Privacy Policy

ARLETTIE PARIS (hereinafter referred to as “we”, “us”, “our”) is committed to protecting the personal data and privacy of all individuals registered for the Services it offers (hereinafter referred to as “you”, “your”).

This Privacy Policy is intended to inform you, with full transparency, of how your personal data is collected, used, and processed when browsing our Website or participating in our Events.

We place great importance on the trust you place in us. Accordingly, we treat the respect and protection of your personal data as a top priority and undertake to process it in compliance with the General Data Protection Regulation (GDPR) and applicable French legislation.

1- What personal data do we process and how is it collected?

We only collect personal data necessary for the purpose for which it is processed. The mandatory nature of providing this information is indicated in the collection form when you register or update your information.

This data includes:

• Your identification data, such as your first name, last name, gender, and date of birth;
• Your contact information, such as your personal and/or professional postal address, personal and/or professional phone number, and personal and/or professional email address;
• Your personal information, namely your date of birth, all information related to your marital status (spouse, children, etc.), and your interests;
• Your event participation information, including all information related to your membership in the Arlettie Club and/or your participation in events, such as registration and attendance, and, if applicable, your purchases, including purchased products and payment method information;
• Data of individuals who may accompany you to certain events (hereinafter referred to as "Guests"): the organization of certain events allows you to be accompanied by third parties under specific conditions. In such cases, to ensure proper conduct of the relevant events and for security reasons, we may process information concerning third parties whose personal data you have previously communicated to us, in whole or in part.

This Policy also applies to the processing of Guests’ personal data that you provide to us. You are therefore invited to ensure that these third parties have authorized you to share their data for this purpose and that they have read this Policy.

• Your connection data when visiting our website, such as information about your computer or mobile device hardware and software. This includes your IP address, device type and model, browser type, and device identification. This information is used to ensure the proper functioning of the website, maintain its quality, for general statistics, and to comply with our legal and regulatory obligations.
• Cookies: we invite you to refer to the section below regarding cookies.

To collect this data, we use various collection methods, including:

• Directly from you: when you fill out a registration form, register for an event, make a transaction, or provide information by phone, mail, online, email, or any other means;
• Indirectly: when you visit our website (e.g., via cookies or connection data) or through the events you attend. We also collect Guests’ personal data indirectly through the forms you provide to us.

2- Are cookies placed when browsing the site?

A "cookie" is a text file placed on your device via a browsing tool. Cookies allow the issuer—and only the issuer—to identify the device on which the cookie is stored, for the duration of the cookie’s validity or storage period, and they cannot be used to run programs or transmit viruses to your computer.

We use cookies or similar technologies to:

1. Facilitate your navigation on the Site;
2. Enable the main functionalities of the Site, secure your connection, and provide direct access to personal areas of the Site using credentials or data you may have previously provided;
3. Customize the presentation of the Site according to your device’s display preferences during your visits;
4. Conduct statistical studies.

You have the option to accept or refuse cookies. Most browsers automatically accept cookies, but if you prefer, you can usually modify your browser settings to refuse cookies. If you choose to refuse cookies, you may not be able to fully enjoy all the functionalities of the Site.

You can configure your browser so that:

• Cookies are either stored or rejected, either systematically or according to the issuer;
• You are prompted to accept or refuse cookies each time, before a cookie can be stored on your device;
• Cookies already stored on your device can be deleted at any time.

The management of cookies varies depending on the browser. Instructions are provided in each browser’s help menu, and for guidance, the following links are provided as examples:

• For Chrome : https://support.google.com/chrome/answer/95647?hl=fr&hlrm=en

• For FireFox : http://support.mozilla.org/fr/kb/cookies-informations-sites-enregistrent?redirectlocale=fr&redirectslug=G%C3%A9rer+les+cookies

• For Internet Explorer : https://support.microsoft.com/fr-fr/help/17442/windows-internet-explorer-delete-manage-cookies

• For Safari : https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

3- On what bases and for what purposes do we process your personal data?

The personal data we collect is processed in accordance with applicable regulations to fulfill explicit, legitimate, and specific purposes, either based on our General Terms and Conditions, to comply with legal, regulatory, or contractual obligations with our partners (including Brands), or subject to your prior consent.

The purposes of the processing we carry out are described below:

A. PROVIDING SERVICES

We collect and use your personal data to enable us to organize the Events we host, in particular to:

• Manage your account and, where applicable, your membership in the ARLETTIE Clubs;
• Inform you about our Events and allow you to participate, in compliance with our obligations and commitments to our partners, including Brands;
• Manage your participation in our Events, including access arrangements, where applicable, in accordance with conditions imposed by Brands as outlined in the General Terms and Conditions, provided such processing is legitimate and lawful;
• Process transactions made during sales and, if necessary, handle any incidents (fraud management, payment issues, disputes, etc.);
• Ensure the quality of our Services and improve them. To this end, we:
• Prepare personalized statistics to enhance the delivery of our Services by providing offerings that may particularly interest you based on your history and purchasing behavior, and
• Prepare general statistics, which are anonymized when processing your personal data is not necessary for their production.
  We may also contact you for surveys;
• Provide customer service;
• Contact us.

Your personal data is also essential for our interactions with you during your navigation on the Site, the management of your registration for our Services, and, more generally, in the context of our business relationship with you.

You are informed that, in certain circumstances described in the General Terms and Conditions, we may:

• Contact you via email, SMS, postal mail, and/or telephone, depending on the preferences you have expressed;
• Select Events that may interest you based on the information you have provided or, conversely, refrain from contacting you if otherwise, to provide a service tailored to your interests and/or obligations to which we may be bound by our partners.

B. SECURING THE SITE

We ensure the security of your personal data, as well as third-party personal data, against any fraudulent access, use, or disclosure by implementing enhanced data protection through appropriate physical and logical security measures to guarantee the integrity of your data and its confidential and secure processing.

Within the limits imposed by the current state of technology, we make every effort to ensure that your information is fully secure. To this end, we work with trusted and reputable partners who provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures, compliant with industry standards, so that the processing of your data meets regulatory requirements and protects your rights.

C. COMPLYING WITH OUR LEGAL AND REGULATORY OBLIGATIONS

In the context of operating the Site and all services offered as described in this Policy, we are subject to various legal and regulatory obligations that involve the retention of your personal data.

4- Who are the recipients of the personal data we process?

We process your personal data exclusively for the purposes described in this Policy.

To this end, we may transfer your data under the conditions described below:

• Within the ARLETTIE group, solely to allow you access to ARLETTIE Spaces where ARLETTIE organizes the Events you wish to attend;
• To trusted partners acting as data processors, in order to provide you with all the services offered on the Site and/or during our Events, specifically:
• To host your data, assist you with the use of the Site, or during your participation in our Events;
• To send you emails;
• To send you postal mail (postal routing center);
• To send you SMS messages;
• To allow you to access the Events;
• In the context of a sale, to process payments (including credit/debit card management);
• To manage logistics (spaces, logistics centers);
• For statistical analysis purposes to help us improve the quality of our products and services.

These third parties are contractually obliged to use the personal data we provide solely for the purposes for which they were engaged. They are also required to maintain the security and confidentiality of your information with protection equal to or greater than the measures we implement.

5- When is data collected and for how long is it retained?

We only retain your personal data for as long as necessary to provide the services we offer, unless the law requires otherwise.

Accordingly, we retain your Account data for a maximum period of five (5) years from the closure of your account, unless the law requires certain data to be retained for a shorter period.

Your banking data is not retained beyond the time necessary to complete the transaction, unless you have given us prior consent to do so. As an exception to the above, if you have not provided such consent, your card number and expiration date may be retained as evidence in case of a potential transaction dispute for a maximum period of thirteen (13) months from the date of the debit, which may be extended to fifteen (15) months for deferred debit cards.

Cookies placed on your browser have a lifespan of thirteen (13) months.

As an exception, this data may be retained and archived for an additional period solely to manage ongoing claims and disputes, to comply with legal and/or regulatory obligations, and/or to respond to requests from authorized authorities.

6- Are your data transferred outside the European Union?

As part of the provision of our Services, we may transfer your personal data to certain external service providers located outside the European Economic Area (EEA), so that the processing of your personal data involves a transfer of data outside the EEA.

In such cases, we ensure that this transfer is carried out in compliance with applicable regulations by taking all appropriate measures and providing legal, technical, and operational safeguards to ensure the confidentiality and security of this data, in particular by:

• Transferring your personal data to countries that the European Commission has recognized as providing an adequate level of protection for personal data; or
• Ensuring that the recipient entity protects your personal data under conditions approved by the European Commission, either through the signing of specific contracts or, in the case of the United States, through adherence to the Privacy Shield framework, which requires them to provide a level of protection comparable to that of personal data shared between Europe and the United States.

7- What are your rights and how can you exercise them?

In accordance with applicable regulations, you have the following rights:

• Access to your personal data, allowing you to receive a copy of the personal data we hold about you and to verify that we process it in compliance with applicable regulations;
• Rectification of personal data, allowing you to correct any incomplete or inaccurate information we hold about you;
• Erasure of your personal data, allowing you to request that we delete personal data when we have no legitimate reason to continue processing it. You also have the right to request deletion if you have exercised your right to object to processing (see below) or if we are required to erase your data under applicable law. Please note that we may not always be able to comply with a deletion request for specific legal reasons, which will be communicated to you, if applicable, at the time of your request;
• Information on the purpose of data processing, allowing you to understand when we rely on a legitimate interest (ours or a third party’s) and your particular situation gives you reason to object to the processing because you believe it affects your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds for processing your personal data;
• Request restriction of processing, allowing you to ask us to suspend the processing of your personal data in the following cases:
• If you want us to establish the accuracy of your personal data;
• When our use of your personal data is unlawful, but you do not want us to erase it;
• When you need us to retain personal data even if we no longer need it, because you require it to establish, exercise, or defend legal claims;
• When you have objected to our use of your personal data, but we need to verify whether we have compelling legitimate grounds for using it;
• Data portability, allowing you to request that we provide your personal data to you or to a third party you have chosen, in a structured, commonly used, and machine-readable format. Please note that this right applies only to automated personal data you initially provided for use or when we used the personal data to perform a contract with you;
• Withdrawal of consent, at any time, where we rely on consent to process your personal data. This does not affect the lawfulness of any processing carried out before you withdrew your consent or when we rely on another legal basis for processing. If you withdraw consent, we may not be able to provide certain products or services. We will inform you at the time you withdraw consent if this is the case.

These rights can be exercised by contacting us at donneespersonnelles@arlettie.fr and providing proof of your identity. Additionally, some of these rights can be exercised directly through your account settings. If you no longer wish to receive messages from us, you can click the link at the bottom of the email. For technical reasons, a reasonable period is necessary to process your request, and you may receive a few messages during that time.

Exercising some of these rights may prevent us from providing you access to the Site and/or using all or part of the services we offer, including informing you about upcoming Events.

You also have the right to file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the supervisory authority responsible for ensuring compliance with personal data obligations.

Finally, please note that we may be required to disclose your personal data, under the conditions provided by law, to a judicial or administrative authority duly authorized.

8- Can this policy be modified?

We may, from time to time, make changes to this Policy, particularly because we update our services and/or due to applicable regulations requiring such changes. We will inform you of any updates via a notice on the Site or by other means.

In any case, we recommend that you regularly review this Policy to stay informed about our latest privacy practices.

The most recent version of the Policy is the one dated at the end of this document.

Date of last update of this Policy: October 5, 2018.