PRIVACY POLICY
Our website address is: https://dive.explo360.fr
Owner, Creator, Webmaster and Publication Director: Jean-Luc Delon
Hosting: OVH, 2 rue Kellermann - 59100 Roubaix - France.
The website dive.explo360.fr (hereinafter the "Site") is a website dedicated to underwater fauna and flora and scuba diving, accessible over the Internet and open to any Internet user. The Site acts as the data controller.
If a user (hereinafter the "Users" or "theUser") has questions or comments about how the Site processes and uses their personal data, or wishes to exercise any rights relating to their personal data, the user may contact the Site using the form at the bottom of the page.
01.
Purpose of the privacy policy.
This privacy policy is intended to inform Users of the Site about the categories of personal data that the Site may collect or process, how these data are used, how they are protected and the rights held by theUser in relation to their personal data.
When using the Site and, more generally, communicating with the Site, theUser provides certain personal data about themselves, particularly when theUser (i) places an order, (ii) downloads a document from the download platform, (iii) identifies themselves to create or access their Members’ Area, or (iv) communicates with the Site particularly through the “Contact us” section.
In accordance with European Regulation No. 2016/679 of 27 April 2016, known as the “General Data Protection Regulation” or “GDPR”, and the amended French Data Protection Act (particularly Act No. 2018-493, known as “LIL 3”, of 20 June 2018, its implementing decree and the recasting Ordinance No. 2018-1225 of 12 December 2018), the Site collects and processes personal data under the conditions described below.
02.
Changes to the Privacy Policy.
The Site may amend this privacy policy, particularly to comply with regulatory, case-law, editorial or technical developments. Where necessary, Users will be informed or contacted to seek their consent where appropriate.
You are advised to consult this privacy policy regularly to learn about any changes or updates to the privacy policy of the Site.
Last updated: 27 May 2024
03.
Categories of personal data concerned.
The categories of personal data that the Site may collect and process are as follows:
Identification data: title, surname, first name, username, password, diving level.
Contact data: email address, telephone number, postal address.
Purchase-related data: products purchased, products placed in the basket, exercise of the right of withdrawal, returned products, reviews (satisfaction survey).
Banking data: payment type (PayPal), transaction number.
Transaction data: products invoiced, refunds made.
Behavioural data: logins to the member profile, content viewed, preferred content, the user’s navigation on the Site, requests to exercise rights.
Technical data: Internet browser, login date and time, device screen resolution, operating system, IP address, MAC address.
When data are collected through forms, theUser is informed by an asterisk whether certain fields or data are mandatory or optional. Personal data marked with an asterisk are mandatory. If these data are not entered, the request (contacting customer service, creating a member profile) cannot be completed.
04.
Source of data.
The Site collects personal data directly from Users, particularly when they contact it, including through the contact form provided on the Site or when creating a member profile or making a purchase.
05.
Purpose of processing.
The purposes of processing carried out by the Site are to:
Monitor, improve, optimise and secure the Site.
Inform, respond to and interact with users in any way.
Manage and monitor creation of and access to the members’ area.
Process and follow up on products ordered online.
Manage payment for online purchases.
Send commercial communications, special offers and news tailored to the profiles of Users.
Assess the quality of products offered for sale or made available free of charge to Users.
Assess the satisfaction of Users.
Carry out audience analysis or produce statistics.
06.
Legal basis for processing.
The legal bases for processing are:
Performance of a contract: providing the requested product or service (for example, purchasing a product, creating and managing members’ areas).
The controller’s legitimate interest: monitoring, improving, optimising and maintaining the security of the Site, assessing product quality and the satisfaction of Users and carrying out audience analysis or producing statistics to improve service quality.
The legitimate interest of theUser : responding to their requests and interacting with them.
Consent: keeping Users informed of news and sending marketing messages (for example, newsletters, solicitations, special offers), and cookies that are not necessary for operation. It is specified that theUser may withdraw consent at any time by email under the procedures set out below in the “Rights of individuals” section.
Compliance with a legal obligation: managing accounting and meeting tax obligations, and responding to requests to exercise users’ rights.
The controller’s legitimate interest: ensuring that the Site and communications work correctly, and improving cookies that are (i) essential to the operation of the Site website and (ii) used to protect and secure the Site website.
07.
Recipients of data.
Data are processed only by the services of the Sitewithin their respective responsibilities, particularly its IT services and its external service providers, including IT providers (for example, the webmaster and hosting provider).
Subject to the transfers mentioned above, data are not disclosed to third parties. In particular, they are not sold, exchanged, transferred or given to a third-party company without the consent of theUser.
Furthermore, in accordance with applicable regulations, collected data may be disclosed to competent authorities upon request, particularly public bodies, officers of the court, public officials, debt collection bodies, and when seeking the perpetrators of offences committed online.
08.
Data retention period.
Data are retained only for the time strictly necessary for the purposes set out above:
For an order placed through the Site :
For the entire period during which the order is fulfilled.
Beyond that:
contract-related data: for five years as evidence of the contract under the French Civil Code.
accounting data: for ten years to meet accounting obligations under the French Commercial Code.
When a member profile is created in the members’ area, personal data are retained until the profile is deleted at the initiative of the user or the Site, or after three years of inactivity;
Data used for communications: for three years from the user’s last order or last contact, unless consent is withdrawn before that time.
Connection data: 12 months.
Other data collected through cookies: six months
Banking data are not retained and are deleted immediately after payment for the order has been completed.
In all cases, the user’s personal data may be retained by the Site for evidentiary purposes, in accordance with statutory limitation periods (five years under the French Civil Code).
Data may also be retained for longer periods. In that case, they will undergo anonymisation procedures to ensure to theUser that they cannot be identified directly or indirectly.
09.
Data security and confidentiality.
The Site implements the necessary technical, organisational and legal measures to preserve the security and confidentiality of data relating to the individuals concerned, both online and offline.
10.
Rights of individuals.
In accordance with Articles 15 to 23 of the GDPR, the user is informed that they have rights of access, rectification, erasure and objection, restriction of processing, data portability, and the right not to be subject to an automated individual decision (including profiling). To exercise these rights, theUser is invited to write to the Siteby email, using the form at the bottom of the page and specifying “personal data” in the subject of the letter or email.
In any event, in a dispute relating to the processing of their personal data, theUser may lodge a complaint with the supervisory authority, namely the CNIL (https://www.cnil.fr). This right may be exercised with the CNIL by post at: CNIL, 3 Place de Fontenoy, TSA 80715, 75 334 Paris Cedex 07, or at: https://www.cnil.fr/fr/plaintes.
11.
Automated decision-making.
The personal data of theUser are not subject to automated decision-making.
12.
Transfers outside the European Union.
Data are not transferred outside the territory of the European Union.
13.
Cookies.
For optimal use of the site, the Site uses files called “cookies”, which may be stored on the device of theUser. The cookie management policy can be viewed on the Site.