Personal Data Protection Policy

This Personal Data Protection Policy forms part of BEXLEY's commitment to transparency. This document describes BEXLEY's practices regarding the collection, use and confidentiality of your personal data, in order to inform you of the conditions under which BEXLEY, in its capacity as data controller, processes your data.

This Personal Data Protection Policy supplements the information provided to you when you send us your data by completing a form on our website www.bexley.fr  (for example: visiting our website, subscribing to our newsletter, creating a customer account, placing an order online), in store or by telephone, whether you are a customer or a prospective customer.

If you have any questions about this document or about the manner in which BEXLEY processes and protects your data, you may contact our Data Protection Officer (DPO) at the following address: dpo@bexley.fr

1. WHAT IS PERSONAL DATA?

Under the General Data Protection Regulation, "personal data" means any information relating to an identified or identifiable natural person; an "identifiable natural person" is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

2. WHY DOES BEXLEY COLLECT YOUR DATA?

The information collected about you enables us to manage, facilitate, record and carry out your purchases, to know you better in order to send you targeted offers and thereby improve and personalise our services, to handle your requests and complaints, and to provide after-sales service.

We use your personal data for specified, explicit and legitimate purposes, which are based on one of the following legal grounds:

• Performance of the contract for the sale of BEXLEY products: processing operations in order to (i) identify you, (ii) perform our contractual relationship when you purchase BEXLEY products in store or online: order, delivery, invoicing, management of the customer relationship, exchanges, returns, refunds, credit notes, loyalty vouchers, complaints;

• Your consent: processing operations in order to (i) send you personalised commercial communications, expressly presented as such when your choice is obtained, by email, SMS, rich mobile messages and/or post, relating to BEXLEY's products, services, loyalty benefits and commercial operations; (ii) use, in the commercial communications sent to you by email, tracking technologies such as tracking pixels and individualised links in order to ascertain whether you open these emails and whether you click on the links they contain; (iii) use this information, where it is directly linked to such personalised marketing, to measure campaign performance, personalise the content of communications, adjust their frequency or the channel used, establish engagement segments or scores and offer you offers suited to your interests; (iv) share certain of your personal data with our commercial partners where such sharing is based on your consent;

• Our legitimate interests: processing operations for the purposes of (i) accounting, the management of litigation and the defence of BEXLEY's rights; (ii) the prevention of and action against fraud; (iii) carrying out loyalty initiatives, commercial offers and direct marketing relating to products similar to those you have already purchased from BEXLEY, subject to your right to object; (iv) conducting studies, surveys, product tests and promotions; (v) organising competitions, prize draws and any promotional operation; (vi) producing commercial statistics, aggregated marketing analyses, and statistics and figures on the frequency and use of our website and stores, collecting and publishing customer reviews in order to improve the quality of our products and services, and optimising your browsing experience and our interfaces through A/B testing; (vii) the technical management of the deliverability of electronic communications, undelivered emails ("bounces"), spam complaints, unsubscriptions and the hygiene of our contact database, to the extent that such processing is strictly limited to these purposes.

• A legal obligation: processing operations in order to (i) manage the exercise of one or more of your rights in accordance with the paragraph below, (ii) comply with our accounting, tax and administrative obligations and retain the elements of the contract of sale in accordance with the statutory limitation period.

3. WILL YOU RECEIVE ADVERTISING FROM BEXLEY?

BEXLEY may send you commercial communications relating to its products, services, loyalty benefits and commercial operations.

If you are a BEXLEY customer, and unless you object, we may send you commercial offers relating to products similar to those you have already purchased from BEXLEY, by email, SMS and postal mail. You may object simply, free of charge, at any time and without giving reasons, via the unsubscribe link included in the relevant communications, via your Customer Account under the "My Newsletter" section, or by writing to dpo@bexley.fr.

BEXLEY may also, where you have consented, send you personalised commercial communications by email, SMS, rich mobile messages and/or post. Where such personalised communications are sent to you by email, they may contain tracking technologies enabling us to track your opens and clicks, under the conditions described in this policy.

If you are a prospective customer (and have therefore never purchased BEXLEY products online or in store), and with your agreement, we may send you information relating to BEXLEY's products and offers, by email, SMS and postal mail.

Refusing or withdrawing your consent to personalised commercial communications and to email tracking means that BEXLEY will no longer use such processing for personalisation or marketing-tracking purposes. In all cases, BEXLEY may continue to send you the messages necessary for the management of your account, your orders, delivery, after-sales service, security or the exercise of your rights.

4. WHAT DATA IS COLLECTED BY BEXLEY?

• In-store purchases

We collect the data you provide to the BEXLEY sales advisor when creating a customer account in store:

• Title
• Surname and first name
• Postal address
• Email address
• Telephone number
• Date of birth

• Online purchases

We collect the data you provide when you:

• Browse and view the websites www.bexley.fr and www.bexley.com;
• Create a customer account;
• Add products to your shopping basket;
• Place an order or submit a return request on our websites;
• Subscribe to BEXLEY's newsletters;
• Contact our customer service;
• Take part in a competition;
• Complete a questionnaire or respond to a survey.

In this context, we collect and process data relating to your identity: surname, first name, title, date of birth, delivery country and delivery address, and we associate with it an internal customer number and a loyalty card number linked to the customer account.

We also collect commercial information relating to the transactions carried out: transaction number, purchase details, payment terms, discounts granted, receipts, balances and unpaid amounts, purchase history, loyalty account, product returns, and correspondence and/or telephone exchanges with you and our after-sales service.

Your banking data is collected and processed directly by our banking service provider, and BEXLEY is never in possession of such data.

We collect information relating to your communication preferences: selection of the authorised communication channels, subscription or unsubscription status, objection to or consent for personalised commercial communications and, where applicable, the tracking of email interactions.

In connection with the sending of our commercial communications by email, we may also collect data relating to your interactions with the emails sent to you, in particular whether or not the email is opened, clicks on the links it contains, the date and time of the open or click, the email address concerned, a technical identifier linked to the contact, information relating to the campaign concerned, the link clicked and, where applicable, the link category.

Certain technical information may also be transmitted when the email is opened or a link is clicked, such as the IP address, the type of device or the browser used, subject to the limitations specific to email clients.

We may also process data relating to unsubscriptions, undelivered emails ("bounces") and spam complaints, in particular the email address concerned, the technical identifier linked to the contact, the date and time of the event, information relating to the campaign or message concerned, the reason for unsubscription where you provide it, the browser language, and the type or category of the undelivered email.

Through cookies, we are also led to collect and process personal data relating to your browsing and behaviour on the BEXLEY website, in particular technical data: your IP address, the pages visited, the products of interest to you, the purchases made, the language, etc.

Subject to your agreement and the settings of your browsing device (computer, tablet, smartphone), BEXLEY may also collect and process all or part of the following personal data: device type, operating system, Internet Service Provider (ISP), browser, network.

• Advertising and conversion tracking (Google Enhanced Conversions)

BEXLEY uses Google's advanced technologies to measure the effectiveness of its advertising campaigns while ensuring the confidentiality of your data.

Enhanced Conversions tracking

We have enabled "Enhanced Conversions" tracking. When a conversion takes place, your data (e.g. email address) is:

• Normalised and Hashed: Transformed locally in your browser using the SHA-256 algorithm before any transmission. Google receives only an irreversible digital fingerprint.
• Secured: This data is not stored in clear text, is not resold and is used solely to statistically re-attribute the purchase to an advertising click.

Google Consent Mode v2 (Advanced Mode)

Our site respects your choices via Google's Consent Mode v2:

• If you consent: The hashed data is transmitted for accurate conversion measurement.
• If you refuse: No personal data is transmitted. A "modelled conversion" is sent via a hashed fictitious email address (e.g. no_consent@gmail.com), enabling overall statistical measurement without any possible identification of the user.

• In all cases

BEXLEY may also be a recipient of personal data from its commercial partners who entrust it with their databases for direct marketing purposes. In this case, you have given your consent to that data controller for its partners, such as BEXLEY, to contact you for direct marketing purposes. In this context, BEXLEY contractually ensures that you have indeed given your consent to that partner for your data to be transmitted to us for this purpose. Your data is then processed by BEXLEY as data controller, to enable us to offer you our offers and to carry out studies, surveys and product tests. The categories of data processed by BEXLEY are as follows: postal address, email address, mobile number, surname, first name, age and socio-professional category.

BEXLEY does not collect or process personal data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, or trade union membership, nor genetic data, data concerning health or data concerning sex life, nor data relating to criminal convictions and offences or related security measures.

For each processing operation, BEXLEY processes only the data that is relevant and necessary in relation to the purpose pursued.

5. WHAT HAPPENS IF YOU DO NOT PROVIDE US WITH YOUR DATA?

Certain information requested in the forms is mandatory and is indicated by an asterisk. Its collection is essential for processing your request. Consequently, in the absence of a response, we will not be able to act on your request (example: postal address for delivery).

Where certain data or choices depend on your consent, in particular for personalised commercial communications and the tracking of email interactions, refusing them does not prevent the creation of your account or the placing of an order.

6. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The data controller is BEXLEY S.A.S, whose registered office is at 19 rue Louis Guérin, 69100 Villeurbanne, France, registered with the Lyon Trade and Companies Register under number 344 434 253 00078.

7. TO WHOM IS YOUR DATA DISCLOSED?

The recipients of all or part of your data are:

• Within BEXLEY: the department responsible for the administrative and technical management of orders and returns, and the department responsible for the management of marketing campaigns;

• Outside the BEXLEY group: the processors to whom BEXLEY entrusts certain processing operations and who process your data on our behalf, in accordance with our instructions, such as: hosting and hosting-management providers, providers for the management and routing of our marketing campaigns, providers for the tracking and audience measurement of our marketing campaigns, providers for the tracking of email opens and clicks, providers for personalisation, segmentation, scoring and marketing-targeting optimisation, providers involved in the deliverability of electronic communications and the management of undelivered emails and spam complaints, logistics providers, providers for the transport and delivery of orders, and providers for the collection and publication of customer reviews.

BEXLEY takes care to select processors offering sufficient guarantees in terms of personal data protection. The transfer of your data to our processors is governed contractually in order to ensure the security of your data.

Where you have agreed to your data being transmitted to BEXLEY's commercial partners for direct marketing purposes, each of these companies becomes the controller of the processing it carries out on your data. Each company that sends you direct marketing must identify itself in any communication with you, enabling you to contact it directly.

BEXLEY may also share with third parties other than those identified above anonymised or aggregated data, for statistical purposes, without it being possible for such third parties to identify you in any way whatsoever.

Data may also be transmitted to the competent authorities, upon their request, or in order to comply with legal obligations.

Certain data, such as your email address or mobile telephone number, may be transmitted in hashed form, that is to say transformed into a form that is not directly legible, to certain providers or partners in order to enable the measurement, personalisation or optimisation of our campaigns, under the conditions described in this policy and in accordance with your consent choices.

 

8. WHAT ARE YOUR RIGHTS?

You have numerous rights concerning your data. These rights may be exercised directly from your customer account, or by sending a letter accompanied by proof of identity to:

BEXLEY
For the attention of the Data Protection Officer
19 rue Louis Guérin, 69100 Villeurbanne, France

Or by email to: dpo@bexley.fr

If BEXLEY has reasonable doubts as to the identity of the natural person making the request referred to under the rights described below, BEXLEY may request that additional information necessary to confirm the person's identity be provided (a copy of an identity card, for example).

We inform you that no payment is required in order to exercise your rights as described below.

However, where a person's requests are manifestly unfounded or excessive, in particular owing to their repetitive nature, BEXLEY may:

• charge a reasonable fee taking into account the administrative costs incurred in providing the information, making the communications or taking the requested measures; or
• refuse to act on such requests.

We will respond to your request within one month of receiving it. Taking into account the complexity and number of requests, this period may be extended by two months. BEXLEY will inform you of any such extension and of the reasons for the delay within one month of receiving the request.

Right to object to the processing of your data

BEXLEY ensures that you can always purchase the products it offers for sale without such purchase being conditional on receiving direct marketing messages from BEXLEY or its partners.

This option is offered to you on the page for creating your customer account, on the "My account / My subscriptions" page of the BEXLEY website, and through the cookie settings. And if you have agreed to receive direct marketing messages from BEXLEY and/or its partners, you may always change your mind subsequently and object to receiving future messages, free of charge and without giving reasons. If you have accepted the placing of cookies on your device, you may also object to this subsequently, again free of charge and without giving reasons.

If you exercise your right to object, BEXLEY will no longer process your data for direct marketing purposes. We would nevertheless draw your attention to the fact that, if you object to receiving direct marketing from BEXLEY in the future, you will nonetheless continue to receive emails from us that are necessary for the management of your account, your orders, delivery, after-sales service, the monitoring of your loyalty account, security or the exercise of your rights, independently of any personalised direct marketing purpose.

You are also informed that you may register free of charge on the BLOCTEL telephone marketing opt-out list. For more information, you may consult the website www.bloctel.gouv.fr

Apart from the processing of your data for direct marketing purposes, you may also object, on legitimate grounds, to your personal data being processed by BEXLEY. If you exercise this right to object, BEXLEY will then no longer process your personal data, unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms (examples: retention of your data for the establishment, exercise or defence of legal claims).

Right of access to your data

You may request directly from BEXLEY information on the processing operations concerning you and the data held about you. To exercise your right of access, you must prove your identity by providing supporting documentation.

The exercise of your right of access must not adversely affect the rights and freedoms of others.

Right to have your data rectified

You may request the rectification of information concerning you if the information held by BEXLEY is inaccurate. You also have the right to have incomplete personal data completed, including by providing a supplementary statement.

You may rectify and update certain of your data directly on the "My account / My information" page of the BEXLEY website.

Where this right is exercised, BEXLEY will notify each recipient to whom your data has been disclosed of any rectification of data, unless such communication proves impossible or involves disproportionate effort.

Right to have your data erased (right to be forgotten)

You have the right to obtain from BEXLEY the erasure of your data where there is a ground provided for by law, such as, for example: the data no longer being necessary or the withdrawal of your consent for processing based on that consent, if you object to processing for marketing purposes, or if you object to processing for another purpose and there are no compelling legitimate grounds for the processing.

Where this right is exercised, BEXLEY will notify each recipient to whom your data has been disclosed of any erasure of data, unless such communication proves impossible or involves disproportionate effort.

BEXLEY may nevertheless retain certain of your data in the form of intermediate archives, for the period necessary to satisfy, in particular, our legal, accounting and tax obligations.

Right to restriction of the processing of your data

You have the right to obtain the restriction of processing by BEXLEY where one of the following applies:

• If you contest the accuracy of your data, for a period enabling us to verify it;
• If the processing is unlawful and you object to the erasure of the data and request instead the restriction of its use;
• If BEXLEY no longer needs your data for the purposes of the processing but you still require it for the establishment, exercise or defence of legal claims;
• If you have objected to processing based on the legitimate interest of the controller, pending verification as to whether the legitimate grounds pursued by the controller override yours.

Where this right is exercised, BEXLEY will notify each recipient to whom your data has been disclosed of any restriction of processing carried out, unless such communication proves impossible or involves disproportionate effort.

Right to the portability of your data

You have the right to request the portability of your data. This enables you to receive the data in a digital format. This right applies only where the processing is carried out by automated means and on the basis of your consent or the performance of a contract.

Right to withdraw your consent to personalised commercial communications and email tracking

You may withdraw at any time, free of charge and without giving reasons, your consent to receiving personalised commercial communications and to the tracking of your interactions with the emails sent to you. You may exercise this withdrawal via the "unsubscribe" link included in any email sent by BEXLEY, by writing to us at dpo@bexley.fr, or by sending STOP by SMS to the number indicated in the message concerned. You may also manage your subscription preferences for our communications directly from your customer account.

When you withdraw this consent, BEXLEY ceases to send you the personalised commercial communications concerned and no longer uses the individual open- and click-tracking data for marketing purposes requiring your consent.

To stop receiving commercial offers from our partners, we invite you to refer to their own data protection policies or unsubscription arrangements. You may in any event exercise your various rights directly with them, in particular the rights of access, rectification and objection. In the event of difficulty, or to stop receiving commercial offers from our partners, you may write to us at any time at dpo@bexley.fr.

Automated decision-making and profiling

BEXLEY does not take any decision concerning you based solely on automated processing that produces legal effects concerning you or that may significantly affect you.

BEXLEY may carry out profiling operations for marketing purposes, in particular in order to analyse your preferences, interests, purchases, interactions with our communications, email opens and clicks, level of engagement, likelihood of purchase, risk of disengagement or potential interest in certain product categories. These analyses may be used to personalise the offers and communications sent to you, to adjust their frequency or channel, to establish marketing segments or scores, or to exclude you from irrelevant campaigns. Where these analyses use data derived from tracking pixels or individualised links inserted in our marketing emails, they are based on your consent. You may withdraw this consent at any time.

Right to give directives on the fate of your data in the event of death

You have the right to define general or specific directives relating to the retention, erasure and communication of your data after your death, specifying the manner in which you intend those rights to be exercised. These directives may designate a person responsible for their execution; failing that, your heirs will be designated. You may communicate specific directives to BEXLEY. In the absence of any directives, your heirs may contact BEXLEY's DPO at dpo@bexley.fr

Such directives, where they are general and concern all personal data relating to you, may be registered with a certified digital trusted third party approved by the Commission nationale de l'informatique et des libertés.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority, such as the Commission nationale de l'informatique et des libertés (CNIL) in France.

9. IS YOUR DATA TRANSFERRED TO A COUNTRY OUTSIDE THE EUROPEAN UNION?

The processing operations carried out by BEXLEY and its processors are, unless otherwise indicated, within the territory of the European Union. Accordingly, all your data is processed and hosted within the territory of the European Union.

10. HOW LONG IS YOUR DATA RETAINED?

The retention period for personal data depends on the purpose for which it is processed. As a general rule, your data is retained for the entire duration of our commercial relationship, plus a period of three years following its end, after which it is archived in order to meet our legal obligations or for evidential purposes, or is anonymised for study and statistical purposes.

Your data will not be retained beyond the period strictly necessary for the purposes pursued as set out herein, in accordance with the law. 

Your order data is retained for seven years from the last order.

Your customer account data is retained, for communication purposes, for a period of three years from your last activity on our website or on an electronic communication medium, where such activity can be taken into account in accordance with your consent choices. At the end of this three-year period, BEXLEY may re-contact you to ascertain whether you wish to continue receiving our commercial communications. In the absence of a positive and explicit response from you, we will delete your data.

The individual data relating to opens and clicks in our commercial communications by email is retained for a maximum period of 3 years from its collection, unless your consent is withdrawn or you unsubscribe before that term. The data strictly necessary for the management of your consent, your unsubscription or your objection may be retained for the period necessary to evidence your choices and to defend BEXLEY's rights. Data relating to undelivered emails, spam complaints and unsubscriptions is retained for the period necessary for the management of the deliverability of electronic communications, the hygiene of our contact database and the evidencing of compliance with your choices.

However, data that serves to establish evidence of a right or a contract, or that is retained in order to comply with a legal obligation, may be subject to an intermediate archiving policy for a period not exceeding that necessary for the purposes for which it is retained, in accordance with the applicable legal provisions and bearing in mind that the ordinary limitation period is five years (Article 2224 of the French Civil Code). In this context, we may retain certain data after the deletion of your account where such retention is provided for by law, or where such retention is necessary to enable us to manage disputes and claims.

Similarly, if you have exercised your right to object to receiving marketing from a data controller, the information enabling your right to object to be taken into account will be retained for a minimum of three years from the exercise of the right to object. This data will under no circumstances be used for purposes other than the management of the right to object, and only the data necessary to give effect to the right to object will be retained.

11.   OUR COOKIE POLICY

The term "Cookie" means, in the broad sense, any tracker placed and/or read when a website or an email is consulted. A cookie may contain information such as the name of the server that placed it, an identifier in the form of a unique number, and an expiry date.

Cookies are, in particular, necessary to enable you to benefit from certain features of our website. If you have chosen to disable Cookies via your internet browser, access to the site may then prove impaired.

BEXLEY uses its own Cookies as well as third-party Cookies. Only the issuer of a Cookie is able to read or modify the information contained within it.

The Cookies used are of several types and serve different purposes. They are installed on your receiving device (computer, tablet, smartphone, etc.) or on your browser, subject to the choice you have expressed regarding Cookies, which choice may be modified at any time. You may accept or refuse Cookies, either globally for the entire BEXLEY website or Cookie by Cookie.

Our commercial communications by email may contain trackers, in particular tracking pixels or individualised links. These trackers may make it possible to ascertain whether you open our emails and whether you click on the links they contain. Where they are used to measure the performance of our campaigns, personalise our communications, adjust their frequency or the channel used, establish engagement segments or scores, or offer you offers suited to your interests, these trackers are subject to your consent.

Certain technical operations linked to security, the management of unsubscriptions, undelivered emails, spam complaints or deliverability may be carried out independently of your consent where they are strictly necessary and limited to those purposes.

We share information about the use of our site, such as browsing and/or geolocation data, with our advertising and analytics partners, who may combine it with other information that you have provided to them or that they have collected in the course of your use of their services.

Owing to third-party applications integrated into our website, certain Cookies may be issued by our commercial partners, and the issuing and use of Cookies by these partners are subject to their own privacy protection policies. BEXLEY informs you of the purpose of the Cookies of which we are aware and of the means available to you to make choices regarding these Cookies.

The table below sets out the main cookies and trackers likely to be placed or read on our site, subject to your consent choices where these are required, together with a link to the privacy policies of the third parties concerned where these are available. These policies may explain the arrangements for objecting to their services.

The duration indicated corresponds to the maximum lifetime observed or declared for these cookies. Certain trackers may expire earlier depending on their technical configuration or your consent choices.

 

How to allow/disable Cookies?

You may at any time manage your choices regarding cookies and other trackers via the cookie management module accessible on our site. You may accept, refuse or modify your choices, globally or purpose by purpose, where these trackers are subject to your consent.

You may also configure your browser in order to limit or delete certain cookies. However, browser settings do not necessarily make it possible to manage all the trackers used on the site or to express your choices purpose by purpose.

You may visit the Youronlinechoices website, offered by digital advertising professionals grouped within the European association EDAA (European Digital Advertising Alliance). You will thus be able to find out which companies are registered with this platform and which offer the possibility of refusing or accepting the Cookies used by these companies, in order to adjust the cookies likely to be placed on your device.

In addition, we invite you to consult the "Cookies: the tools to manage them" section of the CNIL website: www.cnil.fr

In the event of difficulty in exercising your right of access or objection regarding Cookies, you may contact BEXLEY: dpo@bexley.fr

12. HOW DO WE ENSURE THE SECURITY OF YOUR DATA

BEXLEY implements appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the likelihood and severity of the risks to the rights and freedoms of natural persons.

For example, our banking payment provider incorporates the SSL (Secure Socket Layer) security protocol. Confidential data — the bank card number, the expiry date and the security code — is encrypted and transmitted to the bank's secure server. Under no circumstances does this data transit through or is it stored on BEXLEY's servers.

BEXLEY also takes measures to ensure that its staff, its processors and their staff, who have access to your data, do not process it except on the instructions of the data controller, unless required to do so by Union law or the law of a Member State.

The site's hosting provider carries out vulnerability tests on our servers twice a year in order to ensure the security of BEXLEY's infrastructure.

BEXLEY ensures that its processors provide sufficient guarantees as to the implementation of appropriate technical and organisational measures so that the processing complies with the applicable regulations concerning the rights of the data subject.

13. AMENDMENTS TO OUR PRIVACY POLICY

We regularly review our Personal Data Protection Policy and will publish any updates on this web page.