www.bag-affair.com is managed by RTfact brands SAS ("RTfact brands") (hereinafter referred to as "the Vendor" or "We" or "Us"). RTFACT Brands has its registered office in France at 6 Rue Noel Roquevert, 29200 Brest, business register number, tax code and VAT number FR40829686179, fully paid share capital of EUR 5.000
1. Our Policy
Everyone has the right to protection of his/her personal data. RTfact brands respect its users' right to be informed regarding the collection of and other operations involving their personal data. In using data that may directly or indirectly identify you personally, we will apply a principle of strict necessity. For this reason, we have designed www.bag-affair.com in such a way that the use of your personal data will be kept to a minimum and will not exceed the purposes for which your personal data was collected and/or processed; we do not process your personal data when we can provide you with services through the use of anonymous data (such as marketing research made for improving our services) or by other means which allow RTfact brands to identify you, apart from when it is strictly necessary or upon request by competent public authorities or the police (for example, in case of traffic data or your IP address) (Article 6 (1) GDPR).
These can be the following cases:
· To ensure access and use of services such as billing and order processing
· Post advertisements and other user content
· To measure and improve the quality and success of operations
· To contact the user via their email address, resolve disputes, enforce claims or provide other customer services
· To detect, prevent and investigate fraud, security breaches or other unlawful activities
· To enforce our general terms and conditions of sales
With the consent of the Bag-Affair homepage user, we may use their personal data to provide advertisement via email (newsletter).
RTfact brands determines the purposes and means for processing your personal data, including security measures, as RTfact brands solely controls www.bag-affair.com users' personal data.
The page is declared at French CNIL under the number 2154707v0 to protect all personal information.
Our website is generally accessible and not intended for children. We do not knowingly collect personal information from users who are considered to be children under their respective national laws.
2. Who Processes Your Personal Data
RTfact brands controls the use of www.bag-affair.com users' personal data; RTfact brands autonomously determines the purposes and means of processing personal data and the instruments used, including those for security measures. Due to organisational and operational purposes only, we have appointed certain entities that will also process personal data belonging to www.bag-affair.com's users for purposes strictly connected to the performance of services on www.bag-affair.com, including the sale of products.
In processing the personal data of www.bag-affair.com's users, the processors shall act only on instructions from RTfact brands. We regularly check that our processors comply with our instructions and that they continue to provide sufficient guarantees regarding their full compliance with the provisions on personal data processing.
Some of the processors of your personal data are:
- United Parcel Service (UPS), for purposes related to shipping, delivering and returning products purchased on www.bag-affair.com;
- Chronopost (French parcel service) for purposes related to shipping, delivering and returning products purchased on www.bag-affair.com;
Aside from the companies appointed for personal data processing, your information will be made available also to third parties, autonomous controllers, for purposes related to supplying services requested by user (for example, for purchase transactions). For more information on the matter, see section 5 (To whom your personal data will be disclosed).
2.1 To Whom Your Personal Data Will Be Disclosed
Personal data will be disclosed to third party companies that provide, on behalf of RTfact brands specific services as data processors or to other recipients of personal data collected by RTfact brands that autonomously process your personal data only for the performance of a contract for purchasing products on www.bag-affair.com and only when such purpose does not exceed the purposes for which your personal data was collected and subsequently processed and, in any case, according to applicable laws and regulations.
Personal data will not be disclosed to third parties or disseminated or transferred without informing our users of such disclosure/dissemination/transfer, without their consent and, in any case, in accordance with the law.
2.2 Use of payment service providers
RTfact processes payments made by the Bag Affair user via the following payment service providers:
· Paypal: Paypal Europe S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
· Stripe: Stripe Payments Europe Ltd, Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland
In order to process payments certain data from your order has to be transmitted to the payment processor/provider and the exact details shall depend on the payment method chosen by the homepage user. The transmitted data is limited to what is strictly necessary in order for the payment to be carried out and can include the user’s name, address, bank account number, bank identification code, credit card number, invoice amount, currency and the transaction number. The legal processing for this is article 6 (1) (b) GDPR. The relevant privacy policies of each payment processor as well as further information to your rights in relation to the processing can be found at the end of this policy.
3. How We Use Personal Data and for What Purposes
Your personal data is collected and processed by RTfact brands for purposes which are strictly connected to the use of the web site, its services and to the purchase of products on the web site. However, your personal data may also be used for other processing operations within the limits of such purposes.
In particular, your personal data shall be processed for the following purposes:
- when you require assistance from our Customer Service, we collect your personal data (for example, your name and surnames, e-mail address and password) for purposes strictly necessary to providing you with customer care services related to www.bag-affair.com services and to the purchase of products on www.bag-affair.com;
- when you execute purchasing procedures for products sold on www.bag-affair.com, we collect your personal data (such as personal details, e-mail address, address, credit card numbers, bank code, tax code and telephone number) on your order form only for the purpose of selling the products ordered by you;
- when you require technical assistance, we collect your personal data in order to provide you with information on net-surfing, browser compatibility and viewing or loading www.bag-affair.com web pages ;
Your personal data is mostly processed by electronic means and in some circumstances by paper-based means, such as when the processing of your personal data is required for preventing fraud on www.bag-affair.com. Your personal data shall be stored in a way which allows RTfact brands to identify you for the period necessary for the purposes which the data was collected for and subsequently processed and, in any case, in accordance with applicable law. Please report any modification of your personal data to firstname.lastname@example.org in order to ensure that your personal information is always accurate and up-to-date, relevant and complete.
Your personal data shall not be disclosed to third parties for purposes which are not permitted by law or without your explicit consent.
Your personal data may only be disclosed to third parties when it is necessary for processing an order. For example, your personal data is disclosed to Societe Generale France for the performance of electronic distance payment services using Credit/Debit Card when you purchase a product on www.bag-affair.com. Moreover, your data may be disclosed to the police or to judicial authorities, according to law and upon a formal request by such entities, for example in the event RTfact brands needs to prevent fraud on www.bag-affair.com (anti-fraud services).
Data processors will also have access to your personal data as stated in section 2 for the specific purposes stated therein. In all the above circumstances, your consent for data processing is not required. Your personal data will not be transferred abroad to non-EU countries that do not ensure an adequate level of protection of individuals. Should this be necessary in order to supply services or to execute a contract for the purchase of products, your personal data shall be transferred to such non-EU countries only after the execution of specific contracts between RTfact brands and such entities in accordance with applicable law and regulations.
We wish to inform you that RTfact brands shall process its users' personal data for purposes that are strictly connected to the supply of services on www.bag-affair.com, execution of contracts related to the sale and purchase of products on www.bag-afair.com and, after receiving your consent, to send you information on new commercial initiatives which are strictly connected to the web site's activities and services.
RTfact brands process your personal data for direct marketing purposes, including by e-mail, only after receiving your consent. RTfact brands may have access to third parties' personal data which was directly disclosed by their users, for example when a user bought a product to be sent to a friend, when the user paying for the product is different from the recipient of the product, or when a user wishes to recommend to a friend a service of www.bag-affair.com or the sale of a particular product.
4. What Happens if You Do Not Disclose Your Personal Data to RTFACT BRANDS
Granting your personal data to RTfact brands (in particular, your personal details, your e-mail address, your address, your Credit/Debit Card numbers and bank code and your telephone number) is necessary for processing your order for the purchase of products on www.bag-affair.com, supplying other services provided on the web site upon your request, or when your personal information is needed to fulfil obligations required by law or regulations.
The refusal to provide RTfact brands with some of your personal data necessary for performing the above purposes may consequently prevent RTfact brands from processing your order for the purchase of products sold on www.bag-affair.com or from supplying other services provided on www.bag-affair.com, such as customer care services, sending the newsletters or fulfilling obligations required by law and other regulations. Therefore, failing to provide data may constitute, in some cases, a legitimate and justified reason for not processing your order for the purchase of products sold on www.bag-affair.com or not providing www.bag-affair.com’s services.
Disclosure of further personal data to RTfact brands other than that required for fulfilling legal or contractual obligations or for providing the services requested, is, on the contrary, optional and does not have any effect on the use of the web site and of its services or on the purchase of products on www.bag-affair.com (for example, if we ask you the name of your favourite designer, favourite colour, etc.).
In some circumstances and if required, from time to time we will duly inform you if the personal data you are disclosing to RTfact brands is compulsory or optional. We will point out to you whether the disclosure of your data is compulsory or optional by marking with an appropriate symbol (*) the information that is compulsory or data needed for providing the required services on www.bag-affair.com and for the purchase of products on www.bag-affair.com. Failing to provide optional personal data will not imply any obligation or disadvantage to our users.
5. How We Collect Your Data on www.bag-affair.com
When you are using www.bag-affair.com, some personal data might be collected automatically (through "cookies"), for example, when we automatically collect users' IP addresses and other information regarding the users' data traffic or the users' preferences in the choice of services provided on this web site and of the products purchased through the provided services. This information and data are collected directly and automatically by the web site as part of its operational functions. This information and data are then processed in a collective and anonymous way for commercial purposes in order to optimize the services provided on www.bag-affair.com for the needs and preferences of the web site's users.
In other circumstances, RTfact brands directly collects personal data and information from its users when they send purchase orders of products sold on the website in order to finalise e-commerce transactions.
RTfact brands will process such data only for the purposes and within the limits of what is stated in the section regarding data collection and may be disclosed to third parties only for the purposes related to providing the services requested by the user.
6. Third-party services and tools
6. 2 Google services
The website, www.bag-affair.com uses diverse services from the American company, Google Inc.. These services include Google Analytics, Google Adwords, and Google Maps.
Google LLC (hereinafter referred to as Google) is certified under both the EU-U.S. and Swiss-U.S. Privacy Shield frameworks and their certifications can be viewed on the Privacy Shield list. RTfact has of course signed a data processing agreement with Google for the utilization of the various Google tools and services listed above.
6.2.1 Google Universal Analytics:
RTfact uses Google Analytics a web analytics service provided by Google for www.bag-affair.com website.
Google Analytics stores cookies on your computer which allow you to analyse the surfing patterns of visitors to your website. We only use Google Analytics with activated IP anonymization. This means that the IP address of the users will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there.
You can prevent data collection via Google Analytics by using the following link: https://tools.google.com/dlpage/gaoptout and installing a browser opt out. An "Opt-out Cookie" shall then be applied to your website which shall prevent any future collection of your data when visiting this website. Additional information on how Google handles personal data in its advertising network can be found here: https://policies.google.com/technologies/ads.
6.2.2 Google AdWords and Google AdWords Remarketing
RTfact uses Google AdWords, an analytics service provided by Google, and Google AdWords, conversion tracking, as well as Google AdWords Remarketing on our www.bag-affair.com website.
Google AdWords stores a cookie for conversion tracking on the computer's hard drive (so-called "conversion cookie") when the site visitor clicks on a Google-served ad. These cookies lose their validity after 30 days and are not used for personal identification. When certain pages are visited on our website, Google and RTfact may recognize that the page visitor has clicked on the ad and has been redirected to this page.
The information obtained through the conversion cookies is used to generate statistics for AdWords customers who use conversion tracking. These statistics tell us the total number of users who clicked on the ad served by Google and viewed a page with a conversion tracking tag. More information about Google AdWords Terms of Service and Privacy can be found here.
With Google AdWords Remarketing, Google sets a cookie in the terminal's browser, which automatically enables interest-based advertising by means of a pseudonymous cookie ID and based on the pages visited by the Bag-Affair page visitor. If the user has consented to sharing his web history with Google, then Google can use the history of the visit to the bag-Affair website, along with the Google analytics data and the Google AdWords data in order to create targeted audiences for cross device remarketing. The user can permanently disable the setting of such cookies by installing the browser plug-in available at the following link: https://www.google.com/settings/ads/onweb/.
6.3 Social Media
The www.bag-affair.com websites also use the Youtube Embedding feature to display and play videos from "Youtube", which is owned by Google.
If you're logged in to Google, your data will be assigned directly to your account when you click on a video. If you do not wish to associate with your profile on YouTube, you must log out before activating the button.
Google stores your data (even for non-logged-in users) as usage profiles and evaluates them. According to Article 6 (1) (f) of the GDPR, such an evaluation is based on the legitimate interests of Google in the display of personalized advertising, market research and / or tailor-made design of its website. You have a right to object to the creation of these User Profiles, and you must be directed to YouTube to use them.
6.4 Newsletter Performance
Our newsletters contain so-called "web-beacons", i.e. pixel-sized files that are retrieved from the server when opening the newsletter from our server or from the shipping service provider, Mailchimp. As part of this call, technical information, such as information about the browser and the system, as well as the IP address and time of the retrieval are collected.
This information is used to improve the technical performance of the services based on the technical data or the target groups and the reading behavior based on their call sites (which can be determined with the help of the IP address) or the access times. Statistical surveys also include determining if the newsletters will be opened, when they will be opened and which links will be clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is neither our goal nor, if used, that of the newsletter service provider to observe individual users. The evaluations serve us much more to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.
The processing of the data entered into the newsletter application form is based solely on consent (Article 6 (1) (a) GDPR). The given consent to the storage of the data, the e-mail address and their use for sending the newsletter can be revoked at any time by the RTfact newsletter subscriber, for example via the "unsubscribe" link in each newsletter. The legality of the data processing that has already taken place shall remain unaffected by the revocation.
The data provided to RTfact by the Bag-Affair User for the purposes of sending the newsletter will be stored by us until the Bag-Affair User is removed from the newsletter and deleted after the newsletter has been unsubscribed. Data that has been stored for other purposes with us (such as e-mail addresses for the members area) shall remain unaffected by this deletion.
7. Security Measures
It is advisable that your computer be provided with software devices that protect network data transmission/receipt (such as updated antivirus systems) and that your Internet service provider take appropriate measures for the security of network data transmission (such as, for example, firewalls and anti-spam filtering).
8. Opt-in/Opt out
RTfact brands processes your personal data only after receiving your consent, freely expressed, in order to send you advertising material and direct marketing or other commercial communications, including by e-mail, which do not fall within customer requested services provided by www.bag-affair.com. Each time your consent is required, we will inform you in advance and we will give you the option to either provide or refuse your consent for the use of your personal data, including your e-mail address, for the above purposes, by ticking the appropriate boxes.
We wish to inform you that RTfact brands and www.bag-affair.com may process your personal data also without your consent in certain circumstances provided by law, such as when such processing is necessary for performing a legal obligation to which RTfact brands and www.bag-affair.com are subject or when such processing is necessary for performing obligations undertaken in contracts with the users (such as, for example, if you purchased products on www.bag-affair.com or if you asked to use specific services through our web site).
In any case, we wish to inform you that RTfact brands guarantees that its users may exercise, at any time and without having to state their reasoning, their right not to receive future communications connected to particular services upon request.
9. Your Right to Access Personal Data and Further Rights
You are entitled to obtain, at any time, confirmation from RTfact brands as to whether or not data relating to you is being processed, whether the data is not yet registered, and the communication in intelligible form of the data undergoing processing.
Moreover according the relevant legislation, including the GDPR, you are entitled to receive from RTfact brands information on the source of your personal data; the purposes and way of processing your personal data; the logic involved in any electronic data processing; details of the data controller and of the data processors; the names of the entities and categories of entities to whom your personal data may be disclosed or who may access your personal data, for example, as a data controller or a party so appointed.
a. the updating, adjustment or, when you have an interest in such, the integration of your personal data;
b. the deletion, the transformation into an anonymous form or blocking of your personal data (unlawfully processed), including data which does not need to be stored for the purposes for which it was collected and subsequently processed;
c. the confirmation that the operations under letters a) and b) have been reported (together with the contents of the same) to whom the data was disclosed or disseminated, except when it becomes impossible or if the means used are clearly disproportionate to the right’s protection.
You are entitled to object, in whole or in part:
- for legitimate reasons, to the processing of your personal data, even if it is related to the purposes for which it was collected;
- to the processing of your personal data for advertising or direct marketing purposes or in order to carry out marketing research or commercial communications.
Insofar as the Bag-Affair user’s or site visitor’s data is collected on the basis of RTfact’s legitimate interests (Article 6(1) (f) GDPR, the Bag-Affair visitor may object to the future processing of their data in accordance with Article 21 GDPR at any time, for the future. The objection may in particular be expressed against processing for direct marketing purposes(via sending an email to email@example.com or unsubscribing directly from such communications via the unsubscribe link in every mail). A corresponding note as regards the Bag-Affair Newsletter unsubscription process can be found in every newsletter email.
If the Bag-Affair user makes use of his right to object, RTfact will stop the processing of the data concerned. However, further processing is reserved if we can demonstrate compelling legitimate reasons for the processing that outweighs the interests of the Bag-Affair user, their fundamental rights and freedoms, or if the processing serves the purpose of asserting, exercising or defending legal claims.
The Bag-Affair user also has the right to object to the processing personal data that is used for statistical purposes in accordance with Article 89 (1) GDPR for reasons that arise from their particular situation via a simple email to that effect sent to firstname.lastname@example.org.
You may freely exercise your rights at any time, provided that you do so in compliance with applicable laws, by sending your request to RTfact brands at the following e-mail address: email@example.com. We will reply to you as necessary.
Right to Data Portability
In certain cases, which are listed in detail in Art. 20 GDPR, the site visitor or the Bag-Affair user has the right to receive personal data concerning him or her, in a structured, common and machine-readable format or to have this data transferred to a third party upon demand.
9.1 Right to Lodge a Complaint
Without prejudice to any other administrative or judicial remedy, the Bag-Affair user has the right to lodge a complaint with a relevant supervisory authority in accordance with Article 77 GDPR, in particular in the Member State of the user’s place of residence, place of work or place of alleged infringement, if the Bag-Affair user is of the opinion that the processing of his personal data has not occurred in accordance with the provisions of the GDPR.
10. Links to Other Web Sites
www.bag-affair.com provides links to other websites exclusively to help its users in their searches and net-surfing activities and to allow links to other web sites on the Internet. When RTfact brands provides links to other websites, RTfact brands does not recommend the use of these websites and do not provide any guarantees regarding their web content or the services and products supplied and sold by these websites to Internet users.
If you wish to receive further information on how RTfact brands processes your personal data, please send an e-mail to firstname.lastname@example.org.
12. Governing Law
14. Duration of the Storage of Personal Data
15. Sharing of Personal Data and the List of Subprocessors and Services used by RTfact
The data of Bag-Affair homepage users shall not be sold to third parties. We shall not share or pass on any personal information without your explicit consent, unless:
· We are legally obligated to do so;
Where third parties are concerned RTfact always enters into a data processing agreement with the third-party and ensures the protection of the Bag-Affair homepage user’s data in accordance with Article 44 ff GDPR.
If RTfact is acquired by another company, information including personal data could be transferred to the acquiring party within the framework of the relevant data protection provisions.
In order to provide our respective services, we may pass on personal data of the Bag-Affair homepage user or the site visitor to the following third parties for the following purposes:
Purpose: The sending of Newsletters, Notifications
Data Category: Inventory data, Newsletter subscriber
Data Subjects: Bag-Affair Users, Subscribers to the Bag-Affair Newsletter
Legal Basis: Consent, Article 6 (1) (a) GDPR, Legitimate interest Art. 6 (1) (f) GDPR
Mailchimp by The Rocket Science Group, LLC
675 Ponce de Leon Ave NE, Suite 5000,
Atlanta, GA 30308, USA
Purpose: User Statistics on www. Bag-Affair.com websites, as well as where activated by the Bag-Affair user
Data Category: Inventory data, usage data
Data Subject: Bag-Affair user, visitors to the Bag-Affair website
Legal Basis: Contract performance, Article 6 (1) (b) GDPR & Article 6 (1) (f) GDPR
| Google LLC,
1600 Amphitheatre Parkway,
Mountain View, CA 94043, USA|| |
Browser Plugin, Opt-Out
Purpose: Payment processor, chosen by the Bag-Affair user
Data Category: Contract data, payment data, inventory data
Data Subject: Bag-Affair user
Legal Basis: Contract performance, Article 6 (1) (f) GDPR
185 Berry Street, Suite 550,
San Francisco, CA 94107, USA
Purpose: Payment Controller(Service Provider) chosen by the Bag-Affair user
Data Category: Contract data, payment data, inventory data
Data Subject: Bag-Affair user
Legal Basis: Contract performance, Article 6 (1) (b) GDPR
PayPal (Europe) S.à r.l. et Cie
22-24 Boulevard Royal
Purpose: Youtube embedding function for displaying and playing videos of the provider Youtube using the extended data protection mode.
Data Category:Inventory data
Data Subject: Bag-Affair user, customers/interested parties of the Bag-Affair website and services
Legal Basis(depends on user): Contract performance, Article 6 (1) (b) GDPR / Consent as provided by the Bag-Affair user, Article 6 (1) (a) GDPR, as well as Legitimate interest Article 6 (1) (f) GDPR, see further details above
1600 Amphitheatre Parkway
Version: July 2018