Privacy Policy

1. Definitions

Capitalised terms have the following meanings:

The “Company” means Clap Français, a brand represented by Ms Marion Trotté, a sole trader whose SIREN number is 877721100 and whose registered office is at 46 rue des Vanneaux, 72000 Le Mans, France.

The “Site” means the website(s) accessible at https://www.clapfrancais.com and all the websites published by the Company to present and sell its Services.

“You” means the persons concerned by the Processing carried out on the Site (users, prospects, customers, etc.).

The “Policy” means this privacy policy.

“Data” means any information relating to an identified or identifiable natural person (the “data subject”), directly or indirectly, in particular by reference to an identifier (name, identification number, location data, online identifier, etc.) or to one or more factors specific to their identity.

“Processing” means any operation performed on Data (collection, recording, organisation, storage, adaptation, communication by transmission, dissemination, erasure, etc.).

A “Controller” is the person who, alone or jointly with others, determines the purposes and means of the processing, and a “processor” is the person who processes Data on behalf of the controller. On the Site, unless otherwise stated, we are the controller of the Data.

A “Recipient” is the natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not it is a third party.

The “Regulations” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”); French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties; the rules on direct marketing set out in the French Postal and Electronic Communications Code; and more generally the laws and regulations applicable to the Processing of Data that we carry out.

2. Showcase website and direct marketing

The Site presents the activities of our Company and various forms (contact, newsletter subscription, etc.). By filling in the forms and communicating with us through the Site, you send us the following categories of information:

• Identity data: title/gender; last name; first name; and, optionally, we may ask for your date of birth in order to offer you birthday offers;

• Contact data and correspondence: email address; postal address (address, postcode, city); phone number. In the case of a request to customer service, the nature and content of your request.

• Review and contribution data: username, date of the review, content of the review, product or service concerned and, where applicable, the profile picture attached to the review. The Company may enrich its Site by collecting and republishing reviews and contributions posted by its customers about its offers on other websites (in particular social networks) when these contributions are freely accessible to the public;

• Data needed to carry out loyalty, marketing, research, survey, product test and promotional actions;

• Data relating to the organisation and management of competitions, lotteries and any promotional operation;

• Data collected when you exercise the rights granted by the Regulations.

In accordance with our legitimate interest and, where applicable, when necessary for the performance of pre-contractual measures taken at your request or of a contract, we process the above Data for the following purposes:

• Presenting the Company’s products and services;

• Managing, handling and following up requests and exchanges with the Company through the Site (where applicable by offering you a chatbot, a call booking tool, etc.);

• Managing relationships with prospects;

• Managing reviews of the Company’s products, services or content;

• Direct marketing and/or sending information, managing the technical operations of direct marketing, selecting people for loyalty, marketing, survey and product test actions;

• Organising competitions, lotteries or any promotional operation on the Site.

Data used for direct marketing purposes are kept for a maximum of three years from the last active contact from the prospect or customer, or less if you withdraw your consent to receive messages from us. Review and contribution Data are kept for as long as the review is publicly available on the Site.

In accordance with our legal obligations, identity and contact data will also be processed for the following purposes:

• Updating our marketing files through the organisation in charge of the telephone marketing opt-out list, in accordance with the French Consumer Code;

• Managing requests for access, rectification and objection, and more generally the rights described in this Policy.

3. Location services

The legal basis for Processing for location purposes is the consent of the Data Subject.

You can activate geolocation on the Site by giving your consent in the window provided for this purpose. You can block it when asked.

In that case, you authorise your browser provider (Firefox, Chrome, Safari, etc.) to process the following Data:

• access to your position based on information about nearby wireless access points;

• and your IP address.

The browser provider sends them to its geolocation service provider to obtain an estimate of your location.

This location estimate is shared with the Company to provide the location features authorised by the User while browsing the Site and, where applicable, to adapt the features of the Site to your location.

You can cancel your location authorisation for a website at any time in your browser settings.

The Company has no control over the terms and conditions of web browsers and their geolocation service providers, for example:

• https://support.mozilla.org/en-US/kb/does-firefox-share-my-location-websites

• https://support.google.com/chrome/answer/142065

• https://support.apple.com/en-us/HT5403

4. Online sales

The Site allows you to make purchases, which leads us to process the following Data:

• Identity and contact data

• Data relating to the contractual and commercial relationship: details of the order; pre-contractual and order-related exchanges (subject, date, etc.); communications with the Company.

• Payment and transaction data: date of the transaction, amount, payment method, order number, billing data;

This information is necessary to manage our customer and prospect file, and more specifically for the following purposes, in accordance with our Terms of sale accepted when ordering on the Site and with our legal obligations:

• Carrying out operations relating to the management of: contracts, including registrations; orders; delivery of the product or service; legal and commercial guarantees; invoices; accounting and the follow-up of the commercial relationship (after-sales service), including reviews of the Company’s offers;

• Preventing and combating fraud, including payment fraud and in particular credit card fraud;

• Managing unpaid amounts and disputes, provided that this does not concern offences and/or does not result in excluding the person from the benefit of a right, a service or a contract.

Secure payment. All transactions made on our Site are secure. Card payments are handled by our payment service providers (“PSP”), as indicated in our terms of sale or on the order page of our products and services. We use SSL encryption to protect your personal data and the payment methods used. Thanks to this process, we are never directly in possession of your bank details.

Retention periods. The personal data we process are kept for the periods set out in the table below.

5. Creating an account

Creating an account is required to place an order on the Site.

On the Site, you can create an account, in which case the following information will be processed:

• Identity and contact data

• Account login data: username, password, which may only be saved automatically on the Site if you agree to it through your browser settings;

• Account access and usage data: IP address, login time, session length, account settings, use of any account features.

Processing will be carried out to manage authentication procedures and procedures for lost usernames or passwords, and for the performance of the order, in accordance with the purposes set out for online sales.

The identity and contact Data entered when creating the account will be used, with your consent, to inform you about the Company’s products and services.

The Company may provide tools to create a profile by adding optional information to your account (identity, social networks, age, profile picture, occupation, etc.).

6. Provision of digital content

The legal basis for Processing aimed at providing digital content is contractual and, where not provided for in the Terms of sale, our legitimate interest. For this purpose, we will process the following Data:

• Identity and contact data

• Content access data: username and password, which may only be saved automatically on the Site if you agree to it through your browser settings, and login information for the access area (IP address, login time, session length, use of any tools available from this area, etc.).

• Content data: content consultation and tracking data: modules viewed, time spent on content; information about audio files downloaded and/or listened to.

• Progress data: progress indicators, statistics and progress tracking; any marks, surveys and quizzes completed, assessments taken.

• Publication data: content of your contribution (comment, question, post, review, etc.), date, time, response rate, information about the publication space concerned.

The Site from which the content is accessible may include technical devices that track the use of the Site (logged-in user account, IP address, type of application used, various connection and account usage logs, etc.). Data from these devices may be used to combat counterfeiting and/or to identify and/or prevent any unlawful or non-compliant use of the Site and/or breach of the applicable Terms of sale.

7. Personalised coaching services

The legal basis for Processing aimed at providing a personalised coaching service is contractual and, where not provided for in the Terms of sale, our legitimate interest.

We offer personalised coaching services, in the course of which we will collect and process the following Data:

• Organisation data: identity and contact data, information about booked, cancelled and completed slots, and all information needed to organise this type of service;

• Progress data: progress indicators, any notes taken during the coaching, data from audits, surveys and quizzes completed, assessments taken, information needed to write a report.

These data may be archived for five years after the end of the order contract for the coaching service.

8. Events

Registration and organisation. We may organise in-person or online events, conferences, social or business events (the “Events”), which may be free or paid. The personal data needed to organise, manage, process and follow up invitations, registrations and attendance at these Events are processed electronically. These Data may be archived for five years after the event.

Image. We may also record your image and/or voice in photos, audio or video during an Event, in accordance with our Terms of sale or any separate agreement. The recordings may be stored and published by the Company, including on social networks, in accordance with its legitimate interests. If you do not wish to appear, you can turn off your camera during an online event, or, during an in-person event, stand at the back of the room, avoid group photos, let the photographer or camera operator know, etc.

9. Social networks and third-party websites

Exchanges on social networks. We may contact you or answer your questions through social networks if you first contacted us that way. Please note that using social networks involves the processing of personal data by the providers of these networks (see their privacy policies).

Public information. Information about you that you have sent us may be enriched for commercial, marketing, communication, solicitation or advertising purposes using other sources of information such as social networks. This includes so-called “public” information or information we can access as administrator of a page or group. The legal basis for this processing is our legitimate interest as a commercial business.

Interconnection. If your member area can connect to another service (for example a social network) for cross-posting, that third-party service may send us information that you have authorised it to disclose. Please note that the publishers of third-party services may also collect information about your browsing and/or use of the Site, in accordance with their own personal data policies. More information about signing up to the Site with a third-party account:

Facebook: https://www.facebook.com/help/223184117694507; https://developers.facebook.com/docs/facebook-login/overview

Google: https://support.google.com/accounts/answer/112802

10. Exercising your rights

For any request to exercise the above rights or for more information, you can contact the Company at contact@clapfrancais.com or by post at the address of the Company’s registered office given at the top of this Policy.

In accordance with the Regulations, you have the following rights over your Data:

• Right of access to your Data, including the right to request a copy, and to the information provided in this privacy policy (art. 15 GDPR). When the legal basis for processing is our legitimate interest, you can ask for information about the balancing test we carried out between the interests of our customers and those of the Company before this processing.

• Right to rectification (art. 16 GDPR) and to update the data we hold about you.

• Right to erasure of your Data (art. 17 GDPR) when the data are no longer necessary, when you have withdrawn your consent to their Processing (if it was based on consent), or when you object to Processing based on our legitimate interest or to processing for direct marketing purposes or profiling related to direct marketing.

• Right to withdraw your consent at any time (art. 13-2c GDPR) for any data processing based on your consent. In addition, for direct marketing, you can unsubscribe from our mailing lists at any time by clicking the unsubscribe link in our communications or by contacting us to stop receiving marketing messages.

• Right to restriction of Processing which, except for compelling reasons, may then only be carried out with your agreement (art. 18 GDPR) when:

• You contest the accuracy of the data, for the time needed to verify it;

• The processing is unlawful but you object to the erasure of the data and request restriction of processing instead;

• We no longer need the data but you still need them to establish, exercise or defend legal claims;

• You have objected to processing based on our legitimate interest, for the time needed to balance our respective interests.

• Right to data portability for Data you have provided directly when they are processed by automated means based on your consent or on a contract (art. 20 GDPR). This means you can ask to receive these data in a structured, commonly used and machine-readable format so that they can be transmitted to another controller.

• Right to object (art. 21 GDPR) to the processing of your data when this Processing is based on our legitimate interest.

• Right to give instructions about what happens to your Data after your death (art. 40-1 of Law 78-17 of 6 January 1978) and possibly to choose a trusted third party to whom the Company should entrust them.

You can also find more information on the CNIL website.

When you make a request, the Company may ask you to clarify it and to provide proof of identity (which will be kept for one year in the case of a request for access or rectification, and three years in the case of an objection). If you are not fully satisfied with our answer, you can always lodge a complaint with the data protection supervisory authority you depend on (in France, the CNIL).

11. Retention periods

Commitments. Effective means of deleting Data are in place once the retention or archiving period needed to fulfil the defined or required purposes has been reached, in particular after your account with our Company is deleted or at the end of the contract with our Company.

Data minimisation. In any event, Data subject to Processing are not kept beyond the time needed to perform the obligations defined when the contract was concluded or set by applicable law. Beyond that, they may be anonymised and kept for statistical purposes, in particular in aggregated form.

Disputes. We may also archive information proving the performance of our contractual obligations until the expiry of the limitation periods applicable to legal actions, in order to defend our interests before the courts in the event of a later dispute. This concerns in particular, but not exclusively, the periods set by the French Commercial Code, Civil Code and Consumer Code.

12. Recipients

Commitments. We undertake to ensure that every recipient of data provides sufficient and appropriate contractual guarantees to respect your rights, so that the processing meets the requirements of the GDPR where it applies (in particular regarding subcontracting). On the basis of our legal obligations, your Data may be disclosed under a law, a regulation or a decision of a competent regulatory or judicial authority.

The information you send us is for internal use by authorised persons. It is strictly confidential and may not be disclosed to third parties, except under the conditions provided by the Regulations, with your express agreement or if you have decided to make it public.

Subcontracting. Our external service providers (e.g. suppliers, carriers, etc.) may, as part of the processing described above, receive personal data when this is necessary to carry out their task.

Transfers outside the EU. We undertake to comply with the regulations applicable to transfers of data to countries outside the European Union, in particular as follows:

• We transfer the data of visitors, prospects and customers to countries recognised as providing an adequate level of protection;

• When the destination country does not provide an adequate level of protection, we frame the transfers with compliant transfer tools (in particular the European Commission’s standard contractual clauses).

Aggregation of non-personal data. We may publish, disclose and use aggregated information (about the users of the site, prospects, customers, etc.) that we combine so that no natural person can be identified individually. This processing is carried out in accordance with our legitimate interest for statistical purposes, sector and market analysis, presentation of our activities, promotional and advertising purposes and other commercial purposes.

13. IT security

Commitments. We undertake to implement appropriate technical and organisational measures, through physical and logistical security means, to limit the risks of accidental, unauthorised or unlawful access to, disclosure, alteration, loss or destruction of your personal data.

Warnings. We invite you to be careful about what you decide to make public on the internet, in particular personal data, including private or sensitive data, made public on your own initiative or inferred from your contributions, comments and positions of any kind on the Site, on social networks, in groups and/or in conversations with other users of the Site.

HTTPS protocol. The Site’s URL is accompanied by a closed padlock or a key icon in your browser, showing that the HTTPS security protocol is in place, including for data storage. This means you are browsing in a secure area, in particular when you are asked for your card number.

Data breach. In the event of an incident leading to the risk of modification, loss or unauthorised access to Data, we undertake to:

• Examine the causes of the incident;

• Take the necessary measures to limit the negative effects and damage that may result from the incident;

• Notify the incident to the competent authority and/or the persons concerned as soon as possible when this is a legal requirement.

Under no circumstances may the commitments above be treated as an admission of fault or liability for the occurrence of the incident.

14. General provisions

Mandatory or optional fields. On the Site, mandatory fields are indicated by an asterisk or any other type of mention. If a request is incomplete (for example registration, online order or request for information), the Company may ask for additional information or prevent the form from being submitted by any technical means.

Hyperlinks. The Site may provide links to other websites, applications and services that may be operated by third-party companies. We are not responsible for the processing of personal data carried out by these third-party sites, or by sites linking to the Site, and users are invited to read their personal data policies for more information. This Policy applies only to the activities of the Company, which cannot be held responsible for a third party’s failure to meet its personal data obligations.

Scope. This Policy does not cover all processing and we reserve the right to complete it by any means.

Language. This Policy is written in French. This English version is provided for information; in the event of a dispute, only the French text prevails.

No waiver. The temporary or permanent non-application of one or more clauses of this Policy shall not constitute a waiver of the other clauses, which remain in force.

Changes and updates. We reserve the right to modify this privacy policy. The persons concerned will be informed when required by the applicable regulations. The date of the last update is shown at the top and we invite you to check it regularly.

15. Information about cookies

Overview: Cookies and trackers (hereinafter “cookies”) are connection tokens and, more generally, any file placed when you visit a website or mobile app, or install or use software on the user’s device, for the purpose of reading or writing information on that device. Cookies allow us to collect Site browsing data (IP address, internet service provider, hardware configuration, software configuration, browser type and language, etc.).

Cookies may be placed by the Company or by third-party companies without your consent when they are strictly necessary for the Site to work or to facilitate online communication, for example for authentication, remembering the content of a shopping basket, generating visitor statistics, or limiting free access to a sample of content requested by users.

Duration: cookies are kept for a maximum of 13 months after they are first placed on your device, and this period is not extended at each visit.

Meta Pixel: The Company uses the Meta Pixel, a tracker provided by Meta Platforms Ireland Limited (Facebook, Instagram), to measure the effectiveness of its advertising campaigns and to show ads to people who have visited the Site. This tracker is only placed with your express consent, through the consent banner, and you can withdraw this consent at any time. Data collected by Meta (IP address, pages visited, browser identifier, actions taken on the Site) may be transferred outside the European Union under the conditions set out in section 12. To find out more: Meta’s privacy policy.

Consent to cookies: You are informed of the presence of non-essential cookies by an information banner on the Site. Except for uses that do not require consent, cookies and trackers are only placed on your device with your express agreement. You may be asked periodically to renew your consent, to make sure it is still valid.

Cookie settings: You can always change your preferences in your browser settings (Firefox; Chrome; Safari; Opera; Microsoft Edge). You can also set your browser to enable the “Do Not Track” option, which tells the websites, ad networks and apps you visit that you do not want to be tracked.

If you refuse non-essential cookies: Some features of the Site, such as video players or interactive content, use services provided by third parties that place cookies allowing them to identify your viewing of the content. If you refuse these cookies, personalisation features will not work and the content offered to you (in particular video suggestions or ads) will still be shown but will not be related to your interests.