Pursuant to Article 13 of Regulation (EU) 2016/679 on data protection (“GDPR”)
Dear User,
Chateau Réal d’Or welcomes you to its website (the “Website”) and invites you to carefully read the following notice (the “Notice”), provided pursuant to Article 13 of Regulation (EU) 2016/679 on the protection of natural persons, with particular regard to the processing and free movement of personal data (the “GDPR”).
This document describes all processing activities carried out through our Website by the Data Controller, as defined below.
Please also note that this Notice applies exclusively to our Website and does not apply to any other website to which you may be redirected through our Website.
Furthermore, should you purchase products or use services provided by Chateau Réal d’Or by means other than our Website, you will be provided, at the time of purchase, with a specific notice pursuant to Article 13 of the GDPR regarding the personal data processed in connection with that purchase or service.
1. WHO IS THE DATA CONTROLLER?
The Data Controller is Chateau Réal d’Or, whose registered office is located at Route des Mayons – La Tuilière, 83590 GONFARON, France (the “Data Controller”).
The Data Controller has also appointed a Data Protection Officer (“DPO”), whom you may contact directly to exercise your rights or obtain any information concerning the processing of your personal data and/or this Notice:
Data Protection Officer – DPO
Route des Mayons – La Tuilière
83590 GONFARON
France
Email: dpo@chateau-realdor.fr
Tel.: +33 (0)4 94 60 00 56
2. WHAT PERSONAL DATA IS PROCESSED?
2.1 BROWSING DATA
During their normal operation, the IT systems and software procedures used to operate the Website collect certain personal data, the transmission of which to the Data Controller is inherent in the use of Internet communication protocols.
This information is not collected for the purpose of being associated with identified individuals. However, by its very nature, and through processing and association with data held by third parties, it may make it possible to identify users.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the Website, the URI addresses (Uniform Resource Identifiers) of the requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numerical code indicating the status of the server response, such as successful completion or error, and other parameters relating to the user’s operating system and IT environment.
This data is used solely to obtain anonymous statistical information concerning the use of the Website and to verify that it is functioning correctly. It is deleted immediately after processing. This data may also be used to establish liability in the event of suspected computer-related offences committed against the Website.
2.2 DATA VOLUNTARILY PROVIDED BY THE USER
The Data Controller processes the following personal data provided by you when completing forms available on the Website:
– personal data such as your first name, surname, address, telephone number, email address, occupation and other contact details, images, vehicle owned, vehicle replacement plans, and similar information;
– data relating to a contract entered into;
– banking details, such as your bank account details.
3. WHAT ARE THE PURPOSES AND LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA?
The Data Controller processes the personal data that you provide by completing the forms available on the Website for the purposes described below.
3.1 PROVISION OF SERVICES AND SALE OF PRODUCTS
The Data Controller intends to process your personal data in order to allow you to access our Website and for purposes strictly connected with the provision of online services offered from time to time through the Website.
This includes responding to requests for information concerning the products and services offered by the Data Controller, managing requests for test drives, allowing access to promotions and offers available on the Website, processing requests to join our community, and providing any assistance that you may request from our customer service department.
Nature of the provision of data: Optional.
Consequences of refusing to provide the data: Refusal to provide the data will make it impossible for the Data Controller to respond to the requests referred to in the preceding paragraph.
Legal basis for processing: Article 6(1)(b) of the GDPR. Your prior consent to the processing is therefore not required.
Personal data retention period: For these purposes, your personal data will be processed for the period strictly necessary to fulfil your request. It will subsequently be retained for the period required by the applicable regulations following the completion of that request.
3.2 MARKETING ACTIVITIES RELATING TO PRODUCTS AND SERVICES SIMILAR TO THOSE PREVIOUSLY REQUESTED BY THE USER
The Data Controller intends to process your personal data in order to send you commercial communications concerning products and services similar to those that you have previously requested and that are offered by the Data Controller, including through processors appointed for this purpose pursuant to Article 28 of the GDPR.
Purpose of processing: Sending advertising and promotional materials, selling products, carrying out market research and/or sending commercial communications.
Nature of the provision of data: Optional.
Consequences of refusing to provide the data: Failure to provide the data will make it impossible for the Data Controller to send you promotional and marketing communications.
Legal basis for processing: Legitimate interests.
Personal data retention period: For this purpose, your personal data will be processed until you decide to object to the processing and/or request that such processing cease at any time.
3.3 MARKETING ACTIVITIES
The Data Controller intends to process your personal data in order to send you commercial communications concerning all products and services offered by the Data Controller, including through processors appointed for this purpose pursuant to Article 28 of the GDPR.
Purpose of processing: Sending advertising and promotional materials, selling products, carrying out market research and/or sending commercial communications.
Nature of the provision of data: Optional.
Consequences of refusing to provide the data: Failure to provide the data will make it impossible for the Data Controller to send you promotional and marketing communications.
Legal basis for processing: Consent.
Personal data retention period: For this purpose, your personal data will be processed until you decide to object to the processing and/or request that such processing cease at any time.
4. METHODS USED TO PROCESS YOUR PERSONAL DATA
Your personal data will be processed in accordance with the provisions of the GDPR, using paper-based, electronic and online systems, according to methods strictly connected with the purposes indicated above and, in all cases, by means suitable for ensuring the security and confidentiality required under Article 32 of the GDPR.
5. RECIPIENTS OF YOUR PERSONAL DATA AND PERSONS WHO MAY HAVE ACCESS TO IT
For the purposes described in Section 3, your personal data may be accessed by the Data Controller’s employees, equivalent personnel and contractors acting as persons authorised to process personal data.
Your personal data may also be disclosed to and processed by third parties belonging to the following categories:
a) entities managing the Data Controller’s Website;
b) companies managing the Data Controller’s IT systems;
c) legal and/or tax advisers and consultancy firms;
d) public authorities, supervisory bodies and, more generally, public or private entities performing public functions;
e) the Data Controller’s suppliers;
f) other companies within the Chateau Réal d’Or Group for marketing, direct sales, market research and statistical studies intended to assess customer satisfaction with the services, products and brands distributed by Chateau Réal d’Or and/or other companies within the Chateau Réal d’Or Group, as well as disclosure to external entities, such as suppliers, where necessary to enable you to benefit from our services.
You may withdraw your consent at any time. The Data Controller will therefore no longer be entitled to process your personal data for the purposes for which you have withdrawn or refused your consent.
In some cases, the entities belonging to the categories listed above act as independent Data Controllers. In other cases, they act as processors specifically appointed by the Data Controller pursuant to Article 28 of the GDPR.
The complete and updated list of entities that may receive your personal data is available from the Data Controller’s registered office or by contacting the DPO.
Your personal data will not be transferred to third parties located outside the European Union and will not be made publicly available.
6. CHILDREN’S DATA
The Data Controller does not process the personal data of individuals under the age of 16 for the purposes referred to in Sections 3.1 and 3.2.
Where a user states that they are under 16 years of age, the consent collection fields will be automatically set to indicate that consent has not been given.
7. GEOLOCATION DATA
The Website may collect and process geolocation data in order to provide services requested by the user, but only after the data subject has given prior consent, which may be withdrawn at any time.
In such cases, your consent will be requested through a pop-up window.
8. RIGHTS OF THE DATA SUBJECT
With regard to the processing activities described in this Notice, you, as the “data subject”, may exercise, under the conditions laid down by the GDPR, the rights provided for in Articles 15 to 21 of the GDPR, including the following:
Right of access – Article 15 of the GDPR
You have the right to obtain confirmation as to whether or not your personal data is being processed and, where it is, to obtain access to your personal data, together with a copy thereof, and to receive information including:
– the purposes of the processing;
– the categories of personal data processed;
– the current and future recipients of your personal data;
– the data retention period or the criteria used to determine that period;
– the rights of the data subject, including rectification, erasure of personal data, restriction of processing and the right to object to processing;
– the right to lodge a complaint;
– the right to receive information concerning the source of the personal data where it was not obtained directly from the data subject;
– the existence of automated decision-making, including profiling.
Right to rectification – Article 16 of the GDPR
You have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data.
Right to erasure, or “right to be forgotten” – Article 17 of the GDPR
You have the right to obtain, without undue delay, the erasure of your personal data where:
a) the data is no longer necessary for the purposes for which it was collected or otherwise processed;
b) you have withdrawn your consent and there is no other legal basis for the processing;
c) you have successfully objected to the processing of your personal data;
d) the data has been processed unlawfully;
e) the data must be erased in order to comply with a legal obligation;
f) the personal data was collected in connection with the offer of information society services referred to in Article 8(1) of the GDPR.
The right to erasure does not apply where processing is necessary to comply with a legal obligation, to perform a task carried out in the public interest or in the exercise of official authority, or for the establishment, exercise or defence of legal claims.
Right to restriction of processing – Article 18 of the GDPR
You have the right to obtain restriction of processing where:
a) you contest the accuracy of the personal data;
b) the processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead;
c) the Data Controller no longer requires the personal data for the purposes of processing, but the data is still required by you for the establishment, exercise or defence of legal claims;
d) you have objected to the processing, pending verification of whether the Data Controller’s legitimate grounds override your own grounds.
Right to data portability – Article 20 of the GDPR
You have the right to receive personal data concerning you that you have provided to the Data Controller in a structured, commonly used and machine-readable format.
You also have the right to transmit that data to another data controller without hindrance from the Data Controller to whom the personal data was originally provided, where the processing is based on consent and is carried out by automated means.
You also have the right to have your personal data transmitted directly from one data controller to another, where technically feasible.
Right to object – Article 21 of the GDPR
You have the right to object, at any time, to the processing of personal data concerning you where the processing is based on legitimate interests, including profiling, unless the Data Controller demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
Right to lodge a complaint
You have the right to lodge a complaint with the French data protection authority:
CNIL
3 Place de Fontenoy
TSA 80715
75334 PARIS CEDEX 07
France
The rights referred to above may be exercised against the Data Controller by contacting the supervisory authority referred to in the preceding paragraph.
The Data Controller will process your request and provide you, without undue delay and in any event within one month of receipt of the request, with information concerning the action taken in response to your request.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 of the GDPR.
However, where requests are manifestly unfounded or excessive, particularly because of their repetitive nature, the Data Controller may charge a reasonable fee based on the administrative costs incurred in processing the request or may refuse to act on the request.
Please also note that the Data Controller may request additional information necessary to confirm the identity of the data subject.
COOKIE POLICY
Chateau Réal d’Or informs users that it uses cookie technology in order to make browsing more convenient and enjoyable for all users visiting the Website.
Cookies are small files that the website visited by the user sends to the user’s browser, where they are stored and subsequently transmitted back to the website during future visits.
Cookies are used for various purposes, including computer authentication, session tracking and storing information concerning specific configurations relating to users who access the server.
By allowing the Website to remember user data during a visit or during subsequent visits, cookies enable users to browse pages efficiently, save their preferences and interact with social networks such as Facebook, Twitter, LinkedIn, Google+ and Instagram, while also enabling the use of services such as Google Maps.
Cookies may also be used to store users’ login details and enable automatic user recognition, meaning that users will no longer need to enter their username and password each time they access the Website.
Data processing is carried out using electronic or, in any event, automated, IT or online tools, according to methods strictly connected with the purposes described above and, in all cases, in a manner that ensures the security and confidentiality of the data.
TECHNICAL COOKIES
Cookies that do not require your consent
Under the regulations in force in France concerning the use of cookies, the user’s express consent is not always required.
In particular, consent is not required for technical cookies, meaning cookies used solely to transmit communications over an electronic communications network or insofar as strictly necessary to provide a service explicitly requested by the user.
In other words, these cookies are essential for the operation of the Website or necessary to carry out activities requested by the user.
Technical cookies that do not require express consent include:
– analytical cookies used directly by the Website administrator to collect aggregated information concerning the number of users visiting the Website and how they use it;
– browsing or session cookies used for authentication, completing purchases and similar activities;
– functionality cookies, which allow users to browse the Website according to a series of selected criteria, such as language or products selected for purchase, in order to improve the service provided.
PROFILING COOKIES
Cookies that require your consent
Our Website also uses profiling cookies, which may only be installed with your consent.
Profiling cookies are intended to create user profiles and are used to send advertising messages in line with the preferences expressed by users while browsing the Internet.
These cookies are used to present content that is more relevant to users and their interests. They may also be used to display targeted advertising or limit the number of times an advertisement is shown.
Given the particularly intrusive nature that these tools may have within users’ private lives, European and French regulations require users to be adequately informed about their use and to give valid consent.
Profiling cookies require the user’s prior informed consent. The Website obtains such consent in accordance with applicable regulations through the banner displayed during the first visit and through this Notice, which enables the user to give or refuse consent.
FIRST-PARTY AND THIRD-PARTY COOKIES
Where cookies received by users are installed directly by the operator of the website they are visiting, they are known as first-party cookies.
While browsing the Website, users may also receive cookies from other websites or servers, known as third-party cookies, on which certain elements available on the Website may be hosted, such as photographs, maps, sounds or specific links to pages on other domains.
In such cases, the cookies are set by a website other than the one currently being visited by the user.
BLOCKING COOKIES
Users may select which cookies they wish to allow through the specific procedure described below.
Users may also allow, block or delete cookies, either entirely or in part, using the specific functions available in their browser.
However, where all or some cookies are disabled, it may not be possible to browse the Website, or certain Website services or functions may be unavailable or may not operate correctly.
Users may also be required to modify or manually enter certain information or preferences each time they visit the Website.
To change your cookie settings, please follow the instructions below for the four most commonly used browsers.
Microsoft Internet Explorer
Click the “Tools” icon in the top-right corner and select “Internet Options”. In the pop-up window, select “Privacy”. You can then adjust your cookie settings.
Google Chrome
Click the menu icon in the top-right corner and select “Settings”. Then select “Advanced Settings” and adjust the settings under “Privacy”.
Mozilla Firefox
From the menu in the top-left corner, select “Options”. In the pop-up window, select “Privacy”. You can then adjust your cookie settings.
Safari
From the menu in the top-right corner, select “Preferences”. Select “Security”, where you can adjust your cookie settings.
As stated in the banner displayed upon the user’s first visit to the Website, consent to the use of all cookies will be given by selecting the relevant acceptance button, such as “OK” or a checkbox, or by continuing to browse the Website, for example by ignoring the banner or pop-up and carrying out further actions.
Users will also have unrestricted access to the link containing this Notice and all relevant information concerning cookies, including their description, purposes and retention periods. Through this Notice, Website visitors will be able to give or refuse consent separately for individual categories of cookies.