Privacy Policy
Preamble
This Privacy Policy is an integral part of the GTs (as defined below) such that the definitions used in the latter are reused in this Privacy Policy.
The purpose of this Privacy Policy is to inform the Data Subjects about how their Personal Data is collected from the Site, how it is processed by MESINEDO and, finally, the Specific Rights (as defined below) that the Data Subjects enjoy regarding such processing as defined below.
Article 1 - Definitions
The following terms, whether used in the singular or plural in this Privacy Policy, shall have the following definitions:
- MESINEDO : refers to the company MESINEDO, a simplified joint-stock company (société par actions simplifiée unipersonnelle), with a capital of €1000, registered with the Paris Trade and Companies Register under number 999 430 929, whose registered office is at Bureau 326, 78 Avenue Des Champs Elysées, 75008 PARIS, represented by Margaux Morand in her capacity as President;
- Intermediate Archiving : refers to the transfer of Personal Data that is still of administrative interest to MESINEDO (for example, in the event of litigation and/or legal obligation) to a separate database, logically or physically separated, and to which access is restricted in any event. This archive is an intermediate stage before the deletion of the relevant Personal Data or their anonymization;
- Privacy Policy : means this policy for the confidentiality and protection of the Personal Data of the Data Subjects implemented by MESINEDO, which is an integral part of the GTs;
- GTs : refers indistinctly to the GTU and GTS;
- Personal Data : means the personal data of the Data Subject, within the meaning of the Personal Data Regulations, collected and processed by MESINEDO in the context of the use of the Site;
- Specific Rights: designates the rights granted by the Personal Data Regulation to the Data Subjects regarding the processing of their Personal Data and detailed in Article 8;
- Data Subject: designates the natural person (Internet user or Client) whose Personal Data is processed by MESINEDO;
- Personal Data Regulation: dessigns the Law No. 78-17 of January 6, 1978, relating to information technology, files and freedoms, in application of the General Data Protection Regulation;
- Terminal(s): des ignates the hardware equipment (computer, tablet, smartphone, telephone, etc.) used by the Data Subject to browse or view the Site and/or any other digital medium published by a third party.
Article 2 - Legal bases for processing
In accordance with the Personal Data Regulation, the processing operations designated in this Privacy Charter are supported by a specific legal basis.
A. The Data Subject has consented to the processing of their Personal Data for one or more specific purposes.
The Site may have requested the express consent of the Data Subject in order to carry out specific processing explained at the time of such consent collection.
B. Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract.
In order to use the Site and benefit from its Services, the Data Subject has accepted at a minimum the Terms of Use and, where applicable, the General Terms and Conditions of Sale to acquire Products. These documents formalize a contractual relationship between the Data Subject and MESINEDO, serving in particular as the legal basis for the collection and processing of the Data Subject's Personal Data by MESINEDO.
This Data is necessary for carrying out a certain number of processing operations linked to the performance of the contractual relationship between the Data Subject and MESINEDO, the purposes of which are detailed in Article 3.
C. Processing is necessary for compliance with a legal obligation to which the controller is subject.
The processing of Personal Data may also be necessary for compliance with a legal obligation to which MESINEDO is subject, for example, the retention of Site access logs, in accordance with Decree No. 2021-1362 of October 20, 2021, relating to the retention of data that makes it possible to identify any person who has contributed to the creation of content published online.
D. Processing is necessary for the purposes of the legitimate interests pursued by MESINEDO or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of personal data, in particular where the Data Subject is a child.
MESINEDO may have a legitimate interest justifying the processing of the Data Subject's Personal Data, such as, for example, the processing of Data strictly necessary for fraud prevention purposes.
In this case, MESINEDO ensures that the processing in question is indeed necessary for the realization of its legitimate interest and evaluates the consequences of this processing on the Data Subject, in particular by taking into account the nature of the Data processed and the way in which it is processed.
MESINEDO ensures that it does not disregard the interest or the fundamental rights and freedoms by allowing the Data Subject, at any time, to object to all or part of the processing described in this Privacy Charter, as well as to exercise their Specific Rights, under the conditions of Article 8.
Article 3 - Processing purposes
The Data Subject's Personal Data is necessary to allow them access to the Site (including the Exclusive Area), its use and improvement, and to allow MESINEDO to:
- Carry out operations relating to its business relationship with the Data Subject, i.e., concerning invoices, accounting, tracking the "customer relationship" with a Client, such as conducting satisfaction surveys, managing complaints, using the Site and, more generally, the services, etc.;
- Select Clients to carry out studies, surveys, and product tests, as well as loyalty, prospecting, and promotional actions (notably via the use of the NFT on each Product);
- Personalize its communication for Clients, notably via information emails, based on their observed preferences and their use of the Site;
- Carry out operations relating to prospecting, i.e., the management of technical prospecting operations (which includes, in particular, technical operations such as standardization, enrichment, and de-duplication);
- Carrying out commercial solicitation operations;
- Developing commercial statistics, analyses, and marketing tools (including classification, scoring, etc.);
- Organizing contests, lotteries, or any promotional operation, excluding online games of chance subject to the approval of the Regulatory Authority for Online Games (Autorité de Régulation des Jeux en Ligne);
- Managing requests to exercise Specific Rights under the conditions of Article 8;
- Managing unpaid debts and litigation;
- Managing comments from Data Subjects on the Site and/or on web pages published by MESINEDO such as social media pages;
- Combating fraud.
Article 4 - Storage of personal data
The Site is hosted by the company whose contact details are available by clicking here.
All precautions have been taken to store the Personal Data of Data Subjects in a secure environment and to prevent it from being distorted, damaged, or accessed by unauthorized third parties. The information provided by the Data Subject will never be transmitted to third parties for commercial purposes, nor sold or exchanged, except with their express prior consent.
Article 5 - Collection of personal data
5.1. Collection of Personal Data on the Site
MESINEDO collects, where applicable upon the creation of an Account and then as it is completed over time, the following Personal Data that the Client provides and that they communicate during their navigation, which is kept for a period of three (3) years, in an active database, from the last connection of the Data Subject to the Site:
- Gender,
- Date of birth,
- Email address,
- Login used on the Site,
- Payment ID,
- Delivery address,
- Billing address,
- Connection data (date, time, IP address, pages viewed) of the Data Subject during their navigation on the Site and, in particular, those related to the use of Specific Services,
- Where applicable, the reason(s) for the exclusion (all evidence demonstrating the actions, dated within less than a month, justifying the exclusion),
- Phone number,
- Company.
| The Personal Data above is also kept in Intermediate Archiving for an additional period of two (2) years in accordance with the common limitation period. |
- Invoices,
- Amount of transactions carried out as well as the date and time of these transactions,
| The Personal Data above is also kept in Intermediate Archiving for an additional period of seven (7) years, in accordance with the tax and accounting obligations of MESINEDO. |
Only the Personal Data designated on the Site as mandatory is essential to benefit from an Account.
5.2 Collection of Personal Data on the Exclusive Area
MESINEDO collects, where applicable upon accessing the Exclusive Area, the following Personal Data that the Client provides and that they communicate during their navigation, which is kept for a period of three (3) years, in an active database, from the last connection of the Data Subject to the Exclusive Area:
- Unique identification number of the NFC (Near Field Communication) chip;
- Last name and first name,
- Email address,
- Delivery address,
- Billing address,
Connection data (date, time, IP address, pages viewed) of the Data Subject during their navigation on the Site and, in particular, those related to the use of Specific Services,
Where applicable, the reason(s) for the exclusion (all evidence demonstrating the actions, dated within less than a month, justifying the exclusion),
Only the Personal Data designated on the Exclusive Area as mandatory is essential to access it.
Article 6 - Recipients or categories of recipients if they exist
MESINEDO may communicate to third parties certain Personal Data that is necessary to fulfill Orders in the context of the T&Cs in order to ensure, in particular:
- shipping of the Products;
- Site maintenance;
- combating fraud;
- after-sales service, etc.
Article 7 - Internet transaction security
In accordance with the General Terms and Conditions, the Site uses the technology of one or more payment service providers to secure Clients' bank transactions.
Thus, during payment on the Site, the bank details of the Data Subject are transmitted in encrypted form to these payment service providers, without MESINEDO being able to access them.
MESINEDO collects neither the full bank card number of the Client nor their security code.
To exercise their rights such as those identified in Article 8, regarding their bank card details, the Data Subject is invited to contact these payment service providers directly.
Article 8 - Specific rights
In accordance with the Personal Data Regulations, the Data Subject may, at any time, benefit from the following Specific Rights to:
- access,
- rectification,
- erasure,
- limitation of processing,
- portability,
- opposition,
- post-mortem directives.
A. Rights of access
The Data Subject has the option to obtain confirmation from MESINEDO as to whether or not Personal Data concerning them is being processed and, where it is, access to said Personal Data as well as the following information:
a) the purposes of the processing;
b) the categories of Personal Data;
c) the recipients or categories of recipients to whom the Personal Data has been or will be communicated;
d) where possible, the envisaged retention period for the Personal Data or, where this is not possible, the criteria used to determine this duration;
e) the existence of the right to request from MESINEDO the rectification or erasure of Personal Data, or a limitation of the processing of their Personal Data, or the right to object to such processing;
f) the right to lodge a complaint with the CNIL;
g) where the Personal Data is not collected from the Data Subject, any available information as to their source;
h) the existence of automated decision-making, including profiling, and, at least in such cases, useful information concerning the underlying logic, as well as the significance and expected consequences of such processing for the Data Subject.
When Personal Data is transferred to a third country or an international organization, the Data Subject has the right to be informed of the appropriate safeguards regarding this transfer.
MESINEDO provides a copy of the Personal Data undergoing processing.
MESINEDO may charge a reasonable fee based on administrative costs for any additional copies requested by the Data Subject.
When the Data Subject submits their request electronically, the information is provided in a commonly used electronic form, unless they request otherwise.
The right of the Data Subject to obtain a copy of their Personal Data must not adversely affect the rights and freedoms of others.
B. Rights of rectification
The Data Subject has the option to obtain from MESINEDO, as soon as possible, the rectification of inaccurate Personal Data concerning them. They also have the option to have incomplete Personal Data completed, including by providing a supplementary statement.
C. Rights to erasure
The Data Subject has the option to obtain from MESINEDO the erasure, as soon as possible, of Personal Data concerning them when one of the following grounds applies:
a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by MESINEDO;
b) the Data Subject has withdrawn their consent for the processing of such Personal Data and there is no other legal ground for the processing;
c) the Data Subject exercises their right to object under the conditions recalled below and there are no overriding legitimate grounds for the processing;
d) the Personal Data have been unlawfully processed;
e) the Personal Data must be erased for compliance with a legal obligation;
f) the Personal Data have been collected from a child.
D. Right to restriction
The Data Subject has the option to obtain from MESINEDO the restriction of processing of their Personal Data when one of the following grounds applies:
a) MESINEDO verifies the accuracy of the Personal Data following a challenge by the Data Subject regarding the accuracy of the Personal Data;
b) The processing is unlawful and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead;
c) MESINEDO no longer needs the Personal Data for the purposes of processing, but they are still required by the Data Subject for the establishment, exercise or defense of legal claims;
d) The Data Subject has objected to the processing under the conditions recalled below and MESINEDO is verifying whether the legitimate grounds pursued override those alleged.
E. Right to Data portability
The Data Subject has the option to receive from MESINEDO the Personal Data concerning them, in a structured, commonly used and machine-readable format when:
a) The processing of Personal Data is based on consent, or on a contract
and
b) The processing is carried out by automated means.
When the Data Subject exercises their right to portability, they have the right to have the Personal Data transmitted directly from MESINEDO to another controller, as designated by them, where technically feasible.
The right to portability of the Data Subject's Personal Data shall not adversely affect the rights and freedoms of others.
F. Right to object
The Data Subject may object at any time, on grounds relating to their particular situation, to the processing of Personal Data concerning them which is based on the legitimate interest of MESINEDO. The latter will then no longer process the Personal Data, unless it demonstrates compelling legitimate grounds for the processing which override the interests and rights and freedoms of the Data Subject, or may retain them for the establishment, exercise or defense of legal claims.
G. Post-mortem instructions
The Data Subject has the option to communicate to MESINEDO instructions relating to the storage, erasure, and communication of their Personal Data after their death, which instructions may also be registered with a "certified digital trusted third party". These instructions, or a type of "digital will", may designate a person responsible for their execution; failing this, the Data Subject's heirs will be designated.
In the absence of any instructions, the Data Subject's heirs may contact MESINEDO in order to:
a) access Personal Data processing operations that allow for "the organization and settlement of the deceased's estate";
b) receive communication of "digital assets" or "data similar to family mementos, transmissible to heirs";
c) have the Data Subject's account closed on the Site and object to the continued processing of their Personal Data.
In any case, the Data Subject has the option to inform MESINEDO, at any time, that they do not wish for their Personal Data to be communicated to a third party in the event of their death.
Article 9 - Exercising user-specific rights
These rights can be exercised at any time with MESINEDO:
MESINEDO
Customer Service
Bureau 326, 78 Avenue Des Champs Elysées, 75008 PARIS
Email: bonjour@mesinedo.fr
In order to exercise their rights according to the conditions mentioned above, and in the event that MESINEDO has doubts regarding the identity of the person making the request, MESINEDO may ask them to provide proof of identity by including their last name, first name, email address, and by attaching a copy of a valid identity document to their request.
A response will be sent to the Data Subject within a maximum period of one (1) month from the date of receipt of the request.
If necessary, this period may be extended by two (2) months by MESINEDO, which will inform the Data Subject accordingly, taking into account the complexity and/or number of requests.
In the event that the Data Subject requests the deletion of their Personal Data and/or exercises their right to request the erasure of their Personal Data, MESINEDOmay nevertheless retain them in the form of Intermediate Archiving for the duration necessary to satisfy its legal obligations, or for evidentiary purposes during the applicable limitation period.
The Data Subject may also lodge a complaint with the competent supervisory authority (the CNIL).
Article 10 - Security of your password
MESINEDO takes all necessary precautions to ensure the secure storage of the Data Subject's password.
However, the security of this password also depends on how it is designed.
Therefore, the Data Subject is reminded that to be valid, their password must consist of at least 8 characters, and at least 3 of the following 4 types: uppercase letters, lowercase letters, numbers, special characters.
Mnemonic devices can be used to create complex passwords, such as:
- Keep only the first letters of the words in a sentence; for example, the sentence "Vive les Sacs !" corresponds to the password V1v3l355@c5l!
- Use an uppercase letter if the word is a noun
- Include punctuation marks (e.g., !)
- Express numbers using digits from 0 to 9 (e.g., One -> 1)
- Replace letters with numbers (e.g., S => 5)
Article 11 - Cookies placed on the data subject's terminal following their navigation on the site
Cookies are used on the Site.
A cookie is a piece of information placed on the Terminal that is used by the Data Subject to access the Site.
Cookies relate to the Data Subject's navigation on the Site and allow determination of the pages they have consulted, as well as the date and time of consultation.
At no time do these cookies allow MESINEDO to personally identify the Data Subject.
The Data Subject is informed, during their first visit, that they have the option to object to the recording of cookies that are supplementary to the operation of the Site; they may change their choices at any time by clicking here
[Insert opt-out for each cookie]
The Data Subject will find more help on the dedicated pages of their browser (below are the most common browsers):
- Internet Explorer™: http://windows.microsoft.com/fr-FR/windows-vista/Block-or-allow-cookies
- Google Chrome™: http://support.google.com/chrome/bin/answer.py?hl=fr&hlrm=en&answer=95647
- Safari™: https://support.apple.com/kb/PH19214?locale=fr_FR&viewlocale=fr_FR
- Firefox™: http://support.mozilla.org/fr/kb/Activer%20et%20désactiver%20les%20cookies
- Opera™: http://help.opera.com/Windows/10.20/fr/cookies.html
The Data Subject can also configure their browser to send a code indicating to websites that they do not wish to be tracked ("Do Not Track" option):
- Internet Explorer™: http://windows.microsoft.com/fr-fr/internet-explorer/use-tracking-protection#ie=ie-11
- Safari™: http://support.apple.com/kb/PH11952
- Chrome™: https://support.google.com/chrome/answer/114836
- Firefox™: https://support.mozilla.org/fr/kb/comment-activer-option-ne-pas-pister
- Opera™: http://help.opera.com/Windows/12.10/fr/notrack.html