitimate interest, or that of a third party, which justifies to implement the said processing of personal data;
- the performance of a contract that binds us to you requires to implement the processing of personal data;
- we are under legal and regulatory obligations to implement the said processing of personal data.

4. Recipients of your data

The personal data that we collect, as well as those collected later, are intended to us as data controller.

These data are mainly intended for:
- the services and authorised staff of the data controller;
- any subcontractors of SAS NAILMATIC called on to intervene in the framework of verified assessment
SAS NAILMATIC can also provide users’ personal information to companies that provide services to help SAS NAILMATIC in its activities such as the offer of services to customers and the sending e-mails on behalf of SAS NAILMATIC.

These companies are only authorized to use such personal information to provide us with the services mentioned above. SAS NAILMATIC will only share personal information with third parties in the ways described herein. SAS NAILMATIC does not sell personal information to third parties. Some personal data may be addressed to third parties or legally empowered authorities in order to fulfill our legal, regulatory or conventional obligations.

We ensure that only authorized people have access to these data. Our service providers may be recipients of these data in order to provide the services required of them.

5. Data retention duration

The data retention periods that we apply to your personal data shall be proportionate to the purposes for which they have been collected. Accordingly, we organize our policy of data retention for the strict time necessary for processing, in accordance with our data retention duration policy.

6. Your rights

6.1.Your right of information

You hereby acknowledge that this policy informs you of the purposes, legal frameworks, interests, recipients or categories of recipients with which your personal data are shared.

You also have the possibility to directly manage the deletion and portability of your personal data through a module made available directly in your personal account.

In addition to this information, and in order to ensure a fair and transparent processing of your data, you declare having received additional information concerning:
 
- the retention period of your personal data;
- your duly-recognized rights and conditions of their exercise

If we decide to process data for purposes other than those indicated, all information relating to these new purposes will be communicated to you.

6.2.Your right of access and correction of your data

You have the right to access and correct your personal data, which can be exercised by contacting us at the following address: NAILMATIC - Data Protection : 27 rue Mercoeur 75011 Paris - FRANCE.

As such, the confirmation is given as to whether your personal data are processed or not, and when they are, and you may access your data as well as any information regarding:
- purposes of the processing;
- categories of data concerned;
- recipients or categories of recipients;
- when this is possible, the duration of personal data retention or, when this is not possible, the criteria used to determine this duration.
- the right to ask the data controller for the rectification or erasure of your personal data, the right to apply a limitation to the processing of your personal data, a right to the portability of your data, the right to oppose this processing;
- the right to lodge a complaint with a supervisory authority;
- information on the data source when they are not collected directly from the data subjects;
- any automated decision-making process, including profiling, and in the latter case, any useful information about the underlying logic, as well as the importance and foreseeable consequences of this processing for the data subjects.

Depending on the cases, you are entitled to ask that your personal data be corrected, supplemented if they are inaccurate, incomplete, ambiguous, or outdated.

6.3.Your right to delete your data

You can ask the cancellation of your personal data when any of the following grounds applies:
- your personal data are no longer needed for the purpose for which they were collected or processed in another way ;
- you are withdrawing the consent previously given ;
- you are objecting the processing of your personal data when there is no legal reason for this processing.
- the processing of personal data is not consistent with the provisions of the applicable legislation and regulations;
- your personal data have been collected as part of the supply of company services to children aged under 16.
 
Nevertheless, the exercise of this right is not possible when the conservation of your personal data is required under the laws or regulations, in order for example to acknowledge, exercise or defend your rights in Court.

6.4.Your right to data processing limitation

You can request limitations on the processing of your personal data in the cases provided for by applicable laws and regulations.

6.5.Your right to oppose the processing of your data

You are entitled to oppose the processing of your personal data when the processing is based on the legitimate interests of the controller.

6.6.Your right to the portability of your data

As of May 25th, 2018, you will have the right to the portability of your personal data.
 
Such right can be specifically exercised as regards the following data:
- only your personal data, which excludes personal data made anonymous or data that do not apply to you;
- declarative personal data and the personal data of operation mentioned above;
- personal data which do not infringe the rights and freedoms of third parties such as those protected by business secrecy
 
This right is limited to processing based on consent or a contract as well as the personal data that you have personally generated.
 
This right does not include derived data or inferred data, which are personal data created by SAS NAILMATIC.

6.7.Your right to withdraw consent

When data processing that we are implementing is based on your consent, you can remove it at any time. We then cease to process your personal data without jeopardizing any previous operations to which you have consented.

6.8.Your right to lodge an appeal

You have the right to lodge a complaint with the Cnil on the French territory without prejudice to using any other administrative or judicial appeal.

6.9.Your right to define post-mortem guidelines

You have the option to define guidelines for the conservation, deletion and communication of your personal data after your death by empowering a trusted third party, who shall be certified and responsible for enforcing the will of the deceased in accordance with the requirements of the applicable legal framework.

6.10.How to exercise your rights

All the rights listed above can be exercised at the following email address dataprotection@nailmatic.com or by regular letter including a copy of an identity document sent to the following address: NAILMATIC - Data Protection - 27 rue Mercoeur 75011 Paris - FRANCE.
 
However, in regard to the exercise of the right of information, we are under no obligation to take action if:
 
- you already have this information;
- the registration or disclosure of your personal information are expressly provided for by law;
- providing information proves impossible;
- providing information would require disproportionate effort.

7. Security

The security of personal data is important for SAS NAILMATIC.
 
In accordance with its legal obligations, SAS NAILMATIC keeps this information under enhanced conditions of security and for limited periods of time proportional to the purposes for which such information was provided to us.
 
SAS NAILMATIC follows generally accepted standards to protect the personal data that are collected, both during transmission and upon receipt by SAS NAILMATIC.

8. Updating this privacy policy

This policy is likely to be amended or adapted at any time by SAS NAILMATIC. You are invited to check it regularly.

Last modified: 05.18.2018.