Internet websites

As far as our internet websites are concerned:

Scope and purpose of the processing of personal data

During visits to our websites

If you use our digital services without supplying any other indications, the web server technology we use automatically records general technical navigation data in its files, known as logs. The IP address of the device used for the visit, data relating to the type of browser, the internet service supplier and the operating system used, those of our digital services which have been visited, the landing/exit pages and the date and duration of the visit are included in this, among others. The purpose of the collection and processing of this information is to allow the use of our internet websites (connection), to ensure and reinforce the safety and stability of our systems and our services, to analyse the use of our offers and services, to gather general demographic information and to optimise our internet services (in particular, but not only, the improvement of products, marketing activities, targeted advertising etc.), as well as obtaining in-house statistics.

The user is not identified at this time. Equally, in principle no link is made between this information collected automatically and the personal data recorded by us. Nevertheless, there may be an exception to this basic rule if you already have a user account registered on one of our websites. You will find below more detailed information concerning the processing of personal data of registered users.

When opening a user account

Your registration, as well as the creation of a user account, may be required for the use of personalised services or for access to protected areas or for the processing of orders and the management of your accounts. It is therefore necessary that you supply some personal data. For example, this includes:

• 1. Your e-mail address, which can also serve as your user name,
• 2. A password, as well as other data, as appropriate according to the context and service, such as,
• 3. Your surname and first name
• 4. Your address (complete postal address, postcode and location)
• 5. Your telephone number
• 6. Information relating to newsletters about subscription and other advertising
• 7. Your preferred language.

As well as the data highlighted as obligatory for the use of a specific digital service, you are free to supply and record other personal data. We use this data to supply and manage our digital services and for verifying the data supplied, in other words for the justification, the content structure and the realisation and modification of contractual agreements made with you concerning your user account, as well as for invoicing with due diligence in the case of sales.

If you post any contributions (comments, photos, videos etc.) via the corresponding functions of our portals in order to share them with other users, it is possible that we may disclose them and that the public may thereby gain access to them. The same applies to your user name or a pseudonym that you may have chosen to this effect. We would draw your attention to the fact that such data that you might publish may be further seen by third parties once it appears on the internet, via search engines for example, even if its deletion or anonymisation has been requested. By confirming the entry and the transfer of data relating to your user account at the time of registration, you guarantee the exactitude of the data you have supplied.

When using a portal as a registered user

We collect data for statistical reasons in order to ensure that the portal works properly and to analyse, optimise and personalise the use of our offers and services. We therefore collect data relating to your use of our digital services, particularly the functions you use, which advertisements you have looked at and how you notice them. You will find further information on the processing of this personal data in this document. As soon as you use our portal as a registered user, statistical data can be consulted by other registered users and captured and evaluated by us.

When making a purchase / when purchasing or acquiring a paid-for

If you buy a product or a paid-for service on our website some data such as, for example, your surname and first name, your address (complete postal address, postcode, location) and other data must potentially be supplied, given that we need this to complete the contract concluded with you. If you choose to purchase a product or a paid-for service using the option of online payment by credit card or PayPal, for example, payment takes place via the online payment system of the supplier concerned. In this case, the processing of personal data and payment is carried out directly via the supplier of the payment system concerned. We do not know nor do we record your payment data. The provisions relating to the protection of data on each supplier's online payment system apply additionally.
Insofar as you are registered and have a user account, we can record your data in your user account for the next purchase or contract concluded. In all cases, we record all the information relating to your present and past purchases and contracts concluded, in other words that relating to the products, services, number of products and services per purchase and the payment amount. We are authorised to use this information for the purposes of marketing and analysis. Further below, you will find more information regarding the purposes of marketing and analysis.

Online advertising

Following your registration or your order as a guest on one of our internet websites:

1. 1. Lucrin.fr
2. 2. Lucrin.de
3. 3. Lucrin.es
4. 4. Lurin.it
5. 5. Lucrin.ie
6. 6. Lucrin.com.nl
7. 7. Lucrin.ch
8. 8. Fr.lucrin.ch
9. 9. Lucrin.co.uk
10. 10. Lucrin.com
11. 11. Lucrin.ca
12. 12. Fr.lucrin.ca
13. 13. Lucrin.hk
14. 14. Zh.lucrin.hk
15. 15. Lucrin.com.au
16. 16. Lucrin.co.jp
17. 17. Lucrin.in
18. 18. Lucrin.com.cn
19. 19. Lucrin.pt
20. 20. Lucrin.fi
21. 21. Lucrin.sg
22. 22. Lucrin.at
23. 23. Lucrin.ae
24. 24. En.Lucrin.ae

We can also use your personal data for the purposes of personalised advertising. This relates as much to the personalisation of e-mail advertising such as e-mails containing general information or information of an advertising nature (newsletter) and instant messaging services as to the supply of contents and personalised advertising on our websites. To this end, we can automatically analyse the information relating to your behaviour which is gathered when you use our portals in order to avoid you receiving inappropriate advertising.

By creating a user account, you essentially become automatically subscribed to receive our newsletter and your e-mail address can then also be used for our own advertising until you unsubscribe from the newsletter concerned. You will find a link at the bottom of each e-mail we send allowing you to unsubscribe from the newsletter at any time. You can also unsubscribe from the newsletter at any time by sending an e-mail to Privacy@lucrin.com.
Unsubscription is possible at any time. We are entitled to instruct third parties to carry out the technical processing of advertising initiatives and our own advertising and to transmit your data for this purpose.

Transmission of data to third parties

We work with other companies or persons or instruct them to carry out the processing and recording of data. They may have access to your personal data or user data, but only insofar as that is necessary for them to carry out their tasks.
We can use and transmit the information you have supplied and your personal data or your user account data to companies in the Lucrin group (Lucrin SA, Lucrin Spain SL, Lucrin Mauritius Ltd, Lucrin Hong Kong Ltd, Lucrin USA, Lucrin India Ltd and Lucrin Japan) for the purposes of evaluation, improvement and organisation according to the needs of our services and for the purposes of personalisation and marketing.

In addition to this, we transmit your data where necessary to third parties for the performance of the contract. For this purpose, we might send the required data to transport companies, banks and other service providers. These service providers use your data exclusively for the processing of the order and not for any other purposes. Insofar as it is necessary for the objectives cited in the first paragraph, the data may also be transmitted abroad, for the delivery of merchandise for example. You will find further information concerning the transmission of data abroad later in the document.

The personal data which you put at our disposal is neither sold nor leased nor exchanged. With the exception of the transmissions described beforehand, we only send your personal data if you have expressly consented to this, if there is a legal obligation so to do or if we need to do so in order to uphold our rights, particularly those arising from any contractual relationship.
In the case of sale, fusion or any other reorganisation of all or part of the asset values of our company, personal data can be transferred, sold or shared by other means with third parties as an element of the said transaction or reorganisation. In the case of an anticipated benefit, for example in the case of a purchase on invoice, we obtain a credit investigation as appropriate for the safeguarding of our legal interest, carried out according to a mathematical and statistical method by an intelligence agency. To do this, we send the personal data necessary for carrying out a credit investigation to an intelligence agency and use the information received relating to the statistical probability of non-payment to make a decision on the validity, the execution or the termination of the contractual relationship. The credit investigation may include probability scores (value scores) which are calculated on the basis of scientifically recognised mathematical and statistical procedures and which include in their calculations address data, among other data. Your rights to the protection of your data are taken into account in accordance with all legal provisions.

Processing of your personal data for the purposes of marketing and analysis

The aim of the Lucrin companies is to continually improve the digital services offered, to structure them in the safest way according to need. To this end, various analysis tools may be implemented to make a link between user-specific data, future and past, which we have available and to analyse, aggregate, pseudonymise and anonymise user behaviour across our services. In order to keep our database up-to-date, we are likely to make use of publicly available data or data from third party service providers. The findings from your use of our services may be used and evaluated as part of the analysis of user behaviour by other participating companies. This data processing relies primarily on pseudonymised or anonymised data. Its chief objective is to send you or to display anonymised advertising on one of our websites, as well as to improve the security of our websites.

Transmission of personal data abroad

We are entitled to send your personal data to third party companies (authorised service providers) located abroad, as soon as this is opportune for the processing of the data described in the current declaration on data protection. These companies are subject to the obligation to protect the data in the same way as ourselves. If the level of data protection in one country does not correspond with that of Switzerland, we ensure, through contracts, that the protection of your personal data corresponds with the level of protection in Switzerland. We call upon one or several of the following measures in order to do this:

by concluding UE-type contractual clauses with authorised service providers, cf.
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_fr

by ensuring that the authorised service providers are certified by the Swiss-US or EU-US Privacy Shield (insofar as the recipient of the data has its headquarters in the USA or if the data will be kept there), cf.
https://www.privacyshield.gov/

by the presence of Binding Corporate Rules (BCR) recognised by a European data protection authority among authorised service providers, cf.
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/binding-corporate-rules_en

Right to information, correction, deletion or in the case of a complaint

You have the right to assert your data protection rights at any time and to request information regarding the personal data relating to you which we are processing.

You can also, at any time, have your personal data corrected, blocked or deleted by informing us in writing, with proof of your identity, to the following address: Privacy@lucrin.com

We reserve the right to correspond with you regarding this. Please note that we sometimes have to keep some of your personal data as part of our legal and contractual storage obligations (for example, for the purposes of invoicing) even after your request to block or delete and in this case we only proceed to block your personal data insofar as required. Moreover, the deletion of your personal data could have the effect of preventing you from continuing to have access to or using the services which you have registered. Under certain conditions, you can ask us to send your personal data to you in standard format, or to a third party specified by you.

You can also oppose the processing of your data for marketing and advertising purposes at any time, as well as the transmission of your data within the Lucrin group. Such an opposition does not entirely exclude the collection of personal data. By using the following link, you can prevent the collection of your user data. The opposition only excludes personal data gathered being processed in a non-anonymised way for marketing purposes, as well as its transmission to other companies for this objective and its being processed by the latter. In order to totally exclude or, at least, reduce the collection of personal data, the steps mentioned in the section relating to the deactivation of cookies need to be carried out. This may have the effect of preventing you from using the services which you have ordered. In addition, you have the right to take action against the processing of data with the appropriate surveillance authorities. You can do this with your local surveillance authority, that linked to your place of work or the location of the alleged data protection infringement.

Duration of the retention of your personal data

We only retain your data for the legal duration or that necessary for its processing. During analyses, we only store your data until the end of the process. If we store your data by virtue of a contractual relationship with you, we only keep it for the duration of this relationship and, at most, up to the deadline of any eventual claims in our favour or as stipulated either by the law or by the provisions in our contract.

Data security

We employ appropriate technical and organisational security measures in order to protect your personal data recorded by us against any unintentional, illegal and unauthorised manipulation, deletion, modification, access, transmission or use and against its total or partial loss. Our security measures are continuously adapted and improved in line with technological progress. We decline any responsibility in the case of loss of data or its communication to third parties and its use by them. If you register with us as a user, access to your user account is only possible with your personal password. We recommend that you always keep your payment and access information confidential and close down your browser when you have ended your communication with us, particularly when you are using a shared computer. We also pay serious attention to internal data protection. Our staff and that of service providers authorised by us are required to maintain confidentiality and respect of legal provisions for data protection.

Cookies

Cookies help us to organise your visit to our websites better to make it easier, more pleasant and more relevant. Cookies are files containing information which the internet browser records automatically on your computer's hard disk when you visit our internet website.

Cookies do not damage your computer's hard disk and neither do we transmit users' personal data. As an example, we use cookies to know who has visited our portal and can infer from that how frequently some pages or services are visited, which parts of the portal are particularly enjoyed and how the portal is used. We use other cookies so that you can navigate freely around our website and use its functions, such as having access to protected areas for example. Cookies such as this also allow us to use the choices that you have made or the decisions that you have taken as parameters in order to make your visit to our portal more pleasant. Generally, cookies are used to improve our services and to make them more efficient and more secure. Cookies also allow the collection of information with a view to proposing advertising which might be of interest to you. Most internet browsers automatically accept cookies.

However, you can configure your browser so that no cookies are recorded on your computer or so that you are always informed when you receive a new cookie.

Monitoring and analysis tools
The use of our digital services is further measured and analysed by various technical systems, principally by third party suppliers such as Google Analytics. These measures can be carried out anonymously or not. It is therefore possible that the data collected may be transmitted to third parties for processing purposes. The most commonly used analysis tool is Google Analytics, a service of Google Inc. In principle, the data collected can thus be transmitted to a Google server in the United States, but IP addresses are anonymised by an ad-hoc process so that no association is possible. Google will therefore not be able to associate the IP address transmitted by your browser within the framework of Google Analytics to other data which it holds regarding you. By visiting the following internet website, it is possible to oppose the collection and processing of this data by Google Analytics by installing a cookie opt-out which prevents the future collection of your data when you are browsing:

https://tools.google.com/dlpage/gaoptout?hl=en


Please find below more information regarding the systems we use:
• Server + Database (Adobe Cloud)

  https://business.adobe.com/privacy/general-data-protection-regulation.html

• Payment (Stripe, PayPal)

  https://stripe.com/gb/privacy

• Marketing (Google Analytics)

  https://static.googleusercontent.com/media/www.google
  .com/en//intl/en/policies/privacy/google_privacy_policy_
  en.pdf https://static.googleusercontent.com/media/www.google.com/en//intl/en/policies/privacy/google_privacy_policy_en.pdf

• Customer Relationship Manager (Salesforce)

  https://www.salesforce.com/company/privacy

• ERP + Shipping (NetSuite, SmartLogVision sarl)

  https://www.netsuite.com/portal/assets/careers/
  includes/privacy-careers.shtml https://www.netsuite.com/portal/assets/careers/includes/privacy-careers.shtml
Legal foundations

We only process your personal data within the framework of the principles of data processing and if there is a legal foundation for so doing. This legal foundation exists at the stages of the preparation and execution of our contract.
In addition to this, we have an interest in constantly improving our services, adapting them to your needs and circulating advertising likely to be of interest to you. This is necessary in order to continue to develop and finance our services and to guarantee their security. We therefore start from the premise that our interests prevail. This is admissible if you have consented to the processing of your data.

Contact

If you have any questions relating to the protection of data on our internet websites, if you would like to obtain information or to request the deletion of your data, please make contact with our data protection manager by sending an e-mail to the following address: Privacy@lucrin.com

The contact details of our data protection manager are as follows:

Lucrin SA
Data Protection Manager
Avenue Krieg 7,
1208 Geneva
Switzerland

Updating and modification of data protection provisions

The development of our internet website or the implementation of new technology can make the modification of the current data protection provisions necessary. Each important modification of these provisions is announced to registered users by e-mail to the e-mail address indicated at the time of registration or via a corresponding reference appropriately placed after connection to the user account. In addition to this, you can consult the data protection provisions currently in force at any time via our website and print them.
The original declaration of confidentiality is in French. The purpose of the translated versions is to facilitate its better understanding. In the case of any discrepancy, the French text is legally binding.

Geneva, 25th October 2018.