Privacy Policy – BAG AFFAIR

Welcome to our web site (“”). Please read our Privacy Policy carefully. This Privacy Policy applies when you visit or surf our web site without purchasing any product, and when you use our services for purchasing products. If you haven’t already done so, please also read the General Terms and Condition of Use of, which contain information on privacy as well as on the security systems used by the web site. is managed by RTfact brands SASU (“RTfact brands”) (hereinafter referred to as “the Vendor” or “We” or “Us”). RTFACT Brands has its registered office in France at 5 rue de Dinan, 29200 Brest, business register number, tax code and VAT number FR40829686179, fully paid share capital of EUR 5.000

  1. Our Policy
    Everyone has the right to protection of his/her personal data. RTfact brands respect its users’ right to be informed regarding the collection of and other operations involving their personal data. In using data that may directly or indirectly identify you personally, we will apply a principle of strict necessity. For this reason, we have designed in such a way that the use of your personal data will be kept to a minimum and will not exceed the purposes for which your personal data was collected and/or processed; we do not process your personal data when we can provide you with services through the use of anonymous data (such as marketing research made for improving our services) or by other means which allow RTfact brands to identify you, apart from when it is strictly necessary or upon request by competent public authorities or the police (for example, in case of traffic data or your IP address) (Article 6 (1) GDPR).

These can be the following cases:

  • To ensure access and use of services such as billing and order processing
  • Post advertisements and other user content
  • To measure and improve the quality and success of operations
  • To contact the user via their email address, resolve disputes, enforce claims or provide other customer services
  • To detect, prevent and investigate fraud, security breaches or other unlawful activities
  • To enforce our general terms and conditions of sales

With the consent of the Bag-Affair homepage user, we may use their personal data to provide advertisement via email (newsletter).

RTfact brands determines the purposes and means for processing your personal data, including security measures, as RTfact brands solely controls users’ personal data.
This Privacy Policy provides you with all information needed to understand how we collect data which may identify’s users. For further information on our Privacy Policy, please contact us at or by mail to our registered office indicated above.

The page is declared at French CNIL under the number 2154707v0 to protect all personal information.

Children’s Privacy

Our website is generally accessible and not intended for children. We do not knowingly collect personal information from users who are considered to be children under their respective national laws.

2. Who Processes Your Personal Data
RTfact brands controls the use of users’ personal data; RTfact brands autonomously determines the purposes and means of processing personal data and the instruments used, including those for security measures. Due to organisational and operational purposes only, we have appointed certain entities that will also process personal data belonging to’s users for purposes strictly connected to the performance of services on, including the sale of products.

In processing the personal data of’s users, the processors shall act only on instructions from RTfact brands. We regularly check that our processors comply with our instructions and that they continue to provide sufficient guarantees regarding their full compliance with the provisions on personal data processing.
Some of the processors of your personal data are:

  • Colissimo (French Post), for purposes related to shipping, delivering and returning products purchased on;

Aside from the companies appointed for personal data processing, your information will be made available also to third parties, autonomous controllers, for purposes related to supplying services requested by user (for example, for purchase transactions). For more information on the matter, see section 5 (To whom your personal data will be disclosed).

2.1 To Whom Your Personal Data Will Be Disclosed
Personal data will be disclosed to third party companies that provide, on behalf of RTfact brands specific services as data processors or to other recipients of personal data collected by RTfact brands that autonomously process your personal data only for the performance of a contract for purchasing products on and only when such purpose does not exceed the purposes for which your personal data was collected and subsequently processed and, in any case, according to applicable laws and regulations.
Personal data will not be disclosed to third parties or disseminated or transferred without informing our users of such disclosure/dissemination/transfer, without their consent and, in any case, in accordance with the law.

2.2 Use of payment service providers

RTfact processes payments made by the Bag Affair user via the following payment service providers:

  • Paypal: Paypal Europe S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
  • Stripe: Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland

In order to process payments certain data from your order has to be transmitted to the payment processor/provider and the exact details shall depend on the payment method chosen by the homepage user. The transmitted data is limited to what is strictly necessary in order for the payment to be carried out and can include the user’s name, address, bank account number, bank identification code, credit card number, invoice amount, currency and the transaction number. The legal processing for this is article 6 (1) (b) GDPR. The relevant privacy policies of each payment processor as well as further information to your rights in relation to the processing can be found at the end of this policy.

  1. How We Use Personal Data and for What Purposes
    Your personal data is collected and processed by RTfact brands for purposes which are strictly connected to the use of the web site, its services and to the purchase of products on the web site. However, your personal data may also be used for other processing operations within the limits of such purposes.
    In particular, your personal data shall be processed for the following purposes:
  • when you require assistance from our Customer Service, we collect your personal data (for example, your name and surnames, e-mail address and password) for purposes strictly necessary to providing you with customer care services related to services and to the purchase of products on;
  • when you execute purchasing procedures for products sold on, we collect your personal data (such as personal details, e-mail address, address, credit card numbers, bank code, tax code and telephone number) on your order form only for the purpose of selling the products ordered by you;
  • when you require technical assistance, we collect your personal data in order to provide you with information on net-surfing, browser compatibility and viewing or loading web pages ;

Your personal data is mostly processed by electronic means and in some circumstances by paper-based means, such as when the processing of your personal data is required for preventing fraud on Your personal data shall be stored in a way which allows RTfact brands to identify you for the period necessary for the purposes which the data was collected for and subsequently processed and, in any case, in accordance with applicable law. Please report any modification of your personal data to in order to ensure that your personal information is always accurate and up-to-date, relevant and complete.
Your personal data shall not be disclosed to third parties for purposes which are not permitted by law or without your explicit consent.
Your personal data may only be disclosed to third parties when it is necessary for processing an order. For example, your personal data is disclosed to Societe Generale France for the performance of electronic distance payment services using Credit/Debit Card when you purchase a product on Moreover, your data may be disclosed to the police or to judicial authorities, according to law and upon a formal request by such entities, for example in the event RTfact brands needs to prevent fraud on (anti-fraud services).
Data processors will also have access to your personal data as stated in section 2 for the specific purposes stated therein. In all the above circumstances, your consent for data processing is not required. Your personal data will not be transferred abroad to non-EU countries that do not ensure an adequate level of protection of individuals. Should this be necessary in order to supply services or to execute a contract for the purchase of products, your personal data shall be transferred to such non-EU countries only after the execution of specific contracts between RTfact brands and such entities in accordance with applicable law and regulations.
We wish to inform you that RTfact brands shall process its users’ personal data for purposes that are strictly connected to the supply of services on, execution of contracts related to the sale and purchase of products on and, after receiving your consent, to send you information on new commercial initiatives which are strictly connected to the web site’s activities and services.

RTfact brands process your personal data for direct marketing purposes, including by e-mail, only after receiving your consent. RTfact brands may have access to third parties’ personal data which was directly disclosed by their users, for example when a user bought a product to be sent to a friend, when the user paying for the product is different from the recipient of the product, or when a user wishes to recommend to a friend a service of or the sale of a particular product.
In all of the above cases, please make sure you receive the consent of such individuals before disclosing their personal data to RTfact brands and make sure you inform them about this Privacy Policy; you will be the only person liable in connection with the disclosure of information and data regarding such third parties if they have not provided you with their express consent for it and for any improper and unlawful use of that information. In any event, RTfact brands shall fulfil any obligation to inform third parties required by law and, when necessary, shall request their express consent upon registering in its archives the personal information of the user indicated.

4. What Happens if You Do Not Disclose Your Personal Data to RTFACT BRANDS
Granting your personal data to RTfact brands (in particular, your personal details, your e-mail address, your address, your Credit/Debit Card numbers and bank code and your telephone number) is necessary for processing your order for the purchase of products on, supplying other services provided on the web site upon your request, or when your personal information is needed to fulfil obligations required by law or regulations.
The refusal to provide RTfact brands with some of your personal data necessary for performing the above purposes may consequently prevent RTfact brands from processing your order for the purchase of products sold on or from supplying other services provided on, such as customer care services, sending the newsletters or fulfilling obligations required by law and other regulations. Therefore, failing to provide data may constitute, in some cases, a legitimate and justified reason for not processing your order for the purchase of products sold on or not providing’s services.
Disclosure of further personal data to RTfact brands other than that required for fulfilling legal or contractual obligations or for providing the services requested, is, on the contrary, optional and does not have any effect on the use of the web site and of its services or on the purchase of products on (for example, if we ask you the name of your favourite designer, favourite colour, etc.).
In some circumstances and if required, from time to time we will duly inform you if the personal data you are disclosing to RTfact brands is compulsory or optional. We will point out to you whether the disclosure of your data is compulsory or optional by marking with an appropriate symbol (*) the information that is compulsory or data needed for providing the required services on and for the purchase of products on Failing to provide optional personal data will not imply any obligation or disadvantage to our users.

  1. How We Collect Your Data on
    When you are using, some personal data might be collected automatically (through “cookies”), for example, when we automatically collect users’ IP addresses and other information regarding the users’ data traffic or the users’ preferences in the choice of services provided on this web site and of the products purchased through the provided services. This information and data are collected directly and automatically by the web site as part of its operational functions. This information and data are then processed in a collective and anonymous way for commercial purposes in order to optimize the services provided on for the needs and preferences of the web site’s users.
    In other circumstances, RTfact brands directly collects personal data and information from its users when they send purchase orders of products sold on the website in order to finalise e-commerce transactions.

RTfact brands will process such data only for the purposes and within the limits of what is stated in the section regarding data collection and may be disclosed to third parties only for the purposes related to providing the services requested by the user.

  1. Third-party services and tools

6.1 Cookies

Cookies are tiny text files stored on your computer. Generally, cookies are stored for the duration of the current session, i.e. until you close your browser, but in some cases they are stored longer than this. A more comprehensive overview of the cookies we use, especially the third-party cookies of the services listed in this Privacy Policy, their purpose and our legal basis for their use, as well as the possibility to object to the processing and collecting of data via cookies (i.e. to opt out) can be found in our Cookie policy.

  1. 2 Google services

The website, uses diverse services from the American company, Google Inc.. These services include Google Analytics, Google Adwords, and Google Maps.

Google LLC (hereinafter referred to as Google) is certified under both the EU-U.S. and Swiss-U.S. Privacy Shield frameworks and their certifications can be viewed on the Privacy Shield list. RTfact has of course signed a data processing agreement with Google for the utilization of the various Google tools and services listed above.

6.2.1 Google Universal Analytics:

RTfact uses Google Analytics a web analytics service provided by Google for website.

Google Analytics stores cookies on your computer which allow you to analyse the surfing patterns of visitors to your website. We only use Google Analytics with activated IP anonymization. This means that the IP address of the users will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there.

Google will use this information to evaluate your use of the website, to compile reports on website activity for website operators and to report other website activity and internet-related services. If required by law, Google will pass along this information to third parties. Google will also pass along data to third parties for processing, provided this processing is done on behalf of Google. Under no circumstances shall Google connect your IP address with any other data held by Google. If you wish, you can adjust your browser settings so as to refuse cookies. Please bear in mind, however, that if you refuse all cookies, you will not necessarily have access to all functions of this website. By using this site, you consent to the processing of your data by Google as described above, for the aforementioned purpose.

You can prevent data collection via Google Analytics by using the following link:  and installing a browser opt out. An “Opt-out Cookie” shall then be applied to your website which shall prevent any future collection of your data when visiting this website. Additional information on how Google handles personal data in its advertising network can be found here:

6.2.2 Google AdWords and Google AdWords Remarketing

RTfact uses Google AdWords, an analytics service provided by Google, and Google AdWords, conversion tracking, as well as Google AdWords Remarketing on our website.

Google AdWords stores a cookie for conversion tracking on the computer’s hard drive (so-called “conversion cookie”) when the site visitor clicks on a Google-served ad. These cookies lose their validity after 30 days and are not used for personal identification. When certain pages are visited on our website, Google and RTfact may recognize that the page visitor has clicked on the ad and has been redirected to this page.

The information obtained through the conversion cookies is used to generate statistics for AdWords customers who use conversion tracking. These statistics tell us the total number of users who clicked on the ad served by Google and viewed a page with a conversion tracking tag. More information about Google AdWords Terms of Service and Privacy can be found here.

With Google AdWords Remarketing, Google sets a cookie in the terminal’s browser, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages visited by the Bag-Affair page visitor. If the user has consented to sharing his web history with Google, then Google can use the history of the visit to the bag-Affair website, along with the Google analytics data and the Google AdWords data in order to create targeted audiences for cross device remarketing. The user can permanently disable the setting of such cookies by installing the browser plug-in available at the following link:

6.3 Social Media

6.3.1 Youtube-Videos

The websites also use the Youtube Embedding feature to display and play videos from “Youtube”, which is owned by Google.

When the playback of embedded Youtube videos starts, the provider “Youtube” uses cookies to collect information about user behavior. According to “Youtube”, these are used, among other things, to capture video statistics, improve user-friendliness and prevent abusive practices.

If you’re logged in to Google, your data will be assigned directly to your account when you click on a video. If you do not wish to associate with your profile on YouTube, you must log out before activating the button.

Google stores your data (even for non-logged-in users) as usage profiles and evaluates them. According to Article 6 (1) (f) of the GDPR, such an evaluation is based on the legitimate interests of Google in the display of personalized advertising, market research and / or tailor-made design of its website. You have a right to object to the creation of these User Profiles, and you must be directed to YouTube to use them.

For more information on data protection at “YouTube”, please see the provider’s Privacy Policy at:

6.4 Newsletter Performance

Our newsletters contain so-called “web-beacons”, i.e. pixel-sized files that are retrieved from the server when opening the newsletter from our server or from the shipping service provider, Mailchimp. As part of this call, technical information, such as information about the browser and the system, as well as the IP address and time of the retrieval are collected.

This information is used to improve the technical performance of the services based on the technical data or the target groups and the reading behavior based on their call sites (which can be determined with the help of the IP address) or the access times. Statistical surveys also include determining if the newsletters will be opened, when they will be opened and which links will be clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is neither our goal nor, if used, that of the newsletter service provider to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

The processing of the data entered into the newsletter application form is based solely on consent (Article 6 (1) (a) GDPR). The given consent to the storage of the data, the e-mail address and their use for sending the newsletter can be revoked at any time by the RTfact newsletter subscriber, for example via the “unsubscribe” link in each newsletter. The legality of the data processing that has already taken place shall remain unaffected by the revocation.

The data provided to RTfact by the Bag-Affair User for the purposes of sending the newsletter will be stored by us until the Bag-Affair User is removed from the newsletter and deleted after the newsletter has been unsubscribed. Data that has been stored for other purposes with us (such as e-mail addresses for the members area) shall remain unaffected by this deletion.

  1. Security Measures
    We have adopted security measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and against all other reasons for data processing that do not comply with our Privacy Policy. Nevertheless, RTfact brands cannot guarantee that the security measures adopted for the protection of the web site and for data and information transmission on will prevent or exclude any risk of unauthorised access or of loss of data.
    It is advisable that your computer be provided with software devices that protect network data transmission/receipt (such as updated antivirus systems) and that your Internet service provider take appropriate measures for the security of network data transmission (such as, for example, firewalls and anti-spam filtering).8. Opt-in/Opt out
    RTfact brands processes your personal data only after receiving your consent, freely expressed, in order to send you advertising material and direct marketing or other commercial communications, including by e-mail, which do not fall within customer requested services provided by Each time your consent is required, we will inform you in advance and we will give you the option to either provide or refuse your consent for the use of your personal data, including your e-mail address, for the above purposes, by ticking the appropriate boxes.
    We wish to inform you that RTfact brands and may process your personal data also without your consent in certain circumstances provided by law, such as when such processing is necessary for performing a legal obligation to which RTfact brands and are subject or when such processing is necessary for performing obligations undertaken in contracts with the users (such as, for example, if you purchased products on or if you asked to use specific services through our web site).
    In any case, we wish to inform you that RTfact brands guarantees that its users may exercise, at any time and without having to state their reasoning, their right not to receive future communications connected to particular services upon request.9. Your Right to Access Personal Data and Further Rights
    You are entitled to obtain, at any time, confirmation from RTfact brands as to whether or not data relating to you is being processed, whether the data is not yet registered, and the communication in intelligible form of the data undergoing processing.
    Moreover according the relevant legislation, including the GDPR, you are entitled to receive from RTfact brands information on the source of your personal data; the purposes and way of processing your personal data; the logic involved in any electronic data processing; details of the data controller and of the data processors; the names of the entities and categories of entities to whom your personal data may be disclosed or who may access your personal data, for example, as a data controller or a party so appointed.
    You can easily find part of the above information in our Privacy Policy. For further information, send an e-mail to You are entitled to obtain at any time from RTfact brands.:
  2. the updating, adjustment or, when you have an interest in such, the integration of your personal data;
  3. the deletion, the transformation into an anonymous form or blocking of your personal data (unlawfully processed), including data which does not need to be stored for the purposes for which it was collected and subsequently processed;
  4. the confirmation that the operations under letters a) and b) have been reported (together with the contents of the same) to whom the data was disclosed or disseminated, except when it becomes impossible or if the means used are clearly disproportionate to the right’s protection.

You are entitled to object, in whole or in part:

  1. for legitimate reasons, to the processing of your personal data, even if it is related to the purposes for which it was collected;
  2. to the processing of your personal data for advertising or direct marketing purposes or in order to carry out marketing research or commercial communications.

Insofar as the Bag-Affair user’s or site visitor’s data is collected on the basis of RTfact’s legitimate interests (Article 6(1) (f) GDPR, the Bag-Affair visitor may object to the future processing of their data in accordance with Article 21 GDPR at any time, for the future. The objection may in particular be expressed against processing for direct marketing purposes(via sending an email to or unsubscribing directly from such communications via the unsubscribe link in every mail). A corresponding note as regards the Bag-Affair Newsletter unsubscription process can be found in every newsletter email.

If the Bag-Affair user makes use of his right to object, RTfact will stop the processing of the data concerned. However, further processing is reserved if we can demonstrate compelling legitimate reasons for the processing that outweighs the interests of the Bag-Affair user, their fundamental rights and freedoms, or if the processing serves the purpose of asserting, exercising or defending legal claims.

The Bag-Affair user also has the right to object to the processing personal data that is used for statistical purposes in accordance with Article 89 (1) GDPR for reasons that arise from their particular situation via a simple email to that effect sent to

You may freely exercise your rights at any time, provided that you do so in compliance with applicable laws, by sending your request to RTfact brands at the following e-mail address: We will reply to you as necessary.

Right to Data Portability

In certain cases, which are listed in detail in Art. 20 GDPR, the site visitor or the Bag-Affair user has the right to receive personal data concerning him or her, in a structured, common and machine-readable format or to have this data transferred to a third party upon demand.

9.1 Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, the Bag-Affair user has the right to lodge a complaint with a relevant supervisory authority in accordance with Article 77 GDPR, in particular in the Member State of the user’s place of residence, place of work or place of alleged infringement, if the Bag-Affair user is of the opinion that the processing of his personal data has not occurred in accordance with the provisions of the GDPR.

  1. Links to Other Web Sites contains links to other websites which may have no connection with or with RTfact brands. RTfact brands does not control or monitor such websites or their web content. RTfact brands shall not be held liable for the web content of such sites and for the rules adopted by them in terms of your privacy and the processing of your personal data while you are visiting those web sites. Please, pay attention when you connect to these web sites through the links provided on and read their terms and conditions of use and their privacy policy carefully.’s Privacy Policy does not apply to third party web sites. provides links to other websites exclusively to help its users in their searches and net-surfing activities and to allow links to other web sites on the Internet. When RTfact brands provides links to other websites, RTfact brands does not recommend the use of these websites and do not provide any guarantees regarding their web content or the services and products supplied and sold by these websites to Internet users.

11. Contact
If you wish to receive further information on how RTfact brands processes your personal data, please send an e-mail to

12. Governing Law
This Privacy Policy is governed by French law.

  1. Modification and Updating of Privacy Policy
    RTfacts brands may amend or simply update all or part of’s Privacy Policy, including when amendments are made to legal provisions or regulations which govern data protection and protect your rights. The amendments and the updating of Privacy Policy shall be notified to our users on’s homepage as soon as such amendments or updates have been introduced and shall be binding as soon as they are published on the web site in this section. Therefore, you are requested to regularly access this section in order to check the publication of the most recent and updated Privacy Policy of
  1. Duration of the Storage of Personal Data

The data processed by us are deleted or limited in their processing in accordance with Articles 17 and 18 GDPR. Unless explicitly stated in this privacy policy, the data stored by us are deleted as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory storage requirements and / or there is no legitimate interest in the re-storage on our part. Where the data cannot be deleted because it is required for another, legitimate purposes, its processing shall be restricted accordingly. The data shall be blocked and not processed for any other purposes. This applies, for example to data that must be kept for commercial or tax reasons.

  1. Sharing of Personal Data and the List of Subprocessors and Services used by RTfact

The data of Bag-Affair homepage users shall not be sold to third parties. We shall not share or pass on any personal information without your explicit consent, unless:

  • We are legally obligated to do so;
  • In order to fulfill contractual services for the user and/or in order to enforce rights and obligations of these terms of use and the corresponding contractual relationship between the Bag-Affair user and RTfact;

Where third parties are concerned RTfact always enters into a data processing agreement with the third-party and ensures the protection of the Bag-Affair homepage user’s data in accordance with Article 44 ff GDPR.

If RTfact is acquired by another company, information including personal data could be transferred to the acquiring party within the framework of the relevant data protection provisions.

In order to provide our respective services, we may pass on personal data of the Bag-Affair homepage user or the site visitor to the following third parties for the following purposes:

Name Purpose Provider Privacy policy
Mailchimp/ Mandrill Purpose: The sending of Newsletters, Notifications
Data Category: Inventory data, Newsletter subscriber
Data Subjects: Bag-Affair Users, Subscribers to the Bag-Affair Newsletter
Legal Basis: Consent, Article 6 (1) (a) GDPR, Legitimate interest Art. 6 (1) (f) GDPR
Mailchimp by The Rocket Science Group, LLC
675 Ponce de Leon Ave NE, Suite 5000,
Atlanta, GA 30308, USA
Google Analytics Purpose: User Statistics on www. websites, as well as where activated by the Bag-Affair user
Data Category: Inventory data, usage data
Data Subject: Bag-Affair user, visitors to the Bag-Affair website
Legal Basis: Contract performance, Article 6 (1) (b) GDPR & Article 6 (1) (f) GDPR
Google Browser Plugin, Opt-Out
Stripe Purpose: Payment processor, chosen by the Bag-Affair user
Data Category: Contract data, payment data, inventory data
Data Subject: Bag-Affair user
Legal Basis: Contract performance, Article 6 (1) (f) GDPR
Stripe Inc.,
185 Berry Street, Suite 550,
San Francisco, CA 94107, USA
Paypal Purpose: Payment Controller(Service Provider) chosen by the Bag-Affair user
Data Category: Contract data, payment data, inventory data
Data Subject: Bag-Affair user
Legal Basis: Contract performance, Article 6 (1) (b) GDPR
PayPal (Europe) S.à r.l. et Cie
22-24 Boulevard Royal
2449 Luxembourg
Youtube Purpose: Youtube embedding function for displaying and playing videos of the provider Youtube using the extended data protection mode.
Data Category:Inventory data
Data Subject: Bag-Affair user, customers/interested parties of the Bag-Affair website and services
Legal Basis(depends on user): Contract performance, Article 6 (1) (b) GDPR / Consent as provided by the Bag-Affair user, Article 6 (1) (a) GDPR, as well as Legitimate interest Article 6 (1) (f) GDPR, see further details above
Google LLC
1600 Amphitheatre Parkway
Mountain View
CA 94043