Privacy policy
Cette politique de confidentialité a pour objectif de vous expliquer pourquoi nous recueillons vos données et comment nous nous engageons à les protéger.
La Papeterie de Tulette is committed to protecting your personal data and your privacy.
In this respect, and in accordance with the General Data Protection Regulation (hereinafter referred to as “GDPR”), we hereby inform you of the conditions under which your personal data may be processed by us.
What personal data do we process?
Purposes:
We may collect and retain your personal data, in particular to:
Receive and process your order Collect your payment, Improve our monitoring and customer service, Ensure the proper functioning and personalization of services, Detect attacks and take legal action against fraud, Store your choices regarding the use of cookies
Categories of data:
Contact details (for example: last name, first name, phone number, email address)
Technical information related to the use of our services
Legal basis for processing
The processing of personal data is based on:
- The data subject’s consent (Article 6.1.a of the GDPR) for all processing activities that require prior consent. In online forms, mandatory fields are marked with an asterisk. Failure to provide required information will prevent us from delivering the requested services.
- The performance of a contract or pre-contractual measures
- The pursuit of a legitimate interest (Article 6.1.e of the GDPR)
- Compliance with a legal or regulatory obligation
Your data is retained for the time necessary to fulfill the purposes mentioned above.
The retention period for Customers’ personal data depends on the relevant purpose. In this context, Customers’ personal data is retained for the time necessary to process their request. If no action is taken, personal data is deleted within the time limits recommended by the French Data Protection Authority (CNIL), after a period of three years from collection, subject to:
- Legal archiving rights and obligations
- Retention obligations for certain data for evidentiary purposes and/or anonymization
Personal data collected and processed for the execution of offers is retained for the duration necessary to manage the contractual relationship. By way of exception, personal data required to establish proof of a right or contract is archived in accordance with legal provisions (5 or 10 years after the end of the commercial relationship, depending on the case).
Who are the recipients of your data?
Your personal data is intended for La Papeterie de Tulette.
Our internal departments: Your data is processed by staff from our various departments, such as the sales department or the department responsible for IT security.
Traffic analysis (Matomo Analytics), Payment provider (Stripe), Email provider (Resend)
We may sometimes allow our partners to process, on our behalf, the personal information we hold about you for the purposes set out in this policy or for any other reason required by law.
Customers’ personal data collected is hosted in France.
If we use a service provider located outside the European Union, we undertake to verify that appropriate measures have been put in place to ensure that personal data benefits from an adequate level of protection.
How does La Papeterie de Tulette protect the security of your data?
We implement all organizational and technical measures necessary to ensure an appropriate level of security for your personal data, in particular to prevent any loss of confidentiality, integrity, or accessibility.
We regularly back up data and implement technical and organizational measures to ensure that Customers’ personal data is stored securely for the duration necessary to achieve the intended purposes.
What are your rights regarding your personal data?
In accordance with the Applicable Regulations, you have the following rights:
Right to rectification : You have the right to obtain the correction of inaccurate data concerning you. You also have the right to complete incomplete data by providing a supplementary statement. If this right is exercised, we undertake to communicate any rectification to all recipients of your data.
Right to erasure: : In certain cases, you have the right to obtain the deletion of your data. However, this is not an absolute right, and we may retain certain data for legal or legitimate reasons.
Right to restriction of processing: In certain cases, you have the right to obtain the restriction of the processing of your data.
Right to data portability: You have the right to receive the data you have provided to us in a structured, commonly used, and machine-readable format for your personal use or to transmit it to a third party of your choice. This right only applies where the processing is based on your consent, on a contract, or is carried out by automated means.
Right to object to processing :
You have the right to object at any time to the processing of your data where processing is based on our legitimate interest, a public interest mission, or for commercial prospecting purposes. This is not an absolute right, and we may refuse your request for legitimate or legal reasons.
Right to withdraw consent at any time:
You may withdraw your consent to the processing of your data where processing is based on your consent. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
Right to lodge a complaint with a supervisory authority:
You have the right to contact your data protection authority to lodge a complaint regarding our personal data protection practices.
Under the GDPR, the conditions for exercising these rights may vary depending on the legal basis for processing mentioned in the first paragraph. We will respond to any request to exercise your rights as soon as possible and, in any event, within 30 days from receipt of the request.
We reserve the right:
- To request proof of the applicant’s identity in case of reasonable doubt, in order to comply with our confidentiality obligations,
- To extend the response period by two months, informing the applicant of this extension and the reasons for the delay within one month of receiving the request,
- To refuse to respond to a request if it is considered abusive (due to its number or repetitive or systematic nature).
Who should you contact for any GDPR-related requests?
To exercise your rights, you may contact us:
La Papeterie
Sole Proprietorship (EI)
Registered under SIREN number 450451737
Address: 1101 chemin de la papeterie, 26790 Tulette, France
Phone: +33 6 12 02 09 18
Director of publication: Didier Percie du Sert
If, despite our efforts and commitments, you believe that your rights regarding your personal data have not been respected, you may file a complaint with the French Data Protection Authority: Commission Nationale de l’Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715 75334, Paris Cedex 07 France
Reservation of the right to modify the Data Protection Policy
This Personal Data Protection Policy may be subject to change. It has been drafted based on a free template that can be downloaded from the website https://donnees.net. As we continuously develop our services, we reserve the right to modify this Privacy Policy in accordance with the applicable legal provisions. Any changes will be published in this document in due time. We recommend that you regularly review this page to stay informed of any modifications or updates made to our privacy policy.