I. Preliminary remarks

This Privacy Policy forms an integral part of the GC (such as defined hereafter), and accordingly, the definitions used in the latter are reused herein.

The purpose of this Privacy Policy is to inform the Data Subjects concerning the method according to which their data is collected from the Website, how the latter is collected by WeeSlim and, finally, the Specific Rights (such as defined hereafter) from which the Data Subjects benefit with regard to such processing, such as defined hereafter.

II. Definitions

The following terms, whether they are used in the singular or the plural in this Privacy Policy, shall have the following definition:

Intermediate archiving :	shall mean the movement of Personal Data which is still of an administrative interest for WeeSlim, (such as, for example, in the event of litigation and/or a statutory obligation) in a separate database, separated automatically or manually, and for which, in any event, the access is restricted. This archiving is an intermediate stage prior to the deletion of the relevant Personal Data or its anonymization;
Privacy Policy:	shall mean this confidentiality policy and the Personal Data protection policy for the Data Subjects, implemented by WeeSlim, which forms an integral part of the GC;
GC:	shall mean interchangeably: GTU http://www.weeslim.com/en/shop/cgu/ GTS http://www.weeslim.com/en/shop/cgs/ and GSC http://www.weeslim.com/en/shop/cgv/
Personal Data :	shall mean the Data Subject’s personal data, within the meaning of the Regulations concerning the Personal Data collected and processed by WeeSlim in the context of the use of the Website;
Specific Rights:	shall mean the rights granted by the Personal Data Regulations for the Data Subjects concerning the processing of their Personal Data and mentioned in detail in Article IX;
Data Subject:	shall mean the individual (Webuser, Client, Subscriber) whose Personal Data is processed by WeeSlim;
Personal Data Regulations :	shall mean the General Data Protection Regulations (GDPR) and corresponding Member State Laws;
WeeSlim:	shall mean CIRCLE GREEN LTD, governed under English law, with its registered office located at 168 The Circle Queen Elizabeth Street, LONDRES, United Kingdom, SE1 2JL, registered under the number 11989378 ;
Terminal(s):	shall mean the hardware equipment (computer, tablet, smartphone, telephone, etc.) used by the Data Subject to consult or visit the Website and/or any other digital support medium edited by a third party.

III. Statutory bases for processing

In accordance with the Personal Data Regulations, the processing designated herein is governed by a specific statutory basis.

A. The Data Subject has granted the processing of their Personal Data for one or several specific purposes.

The Data Subject’s express consent was obtained on the Website in order to conduct specific processing expressed upon the latter’s consent thereto.

B. The processing is necessary for the performance of an agreement to which the Data Subject is a party or the performance of precontractual measures taken at the latter’s request.

In order to use the Website and benefit from its services, the Data Subject accepted a minima the GTU and, as the case may be, the GSC and/or GTS. These documents formalize a contractual relation between the Data Subject and WeeSlim, and used as a statutory base for the collection and processing of the Data Subject’s Personal Data by WeeSlim.

This Data is necessary for the realization of a certain processing related to the performance of a contractual relation between the Data Subject and WeeSlim, the purposes of which are mentioned in detail in paragraph IV – The purposes of the processing.

C. The processing is necessary for the respect of a statutory obligation to which it is subject.

The Personal Data processing may also be required for the respect of a statutory obligation to which WeeSlim may be subject, for example, the retention of access logins to the Website.

D. The processing is necessary for WeeSlim’s legitimate interests or those of a third party, unless the Data Subject’s interests or fundamental liberties prevail, which require personal data protection, in particular when the Data Subject is a child.

WeeSlim may have a legitimate interest to justify the processing of a Data Subject’s Personal Data, such as, for example, the processing of Data that is strictly required for fraud prevention.

In this situation, WeeSlim shall ensure that such processing is necessary to meet its legitimate interest and shall assess the consequences of this processing for the Data Subject, in particular, by taking into consideration the type of the Data processed and the means of processing thereof.

WeeSlim shall ensure the protection of interests and the fundamental liberties enabling the Data Subject, at any time, to object to all or part of the processing mentioned in this Privacy Policy, or to implement their Specific Rights, and under the conditions of paragraph IX – The Specific Rights.

IV. The purposes of the processing

 

The Data Subject’s Personal Data is necessary to enable them to access, use and update the Website and to enable WeeSlim to do the following:

· Carry out commercial relations with the Data Subject, i.e., concerning the invoices, accounts, “client relation” follow-up, with a Client or Subscriber, such as carrying out satisfaction surveys, complaint management, use of the Website and, more generally, the services, etc.;

· Select Clients or Subscribers to carry out surveys, opinion polls and product tests, and for loyalty programs, prospection and promotion;

· Customize its communication for Clients or Subscribers, in particular through information emails, depending on the preferences identified from the use of its Website;

· Carry out prospection operations, i.e., the management of technical prospection operations (which includes, in particular, the technical operations such as normalization, enrichment and deduplication);

• Commercial solicitation;

· The setup of commercial statistics; analyses of marketing tools (in particular classification, score, etc.)

· The organization of game contests, lotteries or any promotional operation, with the exclusion of online gambling subject to the approval of online gambling regulatory authority;

· The management of the exercise of Specific Rights under the conditions of paragraph IX – The Specific Rights;

· Debt recovery and litigation;

· The management of comments from the Data Subjects on the Website and/or the web pages edited by WeeSlim such as the pages of the social networks;

• Combating fraud.

V. Data storage

The website is hosted with the company Heroku, Inc, 1 Market St, Suite 300, San Francisco, CA 94105.

All the precautions have been taken to store the Data Subjects’ Personal Data in a secure environment and prevent such data from being misrepresented, damaged or that unauthorized third parties would have access thereto. The information provided by the Data Subject shall never be communicated to third parties for commercial purposes, or sold or exchanged, without the latter’s express and prior consent.

VI. The collection of Personal Data on the Website

Upon the creation of an Account, and upon its progressive completion, as the case may be, WeeSlim shall collect the following Personal Data communicated by the Client and the Subscriber, which they shall communicate upon visiting the Website and which is stored for a period of three (3) years, in active mode, as from the Data Subject’s latest connection to the Website:

Ø Gender,

Ø Date of birth,

Ø Email address,

Ø Website user ID,

Ø Payment method used,

Ø Delivery address,

Ø Invoicing address,

Ø The Data Subject’s login data (date, time, IP address, pages consulted) upon their visit to the Website, and in particular, those related to the User’s use of the Specific Services,

Ø The data provided by the Subscriber on the Website upon their use of the Specific Services,

Ø As the case maybe the reasons for exclusion (all the elements enabling the actions to be proven that have occurred within the last month and which justify the exclusion).

Ø Invoices,

Ø Amount of the transactions and the date and time of completion thereof.

Only the Personal Data mentioned on the Website as obligatory shall be required to benefit from an Account.

VII. Recipients or recipient categories, if applicable

WeeSlim may communicate to third parties certain Personal Data which is necessary for completing the Orders in the context of the GSC or the Subscription in the context of the GTS, in order to ensure, in particular, the following:

- product shipment;

- sending of emails with the Digital Books;

- combat fraud,

- after-sales service, etc.

VIII. Security of online transactions

In accordance with the GC, the Website uses the technology of Secured Payment Service Providers, to secure the bank transactions with Clients and Subscribers.

Accordingly, upon payment on the Website, the Data Subject’s bank account balance shall be provided to the Secured Payment Service Providers, without WeeSlim being informed thereof.

WeeSlim shall not collect either the Client’s or the Subscriber’s full bank card number nor the cryptogram.

To exercise their rights such as those identified in paragraph IX – The Specific Rights, relating to their bank card details, the Data Subject is requested to make direct contact with the Payment Service Provider. To find out which Payment Service Provider handled your payment, contact us at contact@weeslim.com

IX. The Specific Rights

In accordance with the Personal Data Protection Regulations, the Data Subject may, at any time, benefit from the following Specific Rights:

- access,

- rectification,

- erasure,

- limitation of processing,

- portability,

- objection,

- post-mortem directives.

A. Access rights

The Data Subject is entitled to obtain confirmation from WeeSlim that their Personal Data are or are not being processed and to be granted the access to such Personal Data as well as to the following information:

a) the processing purposes;

b) the categories of the Personal Data;

c) the recipients or recipient categories to which the Personal Data has been or shall be communicated;

d) when possible, the envisaged retention period for the Personal Data or, when this is not possible, the criteria used to define such duration;

e) the existence of the right to request WeeSlim for the rectification or deletion of Personal Data, or a limitation of their Personal Data, or the right to object to this processing;

f) the right to introduce a complaint with the Member State Protection Authority;

g) when the Personal Data is not collected from the Data Subject, any information available regarding its source;

h) the existence of automatic decision making, including profiling, and, at least in similar circumstances, appropriate information concerning the underlying rationale and the importance and consequences provided for the Data Subject for this processing.

When the Personal Data is transferred to a third party country or an international organization, the Data Subject shall be entitled to be informed of the appropriate guarantees concerning this transfer.

WeeSlim shall provide a copy of the Personal Data subject to processing.

WeeSlim may require the payment of reasonable expenses based on the administrative costs for any additional copy requested by the Data Subject.

When the Data Subject presents their request electronically, the information shall be provided in standard electronic format, unless they have requested otherwise.

The right for the Data Subject to obtain a copy of their Personal Data must not violate the rights and freedoms of others.

B. Rectification rights

The Data Subject shall be entitled to obtain from WeeSlim, as soon as possible, the rectification of their Personal Data, if the latter is inaccurate. They shall also be entitled to request that any incomplete Personal Data be completed, including by providing a complementary declaration.

C. Right of erasure

The Data Subject shall be entitled to request their Personal Data erasure, when one of the following reasons apply:

a) the Personal Data shall no longer be necessary for the initial purpose for which it was collected or processed by any other means by WeeSlim;

b) the Data Subject has withdrawn their consent for the processing of this Personal Data and there is no other statutory basis for the processing;

c) the Data Subject shall exercise their right of objection under the conditions recalled above and there is no imperative legitimate reason for the processing;

d) the Personal Data has been lawfully processed;

e) the Personal Data must be deleted to respect a statutory obligation;

f) the Personal Data has been collected from a child.

 

D. Rights to restriction

The Data Subject shall be entitled to request from WeeSlim the processing of their Personal Data when one of the following reasons apply:

a) WeeSlim shall verify the accuracy of the Personal Data following the objection by the Data Subject concerning the accuracy of the Personal Data;

b) The processing is unlawful and the Data Subject objects to the deletion of the Personal Data and requests limited use thereof;

c) WeeSlim shall no longer require the Personal Data for the purposes of the processing but such data shall still be necessary for the Data Subject for the acknowledgment, exercise or defense for litigation;

d) The Data Subject has objected to the processing under the conditions recalled hereafter and in such case WeeSlim shall verify whether the legitimate reasons stipulated prevail over the alleged reasons.

E. Right to Data Portability

The Data Subject shall be entitled to obtain his Personal Data from WeeSlim, in a structured format, commonly used and machine readable, when:

a) The Personal Data processing is based on consent, or on an agreement

and

b) The processing is made through automated processing.

When the Data Subject exercises their right of portability they are entitled to request that the Personal Data be communicated directly by WeeSlim to another data controller designated by the latter, when this is technically possible.

The right to the Data Subject’s portability of Personal Data shall not violate the rights and freedoms of others.

F. Right to objection

The Data Subject may object at any time to the processing of their Personal Data, for their own specific reasons, based on WeeSlim’s legitimate interest. Accordingly, the latter shall no longer process the Personal Data, unless it is able to prove the existence of imperative and legitimate reasons for the processing which prevail over the Data Subject’s interests, rights and liberties, or to retain such data for the acknowledgment, exercise or defense for litigation.

G. Post-mortem directives

The Data Subject shall be entitled to communicate directives to WeeSlim relating to the retention, deletion and sharing of their Personal Data after their demise, and such directives may also be registered with a “certified digital confidence third party”. These directives, or “ digital will”, may designate a person in charge of the performance thereof; failing that, the Data Subject’s heirs shall be appointed.

In the absence of any directive, the Data Subject’s heirs may contact WeeSlim for the following reasons:

a) to access the processing of the Personal Data enabling “ the organization and settlement of the deceased’s succession”;

b) to receive communication of the “digital assets” or “ data belonging to family souvenirs, transferable to the heirs”;

c) proceed with the closure of the Data Subject’s account on the Website and object to the continuation of the processing of their Personal Data.

In any event, the Data Subject shall be entitled to mention to WeeSlim, at any time, if he does not wish, in the event of their demise, that their Personal Data be communicated to a third party.

X. Exercise of the U sers’ Specific Rights

 

These rights may be exercised, at any time, with WeeSlim:

a) By email at the following address: contact@weeslim.com

b) By postal address at the following address: CIRCLE GREEN LTD,168 The Circle Queen Elizabeth Street, LONDRES, United Kingdom, SE1 2JL

In order to assert its rights following the conditions mentioned above and in the event whereby WeeSlim would have doubts concerning the party at the origin of the request, WeeSlim may request the latter to provide proof of identity by mentioning their surname, name, email address and that their request be accompanied with a copy of a valid identity document.

A response shall be sent to the Data Subject within a maximum period of one (1) month following the date of receipt of the request.

If necessary, this period may be extended by two (2) months by WeeSlim which shall inform the Data Subject in the event of the complex nature of the request and/or the number of requests.

In the event of a request by the Data Subject for the deletion of their Personal Data and/or in the event of the exercise of their right to request the deletion of their Personal Data, WeeSlim may nonetheless retain such data in the form of Intermediate Archiving, and for the duration required to meet its statutory requirements, or for evidential purposes during the applicable statute of limitation period.

The Data Subject may also file a claim before the competent authority.

 

 

XI. Password security

 

WeeSlim shall take all the necessary precautions to ensure the secure storage of Data Subject’s password.

Nevertheless, the security of this password shall also depend on its compilation.

Accordingly, the Data Subject shall be reminded that their password, to be valid, must be comprised a minima of 8 characters, of at least 3 of the following 4 types: upper case letters, lower case letters, figures, special characters.

There are technical methods for the creation of complex passwords, such as the following:

Ø Only retain the first letters of the words in a phrase; for example, the phrase “ Un Mot de Passe se retient!” “a password shouldn’t be forgotten” corresponds to the password 1P@Wsbf!

Ø By using an upper-case letter if the word is a noun (e.g.: word)

Ø By keeping the punctuation signs (e.g.!)

Ø By expressing the numbers with the assistance of the figures 0 to 9 (e.g. A=One ->1)

 

 

XII. The cookies deposited on the Data Subject’s Terminal following their browsing on the Website

 

Cookies are used on the Website.

A cookie corresponds to information deposited on the Terminal which enables the Data Subject to access the Website.

Cookies are related to the Data Subject’s browsing on the Website and which enable the pages that they have visited to be defined, and their date and time of consultation.

At no time shall these cookies enable WeeSlim to personally identify the Data Subject.

The retention period for these cookies on the Data Subject’s Terminal shall not exceed thirteen (13) months.

More specifically, the Personal Data collected from the cookies issued by WeeSlim or third parties shall enable the following:

a) to establish statistics and the visitation volume and use of the Website, to improve the interest and ergonomics of the services;

b) to adapt the presentation of the Website to the Data Subject’s preferred Terminal display (language used, display resolution, operating system used, etc.);

c) to memorize the information relating to a form completed by the Data Subject on the Website (inscription or access to your account);

d) to implement security measures, for example, when the Data Subject is requested to reconnect to the Website after a certain period of inactivity on the Website;

Through the cookies, WeeSlim shall collect and process for the purposes defined above, all or part of the following Data:

Ø Information relating to the Data Subject’s Terminal and/or the Data Subject:

- Their type of Terminal (Smartphone, tablet, computer, etc.);

- The operating system on their Terminal (Mac Os, iOS, Android, Windows, BlackBerry etc.);

- The categories and plug-in versions on their Terminal,

- Their Internet access provider (Orange, SFR, Bouygues, Free, etc.);

- The browser that they use (Safari, Chrome, Internet explorer, etc.);

- Their advertizing ID related to the operating system on their Terminal;

- The IP address for their Terminal;

- Their language preferences.

Ø Information relating to their browsing and preferences on the Website:

- The statistics concerning the consultation of the different Website pages;

- Comprehensive URL tracking to, via and from the Website;

Ø Information concerning the Data Subject (age or age bracket, gender, socio-professional status declared and/or presumed, presumed interests, etc.) related to their Internet activity and communicated by third parties (advertizers, advertising controllers, etc.).

A. WeeSlim’s cookies

 

B. Objection to cookies

 

The Data Subject shall be informed, upon their first visit, that they are entitled to object to the registration of cookies which are ancillary to the functioning of the Website and, in particular, by setting their Web browser accordingly or by exercising their choices on this page (see below).

The Data Subject browsing the Website and the information communicated may be saved or read, on their Terminal, at their discretion.

The Data Subject shall find more assistance on the relevant pages of their browser (hereafter the most frequently used browsers):

• Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies
• Google Chrome https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=en
• Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
• Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

The Data Subject may also set their browser in order for a code to be sent mentioning the Websites that they do not want tracked (“ Do No Track” option):

• Internet Explorer™: https://support.microsoft.com/en-us/help/17288/windows-internet-explorer-11-use-do-not-track

• Chrome™: https://support.google.com/chrome/answer/114836

• Firefox™: https://support.mozilla.org/en-US/kb/how-do-i-turn-do-not-track-feature