PERSONAL DATA PROTECTION POLICY

Our privacy protection and security policy (hereinafter the « Policy ») describes how ARC Management & Services SAS, a French simplified joint-stock company having its registered office at 104 avenue du Général de Gaulle, 62510 Arques (France), in its capacity of data controller, processes internet users’ (hereinafter the « User » or « Users ») personal data.

ARC Management & Services, the owner of the website www.cristaldarquesparis.com (hereinafter the « Website »), may be required to collect, store and process Users’ personal data as they make use of the Website. This Policy deals exclusively with the processing of data collected directly from the Website.

Your data may be transferred to ARC Group entities, meaning any entity of any form whatsoever in which ARC Holdings (Boulogne-sur-Mer Trade & Companies Register no. 575 680 350) directly or indirectly holds either capital or voting rights (hereinafter referred to as « ARC »). Article 5 of the present Policy shows the list of the ARC Group entities that may be permitted to process your personal data.

Keen to ensure the best level of protection for your personal data, ARC undertakes to take all measures necessary to process your personal data in accordance with the provisions of French law number 78-17 of 6 January 1978 as amended, on computing, data storage and freedom of information, and those of Regulation (EU) 2016/679 of 27 April 2016 on data protection.

1. What personal data do we collect and how?

1.1. ARC is likely to collect and process all or some of the following personal data for the purposes described below:

• Surname;
• First name(s);
• Telephone number(s);
• Email address(es);
• Postal address;
• Company name;
• Information about requests sent using the contact form.

Arc does not process data on racial or ethnic origins, political or religious opinions, philosophical beliefs, trade union membership, genetic or lifestyle data, or on Users’ sexual orientation.

1.2. Users’ personal data is collected when:

• Users navigate around the Website;
• Users make contact with Arc using the « Contact » tab;
• Users subscribe to the newsletter;
• Users enter a competition;
• Users fill in a document download access form.

2. Data about children aged under 16

Our services are intended for adult Users and ARC does not wish to collect or process personal data about children under 16 years of age.

If it appears that we have been sent data about a child aged under 16 either online or by telephone, we can only process the request once it has been confirmed by a person holding parental authority.

In any event, parents or persons holding parental authority can block the request made by contacting us at DPO@arc-intl.com.

The same address can be used to request the deletion of data collected about individuals who were minors at the time it was collected.

3. Why does ARC collect your data, and for what purposes?

3.1. ARC collects Users’ personal data for the following purposes:

• Managing the relationship with the User when any kind of request has been sent using the contact form on the Website;
• Legal or administrative requirements incumbent on ARC;
• Managing requests by data subjects to exercise their rights.

LThe processing conducted by ARC is necessary to enable it to process your requests for information. Without this processing, ARC would be unable to respond to Users’ requests.

ARC has a commercial interest in processing Users’ data which is justified, balanced and is not designed to infringe any User’s privacy. When the processing ARC conducts is based on its legitimate interests, Users can oppose such processing if it is established that Users’ interests or basic freedoms prevail over ARC’s legitimate interests.

3.2. Users’ data can be processed in this way when:

• Running campaigns with Users for the purposes of advertising similar or identical products;
• Sending satisfaction surveys to improve our services;
• Analysing statistics to manage and improve our services;
• Handling disputes to defend our interests in court.

All processing used to send marketing emails to Users is based on their consent. Users consequently agree to Arc’s processing of their personal data by means of giving express consent (opting in, voluntarily) in particular when:

• Agreeing to the installation of cookies for audience measurement and improving the User’s experience on the Website;
• Sending targeted offers by email;
• Organising competitions;
• Users fill in a document download access form and give their consent to the sending of newsletters.

Users can withdraw their consent at any time.

4. Information about the use of cookies on our Website

A cookie is a file installed on your device’s hard drive by the Website server. This cookie, or “tracker”, is used to identify the device on which it is stored, during the consent validity period, which cannot exceed 13 months from the time it is first installed on the User’s device.
A cookie does not hold or record separate data. It can be read by a server using a web browser, and provides information enabling the Website to better adapt to different users by saving data including user preferences, by detecting errors, and compiling data for statistical purposes. Information collected in this way is mainly used to track the volume, type and configuration of traffic using the Website.

Arc is legally obliged to collect consent before installing cookies on your device when using the Website. Some cookies and trackers are exempt from your consent, which are those cookies strictly necessary to supply a service expressly requested by the user (functional cookies).

ARC utilise deux types de cookies sur le Site :

Cookies that are strictly necessary for the Website to work (functional cookies)

These are cookies essential for moving around our Website that enable you to use the Website’s main functions and keep your connection secure.
Some parts of the Website might not work if the User does not agree to accept cookies, which is why these cookies are not optional.

Functional cookies make it possible for ARC to:

• Implement security measures on the Website;
• Improve User navigation;
• Adapt the Website to match the display preferences on the User’s device (language used, display resolution, etc.).

Analytics cookies

Google Analytics is a service provided by Google that places cookies on your device’s hard drive. These are cookies Arc can use to find out how the Website is used and how it performs, to produce statistics, and determine visitor numbers and the use made of various aspects of the Website. These cookies collect data about User behaviour on the Website by analysing URLs (where visitors come from, what banners they click on, how they were directed to the Website), and also the timing of visits. These cookies in particular enable us to:

• Produce statistics about Website traffic volume (number of visits and unique visitors, pages viewed, etc.) and to compile reports and statistics on the use of various aspects of the traffic (sections and content viewed, navigation paths taken);
• Improve our Website as a consequence;
• Better understand the products and services you prefer, and to offer you more customised communication and/or content on our Website;
• Detect any navigation issues there might be.

Google Tag Manager eis an analytics service from Google Inc. that can be used to effectively monitor and measure our Website’s performance.

Deleting analytics cookies does not prevent navigation on the Website.

You can configure analytics cookies at any time by clicking here.

For more detailed information about analytics cookies, see: https://support.google.com/analytics/answer/6004245.

5. Who receives Users’ personal data?

ARC undertakes not to sell Users’ personal data to partner brands for commercial purposes. Users’ personal data is for the sole use of ARC.
To fulfil the aforementioned purposes, Arc does disclose personal data, but only to:

ARC Group entities:

Only authorised ARC personnel whose duties justify access to data, for internal audit and administration purposes, but also to ensure that Users receive the same quality of service regardless of their country.

The following list is of the ARC Group entities that may be permitted to process your personal data for the relevant purposes:

Subcontractors:

Service providers and subcontractors supply services following instructions given by ARC, and only on ARC’s behalf.

ARC uses commercial and technical subcontractors acting according to instructions given by ARC, and only on ARC’s behalf, and some User data might be temporarily and securely sent to them, such as:

• Subcontractors assisting us in providing IT services, to maintain our database, software and related applications, where such services might have access to your data to carry out the tasks requested.
• Subcontractors in charge of routing emails containing newsletters and marketing material.
• Subcontractors responsible for hosting the Website.

Third parties (outside ARC Group):

• As part of a restructuring, reorganisation or transfer, in any way and in any respect whatsoever (including business disposal, dissolution, winding up, merger, etc.) involving ARC Group entities;
• As part of a request from a User concerning ARC Group product resellers and distributors. Depending on the User’s request, the User might be put into direct contact with ARC Group third party distributors and resellers to obtain information about ARC Group products and the nearest sales outlets.

Other third parties:

• ARC shares your personal data with other third parties only if (i) ARC is obliged to do so by virtue of its legal obligations (e.g. at the request of the competent courts) or (ii) if sharing data is lawful under the applicable law.
• Certain regulated professions such as lawyers, notaries, auditors in the performance of an assignment or directly to legal or governmental authorities pursuant to legal provisions.

6. Data transfer outside the European Union

ARC undertakes to take all necessary measures to ensure that its staff and subcontractors acting only on its instructions and on its behalf endorse the commitments stated in the present Privacy and Security Policy, including in concluding appropriate contracts based on the templates adopted by the European Commission or on any other valid transfer mechanism that might be implemented in future.

Transfers outside the European Union may be conducted as part of the following activities in particular:

7. User personal data retention period

ARC ensures it retains Users’ personal data for a period necessary for the purposes of the processing conducted (point 3) or for a legally-defined duration.

Users’ personal data is retained for a period of three (3) years commencing from the last positive deliberate contact from the User.

User data is then archived, and may be used within the context of a dispute, legal proceedings or litigation, during the applicable legally-permitted period. In the event of legal proceedings, data may be retained until all modes of appeal are exhausted, and will then be deleted or archived within the limits permitted by the law.

Data is then erased or anonymised.

8. Users’ rights

In accordance with French law number 78-17 of 6 January 1978 as amended, on computing, data storage and freedom of information, and Regulation (EU) 2016/679 of 27 April 2016 on data protection, Users have the following rights:

• The right to access data: Users are entitled to information concerning the processing of their personal data and a copy of the personal data held.
• The right to correct data: a User who believes their personal data is inaccurate or incomplete can require it to be amended accordingly.
• The right to erase data: Users can require their personal data to be deleted, subject always to regulatory limits.
• The right to restrict processing: Users can request that the processing of their personal data is restricted.
• The right to oppose processing: Users can oppose the processing of their personal data, for reasons connected to a particular situation. Users have an absolute right to oppose the processing of their personal data for marketing purposes, including profiling associated with lead prospection activities.
• Right to data portability: when the right is applicable, Users are entitled to request that personal data provided to ARC is returned or, when technically possible, transferred to a third party.
• Right to stipulate directives relating to storage, erasure or disclosure of personal data, applicable after death.
• Right to withdraw consent: Users who have agreed to the processing of their personal data have the right to withdraw that consent at any time using the unsubscribe link; doing so does not affect the legitimacy of processing carried out before consent was withdrawn.

Users may exercise the above rights at any time by sending a request to the ARC Group Data Protection Officer by email at DPO@arc-intl.com.

Or by post to the following address:

The Data Protection Officer,
ARC Management & Services,
104 avenue du Général de Gaulle
62510 Arques – FRANCE

Pursuant to the applicable regulations, Users are able to submit complaints to the competent supervisory authority, such as the CNIL in France or the competent local equivalent supervisory body.

9. Data protection officer

ARC has designated a Data Protection Officer, who can be contacted using the following details:

Email address: DPO@arc-intl.com.

Postal address:
The Data Protection Officer,
ARC Management & Services,
104 avenue du Général de Gaulle
62510 Arques – FRANCE

10. Changes to the Policy

The Privacy and Security Policy is liable to be amended including to reflect any changes in how ARC processes and collects Users’ data on the Website. Users can keep abreast of updates to the Policy by reading it on the Website (the first page shows the date of the most recent update).

11. Contact

Any additional questions on the management of Users’ personal data can be emailed to the following address: DPO@arc-intl.com.
Users can also visit the website of the French national data protection authority (CNIL) at: www.cnil.fr.