QUAI DES CELESTINS, a simplified joint-stock company with share capital of €9,050, registered with the Paris Trade and Companies Register under number 522 306 265, whose registered office is at 207 rue du Faubourg Saint-Martin, 75010 Paris (hereinafter the “Company” or “QUAI DES CELESTINS”), represented by Ms. Fleur PHELIPEAU in her capacity as President, collects and processes personal data concerning the Company’s customers, users of the Company’s website (hereinafter the “Site”), and users of the services (hereinafter the “Services,” as defined in the General Terms and Conditions of Sale available at the following link: https://dailylab.com/pages/conditions-generales-de-vente, hereinafter the “GTCS”), collectively referred to below as the “Users,” “You,” or “Customers.”

The Company is committed to protecting Users’ privacy and personal data. Accordingly, it ensures that it adopts and complies with a personal data processing policy in accordance with applicable regulations, and in particular with the General Data Protection Regulation No. 2016/679 of April 27, 2016 (the “GDPR”) and the French Data Protection Act of 1978, as amended.

Accordingly, this privacy and personal data protection policy (the “Policy”) sets out the methods and conditions for the processing of personal data by the Company concerning Users.

The Company reserves the right to amend the Policy at any time and undertakes to inform Users of these changes via a notification when using the Services.

1. The data controller

The Company is the data controller for the personal data collected and processed under the conditions set out in this Policy applicable to Users.

You can contact the Company using the contact details provided in Article 8, “Contact,” of this Policy.

The data controller is the person—in this case, the Company—who determines the methods and purposes of processing personal data. As its name indicates, it assumes responsibility for the personal data processing it carries out and is the User’s primary contact for exercising their rights in relation to the processing.

2. Sources and categories of personal data

2.1. Source and collection of personal data

The Company collects Users' personal data in connection with the use of the Services. In particular, the Company collects and processes Users' personal data when:

• placing an order;
• providing Services;
• invoicing and payment of orders, as well as preliminary checks on credit cards;
• creating the User's profile on the Site (hereinafter the “Profile”);
• browsing the Site (in particular through cookies); and/or
• statistical and commercial analysis of the data;
• sending mass or targeted informational emails;
• sending emails relating to order tracking and the creation of finished products

The Company also processes all personal data communicated spontaneously and voluntarily, particularly when Users contact the Company.

2.2. Categories of personal data

The Company collects and processes the following categories of personal data:

• Information required to place an order:
• Personal data: surname, first name, telephone number, and email address of the customer (if an individual) or the main contact within the customer company.
• Information required for any communications with You:
• Personal data: surname, first name, telephone number, and email address of the customer (if an individual) or the main contact within the customer company.
• Information required for invoicing and payment of orders:
• Personal data: surname, first name, telephone number, and email address of the customer (if an individual) or the main contact within the customer company, as well as the billing address. We do not retain bank details when payment is made by bank card.
• Information required to create the Profile:
• Personal data: email address, telephone number, username, password
• Information collected when using the “Contact” form:
• Personal data: surname, first name, email address, and any other information that You may voluntarily provide in your message.
• Company data: distribution sector, country/city of sale
• Information relating to the type of device used, IP address, and browser type and language.
• Information collected by cookies installed on our Site that have previously been accepted or rejected, including, in particular, the pages viewed.

2.3. Whether the provision of data is mandatory

Certain information may be required to provide the Services. When placing an order, creating a Profile, or using the “Contact” form, required data is indicated on our forms with an asterisk or by the explicit mention “Required information.” If you do not provide the required data, we will be unable to provide the relevant Services.

2.4. Accuracy of data

The Company makes every effort to keep personal data accurate and complete. To ensure that we have up-to-date information, you may inform us of any change to your contact details or any other data by contacting the Company using the contact details provided in Article 8, “Contact,” below, or by regularly updating your Profile.

2.5. Location of personal data

3. Purposes and legal bases for processing

• Establish statistics on the use of the Services and User behavior;
• Send newsletters;
• Offers for the Company's Services; and
• Provide, maintain, and improve our Services and Website.

Furthermore, processing based on legitimate interest also enables us to:

• Manage debt collection;
• Detect, investigate, prevent, or take action regarding illegal activities, abuse, suspected fraud, or situations involving potential threats to the security or rights of a person or entity, and use this as evidence in the event of litigation;
• Investigate, prevent, and stop breaches of our Terms and Conditions and this Policy; and
• Protect and defend our rights and interests, including our intellectual property rights, before the competent courts or tribunals.

The Company also seeks to enable the training of its employees and the performance of compliance and security audits.

Lastly, the data is collected to comply with legal obligations:

• Comply with the legal and regulatory obligations to which the Company is subject, such as tax reporting relating to transactions and the retention of invoices,
• Train our teams, in accordance with the legal obligations to which the Company is subject as an employer,
• Manage Users' requests concerning their personal data rights.

4. Disclosure of personal data

The personal data collected and processed may be transmitted:

• To authorized personnel in the relevant departments within the Company;
• In the event of a claim, theft, or other violation of the General Terms and Conditions of Sale or the law, personal data may be transmitted to our insurance company and/or brokerage firm, which is required to maintain the confidentiality of the data transmitted and, where applicable, to the police and judicial authorities.
• To administrative and judicial authorities and, more generally, public bodies in connection with compliance with our legal obligations or to enable us to defend our rights and interests,
• Where necessary, to our legal advisers and attorneys,
• If we sell or transfer our business or part of it and your personal data relates to the part sold or transferred, or if we merge with another company, we will share your personal data with the new owner of the business or our merger partner, respectively.

5. Personal data security

The Company implements organizational, technical, software, and physical security measures to protect personal data against any loss, unauthorized access, disclosure, or alteration.

6. Data retention

The Company retains your personal data for as long as necessary to fulfill the purposes pursued, where applicable extended by the statutory archiving, retention of certain data, and limitation periods. At the end of the processing, the personal data will either be deleted or anonymized by the Company.

The retention period depends on the type of personal data and the purpose. In particular, the retention period is determined according to the following criteria:

• The closure of the Profile;
• How regularly you use the Services;
• The existence of legal or contractual obligations requiring us to retain the data;
• The existence of a retention period specifically defined by applicable regulations; and
• The type of personal data and, in particular, its sensitivity (for example, your banking information).

In this context, the Company applies the following retention periods:

• Data concerning your Profile are retained for as long as the account is active and, at the latest, until three years after the last transaction.
• Once your account has been closed, your data will be deleted or anonymized by the Company, unless the data must be retained for accounting purposes, to comply with legal obligations, resolve disputes, collect debts, or prevent fraud.
• In the event of a dispute concerning a transaction, we retain the data relating to that transaction for the applicable limitation periods.

For more information concerning the retention period of your personal data, we invite You to contact us using the contact details indicated in Article 8 “Contact” below.

7. User Rights

Users are informed that, under the conditions set out in the GDPR and the laws applicable in France, they have the right to access, rectify, erase, and port their personal data, as well as the right to restrict and object to the processing of such data.

Users also have the right to determine what happens to their personal data after their death, as well as the right to lodge a complaint with the CNIL, whose website is accessible at http://www.cnil.fr and whose registered office is located at 3 Place de Fontenoy, 75007 Paris.

For processing based on their consent, the User may withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal.

The User may exercise their rights free of charge with the Company using the contact details indicated in Article 8 “Contact” below, except in the event of a manifestly excessive request, in which case fees may be charged.

In addition to the information below, the Company invites the User to visit the CNIL website:

• Right of access: The User has the right to obtain from the Company confirmation as to whether or not their personal data are being processed and, where they are, access to those data as well as information concerning the purposes of the processing (Article 15 of Regulation 2016/679 on the protection of personal data (“GDPR”)). Requests that are manifestly unfounded, excessive, or repetitive may not receive a response or may incur fees.
• Right to rectification: the User has the right to obtain from the Company, without undue delay, the rectification of their personal data that they consider inaccurate (Article 16 of the GDPR).
• Right to erasure: the User has the right to obtain from the Company the erasure of their personal data under the conditions set out in Article 17 of the GDPR.
• Right to data portability: the User has the right to receive, or request that their personal data be sent to a third party, the personal data concerning them that they have provided to the Company, in a structured, commonly used, and machine-readable format (Article 20 of the GDPR).
• Right to restriction of processing: the User may obtain from the Company the restriction of processing of their personal data under the conditions of Article 18 of the GDPR.
• Right to withdraw consent: Users have the right to withdraw their consent to the processing of their data if this processing is based on consent. Withdrawing consent does not affect the lawfulness of processing based on consent carried out before its withdrawal.
• Right to object: the User has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data when it is based on legitimate interest and under the conditions of Article 21 of the GDPR.
• Right to determine what happens to their personal data in the event of death: the User may define general or specific instructions concerning the retention, deletion, and communication of their personal data after their death (Law 78-17 of January 6, 1978, as amended, Article 40, II).
• Right to lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, the User has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them constitutes a violation of the applicable regulations on personal data (Article 77 of the GDPR).

8. Contact

For more information about the processing of your personal data or to exercise your rights, you can contact us using the following details:

QUAI DES CELESTINS / D-LAB
207 rue du Faubourg Saint-Martin
75010 Paris

Email: contact@dailylab.com
Phone: 01 84 80 44 20