Article 1: Foreword

ETF, acting as data processor within the meaning of Regulation (EU) 2016/679 of 27 April 2016 and the French Data Protection Act of 6 January 1978, as amended (Loi Informatique et Libertés), (hereinafter referred to collectively as the “Regulations”) attaches great importance to the protection of your personal data and your private life.

The aim of this privacy policy (hereinafter referred to as the “Policy”) is to inform you how we collect, use and share the personal information that you provide via our website https://shop.uic.org (hereinafter referred to as the “Website”).

This Policy is only applicable to the processing of information (hereinafter referred to as “Personal Data”) that can potentially identify or make identifiable the user (hereinafter referred to as the “Client”) of the Website, directly or indirectly.

ETF undertakes to limit the processing of Personal Data to those cases provided for in this Policy, and to keep this Policy updated to ensure a high level of Personal Data protection in compliance with the applicable Regulations.

This Privacy Policy works in conjunction with our Website’s Conditions of Sale and Cookies Policy, which are available at the following address:

https://shop.uic.org/fr/content/3-conditions-generales-de-vente

Article 2: Personal Data collected and processed in the course of navigating the Website

2.1 What data do we collect?

When using the Website, you may provide us with Personal Data, directly or indirectly, or through your use of the Website.

Consequently, we collect the Personal Data that you provide.

The Personal Data collected may therefore include:

• Identifying data: name, email address, postal address and telephone number;

• Data related to work: company name, professional email address;

• Transaction data: shopping cart;

• Technical data: IP address, browser type and version, operating system used;

• Connection data: functions used, pages visited, configurations selected, access times and search terms.

When your Personal Data is collected, you may be informed that some data is necessary to achieve the expected outcome. If this obligatory information is not provided, it may not be possible to carry out the request.

2.2 Why do we collect your personal data?

We collect and process your Personal Data for the following purposes:

• In order to create your online account;

• In order to fulfil the contracts concluded between you and us;

• In order to manage commercial aspects such as deliveries, invoices and after-sales services;

• In order to send you newsletters, with your consent;

• In order to provide technical support and maintenance to ensure the proper functioning and security of our Website;

• In order to improve the function and quality of your browser on our Website by performing analyses and gathering statistics;

• In order to offer you relevant content, adapted and personalised to your interests and geographical location;

• In order to inform you of any modifications, updates or other changes we make to our Website;

• In order to comply with legal obligations to which we are subject;

ETF undertakes not to use the information for purposes other than those mentioned above.

This data may be collected when:

-         The Client creates an account entitled “Account”;

-         The Client is contacted by ETF customer services;

-         The Client subscribes to the Newsletter.

2.3 The legal bases for the collection of your Personal Data

We collect and process your Personal Data in compliance with the Regulations and only within the framework of the following legal bases:

• When required as part of the fulfilment of a contract concluded with you;

• When required to comply with our legal obligations;

• When you have expressly consented to the processing of your Personal Data;

• When it is necessary to protect our legitimate interests.

2.4 Transmission of data to third parties

Personal Data collected by the Website is not transmitted to any third parties and is only processed by the Website editor.

The Data collected is intended for us in our capacity as data processor.

Unless required to fulfil a legal, accounting or judicial obligation, we shall not disclose, rent, lease or transmit in any way whatsoever your Personal Data to third parties.

2.5 Data hosting

The website https://shop.uic.org is hosted by UIC, which has its headquarters at the following address:

UIC

16 rue Jean Rey, 75015 Paris, France

The data collected and processed by the website is hosted and processed solely in France.

2.6 Transfer of data

Your data will not be transferred outside the European Union.

2.7 Duration of data retention

Your Personal Data will only be retained for as long as is strictly necessary to achieve its purposes, as issued by this Policy, and in compliance with the Regulations and applicable laws.

Technical and connection data is retained for 6 months from the date of collection.

Identifying data, data related to work and connection data is retained for the duration of the account. For inactive accounts, your Personal Data will be retained for 3 years.

After these deadlines, your Personal Data will be deleted.

Article 3: Obligations of the data processor

The data processor for personal data is ETF. We undertake to protect the personal data collected, to not transmit it to third parties without first informing the Client ,and to respect the purposes for which this data has been collected.

In addition, as data processor, we undertake to notify the Client in the event of the rectification or erasure of data, unless this involves disproportionate effort.

In the event that the integrity, confidentiality or security of the Personal Data of the Client is compromised, we undertake to inform the Client by all means necessary.

Article 4: Rights of the Client

In accordance with the applicable laws and regulations on the protection of Personal Data, you benefit from a number of rights relating to your Data, as follows:

–       Right of access and information: you have the right to be informed in a concise, clear, intelligible and easily accessible manner as to how your Data is being processed. You also have the right to obtain confirmation as to whether or not Data concerning you is being processed, and, where that is the case, the right to access the Data and to obtain a copy.

–       Right to rectification: you have the right to obtain the rectification of inaccurate Data concerning you. You also have the right to have incomplete Data concerning you completed, by providing a supplementary statement. If this right is exercised, we undertake to communicate any rectification to each recipient to whom the Data has been disclosed.

–       Right to erasure: in certain cases, you have the right to obtain the erasure of your Data. However, this is not an absolute right, and we may retain your Data for legal or legitimate reasons.

–       Right to restriction of processing: in certain cases, you have the right to obtain the restriction of processing your Data.

–       Right to Data portability: you have the right to receive the Data that you have provided, in a structured, commonly used and machine-readable format, for your personal use or to transmit it to a third party of your choice. This right only applies where the processing of your Data is based on consent or a contract, and the processing is carried out by automated means.

–       Right to object to processing: you have the right to object, at any time, to the processing of your Data for processing based on our legitimate interest, a task carried out in the public interest and for marketing purposes. This is not an absolute right, and we may refuse your request to object for legal or legitimate reasons.

–       Right to withdraw your consent at any time: you can withdraw your consent for the processing of your Data where processing is based on your consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

–       Right to lodge a complaint with a supervisory authority: you have the right to contact the French Data Protection Agency (Commission Nationale de l’Informatique et des Libertés – CNIL) to lodge a complaint regarding our privacy practices.

–       Right to provide instructions as to the fate of your Data after your death: you have the right to give us instructions regarding the use of your Data after your death.

To exercise these rights, you can contact us at the following email address:

–       DPO@uic.org

–       UIC

–       16 rue Jean Rey, 75015 Paris, France

Please note that we may require proof of identification for the exercise of these rights.

Article 5: Modification of our Privacy Policy  

From time to time, we may modify this Policy, in order to comply with changes to regulations and jurisprudence, and editorial or technological developments.

Where appropriate, we will change the “Last modified” date and provide the date on which the latest modifications were made.

Where necessary, we will inform you of changes and/or seek your consent.

We recommend that you check this page regularly for any modifications or updates to our Policy.

Article 6: Contact

If you have any questions concerning this Policy, or for any requests relating to your Data, you can contact us by emailing the following address: DPO@uic.org

Last modified: December 2022