WEBSITE PRIVACY POLICY

Preamble

Terms starting with a capital letter and not defined below have the meaning as indicated in the general conditions of use of the website www.laboratoire-alab.fr.

This confidentiality policy makes it possible to clearly and precisely present to Users what personal data may be collected when browsing the Website www.laboratoire-alab.fr.

We are committed to respecting the privacy of Users. Also, we set out below the conditions under which the personal data of Users, when browsing the Website, may be subject to Processing of their Data.

I. Definitions

“Data(s)”: any information(s) relating to an identified or identifiable natural person (as defined by the GDPR);

“GDPR”: means the European Regulation on the Protection of Personal Data n°2016/679 of April 27, 2016;

“RT” or “we”: refers to the Host;

“Processing”: means “any operation or set of operations, whether or not carried out by automated means and applied to personal data or sets of data, such as collection, recording, organization , structuring, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, reconciliation or interconnection, limitation , erasure or destruction” (definition given by the GDPR);

“User(s)” or “you”: means any natural person(s) who browse the Website and access its features and content.

II. Data collection

Time of Data collection

This privacy policy applies to all Data that you communicate to us or that we collect, directly or indirectly, in particular by:

Browsing the Website;

Subscribing to the newsletter;

Requesting all information, in particular via the contact form on the Website.

When the collection of specific Data is necessary for the associated Processing, we mark the mandatory fields with an asterisk. Your Data may also be collected from third parties subject to having obtained your prior consent.

Details of Data processing

The table below allows you to have an overview of the Data processed by the RT, the purposes of Data Processing as well as the legal basis for said Processing.

Treatment	Data collected	Purpose of Data Processing	Legal basis(s) for Data Processing
Management of commercial communications (including newsletters)	Email Last Name First Name	This data will allow us: To send you commercial communications concerning our group, our offers, our products, etc. by email; To carry out advertising targeting in conjunction with advertising partners or others (notably Facebook, Google, etc.); to produce statistics and audience measurements.	User Consent Legitimate interest
Management of Internet user knowledge, statistics and performance of the Website	Connection data Navigation data Name First name Email	This data will allow us: – to carry out satisfaction surveys; – to enrich your Internet user profile (preferences); to analyze the activity of our Website and improve the services offered; to carry out Internet user journey analyses, audience measurements, and statistics.	User Consent Legitimate interest
Management of all types of requests (notably through the contact form)	Title Name, First name, Email Full postal address Telephone number All information transmitted about you (including health data)	This data will allow us: to provide a personalized response following your request; to carry out statistics, satisfaction surveys; to process your request as part of our vigilance approach (prevention and monitoring of adverse effects of products – monitoring corrective actions taken if necessary)	User Consent Legitimate interest Legal obligation
Online browsing management	Connection data Navigation data	This data will allow us to: ensure the proper functioning of our Website; produce statistics; distribute targeted advertising online on our Website and on other sites (for example on social networks).	User Consent Legitimate interest

In addition, we may use certain techniques referred to as “profiling”, namely any form of automated processing of personal data consisting of using the Data collected to analyze and evaluate certain personal aspects relating to a natural person, in particular to analyze and /or deduce, via dynamic segmentation, the development of scenarios, audiences, certain elements and/or behaviors relating in particular to personal preferences, centers of interest, etc.

Based on these analyzes and deductions, we send you and/or display communications and/or content (concerning HAVEA GROUP and its subsidiaries) tailored to your interests/needs that we have identified. It is also possible that automated decisions are made based on profiling, in particular we may use this type of process to determine whether or not it is relevant to send you certain communications.

You have the right, in certain circumstances, to object to the use of your data for “profiling” purposes. In this case, please refer to point 7 below.

The destination of the Data

The Data subject to Processing is intended for the internal teams of the RT (and its subsidiaries) and possibly for the service providers to whom the RT may call (considered subcontractors within the meaning of the GDPR). The Data may be transmitted to third party service providers to whom we entrust your Data to carry out commercial or marketing missions on our behalf (in particular web analytics, advertising agencies in the context of carrying out marketing and commercial campaigns). Some service providers may contact you to send you commercial offers as well as satisfaction surveys in order to assess the quality of their service. If you wish to object, we invite you to contact the said service providers directly who initiated these sendings.

In addition, the Data could also be transmitted to any police, judicial or administrative authorities (as part of a legal obligation or the legitimate interest of the RT).

Minors’ Data

The Website is accessible to any person, adult or minor. However, the prior consent of the holder of parental authority is required for minors under the age of fifteen whose Data would be Processed by the RT.

Data retention

Your Data is kept for a period in accordance with legal provisions or proportional to the purposes for which it was processed. Certain retention periods may meet the legitimate interest of the RT.

For exemple :

all prospect Data is kept for three (3) years from collection or the last contact from the prospect;

Browsing Data is kept for a maximum of thirteen (13) months.

Archiving in an intermediate database is also possible for administrative reasons, particularly in matters of litigation, commercial, civil or even tax matters, as part of compliance with a legal obligation.

In any case, when their conservation is no longer justified by legal, commercial, marketing requirements or linked to the legitimate interest of the RT or if the User has made use of a right of modification or deletion or opposition (except in the case of retention for the purposes of compliance with a legal obligation), we anonymize them or delete them securely.

Transfer of your Data

We store your Data within the European Union. However, it is possible that the Data may be transferred to subcontractors and/or partners located in other countries and in particular outside the European Union. In the event of a transfer of this type, we ensure that the Processing is carried out in accordance with this confidentiality policy and that it is governed by the standard contractual clauses of the European Commission which make it possible to guarantee a sufficient level of protection of the Data and allowing respect for the privacy and fundamental rights of individuals.

Conditions for exercising Users’ rights

In accordance with the regulations on the protection of personal data (and in particular the GDPR), you have a right of access, rectification, erasure, opposition, limitation and portability of your Data. You also have the possibility to formulate directives concerning the fate of your Data after your death.

To exercise these rights, simply send a formal written and complete request accompanied by any element allowing your identification (identity document, customer number, etc.) according to the following methods of receipt:

By email: dpo@havea.com;

Via the contact form (if existing); Or

By post: A-LAB – Consumer Services – 42 rue de Washington, 75008 Paris.

The precise terms relating to the exercise of your rights are mentioned in the GDPR and also on the CNIL website.

Before responding to any request, we may verify your identity and/or ask you to provide us with further information to respond to your request.

From receipt of any written and complete request, we undertake to respond to any request within one (1) month, this period may be extended by two (2) months in the event of a complex request.

In the event that we have not responded satisfactorily to your request, a complaint can be lodged with the Commission Nationale de l’Informatique et des Libertés (CNIL) via its website https://www.cnil.fr/ Fr/.

Data security

As RT, we implement appropriate technical and organizational measures in accordance with applicable legal provisions, to protect your Data against alteration, accidental or unlawful loss, use, disclosure or unauthorized access.

Changes to the Privacy Policy

We may occasionally modify this privacy policy (in particular for reasons of legislative or regulatory change). Users are therefore advised to regularly consult this page to be aware of any modifications or updates made to this confidentiality policy.

III.Applicable law and attribution of jurisdiction

This privacy policy is governed by French law.

In the event of a dispute and in the absence of an amicable agreement, the User may seize either one of the territorially competent courts under the code of civil procedure, or the jurisdiction of the place where he resided at the time of the conclusion of the contract or of the occurrence of the harmful event.