Data Protection Policy

This Personal Data Protection Policy forms part of BEXLEY’s commitment to transparency. This document describes BEXLEY’s practices regarding the collection, use and confidentiality of your personal data, in order to inform you of the conditions under which BEXLEY, in its capacity as data controller, processes your data.

This Personal Data Protection Policy supplements the information provided to you when you submit your data by filling in a form on our website www.bexley.com  (for example: visiting our website, subscribing to our newsletter, creating a customer account, placing an online order), in store or by telephone, whether you are a customer or a prospect.

If you have any questions about this document or about the way BEXLEY processes and protects your data, you may contact our Data Protection Officer (DPO) at the following address:  dpo@bexley.com

1. WHAT IS PERSONAL DATA?

According to the General Data Protection Regulation, “personal data” means any information relating to an identified or identifiable natural person; an “identifiable natural person” is deemed to be a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

2. WHY DOES BEXLEY COLLECT YOUR DATA?

The information collected about you enables us to manage, facilitate, record and fulfil your purchases, to get to know you better in order to send you targeted offers and thereby improve and personalise our services, to process your requests and complaints, and to provide after-sales service.

We use your personal data for specific, explicit and legitimate purposes, based on one of the following legal grounds:

• Performance of the contract for the sale of BEXLEY products : processing carried out in order to (i) identify you, (ii) perform our contractual relationship when you purchase BEXLEY products in store or online: order, delivery, invoicing, customer relationship follow-up, exchanges, returns, refunds, credit notes, loyalty vouchers, complaints;

• Your consent : processing carried out in order to (i) communicate with you, send you newsletters, promotional offers, loyalty benefits, (ii) communicate some of your personal data to our business partners;

• Our legitimate interests : processing for the purposes of (i) accounting, dispute management; (ii) fraud prevention and detection; (iii) carrying out loyalty initiatives, commercial offers, direct marketing for products similar to those already purchased, studies, surveys, product testing and promotion, (iv) organising competitions, lotteries and any promotional operation, (v) preparing sales statistics, marketing analyses, statistics and traffic and usage volumes for our website and our stores, collecting and publishing customer reviews in order to improve the quality of our products and services, and optimising your browsing experience and our interfaces through A/B testing.

• A legal obligation : processing carried out in order to (i) manage the exercise of one or more of your rights in accordance with the paragraph below, (ii) retain the elements of the sales contract in accordance with the legal limitation period

3. WILL YOU RECEIVE ADVERTISING FROM BEXLEY?

BEXLEY carries out advertising campaigns by email, SMS and postal mail relating to BEXLEY products.

If you are a BEXLEY customer, and unless you object, we may send you information relating to BEXLEY products and offers by email, SMS and postal mail. You may object simply, free of charge, at any time and without providing any reason via your Customer Area, My Newsletter section

If you are a prospect (and therefore have never purchased BEXLEY products online or in store), and subject to your agreement, we may send you information relating to BEXLEY products and offers by email, SMS and postal mail.

When collecting your data, we will also process postal mailing information with a view to passing it on to our business partners for their own direct marketing purposes, so that you may discover their products, services, special offers, promotions, deals, etc. If you do not wish your postal address to be shared with our business partners for direct marketing purposes, we invite you to go to your customer account and untick the box “I agree to receive postal mail from Bexley.”

4. WHAT DATA IS COLLECTED BY BEXLEY?

• When making purchases in store

We collect the data you provide to the Bexley sales assistant when creating a customer account in store:

• Title
• Surname and first name
• Postal address
• Email address
• Telephone number
• Date of birth

• When making purchases online

We collect the data you provide when you:

• Browse and visit the websites www.bexley.com and www.bexley.com;
• Create a customer account;
• Add products to your shopping basket;
• Place an order or request a return on our websites;
• Subscribe to BEXLEY newsletters;
• Contact our customer service department;
• Take part in a competition;
• Complete a questionnaire or answer a survey.

In this context, we collect and process data relating to your identity: surname, first name, title, date of birth, delivery country, delivery address, and we associate this with an internal customer number and a loyalty card number linked to the customer account.

We also collect commercial information relating to transactions carried out: transaction number, purchase details, payment methods, discounts granted, receipts, balances and unpaid amounts, purchase history, loyalty account, product returns, correspondence and/or telephone exchanges with you and our after-sales service.

Your bank details are collected and processed directly by our banking service provider and BEXLEY never has possession of this data.

We collect information relating to your communication preferences: selection of authorised communication channels.

Through cookies, we may also collect and process personal data relating to your browsing and behaviour on the BEXLEY website, including in particular technical data: your IP address, pages visited, products of interest to you, purchases made, language, etc.

Subject to your agreement and the settings of your browsing device (computer, tablet, smartphone), BEXLEY may also collect and process all or part of the following personal data:  device type, operating system, Internet service provider (ISP), browser, network.

• Advertising and conversion tracking (Google Enhanced Conversions)

BEXLEY uses Google’s advanced technologies to measure the effectiveness of its advertising campaigns while ensuring the confidentiality of your data.

Enhanced Conversions tracking

We have enabled “Enhanced Conversions” tracking. When a conversion is made, your data (e.g. email address) is:

• Normalised and Hashed: Transformed locally on your browser using the SHA-256 algorithm before any transmission. Google only receives an irreversible digital fingerprint.
• Secured: This data is not stored in plain text, is not resold and is used solely to statistically reattribute a purchase to an advertising click.

Google Consent Mode v2 (Advanced Mode)

Our website respects your choices through Google Consent Mode v2:

• If you consent: The hashed data is transmitted for precise conversion measurement.
• If you refuse: No personal data is transmitted. A “modelled conversion” is sent via a hashed fictitious email address (e.g. no_consent@gmail.com), enabling overall statistical measurement without any possible identification of the user.

• In all cases

BEXLEY may also receive personal data from its business partners who provide it with their databases for commercial prospecting purposes. In such cases, you have given your consent to that data controller for its partners, such as BEXLEY, to contact you for direct marketing purposes. In this context, BEXLEY contractually ensures that you have indeed given your consent to that partner for your data to be transmitted to us for this purpose. Your data is then processed by BEXLEY as data controller, in order to enable us to offer you our products and carry out studies, surveys and product tests. The categories of data processed by BEXLEY are as follows: postal address, email address, mobile number, surname, first name, age, socio-professional category.

BEXLEY does not collect or process personal data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic data, data concerning health or sex life, or data relating to criminal convictions and offences, or related security measures.

For each processing operation, BEXLEY only processes data that is relevant and necessary for the purpose pursued.

5. WHAT HAPPENS IF YOU DO NOT PROVIDE US WITH YOUR DATA?

Some information requested in forms is mandatory and is marked with an asterisk. Its collection is essential to the processing of your request. Consequently, if no response is provided, we will not be able to deal with your request (for example: postal address for delivery).

6. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?

The data controller is BEXLEY S.A.S, whose registered office is located at 19 rue Louis Guérin, 69100 Villeurbanne, France, registered with the Lyon Trade and Companies Register under number 344 434 253 00078.

7. TO WHOM IS YOUR DATA DISCLOSED?

The recipients of all or part of your data are:

• Within BEXLEY: the departments responsible for the administrative and technical management of orders and returns, and the department responsible for managing marketing campaigns;

• Outside the BEXLEY group: the processors to whom BEXLEY entrusts certain processing operations and who process your data on our behalf, in accordance with our instructions, such as hosting and hosting management providers, providers managing and sending our marketing campaigns, providers monitoring and measuring the audience of our marketing campaigns, logistics providers, transport and order delivery providers, and providers collecting and publishing customer reviews.

BEXLEY ensures that it selects processors providing sufficient guarantees in terms of personal data protection. The transfer of your data to our processors is contractually governed in order to ensure the security of your data.

Where you have agreed that your data may be transmitted to BEXLEY’s business partners for direct marketing purposes, each of these companies becomes the data controller for the processing it carries out on your data. Each company that sends you marketing communications must identify itself in every communication with you, which allows you to contact it directly.

BEXLEY may also share anonymised or aggregated data with third parties other than those identified above, for statistical purposes, without it being possible for such third parties to identify you in any way whatsoever.

Data may also be transmitted to the competent authorities, at their request, or in order to comply with legal obligations.

Data relating to email addresses and mobile telephone numbers may be used anonymously for profiling purposes.

 

8. WHAT ARE YOUR RIGHTS?

You have numerous rights regarding your data. These rights may be exercised directly from your customer account, or by sending a letter together with proof of identity to:

BEXLEY
For the attention of the Data Protection Officer
19 rue Louis Guérin, 69100 Villeurbanne France

Or by email at:  dpo@bexley.com

If BEXLEY has reasonable doubts as to the identity of the natural person submitting the request under the rights described below, BEXLEY may request the additional information necessary to confirm that person’s identity (for example, a copy of an identity card).

Please note that no payment is required in order to exercise your rights as described below.

However, where a person’s requests are manifestly unfounded or excessive, in particular because of their repetitive nature, BEXLEY may:

• require payment of a reasonable fee taking into account the administrative costs incurred in providing the information, making the communications or taking the requested action; or
• refuse to act on such requests.

We will respond to your request within one month from receipt of your request. In view of the complexity and number of requests, this period may be extended by two months. BEXLEY will inform you of this extension and the reasons for the delay within one month of receiving the request.

Right to object to the processing of your data

BEXLEY ensures that you can always purchase the products it offers for sale without such use being conditional upon receiving direct marketing messages from BEXLEY or its partners.

This option is offered to you on the page for creating your customer account, on the “My account / My subscriptions” page of the BEXLEY website, and through cookie settings. And if you have agreed to receive direct marketing messages from BEXLEY and/or its partners, you may always change your mind afterwards and object to receiving future messages, free of charge and without giving any reason. If you have agreed to cookies being placed on your device, you may also object to this afterwards, again free of charge and without giving any reason.

If you exercise your right to object, BEXLEY will no longer process your data for commercial prospecting purposes. However, please note that if you object to receiving future marketing communications from BEXLEY, you will nonetheless continue to receive emails from us relating to:

• orders you place (confirmation, tracking, satisfaction questionnaire);
• your loyalty vouchers (sending and reminders relating to unused loyalty vouchers);
• your promotional code for your birthday.

You are also informed that you may register free of charge on the BLOCTEL telephone marketing opt-out list. For further information, you may consult the website www.bloctel.gouv.fr

Apart from the processing of your data for commercial prospecting purposes, you may also object, on legitimate grounds, to your personal data being processed by BEXLEY. If you exercise this right to object, BEXLEY will then no longer process your personal data, unless there are compelling legitimate grounds for the processing which override your interests and your rights and freedoms (for example: retention of your data for the establishment, exercise or defence of legal claims).

Right of access to your data

You may ask BEXLEY directly for information about the processing operations concerning you and the data held about you. To exercise your right of access, you must prove your identity by providing supporting documentation.

The exercise of your right of access must not adversely affect the rights and freedoms of others.

Right to have your data rectified

You may request the rectification of information concerning you if the information held by BEXLEY is inaccurate. You also have the right to have incomplete personal data completed, including by providing a supplementary statement.

You may rectify and update some of your data directly on the “My account / My information” page of the BEXLEY website.

Where this right is exercised, BEXLEY shall notify each recipient to whom your data has been disclosed of any rectification, unless such communication proves impossible or involves disproportionate effort.

Right to have your data erased (right to be forgotten)

You have the right to obtain from BEXLEY the erasure of your data where there is a ground provided for by law, such as for example: the data is no longer necessary, or you withdraw your consent for processing based on that consent, if you object to processing for prospecting purposes, or if you object to processing for another purpose and there are no overriding legitimate grounds for the processing.

Where this right is exercised, BEXLEY shall notify each recipient to whom your data has been disclosed of any erasure, unless such communication proves impossible or involves disproportionate effort.

BEXLEY may nevertheless retain some of your data in intermediate archives for the period necessary to comply in particular with our legal, accounting and tax obligations.

Right to restriction of the processing of your data

You have the right to obtain restriction of processing by BEXLEY where one of the following applies:

• If you contest the accuracy of your data, for a period enabling us to verify it;
• If the processing is unlawful and you oppose their erasure and request instead the restriction of their use;
• If BEXLEY no longer needs your data for the purposes of the processing but you still require it for the establishment, exercise or defence of legal claims;
• If you have objected to processing based on the legitimate interest of the data controller, pending verification whether the legitimate grounds pursued by the data controller override yours.

Where this right is exercised, BEXLEY shall notify each recipient to whom your data has been disclosed of any restriction of processing carried out, unless such communication proves impossible or involves disproportionate effort.

Right to data portability

You have the right to request the portability of your data. This allows you to receive the data in a digital format. This right only applies where the processing is carried out by automated means and on the basis of your consent or the performance of a contract.

Right to withdraw your consent for commercial prospecting purposes

You have the right to request that you no longer receive marketing messages from us, at any time, free of charge and without giving any reason. You simply need to click on the “unsubscribe” link included in every email sent by BEXLEY, or write to us at dpo@bexley.com, or send STOP by SMS to 36608. In this case, your data will no longer be processed for prospecting purposes.

You may also manage your communication subscription preferences directly from your customer account.

To stop receiving commercial offers from our partners, we suggest that you refer to their terms and conditions for further information. In any case, you may exercise your various rights directly with them, in particular your rights of access, rectification and objection. If you encounter any difficulty or do not wish to receive commercial offers from our partners, you may write to us at any time at dpo@bexley.com.

Automated decisions and profiling

BEXLEY does not make any decision concerning you based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

The only “profiling” carried out by BEXLEY consists in analysing your data concerning your preferences or personal interests and your location. This information may be taken into account in order to send personalised communications automatically, depending for example on gender, an age group or postcode. You may always object to this profiling.

Right to provide instructions regarding your data after your death

You have the right to define general or specific instructions relating to the retention, erasure and communication of your data after your death, specifying how you intend these rights to be exercised. These instructions may designate a person responsible for carrying them out; failing that, your heirs will be designated. You may communicate specific instructions to BEXLEY. In the absence of any instructions, your heirs may contact BEXLEY’s DPO at dpo@bexley.com

Where such instructions are general and concern all personal data relating to you, they may be registered with a trusted digital third party certified by the French Data Protection Authority (Commission nationale de l'informatique et des libertés).

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority, such as the French Data Protection Authority (CNIL) in France.

9. IS YOUR DATA TRANSFERRED TO A COUNTRY OUTSIDE THE EUROPEAN UNION?

The processing carried out by BEXLEY takes place within the territory of the European Union. Therefore, all your data is processed and hosted within the territory of the European Union.

10. HOW LONG IS YOUR DATA RETAINED?

The retention period for personal data depends on the purpose for which it is processed. Generally speaking, your data is retained for the duration of our business relationship, plus a period of three years after its end, and is then archived in order to meet our legal obligations or for evidential purposes, or anonymised for study and statistical purposes.

Your data will not be retained beyond the period strictly necessary for the purposes pursued as set out herein and in accordance with the law. 

Your order data is retained for seven years from the date of the last order.

Your customer account data is retained, for communication purposes, for a period of three years from your last activity on our website or on an electronic communication medium (in particular, clicking on a hyperlink contained in one of our emails). At the end of this three-year period, BEXLEY may contact you again to find out whether you wish to continue receiving our commercial communications. In the absence of a positive and explicit response from you, we will delete your data.

However, data enabling proof of a right or a contract to be established, or retained in compliance with a legal obligation, may be subject to an intermediate archiving policy for a period not exceeding the duration necessary for the purposes for which it is retained, in accordance with the legal provisions in force, it being recalled that the ordinary limitation period is five years (Article 2224 of the French Civil Code). In this context, we may retain certain data after deletion of your account where such retention is required by law, or where such retention is necessary to enable us to manage disputes and claims.

Likewise, if you have exercised your right to object to receiving marketing communications from a data controller, the information necessary to take your objection into account will be retained for at least three years from the exercise of that right. Such data shall under no circumstances be used for purposes other than managing the right to object, and only the data necessary to take that right into account shall be retained.

11.   OUR COOKIE POLICY

The term “Cookie” refers, in the broad sense, to any tracker placed and/or read when viewing a website or an email. A cookie may contain information such as the name of the server that placed it, an identifier in the form of a unique number, and an expiry date.

Cookies are in particular necessary to enable you to benefit from certain features of our website. If you choose to disable Cookies via your internet browser, access to the website may then be impaired.

BEXLEY uses both its own Cookies and third-party Cookies. Only the issuer of a Cookie is likely to read or modify the information contained therein.

The Cookies used are of several types and serve different purposes. They are installed on your receiving device (computer, tablet, smartphone, etc.) or on your browser, subject to the choice you have expressed regarding Cookies, and this choice may be modified at any time. You may accept or refuse Cookies either globally for the entire BEXLEY website or Cookie by Cookie.

We share information about the use of our website, such as browsing and/or geolocation data, with our advertising and analytics partners, who may combine it with other information that you have provided to them or that they have collected through your use of their services.

Because of third-party applications integrated into our website, some Cookies may be issued by our business partners and the issuance and use of Cookies by these partners are subject to their own privacy policies. BEXLEY informs you of the purpose of the Cookies of which we are aware and of the means available to you to make choices regarding those Cookies.

 

The table below sets out the main cookies and trackers likely to be placed or read on our website, subject to your consent choices where required, as well as a link to their privacy policies explaining how to object to their services.

The duration indicated corresponds to the maximum lifespan observed or declared for these cookies. Some trackers may expire earlier depending on their technical settings or your consent choices.

 

How to enable/disable Cookies?

You may at any time manage, disable and enable Cookies by deleting cookies in your browser settings.

You may visit the Youronlinechoices website, provided by digital advertising professionals grouped together within the European association EDAA (European Digital Advertising Alliance). You will then be able to find out which companies are registered on this platform and which offer you the possibility of refusing or accepting the Cookies used by those companies in order to adapt the cookies likely to be placed on your device.

In addition, we invite you to consult the “Cookies: tools to control them” section of the CNIL website: www.cnil.fr

If you encounter any difficulty in exercising your right of access to or objection to Cookies, you may contact BEXLEY: dpo@bexley.com

12. HOW DO WE ENSURE THE SECURITY OF YOUR DATA

BEXLEY implements appropriate technical and organisational measures, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the degree of probability and severity of the risks to the rights and freedoms of natural persons.

For example, our banking payment service provider incorporates the SSL (Secure Socket Layer) security protocol. Confidential data: bank card number, expiry date and security code are encrypted and transmitted to the bank’s secure server. Under no circumstances does this data pass through or remain stored on BEXLEY’s servers.

BEXLEY also takes measures to ensure that its staff, its processors and their staff who have access to your data do not process it, except on the instruction of the data controller, unless required to do so by Union law or the law of a Member State.

The website hosting provider carries out vulnerability tests on our servers twice a year in order to ensure the security of Bexley’s infrastructure.

BEXLEY ensures that its processors provide sufficient guarantees as to the implementation of appropriate technical and organisational measures so that the processing best respects the protection of the rights of the data subject.

13. CHANGES TO OUR PRIVACY POLICY

We regularly review our Personal Data Protection Policy and will publish any updates on this webpage.