Version dated August 10, 2022
Preamble
The General Data Protection Regulation (GDPR) came into force on May 25, 2018 and supplements the legislation on the protection of personal data.
For your information:
- personal data means any information relating to a natural person who is identified or can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to them (last name, first name, address, email, phone number, contract number, credit card number, etc.);
- processing of personal data means any operation performed on personal data (collection, storage, transmission, deletion, consultation, etc.), whether on paper or electronically;
- the data controller is the person who determines the purposes (objectives) of each processing operation and the means of achieving them.
Protecting personal data is a priority for Masamune. For this reason, and in the interest of transparency, the purpose of this Privacy Policy is in particular to explain why your personal data is collected and processed by Masamune, as data controller, how it is processed, what rights you have over your data and how you can exercise them.
Masamune reserves the right to modify this Privacy Policy at any time. Any modification will take effect immediately.
You are therefore invited to consult our Policy regularly; it can be accessed from every page of the Site, so that you are aware of the latest version in force. For changes we consider most significant, a notice will be posted on the Site. You are also invited to check the date shown on this Policy to know the date of the latest applicable version.
Contents
- Why does Masamune collect your personal data?
- What personal data does Masamune collect?
- What is the legal basis for processing your data?
- How long is your data kept?
- What are your rights and how can you exercise them?
- Your rights over your data
- Exercising your rights
- Who does Masamune share your data with?
- Is your data transferred outside the EU?
- How does Masamune secure the processing of your data?
- Required fields
- Cookie Policy
- Privacy by Design/by Default
- Accountability
1. Why does Masamune collect your personal data?
Masamune collects the personal data it needs for the following purposes:
- quotes,
- management of contractual relationships,
- management of communications and newsletters,
- questions from our customers.
As a general rule, Masamune does not process any personal data for purposes incompatible with those for which it was collected, unless you have given your prior consent.
2. What personal data does Masamune collect?
Masamune collects several types of personal data:
- The personal data you provide directly to Masamune:
- when you fill in a contact form,
- when you fill in a quote request,
- when you apply to take out a contract,
- when you contact customer service to ask a question or make a complaint,
- in general, when you communicate with Masamune in any other way.
- The personal data collected automatically by Masamune:
Masamune automatically collects certain data about you when you visit its Site, in particular information about your browsing. Masamune uses cookies and other tracking technologies to collect data about you when you interact with the Masamune Site.
To learn more about cookies, please see the Cookie Policy.
3. What is the legal basis for processing your personal data?
As a reminder, your personal data is collected by Masamune for the purposes set out in section 1 of this Privacy Policy.
Your personal data collected in this context is collected only when its collection and processing are based on a legal basis. These legal bases are described below.
Performance of the contractual relationship with Masamune
Your personal data is necessary for the performance of the contract you have entered into or wish to enter into. For all processing based on this contractual legal basis, any refusal to provide your personal data will prevent the contract from being concluded and performed.
Compliance with a legal obligation to which Masamune is subject
Some of your personal data must be processed by Masamune to meet its legal obligations, in particular:
- Xxxxxxxxxxxxxxxxx [to be specified]
- Xxxxxxxxxxxxxxxxx [to be specified].
Your consent
Subject to your prior consent, your personal data may be processed by Masamune to:
- send you commercial offers for its products and services,
- place cookies on your device under the conditions described in the Cookie Policy.
You can change your choice at any time and withdraw your consent as described in section 5.2 of this Policy, without affecting the lawfulness of processing based on consent carried out before its withdrawal.
Masamune's legitimate interests
Your personal data may be processed by Masamune for the purposes of its legitimate interests, in particular to offer you personalized services.
4. How long does Masamune keep your data?
Your data is kept by Masamune for as long as necessary to achieve the purposes described in section 1 of this Privacy Policy, plus the applicable statutory limitation periods.
For XXXXXXXXXX [purpose to be specified].
Masamune may keep the data for XXXXXXXXXX.
For XXXXXXXXXX [purpose to be specified].
Masamune may keep the data for XXXXXXXXXX.
For XXXXXXXXXX [purpose to be specified].
Masamune may keep the data for XXXXXXXXXX.
For more information about how long your personal data is kept, you can contact the Masamune department in charge of personal data protection (see section 5.2 of this Privacy Policy).
5. What are your rights over your data and how can you exercise them?
5.1 Your rights over your data
Right of access
You can ask Masamune for, and obtain, confirmation of:
- whether or not your personal data is being processed by Masamune;
- where it is, access to all the data and information Masamune holds about you.
Right to rectification
You can have Masamune correct any inaccurate or incorrect data about you without undue delay. You can also ask for your data to be completed.
Right to erasure
Subject to legal exceptions, you can have Masamune erase your personal data without undue delay, in particular if you consider that the processing of your data by Masamune is no longer necessary for the purposes for which it was originally collected.
Right to data portability
You can ask to receive some of your personal data in an open, machine-readable format, or ask Masamune to transfer this data to another organization. This right applies only to:
- the data you have actively and knowingly provided to Masamune (for example, the data you entered in an online form),
- or the data generated when using a service or device in connection with entering into or managing your contract, and processed by automated means, on the basis of consent or the performance of a contract.
Right to object
You can object to your data being used by an organization for a specific purpose. You must then give reasons relating to your particular situation, except in the case of direct marketing, which you can object to without giving a reason.
You can object at any time to the processing of your personal data for direct marketing purposes (see section 5.2 of this Privacy Policy). You can also object at any time to cookies being placed on your device (see section 10 of this Privacy Policy).
Right to restriction of processing
You can ask Masamune to keep your personal data without being able to use it, only in one of the following cases:
- you contest the accuracy of your data processed by Masamune,
- you object to your data being processed by Masamune,
- your data is being used unlawfully but you object to its erasure,
- you need this data to establish, exercise or defend legal claims.
Right to withdraw your consent
When the processing of your personal data by Masamune is based on your consent (for example, electronic direct marketing), you can withdraw your consent at any time (see section 5.2 of this Privacy Policy).
Likewise, you can withdraw your consent to cookies at any time as described in the Cookie Policy.
Right to give instructions for after your death
You can give instructions regarding the retention, erasure and disclosure of your data after your death. These instructions set out how you wish your rights over your data to be exercised after your death. You can send these instructions by mail to the Masamune department in charge of data protection
(see section 5.2 of this Privacy Policy), with the subject line "Post-mortem instructions".
You can change or revoke your instructions at any time.
Right to lodge a complaint with the CNIL
If you consider that your rights are not being respected or that your data is not protected in accordance with the GDPR, you can at any time lodge a complaint with a competent supervisory authority (in France, the CNIL), directly on the CNIL website or by mail at:
CNIL
3 Place de Fontenoy
TSA 80715 - 75334 PARIS CEDEX 07, France.
5.2 Exercising your rights
To exercise any of your rights, please send your request to:
contact@masamune-store.com
or
Masamune SARL
Data Protection Department
11 Rue Henri Regnault
75014 Paris, France
Every request must state, in the subject line, the reason for the request (exercise of the right of access, the right to object, etc.) and the company concerned. It must also include proof of identity (customer number, member number, etc.) and state the address to which the reply should be sent.
Masamune will reply within one (1) month at most from the date your request is received. This period may, however, be extended by two (2) months given the complexity and number of requests.
If, after contacting Masamune, you consider that your data protection rights under the French Data Protection Act are not being respected, you can lodge a complaint with the CNIL.
Direct marketing and targeted advertising
Once you have agreed to receive commercial offers from Masamune, you can change your mind at any time by sending an email. If you have agreed to receive newsletters from Masamune, you can unsubscribe at any time using the unsubscribe link included in each newsletter.
More generally, for any question about this Privacy Policy or any request about how Masamune manages your personal data, you can send your request by email or by mail as indicated above.
6. Who does Masamune share your personal data with?
Masamune may transfer your personal data to the following entities when necessary for one of the purposes set out in section 1 of this Privacy Policy:
- For shipping, your data may be transferred (depending on your choice when ordering) to:
- Colissimo,
- UPS,
- Chronopost.
- For newsletters, your data may be transferred to:
- Mailjet,
- Mailchimp.
7. Is your personal data transferred outside the European Union?
Your data is hosted on secure servers located in France.
Should your data be transferred outside the EU, in particular through our subcontractors, we would take particular care to ensure that they process your data in strict compliance with the applicable personal data protection regulations. If they were located in a country that is not covered by an adequacy decision of the European Commission recognizing a level of protection equivalent to that of the European Union, a contract based on the standard clauses established by the European Commission would be drawn up.
8. How does Masamune secure your personal data?
Masamune implements all technical, physical and organizational measures to ensure the security and confidentiality of your data during its collection, processing and transfer.
Masamune's infrastructure is protected against malicious software (viruses, spyware, etc.). Physical and remote access to the servers hosting the data is controlled. Penetration tests and regular backups, with restore tests, are carried out.
The security of the device you use to connect to our Site is your responsibility.
Should Masamune use service providers to process some of your data, it undertakes to check that they offer sufficient guarantees to ensure the protection of the personal data entrusted to them, and to have them sign confidentiality clauses in accordance with Article 28 of the GDPR.
In the event of a personal data breach, that is, a security incident, malicious or not and intentional or not, that compromises the integrity, confidentiality or availability of your personal data, Masamune undertakes to meet the following obligations:
- If the data breach poses no risk to you:
⇨ Masamune records and documents the breach internally in its "breach register". - If the data breach poses a risk to you:
⇨ Masamune records and documents the breach internally in its "breach register";
⇨ Masamune notifies the CNIL of the data breach within 72 hours at most. - If the data breach poses a high risk to you:
⇨ Masamune records and documents the breach internally in its "breach register";
⇨ Masamune notifies the CNIL of the data breach within 72 hours at most;
⇨ Masamune informs you of the data breach as soon as possible.
The "Breach Register" contains the following information:
- the nature of the breach;
- the categories and approximate number of people concerned;
- the categories and approximate number of files concerned;
- the likely consequences of the breach;
- the measures taken to remedy the breach and, where appropriate, to limit its negative consequences;
- where applicable, the reasons for not notifying the CNIL or informing the people concerned.
However, in accordance with the regulations in force, Masamune is not required to inform you of a breach in the following cases:
- your personal data is protected by measures that make it unintelligible to anyone not authorized to access it;
- measures have been taken so that the risk is no longer likely to materialize;
- informing you would require disproportionate effort from Masamune, in particular because it has no means of contacting you.
9. Required fields
The fields of our forms marked with an asterisk are required and must be filled in. If these required fields are not filled in, your request cannot be taken into account. This obligation to provide the requested data is contractual, as this data is necessary for the performance of the contract to which you are a party or of pre-contractual measures taken at your request, in particular when you request information or a quote about our products and services.
10. Cookie Policy
For more information, please refer to our Cookie Policy.
11. Privacy by Design/by Default
Masamune undertakes to build personal data protection into the design of any project, service or other tool involving the processing of personal data, including data minimization, purpose limitation, respect for the integrity and confidentiality of data, and limited retention periods.
12. Accountability
To comply with the accountability principle, Masamune:
- adopts internal procedures to ensure compliance with the company's rules (through its personal data protection charter);
- keeps documentary records of all processing carried out under its responsibility or that of its subcontractors (register of processing activities, confidentiality agreements with employees and service providers, company security policy, procedures for handling requests to exercise rights, etc.);
- carries out data protection impact assessments (DPIA) for processing that presents particular risks to rights and freedoms.
The aim is to provide documentation that can demonstrate compliance with data protection rules at any time.