At Rosae, protecting your personal data is a priority. When you use https://www.rosaeparis.com (the “Site”), we may collect personal data about you.

The purpose of this policy is to inform you about how we process such data in compliance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the “RGPD”) and Law No. 78-17 of January 6, 1978 on data processing, files and freedoms (together the “Applicable Regulations”).

The data controller is Rosae PARIS, SAS, registered in the Paris Trade and Companies Register under number 853 315 653 and whose registered office is located at 6 rue d'Uzes - 75002 Paris (“We”).

Personal data is data that can be used to identify an individual, either directly or by cross-referencing with other data. We collect personal data in the following categories:- Identification data (surname, first name, email address, delivery address, billing address, telephone number);
- Data relating to your orders;
- Connection data (connection logs, encrypted passwords);
- Browsing data (IP address, pages viewed, date and time of connection, browser used, operating system, user ID, MAID);
- Any information you wish to send us in connection with your contact request.
Mandatory data are indicated when you provide us with your data. They are indicated by any means.

3.1 OBJECTIVE - Provide our services available on our Site (access your account, view your deliveries, etc.).

LEGAL BASIS - Execution of your legal contract with us

STORAGE DURATION - Once you have created an account: your data is kept for the duration of your account. In addition, your data may be archived for evidentiary purposes for a period of 5 years.

3.2. OBJECTIVE - Fulfill your order, carry out customer management operations concerning contracts, orders, deliveries, invoices, loyalty programs and ensure the follow-up of the contractual relationship with our customers.

LEGAL BASIS - Execution of your legal contract with us

STORAGE DURATION - Personal data is kept for the duration of the contractual relationship. In addition, your data (with the exception of your bank details) is archived for evidentiary purposes for a period of 5 years. Your credit card details are kept by our payment service provider until receipt of your order, plus your withdrawal period.

3.3. OBJECTIVE - Manage your product reviews.

LEGAL BASIS - Our legitimate interest in collecting your feedback on our products.

STORAGE DURATION - 2 years from the publication of the review.

3.4. OBJECTIVE - Build up a file of customers and prospects.

LEGAL BASIS - Our legitimate interest in developing and promoting our business.

STORAGE DURATION - For customers: data is kept for the duration of the contractual relationship. For prospects: data is kept for a period of 3 years from the date of your last contact.

3.5. OBJECTIVE - Send newsletters, solicitations and promotional messages by email.

LEGAL BASIS - For customers: our legitimate interest in building customer loyalty and informing our customers of our latest news. For prospects: your consent.

STORAGE DURATION - Data is kept for 3 years from your last contact with us or until your consent is withdrawn.

3.6. OBJECTIVE - Provide answers to your information requests.

LEGAL BASIS - Our legitimate interest in responding to your requests.

STORAGE DURATION - Data is kept for a period of 3 years from the date of your last contact.

3.7. OBJECTIVE - Comply with legal obligations applicable to our business.

LEGAL BASIS - Comply with legal and regulatory obligations.

STORAGE DURATION - Invoices: Invoices are archived for 10 years.

3.8. OBJECTIVE - Organize giveaways and promotional operations.

LEGAL BASIS - Our legitimate interest in retaining our customers and offering them gifts.

STORAGE DURATION - Data is kept for the duration of the games or promotional operations and may be archived for 5 years for evidentiary purposes.

3.9. OBJECTIVE - To compile statistics (on browsing, the Site's audience, etc.) and improve the Site's functionalities by depositing audience measurement cookies.

LEGAL BASIS - Your consent or Our legitimate interest in analyzing the composition of our customer base and improving our services.

STORAGE DURATION - Data is kept for 25 months.

3.10. OBJECTIVE - Deliver personalized advertising by depositing advertising cookies.

LEGAL BASIS - Your consent.

STORAGE DURATION - Data is kept for 2 years.

3.11. OBJECTIVE - Manage requests to exercise rights.

LEGAL BASIS - Our legitimate interest in responding to your requests and keeping track of them.

STORAGE DURATION - If we ask you for proof of identity, we keep it only for the time needed to verify your identity. Once verification has been completed, the proof of identity is deleted. If you exercise your right to object to receiving marketing communications: we keep this information for 3 years. Information enabling us to manage your requests to exercise your rights under the RGPD will be kept for 3 years from the date of the request.

The following Entities or People will have access to your personal data:
- Our Company staff ;
- Our subcontractors: hosting service provider, newsletter dispatch service provider, audience measurement and analysis service provider, e-mail service provider, secure payment service provider, invoicing tool, cookie management tool, customer relationship management (CRM) tool, logisticians in charge of product delivery, website creation service provider;
- Where applicable: public and private bodies, exclusively to meet our legal obligations.

Your data is kept and stored for the duration of processing on the company's servers, located in the European Union.In the context of the tools we use (see article on recipients concerning our subcontractors), your data may be transferred outside the European Union. The transfer of your data in this context is secured using the following tools:
- Either the data is transferred to a country that has been the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the RGPD: in this case, this country ensures a level of protection deemed sufficient and adequate to the provisions of the RGPD;
- Or the data is transferred to a country whose level of data protection has not been recognized as adequate to the RGPD: in this case such transfers are based on appropriate safeguards indicated in Article 46 of the RGPD, tailored to each provider, including but not limited to the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules or under an approved certification mechanism;
- Or the data is transferred on the basis of one of the appropriate guarantees described in Chapter V of the RGPD.

You have the following rights with regard to your personal data:
- Right to information: this is precisely why we have drawn up this policy. This right is provided for in Articles 13 and 14 of the RGPD.
- Right of access: you have the right to access all your personal data at any time, under Article 15 of the RGPD.
- Right of rectification: you have the right to rectify inaccurate, incomplete or obsolete personal data at any time pursuant to Article 16 of the GDPR.
- Right to limitation: you have the right to obtain the limitation of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
- Right to erasure: you have the right to demand that your personal data be erased, and to prohibit any future collection on the grounds set out in Article 17 of the GDPR.
- Right to lodge a complaint with a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data constitutes a breach of the applicable texts, in accordance with Article 77 of the RGPD.
- Right to define directives regarding the retention, erasure and communication of your personal data after your death.
- Right to withdraw your consent at any time: for purposes based on consent, Article 7 of the RGPD states that you may withdraw your consent at any time. This withdrawal will not call into question the legality of the processing carried out prior to the withdrawal.
- Right to portability: under certain conditions specified in Article 20 of the RGPD, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to demand its transfer to the recipient of your choice.
- Right to object: under Article 21 of the RGPD, you have the right to object to the processing of your personal data. Please note, however, that we may continue to process them despite this objection, for legitimate reasons or the defense of legal rights.
You can exercise these rights by writing to us using the contact details below. We may ask you to provide additional information or documents to prove your identity.

To find out more about cookie management, please consult our Cookie Policy.

Email : laboutique@rosaeparis.com

Adresse: 6 rue d'Uzès 75002 Paris - France

We may modify this policy at any time, in particular in order to comply with any regulatory, legal, editorial or technical developments. These modifications will apply as of the effective date of the modified version. You are therefore invited to consult the latest version of this policy on a regular basis. Nevertheless, we will keep you informed of any significant changes to this privacy policy.
Effective date: 7th of June 2024