POLICY ON PERSONAL DATA IN STORES

The data controller is the company CHEVIGNON, located at: 36 rue du Faubourg Saint-Antoine, 75012, Paris, France (RCS of Paris: 316 643 170).

The Company has a Data Protection Officer whose mission is to ensure compliance with the regulations in force on the protection of personal data.

You can contact the Company's DPO at the following address: dpochevignon@chevignon.fr or by mail to the address of its head office indicated below.

Personal Data is any data of a customer, a natural person, allowing their identification directly or indirectly.

The Company, in stores under the CHEVIGNON brand, collects directly through its branches, the Data of adult natural persons and minor natural persons aged between 16 and 18, subject to having obtained parental authorization from the legal representative(s).

Consequently, the Company cannot be held liable and the Company reserves the right (i) to carry out any checks concerning the age of the person concerned and (ii) where applicable, to immediately delete any customer account and/or cancel any current order if the above conditions are not met.

When collecting Data by sales advisors in a CHEVIGNON store when purchasing one or more items, organizing a competition or when collecting an item reserved through the “e-reservation” process or without even a purchasing process, the Company collects all or part of the
Following data, and in particular:

• Name
• First name
• Postal delivery address and, where applicable, any additional information relating to delivery
• Billing address
• Email address
• Date of birth
• Phone number
• Sex
• Information relating to transactions and monitoring of the commercial relationship (details of products purchased, quantities, amount, payment terms, discounts possibly granted)
• Information relating to participation in competitions and/or any promotional operations (date, frequency, responses to competitions, prizes awarded).

Some Data is mandatory, others are optional in accordance with what is indicated to you at the time of Data collection.

The Company is also required to collect, indirectly through its department store corners, data concerning customers, individuals, of the department store brand concerned, in particular for the purposes of managing the after-sales service for its products.

The relevant department stores act as data controllers
of their customers. CHEVIGNON, recipient of the data, acts as an independent data controller for its own purposes.

Your Personal Data is hosted within the European Union. The Data collected is only intended to be used by the Company, with your consent.

The Company may however use commercial and technical subcontractors to whom the Data could be transmitted temporarily and securely, such as:

• Service providers who assist us and help us manage loyalty programs, customer relationship management (CRM);
• Marketing agencies to carry out our advertising, marketing and sales campaigns;
• Service providers who assist us and help us provide IT services, for maintaining our database and related software and applications: these services may sometimes have access to your data to carry out the requested tasks;
• Logistics and transport providers for the delivery of parcels;
• Service providers responsible for customer relations, including the collection of customer reviews, and after-sales service;
• The companies providing support services which may act on our behalf as subcontractors (for IT services, accounting control, legal services, etc.) within the meaning of the applicable regulations).

Guarantees have been taken to ensure a sufficient level of protection of Data with regard to the requirements of French and European regulations.

The Personal Data processed by the Company are not, in principle, transferred outside the European Union.

Certain Data may nevertheless be transmitted to subcontractors located outside the territory of the European Union.

Consequently, if said Data is likely to be processed in countries that are not recognized as offering an adequate level of protection of personal data in accordance with the Data Protection Regulation, the Company will ensure that these service providers have undertaken to respect the guarantees in accordance with this regulation for such transfers (example: standard contractual clauses of the European Commission, Binding Corporate Rules (BCR), or other system recognized by this regulation.

All information relating to these guarantees is available from the DPO whose address is given in point I.

As part of our business, the Company may also be required to transmit
Data :

• To legal authorities for the purpose of responding to an injunction from the latter.
• To certain regulated professions such as lawyers, notaries, auditors in the context of the execution of their mandate or directly to judicial or administrative authorities in application of legal provisions.
• With your consent, to partner companies, particularly in the context of organizing competitions. The dedicated information notice and opt-in will then be set up by our Company. When you have consented to the transmission of your data to these partners, the processing of your data will be subject to their own data protection policy, under their responsibility.
• In the context of a restructuring, reorganization or transfer in any form and for any reason whatsoever (in particular transfer of business assets, dissolution, liquidation, merger, etc.) of its entities.

In any event, the Data will never be transmitted to third parties for commercial purposes, nor sold or exchanged, without your express consent.

The Company attaches particular importance to the security of the Data of Users of the Site and its Customers.

Appropriate technical and organizational measures are implemented to ensure that the Data is processed in a manner that guarantees its protection against loss, destruction or accidental damage that could affect its confidentiality or integrity.

When developing and designing, or when selecting and using the various tools that enable the processing of Data, the Company ensures, where applicable with the publishers of such tools, that they enable an optimal level of protection of the Data processed.

The Company thus implements measures that respect the principles of protection by design and protection by default of the data processed. As such, it is able to use pseudonymization or data encryption techniques when this proves possible and/or necessary.

Your personal data is kept for a period according to the purposes of the collection, namely: Data relating to customer complaints, requests to exercise rights, the fight against in-store fraud are kept in accordance with the applicable legal limitation periods (including those provided for in the civil code, penal code, consumer code).

In accordance with the applicable regulations regarding personal data, you have the right to access, object to processing, modify (rectify, update), delete, withdraw consent, limit and port your Personal Data and may define post-mortem directives. You may also lodge any complaint with a supervisory authority such as the National Commission for Information Technology and Civil Liberties www.cnil.fr.

The Company complies with the rules applicable to each prospecting channel under French law and under the GDPR.

In all cases, the Company gives you the possibility to oppose it either by an unsubscribe link present in the email, or through your account, if you have one on chevignon.fr, or by text message by sending a stop text message.

Certain Data not provided or any opposition to their collection may make certain services offered inaccessible, for example: an order for products and/or participation in a competition or
to a promotional operation.

You can exercise your rights by writing to the following address: dpochevignon@chevignon.fr or by writing to the address of its head office: 36 rue du Faubourg Saint-Antoine, 75012, Paris, France or to the following email address: dpochevignon@chevignon.fr – unless otherwise specified in an email that may be sent to you.
sent by an Affiliate in the context of commercial communications made on its own initiative. In the latter case, the exercise of your rights is carried out via the email address specified in said communication. If applicable, a copy of your identity card may be requested.