The User may, as applicable, exercise the following rights:

• Right of access (to be informed about which personal data the Company processes, for what purposes, and to whom such data is disclosed)
• Right to rectification (correction of any inaccurate or incomplete data)
• Right to erasure / right to be forgotten (deletion of personal data from the Company’s records where its retention is no longer necessary)
• Right to restriction of processing (for example, where the accuracy of the data is contested)
• Right to data portability (the right of the Customer to receive their personal data in a structured, commonly used and machine-readable format)

These rights may be exercised free of charge by the User by sending the relevant request by post or email to the Data Protection Officer (DPO), unless such requests are manifestly repetitive or excessive and, due to their volume, impose an administrative burden on the Company, in which case the User may be required to bear the relevant cost.

If the User exercises any of the above rights, the Company shall make every reasonable effort to satisfactorily complete the relevant request within thirty (30) days of receiving it, informing the User either of the action taken or of the specific reasons preventing the Company from fulfilling the request.

Processing of Data by Third Parties

It is the responsibility of the Company, as Data Controller, to engage Data Processors that have implemented appropriate technical and organisational measures to ensure that processing complies with the requirements of Regulation (EU) 2016/679 and any other applicable European and national legislation.

Processing by a Data Processor, acting as a partner of the Company, shall be governed by a contract or other legal act under Union or Member State law that is binding on the Data Processor in relation to the Company and sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of Data Subjects, as well as the obligations and rights of the Data Controller.

Such contract or other legal act shall provide, in particular, that the Data Processor:

1. Processes personal data only on documented instructions from the Company, as Data Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the Data Processor is subject. In such a case, the Data Processor shall inform the Data Controller of that legal requirement before processing, unless such law prohibits such information on important grounds of public interest.
2. Ensures that persons authorised to process personal data have committed themselves to confidentiality or are subject to an appropriate statutory obligation of confidentiality.
3. Takes all necessary measures required pursuant to Article 32 of Regulation (EU) 2016/679.
4. Complies with the conditions referred to above concerning the engagement of another Data Processor.
5. Taking into account the nature of the processing, assists the Data Controller, through appropriate technical and organisational measures and insofar as this is possible, in fulfilling the Data Controller’s obligation to respond to requests for exercising the Data Subject’s rights laid down in Regulation (EU) 2016/679.
6. Assists the Data Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of Regulation (EU) 2016/679, taking into account the nature of the processing and the information available to the Data Processor.
7. At the choice of the Data Controller, deletes or returns all personal data to the Data Controller after the end of the provision of services relating to processing and deletes existing copies, unless Union or Member State law requires the storage of such personal data.
8. Makes available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in this section and allows for and contributes to audits, including inspections, conducted by the Data Controller or another auditor authorised by the Data Controller.

With regard to the final obligation above, the Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes Regulation (EU) 2016/679 or other Union or Member State data protection provisions.

Where a Data Processor engages another Data Processor to carry out specific processing activities on behalf of the Company as Data Controller, the same data protection obligations set out in the contract or other legal act between the Company and the initial Data Processor shall be imposed on the other Data Processor by way of a contract or other legal act under Union or Member State law. In particular, the other Data Processor shall provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing complies with the requirements of Regulation (EU) 2016/679.

Where the other Data Processor fails to fulfil its data protection obligations, the initial Data Processor shall remain fully liable to the Company, as Data Controller, for the performance of the other Data Processor’s obligations.

Cookies

A cookie is a small text file that a website stores on your computer or mobile device when you visit the website.

• First-party cookies are cookies set by the website you are visiting. Only that website can read them. In addition, a website may use external services that also set their own cookies, known as third-party cookies.
• Persistent cookies are cookies stored on your computer that are not automatically deleted when you close your browser, unlike session cookies, which are deleted when you close your browser.

Each time a User visits the website, they may be asked to accept or reject cookies.

By storing a User’s cookies, the website can remember their preferences, making it possible to suggest new products that may be of interest to them or to display advertisements on social media. This allows Users to discover products they may not previously have been aware of and to receive information about offers and promotions.

Cookies may also be used to generate anonymous statistics regarding the browsing experience on our website.

The three types of first-party cookies we use are:

1. Store visitor preference cookies
2. Cookies required to make our websites functional
3. Analytics cookies used to collect data about User behaviour

Visitor Preference Cookies

These cookies are set by us and can only be read by us. They remember:

• whether you have accepted or rejected this website’s Cookie Policy
• whether you have already responded to our survey pop-up regarding how useful you found the website content, so that you will not be asked again

Functional Cookies

Certain cookies are necessary for specific website functions to operate. For this reason, they do not require your consent. These include, in particular:

• authentication cookies
• technical cookies required by certain IT systems

Authentication Cookies

These cookies are stored when you log in to our website using the authentication service. By doing so, you accept the relevant Privacy Policy.

Analytics Cookies

We use these cookies solely for internal research purposes, in order to understand how we can improve the services we provide to all Users.

These cookies assess how you interact with our website as an anonymous User. The data collected does not personally identify you.

This data is not shared with third parties or used for any other purpose. Anonymous statistical information may, however, be shared with contractors working on marketing projects or with developers of new products.

You are free to refuse these types of cookies through the cookie banner displayed on the first page you visit.

Advertising or Marketing Cookies

These cookies are used to display advertisements that are more relevant and appealing to each User and more closely aligned with their interests. They may also be used for targeted advertising in order to reduce irrelevant or repetitive advertisements.

Third-Party Cookies

Some of the content displayed on our website may be provided by external providers, such as YouTube, Facebook and Twitter.

To view such third-party content, you must first accept the relevant terms and conditions. These include the third parties’ cookie policies, over which we have no control.

If you do not view such content, no third-party cookies related to that content will be installed on your device.

These third-party services are outside the Company’s control. Providers may change their terms of service, the purposes for which cookies are used, their cookie practices and other related provisions at any time.