Privacy policy
This Privacy Policy aims to explain why we collect your data and how we are committed to protecting it.
COMPAGNIE DES AGRAFES A VIGNE (CAVI) is committed to safeguarding your personal data and privacy.
In this context, and in accordance with the General Data Protection Regulation (hereinafter referred to as “GDPR”), we inform you of the conditions under which your personal data may be processed by us.
What personal data do we process?
Purpose:
We may collect and store your personal data, in particular for:- Processing and responding to your messages,
- Creating and managing access to your accounts,
- Receiving and processing your order,
- Establishing and monitoring the commercial relationship arising from your messages,
- Receiving your payment,
- Managing accounting and administration,
- Improving our tracking and customer service,
- Ensuring proper functioning and customization of services,
- Detecting attacks and taking legal action against fraud,
- Storing your choices regarding the use of cookies,
- Processing and responding to your requests to exercise your rights,
- Complying with current or forthcoming regulatory requirements
Categories of data:
Contact details (e.g., first name, last name, phone number, email); payment information; technical and location information generated through the use of our services.Legal basis for processing
The personal data processing carried out is based on:-
- Either the consent of the data subject (Article 6.1.a of the GDPR) for all processing that requires prior consent. In online forms, mandatory fields are marked with an asterisk. Failure to respond to mandatory questions will prevent us from providing the requested services.
-
- Or for the performance of a contract or pre-contractual measures,
-
- Or for the pursuit of a legitimate interest (Article 6.1.e of the GDPR),
-
- Or for compliance with a legal or regulatory obligation.
Who are the recipients of your data?
Your personal data is intended for COMPAGNIE DES AGRAFES A VIGNE (CAVI). Our internal services: They are processed by our staff from various departments such as sales or IT security. Trusted companies or individuals: they process your information on our behalf for the purposes described above, in accordance with our instructions as outlined in our Privacy Policy and any other appropriate use regarding confidentiality and security. Technical subcontractors: Your personal data may be transferred to our technical subcontractors (as per Article 4.8 of the GDPR) under strict conditions. In case of transfer, we ensure that subcontractors comply with the GDPR and implement technical and organizational measures to protect the data (Art. 28 GDPR). Traffic analysis (such as Google Analytics), CRM provider (such as Hubspot), Payment provider (such as Stripe) Sometimes we need to allow our partners to process, on our behalf, the personal information we hold about you for the purposes stated in this policy or for any other reason required by law. Customer personal data is hosted in France. If a service provider is located outside the European Union, we ensure that appropriate measures are in place to guarantee an adequate level of protection for personal data.How does COMPAGNIE DES AGRAFES A VIGNE (CAVI) safeguard your data?
We implement all organizational and technical measures to ensure an appropriate level of security for your personal data, in particular to prevent any loss of confidentiality, integrity, or accessibility. We frequently back up data, encrypt your data during transfer, limit access to personal information to only those who need to process it, ensure that third parties provide the same level of protection for personal data, implement technical and organizational measures to ensure that customer personal data is securely stored for the duration necessary to achieve the purposes pursued; – GDPR training for our teamsWhat are your rights regarding your personal data?
In accordance with applicable regulations, you have the following rights: Right to rectification: You have the right to obtain correction of inaccurate personal data. You also have the right to complete incomplete data by providing additional information. In exercising this right, we commit to communicating any corrections to all recipients of your data. Right to erasure: In certain cases, you have the right to obtain the deletion of your data. However, this is not an absolute right and we may retain such data for legal or legitimate reasons. Right to restriction of processing: In certain cases, you have the right to obtain the restriction of processing on your data. Right to data portability: You have the right to receive the data you provided to us in a structured, commonly used, and machine-readable format, for personal use or to transmit it to a third party of your choice. This right applies only when the processing is based on your consent, a contract, or is carried out by automated means. Right to object to processing: You have the right to object at any time to the processing of your data for processing based on our legitimate interest, a task carried out in the public interest, or for direct marketing purposes. This is not an absolute right, and we may refuse your request for legal or legitimate reasons. Right to withdraw consent at any time: You may withdraw your consent to the processing of your data when processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before the withdrawal. Right to lodge a complaint with a supervisory authority: You have the right to contact your data protection authority to complain about our personal data practices. In accordance with GDPR, the conditions for exercising these rights may vary depending on the legal basis of the processing mentioned in the first paragraph. We will respond to any exercise of rights as soon as possible, and in any case within 30 days from receipt of the request. We reserve the right to:-
- Request proof of identity of the requester in case of reasonable doubt to comply with confidentiality obligations,
-
- Extend the response period by two months, informing the requester of this extension and the reasons within one month of receipt of the request,
-
- Refuse to respond to an exercise of rights if it is considered abusive (due to the number, repetitive or systematic nature of requests).