Preamble
These Privacy Policies form an integral part of the General Terms and Conditions (as defined below) and the definitions used in the General Terms and Conditions are reused in these Privacy Policies.
The purpose of this Privacy Policy is to inform Data Subjects of the manner in which their Personal Data is collected from the Site, how such Personal Data is processed by Lenasto and finally the Specific Rights (as defined below) that Data Subjects enjoy in relation to such processing as defined below.
Definitions
The following terms, whether used in the singular or plural in these Confidentiality Policies, shall have the following definition:
Intermediate archiving:
means the transfer of Personal Data which is still of administrative interest to Lenasto (for example, in the event of litigation and/or in the event of a legal obligation) to a separate database, logically or physically separate and, in any event, to which access is restricted. This archive is an intermediate step before the Personal Data concerned is deleted or made anonymous;
Privacy policy:
means this privacy and data protection policy implemented by Lenasto, which forms an integral part of the General Terms and Conditions;
General Terms and Conditions refers indiscriminately to: General Terms and Conditions of Use, General Terms and Conditions of Service and General Terms and Conditions of Sale.
Personal data:
means the personal data of the Data Subject, within the meaning of the Regulation on Personal Data, collected and processed by Lenasto in connection with the use of the Site;
Specific rights:
means the rights granted by the Personal Data Regulations to Data Subjects concerning the processing of their Personal Data and detailed in Article IX;
Person concerned:
refers to the natural person (Internet user, Customer, Subscriber) whose Personal Data is processed by Lenasto;
Regulation on Personal Data:
means Law no. 78-17 of 6 January 1978 relating to data processing, data files and individual liberties, in application of the General Data Protection Regulation;
Lenasto:
refers to the company Ecomeo OÜ, whose registered office is located at Lõõtsa tn 2a, 11415 Tallinn, Estonia, registered under the number 16563515.
Terminal(s):
means the hardware equipment (computer, tablet, smartphone, telephone, etc.) used by the Person Concerned to consult or view the Site and/or any other digital medium published by a third party.
Legal basis for processing
In accordance with the Personal Data Regulations, the processing operations referred to in these Privacy Policies are supported by a specific legal basis.
The Data Subject has consented to the processing of his/her Personal Data for one or more specific purposes.
The Site may have required the express consent of the Data Subject in order to carry out a specific processing operation explained at the time of obtaining consent.
The processing is necessary for the performance of a contract to which the Data Subject is a party or for the performance of pre-contractual measures taken at the Data Subject's request.
In order to use the Site and benefit from its services, the Data Subject has accepted at least the General Terms and Conditions of Use and, where applicable, the General Terms and Conditions of Sale and/or the General Terms and Conditions of Service. These documents formalize a contractual relationship between the Data Subject and Lenasto, serving in particular as the legal basis for the collection and processing of the Data Subject's Personal Data by Lenasto.
This Data is necessary for the performance of a certain number of processing operations linked to the execution of the contractual relationship between the Data Subject and Lenasto, the purposes of which are detailed in the paragraph entitled "The purposes of the processing operations".
The processing is necessary to comply with a legal obligation to which it is subject.
The processing of Personal Data may also be necessary to comply with a legal obligation to which Lenasto is subject, for example, the storage of logs of access to the Site, in accordance with Decree No. 2011-219 of 25 February 2011 on the storage and communication of data identifying any person having contributed to the creation of content placed online.
The processing is necessary for the purposes of the legitimate interests pursued by Lenasto or by a third party, unless the interests or the fundamental rights and freedoms of the Data Subject require the protection of personal data, in particular when the Data Subject is a child.
Lenasto may have a legitimate interest justifying the processing of the Data Subject's Personal Data, such as the processing of Data strictly necessary for fraud prevention purposes.
In such a case, Lenasto shall ensure that the processing in question is necessary to achieve its legitimate interest and shall assess the consequences of such processing for the Data Subject, in particular by taking into account the nature of the Data processed and the way in which they are processed.
Lenasto ensures that it does not disregard the interest or fundamental rights and freedoms by allowing the Data Subject, at any time, to object to all or part of the processing described in these Confidentiality Policies, as well as to exercise his or her Specific Rights, under the conditions set out in the paragraph entitled "Specific Rights".
Purposes of processing
The Data Subject's Personal Data is necessary to enable him or her to access, use and improve the Site, and to enable Lenasto to:
- Carry out operations relating to its commercial relationship with the Data Subject, ie invoicing, accounting, monitoring the "customer relationship" with a Customer or Subscriber, such as carrying out satisfaction surveys, managing complaints, using the Site and more generally services, etc. .. ;
- To select Customers or Subscribers in order to carry out studies, surveys and product tests, as well as loyalty, canvassing and promotional campaigns;
- To personalize its communications to Customers or Subscribers, in particular by means of information e-mails, according to their preferences and use of the Site;
- To carry out canvassing operations, ie the management of technical canvassing operations (including technical operations such as standardization, enrichment and de-duplication);
- Carrying out commercial solicitation operations;
- Drawing up commercial statistics, analyzes and marketing tools (including classification, scoring, etc.).
- The organization of competitions, lotteries or any promotional operation, with the exception of online gambling and games of chance subject to approval by the “Online Games Regulatory Authority”;
- The management of requests to exercise Specific Rights under the conditions set out in the paragraph entitled "Specific Rights";
- Management of unpaid and disputed amounts;
- The management of comments made by Concerned Parties on the Site and/or on internet pages published by Lenasto such as social network pages;
- Combating fraud.
Storage of Personal Data
The Site is hosted by the company whose contact details are available in the General Terms and Conditions of Use, accessible from the footer of the site.
Every precaution has been taken to store the Personal Data of Data Subjects in a secure environment and prevent it from being distorted, damaged or accessed by unauthorized third parties. The information transmitted by the Data Subject will never be transmitted to third parties for commercial purposes, nor will it be sold or exchanged, except with the Data Subject's express prior consent.
Collection of Personal Data on the Site
Lenasto collects the following Personal Data that Customers and Subscribers fill in and communicate when browsing the Site. This data is kept for a period of three (3) years, on an active basis, from the date of the last connection of the Person Concerned to the Site:
- Gender,
- Date of birth,
- email address,
- Username used on the Site,
- Payment identifier,
- Delivery address,
- Invoice address,
- Telephone number,
Connection data (date, time, IP address, pages consulted) of the Person Concerned when browsing the Site and, in particular, data relating to the use of Specific Services by the Subscriber,
The data entered by the Subscriber on the Site when using the Specific Services,
If applicable, the reason(s) for the exclusion (all the information needed to demonstrate the behavior, which is less than one month old and justifies the exclusion),
The above Personal Data is also kept in Intermediate Storage for a further period of two (2) years in accordance with the common limitation period.
- Invoices,
- Amount of transactions carried out as well as the date and time of these transactions,
The above Personal Data is also kept in Intermediate Storage for a further period of seven (7) years, in accordance with Lenasto's tax and accounting obligations.
Only the Personal Data designated as compulsory on the Site is required to have an Account.
Addressees or categories of addressee, if any
Lenasto may communicate to third parties certain Personal Data which are necessary for the completion of Orders under the General Terms and Conditions of Sale or Subscriptions under the General Terms and Conditions of Service, in order to ensure in particular:
- shipment of Products;
- the fight against fraud,
- after-sales service, etc.
Internet transaction security
In accordance with the General Terms and Conditions, the Site uses the technology of various PSP (Payment Service Provider) companies to secure the banking transactions of Customers and Subscribers.
Thus, when payment is made on the Site, the bank details of the Person Concerned are transmitted encrypted to the company processing the payment, without Lenasto being able to see them.
Lenasto does not collect the full number of the Customer's bank card or the Subscription, nor its cryptogram.
To exercise their rights, such as those identified in the "Specific Rights" paragraph, relating to their bank card details, the Data Subject is invited to contact the company that processed the payment directly. To obtain the contact details of the PSP company, please contact Lenasto at contact@Lenasto.com.
Specific Rights
In accordance with the Personal Data Regulations, the Data Subject may, at any time, benefit from the following Specific Rights of/to:
- access,
- correction,
- deletion,
- limitation of processing,
- portability,
- opposition,
- post-mortem guidelines.
Access rights
The Data Subject may obtain from Lenasto confirmation as to whether or not Personal Data concerning him or her is being processed and, where it is being processed, access to such Personal Data and the following information:
- the purposes of the processing;
- the categories of Personal Data;
- the recipients or categories of recipients to whom the Personal Data has been or will be disclosed;
- where possible, the intended retention period for the Personal Data or, where this is not possible, the criteria used to determine this period;
- the existence of the right to ask Lenasto to rectify or erase Personal Data, or to restrict the processing of Personal Data, or the right to object to such processing;
- the right to lodge a complaint with the CNIL;
where Personal Data is not collected from the Data Subject, any available information as to its source;
- the existence of automated decision-making, including profiling, and, at least in such cases, useful information concerning the underlying logic, as well as the importance and the anticipated consequences of this processing for the Data Subject.
Where Personal Data is transferred to a third country or to an international organization, the Data Subject has the right to be informed of the appropriate safeguards with respect to such transfer.
Lenasto provides a copy of the Personal Data being processed.
Lenasto may charge a reasonable fee based on administrative costs for any additional copies requested by the Data Subject.
Where the Data Subject submits his or her request electronically, the information shall be provided in a commonly used electronic form, unless he or she requests otherwise.
The Data Subject's right to obtain a copy of his or her Personal Data shall not prejudice the rights and freedoms of others.
Rights of rectification
The Data Subject may obtain from Lenasto, as soon as possible, the rectification of any Personal Data concerning him or her that is inaccurate. He or she may also request that incomplete Personal Data be completed, including by providing an additional declaration.
Erasure rights
The Data Subject has the right to obtain from Lenasto the erasure, as soon as possible, of Personal Data concerning him or her where one of the following reasons applies:
- the Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed by Lenasto;
- the Data Subject has withdrawn his/her consent to the processing of such Personal Data and there is no other legal basis for the processing;
- the Data Subject exercises his/her right to object under the conditions set out below and there is no compelling legitimate reason for the processing;
- the Personal Data has been processed unlawfully;
- the Personal Data must be deleted to comply with a legal obligation;
- the Personal Data has been collected from a child.
Limitation rights
The Person Concerned has the possibility of obtaining from Lenasto the limitation of the processing of his/her Personal Data when one of the following reasons applies:
- Lenasto verifies the accuracy of the Personal Data following a challenge by the Data Subject to the accuracy of the Personal Data;
- The processing is unlawful and the Data Subject objects to the erasure of the Personal Data and instead requests that its use be restricted;
- Lenasto no longer needs the Personal Data for the purposes of the processing, but it is still necessary for the Data Subject to establish, exercise or defend legal claims;
- The Data Subject has objected to the processing under the conditions set out below and Lenasto shall verify whether the legitimate grounds pursued prevail over the alleged grounds.
Right to data portability
The Person Concerned has the possibility of receiving from Lenasto Personal Data concerning him or her, in a structured, commonly used and machine-readable format when:
- The processing of Personal Data is based on consent or on a contract. And,
- Treatment is carried out using automated processes.
When the Data Subject exercises his or her right to portability, he or she has the right to obtain that the Personal Data be transmitted directly by Lenasto to another controller that it will designate when this is technically possible.
Right to object
The Data Subject may object at any time, on grounds relating to his or her particular situation, to the processing of his or her Personal Data based on the legitimate interests of Lenasto. The latter will then no longer process the Personal Data, unless it can demonstrate that there are compelling legitimate grounds for the processing which override the interests and rights and freedoms of the Data Subject, or may retain them for the establishment, exercise or defense of legal claims.
Likewise, we remind you that, if the Data Subject has provided a telephone number, he or she has the right to register on a telephone anti-solicitation list.
Post-mortem instructions
The Data Subject has the possibility of communicating to Lenasto directives relating to the conservation, deletion and communication of his/her Personal Data after his/her death, which directives may also be registered with a "certified trusted digital third party". These directives, or a sort of "digital will", may designate a person to be responsible for their execution; failing this, the heirs of the Data Subject will be designated.
In the absence of any directive, the heirs of the Person Concerned may contact Lenasto in order to:
- access Personal Data processing enabling "the organization and settlement of the deceased's estate";
- to receive communication of "digital assets" or "data similar to family memories, which may be passed on to heirs";
- to close the Data Subject's account on the Site and to oppose the continued processing of his/her Personal Data. In any event, the Data Subject has the possibility of indicating to Lenasto, at any time, that he or she does not wish to , in the event of death, that their Personal Data be communicated to a third party.
Exercising Users' Specific Rights
These rights may be exercised at any time by contacting Lenasto:
- By e-mail to the following address:
contact@Lenasto.com
- By post to the following address:
Ecomeo OÜ, Lõõtsa tn 2a, 11415 Tallinn, Estonia.
For the purposes of enforcing its rights under the conditions set out above and in the event that Lenasto has doubts about the person making the request, Lenasto may ask that person to provide proof of his or her identity by mentioning his or her surname, first name and e-mail address and to accompany the request with a copy of a valid form of identification.
A reply will be sent to the Person Concerned within a maximum of one (1) month following the date of receipt of the request.
If necessary, this period may be extended by two (2) months by Lenasto, which will notify the Person Concerned, taking into account the complexity and/or number of requests.
Should the Data Subject request the deletion of his or her Personal Data and/or exercise his or her right to request the deletion of his or her Personal Data, Lenasto may nevertheless retain them in the form of Intermediate Archiving, for the period necessary to meet its legal obligations, or for evidentiary purposes during the applicable limitation period.
The Data Subject may also lodge a complaint with the competent supervisory authority (the CNIL).
The security of your password
Lenasto takes every precaution to ensure the secure storage of the Data Subject's password.
However, the security of this password also depends on its design.
The Person Concerned is therefore reminded that, to be valid, his/her password must consist of at least 8 characters, including at least 3 of the following 4 types: upper case, lower case, numbers, special characters, etc.
There are mnemonics for creating complex passwords, such as:
- Keeping only the first letters of words in a sentence; for example, the sentence "Remember your password" corresponds to the password 1mdp@sr!
- By capitalizing the word if it is a noun (eg: word)
- Use punctuation marks (eg!)
- Expressing numbers using digits from 0 to 9 (eg Un ->1)
Cookies deposited on the Terminal of the Person Concerned following their browsing on the Site
Cookies are used on the Site.
A cookie is a piece of information deposited on the Terminal used by the Person Concerned to access the Site.
Cookies are related to the Person Concerned's browsing on the Site and make it possible to determine which pages he/she has consulted and the date and time of consultation.
At no time do these cookies enable Lenasto to identify the Data Subject personally.
These cookies are kept on the Terminal of the Person Concerned for no longer than thirteen (13) months.
More specifically, Personal Data collected from cookies issued by Lenasto or third parties is used to:
- To compile statistics and volumes of visits to and use of the Site in order to improve the interest and ergonomics of the services;
- To adapt the presentation of the Site to the display preferences of the Terminal of the Person Concerned (language used, display resolution, operating system used, etc.);
- To memorize information relating to a form completed by the Person Concerned on the Site (registration or access to your account);
- To implement security measures, for example when the Data Subject is asked to connect to the Site again after a certain period of time;
Thanks to cookies, Lenasto collects and processes all or part of the following Data for the purposes set out above:
- Information relating to the Terminal of the Data Subject and/or the Data Subject:
- Their type of Terminal (Smartphone, tablet, computer, etc.);
- Their Terminal operating system (Mac Os, iOS, Android, Windows, BlackBerry, etc.);
- Terminal plug-in categories and versions,
- Internet service provider (Orange, SFR, Bouygues, Free, etc.);
- The browser used (Safari, Chrome, Internet Explorer, etc.);
- Their advertising identifier linked to their Terminal's operating system;
- The IP address of their Terminal;
- Language preferences.
- Information on browsing and behavior on the Site:
- Statistics on the consultation of the various pages of the Site;
- The complete URL path to, via and from the Site;
- Information concerning The Person Concerned (age or age bracket, gender, declared and/or presumed socio-professional category, presumed centers of interest, etc.) linked to his/her activity on the Internet and communicated by third parties (advertisers, advertising agencies , etc.).
Opposition to cookies
The Person Concerned is informed, at the time of his/her first visit, that he/she has the option of opposing the recording of cookies which are accessory to the operation of the Site, in particular by configuring his/her Internet browser to do so or by exercising his/her choices on this page (see below).
When the Data Subject browses the Site, information may be recorded or read in his/her Terminal, subject to his/her choices.
[Opt-out insertion of each cookie]
The Person Concerned will find further assistance on the dedicated pages of his/her browser (hereinafter the most common browsers):
- Internet Explorer: http://windows.microsoft.com/fr-FR/windows-vista/Block-or-allow-cookies
- Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=fr&hlrm=en&answer=95647
- Safari: https://support.apple.com/kb/PH19214?locale=fr_FR&viewlocale=fr_FR
- Firefox: http://support.mozilla.org/fr/kb/Activer%20et%20désactiver%20les%20cookies
- Opera: http://help.opera.com/Windows/10.20/fr/cookies.html
The Data Subject may also set his/her browser to send a code indicating to websites that he/she does not wish to be tracked ("Do No Track" option):
- Internet Explorer™: http://windows.microsoft.com/fr-fr/internet-explorer/use-tracking-protection#ie=ie-11
- Safari™: http://support.apple.com/kb/PH11952
- Chrome™: https://support.google.com/chrome/answer/114836
- Firefox™: https://support.mozilla.org/fr/kb/how-to-activate-option-do-not-track
- Opera™: http://help.opera.com/Windows/12.10/fr/notrack.html
