Data Protection

Easy Dressing, conducting its business under the trade name Easy Dressing, collects and processes personal data concerning natural persons browsing or registered on its e-commerce website www.easy-dressing.fr, through which they may order various fashion products (the "Site").

Easy Dressing is committed to protecting the privacy and personal data of its customers. Accordingly, it endeavors to adopt and comply with a personal data processing policy that complies with the applicable regulations, and in particular with the General Data Protection Regulation No. 2016/679 of April 27, 2016 (the "GDPR").

The purpose of this privacy and personal data protection policy (the "Policy") is therefore to set out the terms and conditions under which personal data is processed by Easy Dressing concerning:

• - Persons browsing and registered on the Site (the "Registered Users"); and
• - Registered Users purchasing products or services from the Company (the "Customers").

(together, the Registered Users and the Customers, the "Users" or "you," "your")

Easy Dressing reserves the right to modify the Policy at any time. We may inform you of any substantial change to the Policy either by email or by stating it on our website.

Regarding the information collected by cookies, we refer you to the cookie policy, available at any time on the Site.

1. Data Controller

Easy Dressing is the controller of the personal data collected and processed under the terms of this Policy applicable to Users.

Easy Dressing, conducting its business under the trade name Easy Dressing, is a sole proprietorship (auto-entreprise).

You may contact the Company using the following details:

Email: contact@easy-dressing.fr

Learn more: The data controller is the person, in this case the Company, who determines the means and purposes of the processing of personal data. As the name indicates, it bears responsibility for the personal data processing it carries out, and it is the User's main point of contact for exercising their rights in connection with the processing.

2. Sources and Categories of Personal Data

2.1.- Source of collection of personal data

The Company collects your personal data primarily in the following cases:

• - When you use our Site or simply when you browse it, in particular through cookies);
• - When you create a personal account on the Site;
• - When you order products or gift cards, and when you contact us.

The Company also collects your personal data when you sign up for our newsletter.

More generally, the Company collects all personal data that you provide to us spontaneously and voluntarily, in particular to our customer service.

We may also collect information about you obtained from authorized third parties. These sources may, for example, be commercial partners (physical or online stores, providers of consumer-oriented services, etc.), advertising agencies, distributors, or data analysts.

2.2.- Categories of personal data

The Company collects and processes primarily the following categories of personal data:

• - The information needed to create a personal account: your first and last name, email address, phone number, and ZIP code.
• - Data relating to the ordering of products and the management of the business relationship, such as the list of products ordered, written exchanges, invoices, etc.
• - The payment card data needed to place an order, namely essentially the first and last name of the cardholder, the card number, its security code, and its expiration date;
• - The data needed or simply useful for processing your order: full address, contact phone number, your building entry code, etc.;
• - The data relating to gift cards purchased on the site (purchase date, remaining balance, etc.);
• - The information collected by the cookies installed on our Site, such as in particular the pages viewed, is presented in the Company's cookie policy, accessible here [insert link].

The Company also processes personal data about you obtained from third-party sources, such as in the context of a commercial partnership.
This data may be combined to achieve the purposes set out below.

2.3.- Mandatory nature of providing the data

Some of this information may be mandatory for the provision of the services, primarily access to the Site, the ordering of products, and our processing of your order.

When you create your personal account or on the product order form, the mandatory data is indicated on our forms by an asterisk.

If the mandatory data is not provided, we will be unable to provide the relevant services.

2.4.- Accuracy of the data

The Company makes its best efforts to keep personal data accurate and complete. To ensure that we have up-to-date information, you may notify us of any change to your contact details or any other data by contacting the Company at the details indicated above.

2.5.- Personal data and social media

It is possible that social media features may be integrated into our Site.

These may, for example, be so-called social login services ("sign up via Facebook"). If you activate or use them while being a member of the relevant social network, we may receive from the operators data that allows you to be identified. As a general rule, we receive the following data from social networks:

• - Your public profile information saved on the social network;
• - Information about the type of device you are using;
• - The account identifier of your profile on the relevant social network.

For more information, we invite you to consult the personal data protection policy of the relevant social networks.

2.6.- Location of personal data

The personal data collected on our website and/or through our application is hosted in France.

3. Purposes and Legal Bases of the Processing

Your personal data is processed by the Company to achieve the following purposes, categorized according to the applicable legal basis.

3.1 Necessary for the performance of the contract

To manage the relationship with Users, which includes in particular:

• - The creation and use of a personal account on the Site;
• - Managing the acceptance of the general terms of use, the general terms and conditions of sale, and this privacy and data protection policy;
• - For Customers, ordering products;
• - For Customers, paying for products;
• - For Customers, processing your product order;
• - Managing your credit and your gift card balance;
• - Communicating with Users, in particular the Company's sales department;
• - Managing Customer complaints and product returns;
• - Managing User loyalty programs;
• - Managing referral operations;
• - And more generally, the performance of any contract concluded between Users and the Company.

3.2 On the basis of our legitimate interest, while respecting your rights

• - (i) Carrying out analyses, in particular statistical, demographic, and marketing analyses, for example on the use of our Site, on product orders, or on consumption habits;
• - (ii) Improving the Site and all of our products and services;
• - (iii) Managing Users' reviews and comments on products and services, as well as conducting satisfaction surveys and polls;

For processing operations (i) to (iii) above, the Company's legitimate interest is to define the type of customers for its products and services, develop its business, and improve its sales and marketing strategy.

• - (iv) Offering Customers, by email, products or services similar to those ordered and acquired from the Company;
• - (v) Offering Users, by phone or postal mail, any product or service or to inform you of commercial offers from the Company or its third-party partners;
• - (vi) Transferring your postal address and phone number to third parties or commercial partners, for prospecting purposes with human intervention;

For processing operations (iv) to (vi) above, the Company's legitimate interest is to develop its business.

• - (vii) Managing debt collection and litigation;
• - (viii) Detecting, investigating, preventing, or taking measures regarding illegal activities, abuse, suspected fraud, or situations involving potential threats to the security or rights of a person or entity, and using this as evidence in the event of litigation;
• - (ix) Investigating, preventing, and impeding breaches of our general terms and conditions of sale, of this Policy, and of our property;
• - (x) Protecting and defending our property, rights, and interests, in particular in litigation before any court or administrative authority.

In this regard, the personal data processed above on the basis of being necessary for the performance of the contract is, upon termination of the contract, processed on this basis of our legitimate interest, namely to preserve our rights in the event of a claim.

For purposes (vii) to (x) above, the Company's legitimate interest is to enforce and exercise its rights as well as to prevent fraud and any prohibited or illegal activity.

• - (xi) Communicating with Users regarding the modification or improvement of our services and changes made to the Policy.

The Company's legitimate interest is to develop its service and its customer relationship.

3.3 With the consent of Users

• - (i) Storing your credit card number, in order to facilitate your future purchases;
• - (ii) Implementing the promotion of non-similar products or services through the transmission of advertising and prospecting offers, by email, by offering Users, for example, personalized services or to inform them of commercial offers from the Company or its third-party partners;
• - (iii) Personalizing our services and the user experience, based on preferences and/or consumption habits;
• - (iv) Transferring, renting, or exchanging customer files and/or prospect files to third parties or commercial partners, in order to offer you products or services directly, by email.

3.4 To comply with a legal obligation

• - (i) Complying with the legal and regulatory obligations to which the Company is subject;
• - (ii) Managing Users' requests in respect of their personal data rights.

4. Disclosure of Personal Data

The personal data collected and processed may be transmitted:

• - To authorized persons within the relevant departments of the Company, who are subject to a confidentiality obligation.
• - To the service providers or subcontractors that the Company calls upon to fulfill the purposes set out in Article 3 of the Policy.
• - These are essentially:
• - our advertising agencies;
• - our IT service providers;
• - our data hosting providers;
• - our payment providers (PayPal and Banque Populaire);
• - and our shipping providers.
• - In the event of a loss, theft, or other breach of the contracts concluded with the Company or of the law, the personal data may be transmitted to our insurance company and/or our brokerage firm, which is required to maintain the confidentiality of the data transmitted and, where applicable, to the police and judicial authorities.
• - To administrative, judicial, and police authorities, fraud enforcement agencies, and more generally to public bodies in the context of compliance with our legal obligations or to enable us to defend our rights and interests;
• - As needed, to our legal counsel and attorneys;
• - If we sell or transfer our business or part of it and your personal data relates to that sold or transferred part, or if we merge with another company, we will share your personal data with the new owner of the business or our merger partner, respectively.

5. Security of Personal Data

The Company implements organizational, technical, software, and physical security measures to protect personal data against any loss, unauthorized access, disclosure, or alteration.

Learn more
For example, the servers used by the Company are fully protected, and the Company has put in place a policy for protecting the User's passwords.

6. Data Retention

The Company retains your personal data for the time needed to accomplish the purposes pursued, where applicable extended by the legal periods for archiving, retaining certain data, and limitation. At the end of the processing, the personal data will be either deleted or anonymized by the Company.

The retention period depends on the type of personal data and the purpose.
In this context, the Company adopts and applies the following retention periods.

7. User Rights

Users are informed that, under the conditions of the GDPR and the laws applicable in France, they have a right of access, rectification, erasure, and portability of their personal data, as well as a right to restrict and object to the processing of this data.

Users also have the right to set out instructions regarding the fate of their personal data in the event of death, as well as the right to lodge a complaint with the CNIL, whose website is accessible at the following address http://www.cnil.fr and whose head office is located at 3 Place de Fontenoy, 75007 Paris.

For processing based on their consent, the User may withdraw it at any time, without affecting the lawfulness of the processing carried out prior to that withdrawal.

The User may exercise their rights, free of charge, with the Company at the details indicated above.

Learn more
In addition to the information below, the Company invites the User to consult the CNIL website:

• - Right of access: the User has the right to obtain from the Company confirmation as to whether or not their personal data is being processed and, where it is, access to that data as well as the information relating to the purposes of the processing (Art. 15 of Regulation 2016/679 on the protection of personal data ("GDPR")). Manifestly unfounded, excessive, or repeated requests may not receive a response.
• - Right of rectification: the User has the right to obtain from the Company, as soon as possible, the rectification of their personal data that they consider inaccurate (Art. 16 of the GDPR);
• - Right to erasure: the User has the right to obtain from the Company the erasure of their personal data, under the conditions provided for in Article 17 of the GDPR;
• - Right to portability: the User has the right to receive the personal data concerning them that they have provided to the Company, in a structured, commonly used, and machine-readable format (Art. 20 of the GDPR). This right applies only to the data provided, where the processing is based on consent or on a contract and is carried out by automated means;
• - Right to restriction of processing: the User may obtain from the Company the restriction of the processing of their personal data under the conditions of Article 18 of the GDPR;
• - Right to withdraw consent: the User has the right to withdraw their consent to the processing of their data if this processing is based on consent. The withdrawal of this consent does not affect the lawfulness of the processing based on consent carried out before its withdrawal.
• - Right to object: the User has the right to object at any time, on grounds relating to their particular situation, to a processing of their personal data, where it is based on legitimate interest and under the conditions of Article 21 of the GDPR;
• - Right to set out the fate of their personal data in the event of death: the User may set general or specific instructions relating to the retention, erasure, and disclosure of their personal data after their death (French Law No. 78-17 of January 6, 1978, as amended, Art. 40, II);
• - Right to lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, the User has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them constitutes a violation of the regulations applicable to personal data (Art. 77 of the GDPR).