–

1. Who are we?

The presentation of the LDLC group is available at the following address: https://www.groupe-ldlc.com/presentation-du-groupe/

The LDLC group is made up of several companies and merchant sites.

The purpose of GROUPE LDLC’s privacy policy is to:

• Send you information related to personal data that is processed by our services;
• Inform you of your rights and how you can exercise them.

This Policy has been drafted in compliance with the provisions of the General Data Protection Regulations (“GDPR”), the amended Data Protection Act of 1978. It is likely to evolve according to the regulations, the case law and the doctrine of the supervisory authorities.

2. Who is responsible for processing your data?

The LDLC GROUP and its subsidiaries (hereinafter “LDLC GROUP”), responsible for the processing of personal data carried out on their sites, collect information about you, in particular when creating your Customer Account or during your purchases.

As the person who determines the purposes and means of processing, the controller is GROUPE LDLC as well as the various companies in the group such as:

• THE LDLC SCHOOL
• DISTRIBUTION LDLC
• DLP CONNECT
• LDLC-EVENT
• OLYS
• LDLC VR STUDIO

Contact details for the head office of GROUPE LDLC and its subsidiaries:

Head office address: 2 rue des Érables, 69760
Telephone number: 04 72 52 37 77
E-mail address: dpo@groupe-ldlc.com

3. What type of data do we collect?

We collect the data necessary to meet a specific purpose.

The data we collect may have as a legal basis:

• Your consent, which can be withdrawn at any time;
• The performance of our contractual relationship or pre-contractual measures;
• Compliance with a legal obligation to which we are subject;
• The legitimate interest pursued by the controller, in respect of your interests and rights.

The following table presents the information to be provided when the data is collected from the data subject (Article 12 of the GDPR).

4. What are the treatments implemented?

5. Who are the recipients?

In addition to the recipients indicated above, and in order to accomplish the aforementioned purposes, we disclose your personal data only to:

• LDLC Group entities that need to know them to ensure their management;
• Service providers and subcontractors performing services on our behalf; They are rigorously selected and act according to our instructions;
• Partner sellers in the event of the purchase of a product on the Ldlc.com Marketplace;
• Stores under the LDLC banner for the 360° program
• Financial, judicial or state agencies, public bodies on request and within the limits of what is permitted by regulation;
• Credit reporting and collection agencies in the context of credit assessment or debt collection in the event of unpaid invoices;
• Certain regulated professions such as lawyers, notaries, auditors.

6. What are the retention periods?

GROUPE LDLC keeps personal data for a period that does not exceed the period necessary for the purposes for which they are collected in accordance with the provisions of the law of January 6, 1978 as amended and the GDPR.

The data may be retained later in the following cases when retention is necessary:

• To the exercise of the right to freedom of expression and information,
• To comply with a legal obligation,
• For the performance of a task in the public interest or in the exercise of official authority vested in the controller,
• For reasons of public interest in the field of public health,
• For archival purposes in the public interest,
• For scientific or historical research purposes or for statistical purposes,
• Or the establishment, exercise or defense of legal claims.

The criteria for determining retention periods are as follows:

• Legal or regulatory provisions
• The doctrine and case law of supervisory authorities
• Sector references

Bank cards are only recorded after an explicit request from the customer, on the payment page (if this option is offered to you). They are kept for a future order in order to improve your shopping experience on our sites. Cards saved for a future purchase are kept in a secure space with our payment provider. GROUPE LDLC does not keep this information. You have the possibility to delete your registered card at any time, on the payment page.

Cookies have a lifespan limited to thirteen months after their first deposit in the user’s terminal equipment (following the expression of consent), as recommended by the CNIL. You can change your preferences at any time via the cookie manager whose link is present at the bottom of the page of our sites. To find out more about cookies and how we are committed to using them, please visit this page .

Commercial management: Your data is kept for the duration of the contractual relationship and according to the limitation periods relating to the conservation or protection of the rights of the data controller.

Management of accounting and tax operations: Accounting and tax data are kept for a period of 10 years.

Management of commercial operations: The data is kept until the withdrawal of consent or 3 years from the last contact. They can also be stored:
– For a period of 3 years from the last contact that the persons to whom they relate had with our company;
– After the execution of the contract, in intermediate archiving, to meet accounting or tax obligations or to constitute evidence in the event of litigation and within the limit of the applicable limitation period.

The data of the customer account, created by the latter, are intended to be kept until the deletion of the account by the user. However, the account may be considered inactive if not used for 2 years and may be subject to deletion.

Management of the rights of persons: When a person exercises his right of opposition to receive prospecting, in order to guarantee its effectiveness, the information allowing this right to be taken into account is kept for a minimum of 3 years from the exercise of the right. right.

Management of reviews: At the request of an author of a review, GROUPE LDLC offers the possibility of unpublishing a review, while maintaining traceability for the purposes of later verification of the review. GROUPE LDLC may delete notices in the event of a change of ownership and/or complete renovation of an establishment, or a modification of the substantial characteristics of a product or service. GROUPE LDLC will keep a history of the opinions deleted, and all documents related to the opinions, from the site and the reason for their deletion for a maximum period of one rolling year from the date of deletion of the opinion.

Management of unpaid bills: In the case of unpaid bills, the data is erased from the file listing the people in a situation of unpaid bills at the latest, 48 hours from the moment when the unpaid bill has actually been settled. Exceptionally, and when necessary and proportionate circumstances justify it, data may be retained in order to prevent renewal. In case of non-regularization, the information is likely to be kept in the file listing the people within the limit of 3 years from the occurrence of the unpaid. They can then be archived to meet accounting and tax obligations or serve as evidence in the event of litigation within the limit of the applicable limitation period.

Recording of telephone calls: Recordings are kept for a maximum of 6 months.

Supporting documents sent to Customer Relations: the purpose of the processing linked to the request for supporting documents is to combat fraud and unpaid bills. The data is kept for 30 days from the month following its receipt and 24 months from the transaction date in the event of a dispute. Supporting documents containing copies of bank cards are immediately deleted.

Newsletters: You can unsubscribe from newsletters at any time from the link provided for this purpose in the email, or directly from your Customer Account.

7. Who has access to personal data?

The data controller does not sell or share your data with third-party business partners. Some of the employees may have access to the data which is necessary for them within the framework of their functions.

Our various service providers may have access to the data for the performance of their contract, in compliance with the purposes set out above and with the regulations.

Data may be transmitted in the context of business transactions (merger, acquisition, sale, restructuring, etc.).

“Authorized third parties” (public authorities or court officers) are organizations that can access certain data contained in public and private files, on the basis of a text authorizing them to do so.

As part of the 360° customer project, aimed at offering a true multi-channel experience to customers, data is shared between the various LDLC.COM brands (branches, franchises, subsidiaries): the customers resulting from this data transfer, who have a email address, will have a web account created following their migration to the new cash register software. However, the account will only be activated when the customer has changed his password on the site during his first connection. The data concerned comes from invoices for purchases made in shops under the LDLC brand, the list of which is available at the following address: https://www.groupe-ldlc.com/boutiques/ . The legal basis for this processing is Legitimate interest, namely the multi-channel processing of customer requests (order tracking, after-sales service, complaints, etc.) and consent for the personalized customer area.

Regarding the LDLC Marketplace, our company’s role is to connect sellers and buyers. The latter are informed that their data and personal information collected when placing an order via the Marketplace, are processed by Groupe LDLC and the service providers in charge of the marketplace. Only the information strictly necessary for the execution of the transactions will be transmitted to the seller, and this for the sole purpose of processing the transactions.

8. Do we transfer data abroad?

Your data is not transferred to third countries and remains hosted within the European Union.

Regarding the functionalities related to the use of social networks, your publications are likely to be accessible outside the European Union. We invite you to consult the data management policy of the networks concerned.

9. Security

We are committed to ensuring the security of your personal data through strict procedures within our company.

For data collected “online”, communications on the client side are encrypted between the user’s workstation and our servers (HTTPS secure zone). The LDLC GROUP undertakes to make every effort to protect your personal data. Within GROUPE LDLC, only those persons will have access to your information who, because of their functions, have a legitimate interest in accessing it. In the context of technical operations, your data may also be hosted by our subcontractors. These are rigorously selected and act in accordance with our instructions.

10. Rights of persons / your rights

Data subjects have the following rights, which they exercise under the conditions provided for by the GDPR:

• Right of opposition, to withdraw consent at any time. Where the processing of your personal data is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent made before its withdrawal.
• Right of access to personal data concerning you
  GDPR Article 15
• Right to rectify data concerning them if they are inaccurate
  Article 16 GDPR
• Right to erasure of data concerning them subject to the conditions for exercising this right pursuant to the provisions of Article 17 of the GDPR
• Right to restriction of processing
  GDPR Article 18
• Right to data portability
  GDPR Article 20
• Right of objection
  GDPR Article 21
• Right to define directives relating to the fate of your personal data (conservation, deletion and communication of data) after your death.
  Article 85 of the Data Protection Act (amended)

• Right to lodge a complaint with a supervisory authority (the CNIL in France).
  Article 104.4 of the Data Protection Act (modified)
• Automated decision. The data subject has the right not to be the subject of a decision based exclusively on automated processing, including profiling, producing legal effects concerning him or significantly affecting him in a similar way. The data subject has the right to obtain human intervention from the controller, to express his or her point of view and to contest the decision.

Consult the cnil.fr website for more information on your rights.
These rights can be exercised directly with the data controller.

11. Exercise your rights

To exercise these rights or for any question about the processing of your personal data, we invite you to use the following forms depending on the site concerned:

• LDLC.com
• LDLC.PRO
• Materiel.net
• Top Buy
• Baby’s love

You can also contact Groupe LDLC and its subsidiaries at the following coordinates, in particular for data relating to another site:

• Head office address: GROUPE LDLC – DPO – 2 rue des Érables, 69760
• Telephone number: 04 72 52 37 77
• E-mail address: dpo@groupe-ldlc.com

12. Complaint

If you believe, after contacting us, that your “Data Protection” rights have not been respected, you can file a complaint with a supervisory authority.

The French supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).

Date of last update: 15.12.2021