Effective January 1, 2024, the website https://www.gambettesbox.fr is operated by:
GBE&W (hereinafter referred to as the "Company" or "GBE&W")
Simplified Joint Stock Company with a share capital of €30,000
Registered office: 13 Boulevard de Rochechouart, 75009 Paris, France
VAT identification number: FR42 789 533 353
Hereinafter, "GBE&W," acting as the data controller or joint data controller in accordance with regulations on personal data, notably General Regulation (EU) No 2026-679 on the Protection of Personal Data of Natural Persons (GDPR), for its brand Gambettes Box.
1. What personal data do we process?
Depending on the services of the website used and your settings choices (especially regarding cookies and other trackers), the processed personal data concerning you mainly include: your name, first name, email address, postal address, phone number, date of birth, your order and product selection history, payment information, preferences, and responses to the beauty questionnaire, as well as your login logs (hereinafter referred to as "Data").
We may allow you to share information about our services on social media websites (in their fixed or mobile versions, including corresponding applications), such as Facebook, X, etc., particularly through share buttons. Please note that accessing these social networks requires your acceptance of their contractual terms containing provisions related to Personal Data Regulation for the processing carried out by them, independently of our pages on said social networks.
To learn more about the protection of your Personal Data when browsing these social networks, we invite you to consult their respective privacy policies.
2. How do we collect your personal data?
These data are collected either based on your consent or are necessary for the execution of your orders (contract execution).
Fraud prevention is based on GBE&W's legitimate interest.
3. Why do we collect your personal data?
Thus, your data is collected for the following purposes:
- Creating and managing your user account;
- Creating and managing your subscription;
- Allowing you to comment on our products;
- Ensuring the security of online transactions, preventing fraud, and payment incidents;
- Managing and optimizing customer relations;
- Sending you information about our offers, news, and events (newsletters, alerts, invitations, and other publications), including through campaigns on social networks;
- Subject to your consent: allowing our partner companies and associations to send you information about their offers, news, and events (newsletters, invitations, and other publications);
- Subject to your specific and prior consent on the CMP (Consent Management Platform): cross-referencing navigation data with those of your registered or subscribed account for profiling purposes;
- Conducting statistics and audience measurements;
- Conducting satisfaction surveys up to a maximum of 15 times a year.
When the processing of your data is essential for GBE&W to achieve the above purposes, the relevant fields are, unless otherwise specified, all mandatory. If you do not provide this mandatory information, GBE&W will not be able to respond to your requests and/or provide you with the requested products and services.
4. To whom do we transmit your personal data?
As the data controller, GBE&W may be required to transmit your personal data to (i) potential subcontractors of GBE&W for exclusively technical and logistical reasons (hosting and maintenance service providers, payment and fraud management providers, moderators, database management providers, logistics providers), (ii) joint data controllers whose identity is indicated prior to each processing, and (iii) third parties in the event of restructuring of our company, including total or partial asset transfer, merger, acquisition, spin-off, and more generally, any reorganization operation.
By accepting our General Conditions, your data may be used for customer relations management and optimization purposes. Your data may also be used for sending information about GBE&W's offers and news, including through advertising campaigns on social networks. Social media companies and email and SMS routing service providers may therefore be recipients of your data.
Our audience measurement and advertising content improvement partners may also be recipients of your data.
Finally, GBE&W may be required to disclose your data to third parties when such disclosure is required by law, regulatory provisions, or a court decision, or if such disclosure is necessary to ensure the protection and defense of its rights.
5. Data transfers outside the European Union
Recipients of your data may be located abroad, including outside the European Economic Area. Any transfer of your data outside the European Economic Area is carried out with appropriate safeguards, including contractual ones, in compliance with applicable data protection regulations.
6. What are your rights?
In accordance with current regulations, you have the right to access and rectify your data, as well as to request their erasure, object to their processing, and obtain their limitation or portability where applicable.
You can also object to the use of your data for profiling purposes; in this case, you will no longer be able to benefit from personalized offers or services.
These rights can be exercised directly with GBE&W by email at [email protected]. Proof of identity may be requested.
Furthermore, you can at any time request not to receive our communications regarding our offers, news, and events by using the hyperlink provided for this purpose in each email we send you. You can also reach us by regular mail at the address GBE&W, 13 Boulevard de Rochechouart, 75009 Paris.
7. How long do we retain your personal data?
Data related to the creation of your user account and your subscription will be retained by GBE&W for a period of five (5) years from the end of the contractual relationship or the inactivity of your user account. After this period, this data will either be archived for accounting and probative purposes during the applicable legal prescription periods or destroyed if these periods have expired.
In the event of collecting banking data, it will be securely stored for the duration necessary for the validation of your order and payment and will then be deleted in accordance with applicable regulations regarding the pursued purposes. For claims management purposes, your data may be kept for proof in intermediate archives.
Regarding your Subscription and/or user account, your data will be retained for a period of five (5) years from their collection or your last contact with GBE&W for the purpose of sending communications related to commercial offers, news, and events offered by GBE&W. In the absence of registration or Subscription, your data will be retained for a period of three (3) years from their collection or your last contact with GBE&W.
Finally, connection logs collected, subject to your agreement, through cookies and other trackers implemented on our website, will be retained in accordance with applicable regulations for a period not exceeding thirteen (13) months.
8. Data Protection Officer (DPO) contact information and the right to lodge a complaint
For any questions related to the collection and processing of your data by GBE&W or the exercise of your rights, you can contact GBE&W's Data Protection Officer by email at the following address: [email protected].
You also have the right to contact the National Commission for Information Technology and Civil Liberties (CNIL), 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07, with any complaints related to how GBE&W collects and processes your data.