Privacy policy

ARTICLE 1 – PURPOSE

This Privacy Policy (the “Privacy Policy”) is intended to inform Visitors, Prospective Users and Users about the Company’s practices regarding (i) the collection, use and sharing of Personal Data and (ii) the use of cookies.

ARTICLE 2 – DEFINITIONS

For the purposes of this Privacy Policy, the terms below shall have the following meanings:

Buyer(s):

means any person who purchases a Product through the Website.

Listing(s):

means a listing published (i) by a Professional Seller or (ii) by the Company on behalf of a Private Seller on the Website for the purpose of selling Products. Each Listing systematically includes a product page containing all essential characteristics and the price of the Products, together with photographs of the Product.

Article(s):

means any article referred to in this Privacy Policy.

Review(s):

means a comment submitted by a Buyer following the purchase of a Product.

Account:

means the account created by a Professional Seller or a Buyer in order to access the services available through the Website.

General Terms of Use:

means the general terms of use of the Website applied by the Company at a given date and available on the Website under the “Terms of Use” section.

CASTAFIORE Commercial Terms:

means the general terms and conditions of sale applied by the Company at a given date to Professional Sellers or Private Sellers. They are accessible to Professional Sellers through their Account and are provided to Private Sellers by the Company prior to the execution of the sales mandate.

Personal Data:

means collectively all personal data enabling a natural person to be identified directly or indirectly, collected in connection with (i) the creation of an Account, (ii) the creation or editing of a Profile, (iii) the publication of a Listing, (iv) commercial transactions, (v) the submission of the Contact Form, (vi) the submission of a Review, (vii) subscription to the Newsletter or (viii) the person’s relationship with the Company, with the consent of the relevant natural person.

Contact Form:

means the form completed by a Prospective User or User wishing to (i) entrust a Product to the Company for sale on the Website under a consignment service or (ii) obtain information relating to the sale or purchase of Products.

French Data Protection Act:

means French Law No. 78-17 of 6 January 1978 relating to information technology, files and civil liberties.

Newsletter:

means the newsletter published by the Company.

Privacy Policy:

means this Company policy relating to the processing of personal data pursuant to French Law No. 78-17 of 6 January 1978 relating to information technology, files and civil liberties and General Data Protection Regulation (GDPR) No. 2016/678 of 27 April 2016.

Product(s):

means vintage and second-hand jewellery, fine jewellery and watchmaking items offered for sale through the Website.

Profile(s):

means the profile page of a Professional Seller containing the information enabling the Company to identify such Seller (first name, last name, affiliated organisation, etc.).

GDPR:

means General Data Protection Regulation No. 2016/678 of 27 April 2016.

Website:

means the interactive electronic service published and operated by the Company, accessible at https://castafiore.fr/.

Company:

means CASTAFIORE, as identified in the legal notice available on the Website.

User(s):

means any (i) adult natural person or (ii) legal entity that has created an Account as a Professional Seller or Buyer for the purpose of selling or purchasing Products.

Prospective User(s):

means any adult natural person or legal entity that has provided its contact details to the Company (i) by submitting a Contact Form, (ii) by telephone or (iii) by email, in order to entrust a Product to the Company for sale on the Website under a consignment service or to obtain information relating to the sale or purchase of Products.

Seller(s):

means either a Professional Seller or a Private Seller.

Private Seller(s):

means any adult natural person who is not acting for professional purposes and who entrusts Products belonging to them to the Company, through a consignment service, for sale on the Website.

Professional Seller(s):

means any natural person or legal entity acting for professional purposes and (i) offering Products belonging to them for sale on the Website or (ii) entrusting Products belonging to them to the Company, through a consignment service, for sale on the Website. Any Product sold by a Professional Seller is identified as such on the Website in accordance with the Seller’s declarations.

Visitor(s):

means any person browsing the Website without having created an Account or completed the Contact Form.

ARTICLE 3 – PROCESSING OF PERSONAL DATA

3.1. PERSONAL DATA PROCESSING POLICY

It is recalled, where necessary, that:

• the Account enables the Seller to sell one or more Products and the Buyer to purchase one or more Products;

• the Contact Form enables the Prospective User and the User to contact the Company in order to (i) entrust a Product to the Company for sale on the Website under a consignment service or (ii) obtain information relating to the sale or purchase of Products.

By browsing the Website, creating an Account, completing the Contact Form or subscribing to the Newsletter, the Visitor, Prospective User and User authorise the Company to process their Personal Data in accordance with this Privacy Policy.

Pursuant to the French Data Protection Act and the GDPR, the Company has implemented a data processing register.

3.1.1. Processing and nature of the data processed

Personal Data: The following persons may voluntarily provide Personal Data to the Company:

• Visitors, for the purposes of (i) creating an Account or (ii) receiving the Newsletter;

• Prospective Users, for the purposes of (i) contacting the Company by telephone or email and (ii) submitting the Contact Form, in order to (i) entrust a Product to the Company for sale on the Website under a consignment service or (ii) obtain information relating to the sale or purchase of Products;

• Users, for the purposes of:

  • logging into their Account and using the services offered through the Website, including creating or editing a Profile, publishing Listing(s), carrying out and monitoring commercial transactions involving the purchase or sale of Products, and submitting Reviews;

  • communicating with the Company, enabling it to provide assistance services and, where applicable, resolve disputes.

Certain information must be provided in order to access the Website’s services. Where such information is not provided, a message will appear on the Website informing the individual that the information is mandatory.

Such information is collected for the purposes of (i) enabling the Visitor, Prospective User or User to access the services of the Website and/or (ii), where applicable, entering into and/or performing a contract between a Seller and the Company.

If the Visitor, Prospective User or User refuses to provide such information, they will not be able to subscribe to the Newsletter, create an Account, create or edit a Profile, publish a Listing, carry out and/or monitor a commercial transaction, submit the Contact Form or submit a Review.

Non-mandatory information is freely provided by the Prospective User or User when using the services offered by the Website. By providing such information, the Prospective User or User consents to its processing by the Company.

The Prospective User or User may withdraw their consent to the processing of non-mandatory information at any time, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal. To exercise this right, the Prospective User or User may modify the information stored in their Account or contact the Company directly by email at the address specified in Article 3.2.2.

Personal Information collected outside the Website is voluntarily provided by the Prospective User or User in the context of their relationship with the Company. Such information is subject to the same arrangements as non-mandatory information described above.

The information, including Personal Data, that the Company may collect from Visitors, Prospective Users and/or Users may include:

• first name and surname of the Visitor, Prospective User and/or User, username where applicable, date of birth, personal and/or professional address and, where applicable, information concerning the company on whose behalf they are acting, including corporate name, registered office, etc., and their role within that company;

• email address(es) of the Visitor, Prospective User and/or User;

• the Professional Seller’s password, it being specified that the Professional Seller will have the option to change their password upon first login;

• contact telephone number(s) of the Prospective User and/or User;

• the identity document of the Private Seller and, where applicable, of the representative of the Professional Seller.

The Visitor, Prospective User or User expressly undertakes to:

• provide complete, accurate and up-to-date information that does not infringe the interests or rights of third parties;

• refrain from providing the Company with any Personal Data (i) that is not necessary for access to the Website’s services or, where applicable, performance of the contract between the Seller and the Company or (ii) in respect of which they have not obtained the prior consent of the relevant person.

The User may modify their personal information through their Account in accordance with the General Terms of Use.

Connection Data: each time the User connects to the Website, the Company collects Personal Data such as the IP address and MAC address of the User’s computer, the date and time of connection, as well as information concerning the User’s browser.

Browsing Data: the Company also collects information making it possible to identify how the Visitor, Prospective User or User accesses the Website, which pages are viewed and for how long. In this context, the Company may use cookies as specified in Article 4.

3.1.2. Data Controller

The controller of Personal Data is the Company.

3.1.3. Purposes of Processing

Personal Data is processed by the Company in order to enable:

• the User:

  • to log into their Account;

  • to access and benefit from the services offered by the Website;

  • where applicable, to receive Newsletters;

• the Visitor, where applicable, to receive Newsletters;

• Prospective Users to (i) entrust a Product to the Company for sale on the Website under a consignment service or (ii) obtain information relating to the sale or purchase of Products by completing the Contact Form;

• the Company:

  • to identify the User using the services and provide such services;

  • to identify the Prospective User or User wishing to (i) entrust a Product to the Company for sale on the Website under a consignment service or (ii) obtain information relating to the sale or purchase of Products;

  • to verify the identity of Sellers;

  • to create and manage Accounts;

  • to create Professional Seller Profiles for the purpose of identifying such Sellers to the Company;

  • to publish Listings on behalf of Sellers as part of a consignment service;

  • to provide Professional Sellers with the data necessary for carrying out a transaction;

  • to enable Users to carry out transactions through the secure payment service;

  • to display Buyers’ Reviews and comments on the Website;

  • to manage the rights of Prospective Users or Users in relation to their Personal Data as provided for in Article 3.2;

  • to ensure the proper operation of credit card and direct debit payment processing services;

  • to enable the Company to contact and communicate with Visitors, Prospective Users or Users by telephone and/or email correspondence, including responses to questions, email alerts and newsletters published by or on behalf of the Company;

  • to manage User and Visitor subscriptions to Newsletters and send Newsletters;

  • to send emails concerning special offers or promotions;

  • to organise events;

  • to analyse browsing data on the Website and use Personal Data to produce general statistics concerning Website traffic and its various sections, and for research and analysis purposes.

By creating an Account, Users expressly authorise the Company to send them Newsletters.

Any Visitor may subscribe to receive Newsletters using the form provided for this purpose on the Website, such subscription constituting the Visitor’s consent to receive Newsletters.

A Buyer may receive “targeted” Newsletters based on Products purchased on the Website.

In all circumstances, the User or Visitor has the right to withdraw their consent to receive the Newsletter at any time by (i) clicking the hyperlink provided for this purpose at the end of each email containing the Newsletter sent by the Company or (ii) notifying the Company by email.

The Company processes only Personal Data that is adequate, relevant and strictly necessary for these purposes.

3.1.4. Legal Bases for the Processing of Personal Data

Depending on the circumstances, the Company’s processing of Personal Data may be based on:

• the consent of the Visitor and/or User;

• performance of the CASTAFIORE Commercial Terms;

• performance of the services provided as an intermediary platform in accordance with the General Terms of Use;

• the Company’s legitimate interest in processing certain data, particularly for the purposes of managing relationships with Visitors and/or Users, managing User and Visitor subscriptions to Newsletters and organising events;

• compliance with the law.

3.1.5. Sharing of Personal Data by the Company

By providing Personal Data to the Company:

• the Professional Seller acknowledges and agrees that the Company may process the Personal Data that they authorise to appear on their Profile, it being specified that such Personal Data has been voluntarily provided to the Company and that no Personal Data is published on the Website or transferred to another User without the Professional Seller’s knowledge;

• the Buyer acknowledges and agrees that, when purchasing Product(s), the Company may transmit their Personal Data to the relevant Professional Seller(s), it being specified that such Personal Data has been voluntarily provided to the Company and that no Personal Data is published on the Website or transferred to another User without the Buyer’s knowledge. The Professional Seller is responsible for processing the personal data that they may receive or collect from Users. In this respect, the Professional Seller undertakes to comply with applicable legal and regulatory provisions relating to the protection of personal data;

• the Visitor, Prospective User or User acknowledges and agrees that the Company may transmit their Personal Data to persons authorised by the Company, including:

  • members of its staff;

  • external service providers responsible for providing a service that is inseparable from the purchase of one or more Products, and more particularly the payment service provider and shipping provider. Users are invited to review the personal data protection policies of such providers before using their services;

  • external service providers providing services to the Company, including mailing providers, accountants, banks, IT service providers, professional messaging providers, archiving companies, software publishers, hosting providers, maintenance providers, etc.;

  • third parties, including market research companies or polling institutes, exclusively for research and analysis purposes.
    

We do not sell, rent, or share your personal information - including your mobile opt-in and SMS consent data - with third parties for advertising purposes.

Such persons will only have access to the information strictly necessary for the performance of their respective assignments and solely for the purposes set out in Article 3.1.3.

All or part of the Personal Data may therefore be processed and/or stored by external IT service providers, such as professional email providers and hosting providers, as well as through the IT tools used by the Company in the course of its business, including Microsoft Office software, computers located at the Company’s registered office, accounting software, etc.

In this respect, Visitors, Prospective Users and Users are informed that Personal Data may be disclosed to companies operating these services, including Google LLC and Microsoft Corporation, whose registered offices are located in the United States.

These companies apply standard contractual clauses in respect of their customers, governing the transfer of personal data and thereby providing a sufficient level of protection in accordance with French regulations.

However, due to the legislation applicable in the United States, there is a risk that Personal Data may be accessed by US authorities.

In all circumstances, the Company ensures that any transfer of Personal Data to countries located outside the European Union is appropriately governed in order to guarantee its security:

• by ensuring that the country concerned is recognised by the European Commission as providing a sufficient and adequate level of protection;

• by obtaining the consent of the Visitor, Prospective User and/or User to such transfer.

As the Company has no control over the transfer of Personal Data by certain companies, any Visitor, Prospective User or User who objects to the transfer of their Personal Data to the United States must refrain from using the services of the Website.

Furthermore, the Company has no control over Professional Sellers. Accordingly, when purchasing one or more Products, Personal Data may be transferred to countries outside the European Union. Users wishing to exercise their rights must contact the relevant Professional Seller and/or the Company directly.

In all circumstances, the Company undertakes not to transmit Personal Data collected from Visitors, Prospective Users and Users for commercial purposes, other than for the purpose of completing a transaction through the Website, without the prior authorisation of the relevant Users.

The Company may also be required to transmit Personal Data to authorised third parties, such as administrative or judicial authorities.

In addition, the Company may use the following processors in connection with the processing of Personal Data, in compliance with the GDPR:

• Klaviyo, Inc. (USA): emailSMS and newsletter management tool;

• Typeform S.L. (Spain): collection of information through customised forms;

• Calendly LLC (USA): online appointment scheduling;

• Skeepers / Avis Vérifiés (France): collection and display of post-purchase customer reviews.

These providers only have access to Personal Data that is strictly necessary for the performance of their services. They are contractually required to comply with applicable personal data protection legislation.

3.1.6. Retention of Personal Data

The Company retains Personal Data only for as long as necessary for the purposes for which it was collected and in accordance with applicable regulations.

The retention period for Personal Data varies depending on the purpose for which it is collected and processed, as follows:

Purpose	Legal basis	Retention period
Creation and management of the User Account	Consent of the User, Prospective User and/or Visitor	Duration of the contractual relationship plus 5 years, without prejudice to statutory retention requirements or limitation periods
Management of services between Users	—	Duration of the contractual relationship plus 5 years, without prejudice to statutory retention requirements or limitation periods
Management of Visitor and User Newsletter subscriptions and sending of Newsletters	—	Duration of the contractual relationship, i.e. until deletion of the Account or unsubscription from the Newsletter, plus 1 year
Organisation of, registration for and invitations to Company events	—	1 year from the last contact initiated by the User or Visitor, unless they unsubscribe
Reviews submitted on the Website	—	Until the User withdraws consent or for as long as required by the Website
Contact Form	—	6 months in the event that the Personal Data provided is not validated by the Company or the Prospective User withdraws
Performance of services	Performance of pre-contractual measures or the contract	Duration of the contractual relationship plus 5 years, without prejudice to statutory retention requirements or limitation periods
Management of the contractual relationship	—	Duration of the contractual relationship plus 5 years, without prejudice to statutory retention requirements or limitation periods
Identity verification	—	For the lifetime of the Account
Invoicing	—	10 years from the end of the financial year during which the invoice was issued
Debt collection	—	Until full payment of invoices
Retention of bank card data following a one-off payment	Performance of the contract / compliance with legal and regulatory obligations	15 months, it being specified that such data is retained by the payment service provider
Analysis of browsing data on the Website	Consent of the User and/or Visitor / legitimate interest of the Company	See the cookie policy set out in Article 4 of this Privacy Policy
Prevention of money laundering and terrorist financing	Compliance with legal and regulatory obligations	5 years following the end of the contractual relationship
Accounting records	—	10 years from the end of the relevant financial year
Management of the right to object	—	3 years from the exercise of the right to object
Management of the rights of Visitors and Users other than the right to object	—	1 year from the exercise of the relevant right

Where Personal Data is collected for several purposes, it will be retained until expiry of the longest applicable retention or archiving period.

3.2. RIGHTS OF OBJECTION, ACCESS, RECTIFICATION AND ERASURE OF PROSPECTIVE USERS AND USERS

3.2.1. Rights of Objection, Access, Rectification, Erasure, Restriction, Portability, Information and Withdrawal

Under the conditions defined by the French Data Protection Act and the GDPR, Prospective Users and Users may, at any time:

• object, (i) on grounds relating to their particular situation, to the processing of Personal Data based on the Company’s legitimate interests, except where there are compelling legitimate grounds or where the processing is necessary for the establishment, exercise or defence of legal claims, and (ii) to direct marketing;

• access all Personal Data concerning them that is being processed;

• request the rectification, completion and/or updating of Personal Data where it is inaccurate, incomplete, ambiguous or outdated;

• request the erasure of Personal Data on legitimate grounds or where its use is no longer necessary for the purposes for which it was collected;

• request restriction of the processing of Personal Data;

• where the legal requirements are met, receive the Personal Data provided to the Company in a readable format and transmit such Personal Data to another person;

• request information from the Company concerning the categories of Personal Data collected and processed, the purposes and legal bases of processing, recipients of Personal Data, retention periods, transfers of Personal Data to countries outside the European Union, etc.

Prospective Users and Users are also informed that they have the right, at any time, to withdraw their consent to the processing of Personal Data without affecting the lawfulness of processing carried out prior to such withdrawal.

Prospective Users and Users also have the right to define general and specific instructions regarding the manner in which they wish the rights referred to in this Article to be exercised after their death.

In the event of difficulties encountered with the Company concerning the processing of Personal Data or the exercise of their rights, the data subjects may at any time lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) in France.

3.2.2. How Prospective Users or Users May Exercise Their Rights

The rights referred to in Article 3.2.1 may be exercised by the Prospective User or User:

• by email at: [email protected];

• by post, addressed to:

CASTAFIORE
11 avenue du Colonel Bonnet
75016 PARIS
France

When submitting such a request, the Prospective User or User must provide proof of identity, including their surname, first name(s) and email address(es), and attach a copy of their identity document.

Furthermore, without prejudice to any other remedy, the Prospective User or User has the right, at any time, to lodge a complaint with the competent supervisory authority, including the CNIL in France.

3.3. SECURITY AND ARCHIVING OF PERSONAL DATA OF PROSPECTIVE USERS AND USERS

3.3.1. The Company processes the Personal Data of each Prospective User and User with the utmost confidentiality and in compliance with the French Data Protection Act and the GDPR. The Company undertakes to take all reasonably necessary measures to secure and protect the Personal Data it processes.

3.3.2. In the event of a Personal Data breach, the Company undertakes, pursuant to Articles 33 and 34 of the GDPR, to:

• notify the CNIL of the breach within a maximum period of seventy-two (72) hours after becoming aware of it, whether internally, through a Visitor or User, through one of its processors or through a third party, unless the breach is unlikely to result in a risk to the rights and freedoms of the natural persons concerned;

• inform the natural persons concerned as soon as possible after becoming aware of the breach, unless one of the following conditions applies:

  • the Company has implemented appropriate technical and organisational safeguards and those safeguards have been applied to the Personal Data affected by the breach, in particular measures rendering the Personal Data unintelligible to any third party not authorised to access it, such as encryption;

  • the Company has taken subsequent measures ensuring that the high risk to the rights and freedoms of the natural persons concerned is no longer likely to materialise;

  • informing the natural persons concerned would require disproportionate effort. In such circumstances, a public communication or similar measure will be used to inform the persons concerned in an equally effective manner.

ARTICLE 4 – COOKIES

The Company uses cookies on its Website enabling it to collect information relating to the browsing activity of a Visitor, Prospective User or User on the Website, including in particular the pages viewed and the dates and times of consultation.

At no time do these cookies enable the Company to identify the Visitor, Prospective User or User personally.

The Company undertakes to comply with CNIL recommendations concerning cookie retention periods, which may not exceed thirteen (13) months from the date on which the cookies are placed, it being specified that:

• regarding cookies placed by the Company on the device of a Visitor, Prospective User or User, including computers, smartphones and tablets, the Company undertakes to delete or anonymise the Personal Data after expiry of the thirteen (13)-month retention period;

• regarding cookies placed by third parties on the device of a Visitor, Prospective User or User, the Company undertakes to verify that such third parties comply with the thirteen (13)-month retention period.

In addition, information collected through cookies is retained for a maximum period of twenty-five (25) months.

Visitors, Prospective Users and Users may object to the storage of such cookies, including by configuring their web browser.

Consent to the storage of cookies is managed by an external provider.

In addition, the Company uses the following services, which may place third-party cookies subject to the User’s prior consent:

• Google Analytics (Google LLC): statistical monitoring of Website traffic;

• Meta Pixel (Meta Platforms Ireland Limited): advertising tracking and retargeting on Facebook and Instagram;

• Hotjar Ltd.: behavioural and user experience analysis, including heatmaps, clicks and browsing journeys;

• Microsoft Clarity (Microsoft Corporation): session recording and browsing analysis.

Users may modify or withdraw their consent at any time through the cookie management interface provided for this purpose.

For more information concerning the use of cookies by these providers:

• Google: https://policies.google.com/privacy

• Meta: https://www.facebook.com/privacy/policy

• Hotjar: https://www.hotjar.com/legal/policies/privacy/

• Microsoft Clarity: https://privacy.microsoft.com/fr-fr/privacystatement

ARTICLE 5 – HYPERLINKS TO OTHER WEBSITES

Where hyperlinks to third-party websites are provided, the Company invites each Visitor, Prospective User and User to review the relevant website’s terms of use and its own personal data collection policy.

The Company accepts no liability for the processing by such websites of personal data that they collect.

ARTICLE 6 – TERM – ENFORCEABILITY – AMENDMENTS

The Privacy Policy is binding upon Prospective Users who have accepted it as well as upon Users.

The Company reserves the right to amend the content of its Privacy Policy unilaterally and at any time.

Any amendments shall become enforceable following notification by email to the address provided to the Company in connection with creation of the Account, submission of the Contact Form or the Prospective User’s or User’s relationship with the Company, thirty (30) days prior to their publication online.

Visitors and Users may exercise the rights referred to in Article 3.2. Failing this, each Prospective User and User shall be deemed to have accepted the new Privacy Policy.

ARTICLE 7 – CONTACT

Visitors, Prospective Users and Users may contact the Company:

• by email at: [email protected];

• by post, addressed to:

CASTAFIORE
11 avenue du Colonel Bonnet
75016 PARIS
France

• by telephone: +33 6 08 13 01 58.