Privacy policy

It concerns you whenever you visit and/or make a purchase on our websites or applications, when you sign up to receive marketing communications and generally whenever you interact with us.

This Privacy Policy is designed to help you understand how Bastille collects and processes your personal data, and what your rights are.

 

1. Who is responsible for processing your personal data?

Ester, a société par actions simplifiée (simplified joint stock company) registered under number 852 938 745 RCS Créteil, whose registered office is located at 5 avenue du Général de Gaulle, 94160 Saint-Mandé, France (" Bastille "or " we ") is responsible for processing your personal data.

2. What personal data do we collect and how?

We collect the following personal data:

• Data you provide us with: we collect personal data that you communicate directly to us (such as your surname, first name, contact details, information relating to your orders or requests, etc.) when you use our websites, applications and services, in particular when you :
• create an online account
• shop online
• subscribe to our newsletters
• fill in a form online or in-store
• take our online personality test to discover the fragrance we recommend for you
• post an opinion/comment on one of our products or on one of our blog posts
• contact us (including by phone, email or via our online contact form) or interact with us

The data we ask you for, which is essential to provide you with the services you request or to respond to your queries, is identified by an asterisk or equivalent on the collection forms or is specified as such verbally at the time of collection. If you do not fill in the mandatory fields or do not provide the information marked as mandatory, we will not be able to provide you with the requested services or respond to your requests.

You undertake to provide accurate information that does not harm the interests or rights of third parties.

• Automatically collected data : when you visit our websites or applications, data is automatically recordedviayour browsing traces, eitherindirectlyvia third-party cookies or directly via server event logs (log files). This is your browsing data. This includes data relating to your connection to the website (IP address, date and time of connection, search engine used, etc.) and data relating to the equipment you are using (type of equipment, operating system and settings).

Our services are not designed for minors and are not intended for them. We do not knowingly solicit or collect personal data from minors. Persons under the age of 18 may not deal with Bastille. If we discover that we have collected information about a minor, we will delete it. Please contact us using the contact details in section 8 below if you believe you have provided us with information about a minor.

3. Why do we collect your personal data?

We only process your personal data where we have a legal basis to do so:

• Processing necessary for the performance of the contract entered into with you: we use your data to manage the contract entered into with you and to meet our contractual obligations, and in particular :

• Supply of products purchased by you, transaction and billing processing, delivery management, management of Internet and payment fraud and payment incidents.
• Manage your account online
• Customer relationship management

• Processing for which you have given your consent:

• Processing of browsing data used to measure the audience for our websites and applications
• Processing your contact requests
• Our newsletter
• Online publication of your opinions/comments about one of our products or an article on our blog

• Processing necessary for our legitimate interests:

• Customer relationship management
• Providing and improving our website and applications, and maintaining a secure environment
• Sending marketing communications to our customers to promote and develop our business
• Commercial statistics, after making your data anonymous or, in any case, after implementing procedures designed to prevent your re-identification.
• Defending our interests in the event of litigation or legal action

• Processing necessary to comply with our legal obligations: some of your data is also processed to comply with our legal obligations (for example, our obligations to manage requests to exercise rights under personal data protection rules) and to ensure the defense of our interests in the event of litigation or legal action.

4. With whom do we share your personal data?

We share your personal data only with :

• our duly authorized personnel, who need access to your data in the course of their duties in connection with the purposes described above;
• our service providers acting as subcontractors;
• our external advisors (lawyers, auditors, etc.) and debt collection agencies, where necessary for the purposes of our legitimate interests;
• public or judicial authorities, when we are legally obliged to do so or to protect our rights or the rights of third parties.

We may also share your personal data with third parties in connection with a potential or actual sale or restructuring of our company or certain of our assets, in which case your data may form part of the transferred assets.

5. Where are your personal data processed?

We store your personal data in the European Union.

However, it is possible that your data may be transferred outside the European Union when it is transmitted to processors located outside the European Union. Where applicable, we undertake in the absence of an adequacy decision by the European Commission under Article 45 of the RGPD, to frame such a transfer by appropriate transfer mechanisms under Articles 46 et seq. of the RGPD (such as standard contractual clauses adopted by the European Commission). You may, if necessary, obtain a copy (excluding confidential provisions) at any time by contacting us using the details given in Article 8 "How to contact us".

6. How long will your data be stored?

We keep your personal data only for as long as is strictly necessary for the purposes set out herein and in accordance with applicable regulations.

Your data is stored as follows:

• Account data: when you create an online account, your personal data (such as your first and last name, contact details, billing and delivery addresses, order history, etc.) is stored for as long as you order products or use our services via your account. Your data and your account will be deleted if :

• you decide to close your account; or
• your account is inactive, i.e. you have not made any purchases or used any of our services for 2 consecutive years and you have stopped interacting with us during this second year (in particular, you have not opened our emails, you have not logged in to your account, etc.).

• Data relating to your order: when you place an order with us, your personal data (billing address, order content, payment methods, etc.) is kept for 5 years from the end of the contractual relationship.

• Bookkeeping: your data is archived for 10 years from the end of the current financial year (legal period).

• Newsletter subscription: we will send you our newsletters until you unsubscribe via your account (if applicable) or via the unsubscribe link provided in each newsletter, or if no account is associated with the e-mail address used to subscribe to the newsletter, 3 years after your last interaction (click) with a newsletter.

Please note that your data may be kept for longer periods, for example in order to establish proof of a right or to comply with a legal obligation. In all cases, your data will not be kept beyond what is strictly necessary for the purposes for which it is processed. When your data is no longer required, we will ensure that it is deleted or made anonymous.

7. What are your rights?

You have a number of rights over your data.

• You may revoke your consent to any processing of your data based on your consent at any time.
• You can ask us to confirm whether we process your data and, if so, inform you of the characteristics of the processing, allow you to access it and obtain a copy.
• You can ask us to rectify or complete your data if it is incorrect or incomplete.
• You can ask us to delete your data or restrict its processing.
• You can ask us to provide you with your data in a structured, commonly used and machine-readable format, or you can request that it be transmitted directly to another data controller.
• You have the right to define (general or specific) directives concerning the fate of your data after your death.
• You may object to any processing of your data that is based on our "legitimate interest". If you exercise this right, we must cease processing unless we can demonstrate compelling legitimate grounds that override your fundamental rights and freedoms, or for the establishment, exercise or defense of legal claims.
• You may object at any time to the processing of your data for prospecting purposes.

You can exercise your rights by contacting us at the address given in article 8 "How to contact us".

You also have the right to lodge a complaint with the competent supervisory authority regarding the processing of your data. In France, the supervisory authority for the protection of personal data is the CNIL (www.cnil.fr).

8. How to contact us

For more information about your rights, to exercise them or for any questions or complaints about the protection of your personal data, you can write to us at the following address: Ester - Bastille Parfums - 5, avenue du Général de Gaulle, Saint-Mandé, 94160, France, or e-mail us at hello@bastilleparfums.com.