Privacy policy
English translation of the French personal data protection charter of So Shape. In case of any difference, the French version prevails.
1. Definition and nature of personal data
When you use our website, we may ask you to provide personal data about yourself.
The term "personal data" means any data that makes it possible to identify an individual, which includes in particular your surname, first names, username, photograph, postal and email addresses, telephone numbers, date of birth, data relating to your transactions on the website, details of your purchases and subscriptions, bank card numbers, and any other information you choose to give us about yourself.
2. Purpose of this charter
The purpose of this charter is to inform you about the means we use to collect your personal data, with the strictest respect for your rights.
In this respect, we inform you that, in collecting and managing your personal data, we comply with French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties, in its current version.
3. Identity of the data controller
The controller of your personal data is So Shape, a French simplified joint-stock company (S.A.S.) registered with the Paris Trade and Companies Register under number 798 038 345, with its registered office at 25 rue de Ponthieu, 75008 Paris, France.
4. Collection of personal data
Your personal data is collected for one or more of the following purposes:
(i) managing your access to and use of certain services available on the website, (ii) carrying out customer management operations relating to contracts, orders, deliveries, invoices, loyalty programmes and the follow-up of customer relations, (iii) building a file of registered members, users, customers and prospects, (iv) sending newsletters, requests and promotional messages; if you do not wish to receive them, we give you the option to refuse when your data is collected, (v) producing commercial and traffic statistics for our services, (vi) organising competitions, lotteries and any promotional operations, excluding online gambling subject to approval by the French online gaming regulator, (vii) managing people's reviews of products, services or content, (viii) managing unpaid amounts and any disputes regarding the use of our products and services, (ix) complying with our legal and regulatory obligations.
When we collect your personal data, we tell you whether certain data is mandatory or optional. We also tell you the possible consequences of not answering.
5. Recipients of the data collected
The staff of our company, the departments in charge of auditing (in particular the statutory auditor) and our subcontractors will have access to your personal data.
Your personal data may also be received by public bodies, exclusively to meet our legal obligations, by officers of the court, ministerial officers and bodies in charge of debt collection.
6. Transfer of personal data
Your personal data will not be sold, rented or exchanged for the benefit of third parties.
7. Retention period of personal data
(i) Data relating to the management of customers and prospects:
Your personal data will not be kept longer than strictly necessary to manage our commercial relationship with you. However, data used to establish proof of a right or a contract, which must be kept to comply with a legal obligation, will be kept for the period provided for by the law in force.
For any marketing operations aimed at customers, their data may be kept for three years from the end of the commercial relationship.
Personal data relating to a prospect who is not a customer may be kept for three years from its collection or from the last contact from the prospect.
At the end of this three-year period, we may contact you again to ask whether you wish to keep receiving commercial requests.
(ii) Identity documents:
If you exercise your right of access or rectification, data relating to identity documents may be kept for the period provided for in article 9 of the French Code of Criminal Procedure, that is, one year. If you exercise your right to object, this data may be archived for the limitation period provided for in article 8 of the French Code of Criminal Procedure, that is, three years.
(iii) Bank card data:
Financial transactions relating to the payment of purchases and fees on the website are entrusted to a payment service provider that ensures they run smoothly and securely.
For the purposes of the services, this payment service provider may receive your personal data relating to your bank card numbers, which it collects and keeps in our name and on our behalf.
We do not have access to this data.
To allow you to make regular purchases or pay the related fees on the website, your bank card data is kept for as long as you are registered on the website and at least until you make your last transaction.
By ticking the box provided for this purpose on the website, you give us your express consent to this retention.
Data relating to the visual cryptogram or CVV2 printed on your bank card is not stored.
If you refuse to have your personal data relating to your bank card numbers kept under the conditions above, we will not keep this data longer than necessary to complete the transaction.
In any event, this data may be kept, as evidence in case of a dispute over the transaction, in intermediate archives for the period provided for by article L 133-24 of the French Monetary and Financial Code, that is, 13 months after the debit date. This period may be extended to 15 months to take into account the possible use of deferred debit payment cards.
(iv) Management of lists of people who object to receiving marketing:
The information used to take your right to object into account is kept for at least three years from the exercise of that right.
(v) Audience measurement statistics:
Information stored on users' devices, or any other element used to identify users and track them or their visits, will not be kept for more than 6 months.
8. Security
We take all useful precautions and appropriate organisational and technical measures to preserve the security, integrity and confidentiality of your personal data, and in particular to prevent it from being distorted or damaged, or accessed by unauthorised third parties. We also use, or may use, secure payment systems that are state of the art and comply with the applicable regulations.
9. Cookies
Cookies are text files, often encrypted, stored in your browser. They are created when a user's browser loads a given website: the website sends information to the browser, which then creates a text file. Each time the user returns to the same website, the browser retrieves this file and sends it to the website's server.
There are two types of cookies, which have different purposes: technical cookies and advertising cookies.
Technical cookies are used throughout your visit to make browsing easier and to perform certain functions. A technical cookie may, for example, be used to remember the answers entered in a form, or the user's preferences regarding the language or layout of a website, when such options are available.
Advertising cookies may be created not only by the website the user is browsing, but also by other websites that display advertising, ads, widgets or other elements on the page shown. These cookies may in particular be used for targeted advertising, that is, advertising based on the user's browsing.
We use technical cookies. They are stored in your browser for a period that cannot exceed six months.
We do not use advertising cookies. However, if we were to use them in the future, we would inform you beforehand and you would be able to disable these cookies where applicable.
We use, or may use, Google Analytics, an audience analysis tool that generates a cookie to measure the number of visits to the website, the number of pages viewed and visitor activity. Your IP address is also collected to determine the city from which you are connecting. The retention period of this cookie is set out in article 7 (v) of this charter.
As a reminder, you can object to cookies being placed by setting up your browser accordingly. However, such a refusal could prevent the website from working properly.
10. Consent
When you choose to provide your personal data, you expressly consent to its collection and use as set out in this charter and in the legislation in force.
11. Access to your personal data
In accordance with French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties, you have the right to obtain the communication and, where applicable, the rectification or deletion of the data concerning you, through online access to your file. You can also write to:
- email address: hello@soshape.com
- postal address: 25 rue de Ponthieu, 75008 Paris, France
Anyone may, for legitimate reasons, object to the processing of data concerning them.
12. Amendments
We reserve the right, at our sole discretion, to amend this charter at any time, in whole or in part. These amendments will take effect from the publication of the new charter. Your use of the website after these amendments take effect will mean that you acknowledge and accept the new charter. Otherwise, if this new charter does not suit you, you should no longer access the website.
13. Entry into force
This charter entered into force on 8 May 2017.