Personal data protection policy

Purpose of this document

The purpose of this personal data protection policy is to inform you how our Aurega website collects and processes your personal data when you use the site.

In particular, it sets out the data collected, the purposes of its collection and processing, the legal basis relied upon, the recipients of the data, its retention period, and your rights over your data, in accordance with the General Data Protection Regulation (GDPR).

The Aurega site is a showcase website presenting the creations and products offered by Aurega SARL. No purchase or payment is made directly on this site.

Personal data is mainly collected when you use the contact form or when you subscribe to our newsletter.

Data controller

The controller of the personal data collected on our site is:

AUREGA SARL — 6027 route de Molières, Bois de Gal, 82130 L’Honor-de-Cos, France — info@aurega-mode.fr

Purpose

The processing is intended to manage the website as well as the requests sent by users through the contact form and, where applicable, their newsletter subscription.

It notably makes it possible:

• to allow users to contact Aurega;
• to receive and handle requests from individuals, professionals, journalists and other correspondents;
• to answer the requests, questions or enquiries sent through the contact form;
• to follow up on exchanges with users;
• to manage and ensure the proper operation, security and maintenance of the website;
• to allow users to subscribe to the newsletter, should they wish to;
• to send the newsletter as well as information about the brand, including its news, new arrivals, collections, events or any other content likely to interest subscribers;
• to measure the site’s audience and traffic, subject to the user’s consent where required;
• to produce statistics on the use of the site in order to improve its content, its operation and the user experience.

Legal basis

Regarding the contact form

Processing carried out through the contact form is based on Aurega’s legitimate interest, in accordance with Article 6(1)(f) GDPR, which consists in being able to receive, handle and answer the requests addressed to it.

Where the request concerns the preparation or performance of a contractual relationship at the data subject’s request, the processing may also be based on Article 6(1)(b) GDPR, relating to steps taken prior to entering into a contract at the data subject’s request.

Regarding the newsletter

Newsletter subscription is based on the data subject’s consent, in accordance with Article 6(1)(a) GDPR.

Regarding cookies and other trackers

Processing linked to cookies and other trackers, in particular those used for audience measurement, is carried out in accordance with the applicable regulations and, where necessary, on the basis of the user’s consent, in accordance with Article 6(1)(a) GDPR.

The banner displayed on your first visit lets you accept or refuse audience measurement: no audience measurement tracker is set until you have given your agreement.

Categories of data processed

The data collected is:

Regarding the contact form

• the capacity of the person making the request: individual, professional, press or other;
• surname and first name;
• e-mail address;
• telephone number, where provided;
• the subject of the request;
• the content of the message;
• the date and time of the request;
• the information needed to handle and follow up on the request.

Regarding newsletter subscription

• the e-mail address.

Regarding the use of cookies

• the IP address;
• data relating to the browser and device used;
• the pages viewed;
• the date and time of connection;
• data relating to browsing on the site;
• information relating to cookies and other trackers.

Source of the data

The data is collected directly from the data subjects:

• when they fill in the contact form;
• when they subscribe to the newsletter;
• when they browse the site and accept, where required, the use of cookies and other trackers.

Certain technical data may also be collected automatically as part of the operation and security of the site.

Mandatory or optional nature of the data collected

In the contact form, the fields identified as mandatory are necessary to handle the request.

The telephone number is optional. Users may therefore choose not to provide it.

Failure to provide the mandatory information may prevent Aurega from handling or answering the request.

For the newsletter, providing an e-mail address is necessary in order to receive the communications. Subscription is entirely optional.

Cookies and other trackers that are not strictly necessary for the operation of the site are subject to the user’s consent where required.

Recipients of the data

Within the limits of their respective needs, the following may receive all or part of the data:

• authorised staff within Aurega responsible for handling requests;
• staff authorised to manage subscriptions and send the newsletter;
• the technical providers responsible for hosting, maintaining and securing the site;
• the providers used to operate the contact form;
• the provider used to manage and send the newsletter;
• audience measurement providers, where the user has consented to the cookies concerned.

Transfers of data outside the European Union

The site is hosted by Netlify, whose parent company is established in the United States. In order to deliver, operate and secure the site, Netlify may process certain technical data, including the IP address, from a country outside the European Union.

Where such transfers take place, they are governed in accordance with Chapter V GDPR, in particular by the standard contractual clauses adopted by the European Commission.

When audience measurement is active, Google Analytics may also process data from the United States. Those transfers are governed by the standard contractual clauses adopted by the European Commission and by Google’s certification under the EU-US Data Privacy Framework.

Data retention periods

Data collected through the contact form is kept for as long as is necessary to handle the request and follow up on the exchanges, then for a maximum of three years from the last contact with the data subject.

Data relating to commercial or professional exchanges may be kept for the duration of the business relationship, then for three years from the end of that relationship, subject to applicable legal obligations.

Data collected when subscribing to the newsletter is kept for the whole duration of the subscription. On unsubscribing, the e-mail address is removed from the mailing list, subject to keeping the information needed to evidence consent or objection.

Data relating to audience measurement cookies and other trackers is kept for a maximum of thirteen months, in line with the CNIL’s recommendation.

Technical log data is kept for six months, within the limits necessary for the security and proper operation of the site.

Data subject to a legal retention obligation is kept for the period laid down by the applicable laws and regulations.

Your rights

In accordance with the applicable regulations, in particular the GDPR, you have the following rights, under the conditions it provides for:

• the right of access to your personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of your data under the conditions provided for by the regulations;
• the right to restriction of processing in the cases provided for by the GDPR;
• the right to object to the processing of your data where it is based on legitimate interest;
• the right to data portability where that right applies;
• the right to withdraw your consent where the processing is based on it.

For the newsletter, you may in particular withdraw your consent at any time by clicking the unsubscribe link included in every communication.

You can exercise your rights by writing to info@aurega-mode.fr.

You also have the right to lodge a complaint with the French data protection authority (CNIL) if you consider that the processing of your personal data does not comply with the applicable regulations.

Withdrawing consent, and what it means

Where the processing of personal data is based on the data subject’s consent, that consent may be withdrawn at any time, in accordance with Article 7(3) GDPR.

For the newsletter, consent may be withdrawn using the unsubscribe link included in the communications sent, or by contacting Aurega at info@aurega-mode.fr.

Withdrawing consent has no consequence other than unsubscribing from the newsletter and stopping the communications concerned. It does not affect the lawfulness of processing carried out beforehand on the basis of consent.