Privacy policy of compagnie des Cuirs Précieux

Effective date : November 2021

1. General declaration

We take your private life very seriously and we undertake to protect it. We believe that you should be able to easily find out which personal data we collect and use and understand your rights with regard thereto. This privacy policy (the “Privacy policy”) explains our policies and practices regarding the way in which your personal data is processed when it is collected on the website www.groupehcp.com (hereinafter the “Website”).

We recommend that you read this Privacy policy carefully, as it contains important information regarding your personal data. This Privacy policy is designed to enable you to easily access the section of interest to you. You can print out the full text of our Privacy policy. Please do not hesitate to contact us if you have any questions or comments regarding this Privacy policy (see the “How to contact us” section hereinafter).

2. Who are we ?

Compagnie des Cuirs Précieux, a Simplified Joint Stock Company [Société par actions simplifiée] with a share capital of €5,000,000, whose registered office is located at 3 avenue Hoche – 75008 Paris – France, registered in the Paris Trade and Companies Register under the number 582 025 755. CCP acts as a data controller of your personal data for the operations listed in article 4 of the Privacy policy.

When you place an order on the Website, your data is also processed by the companies hereinafter as joint data controllers for the operations listed in article 4 of this Privacy policy :

• Tannerie d’Annonay, a Simplified Joint Stock Company [Société par actions simplifiée] with a share capital of €2,924,022, whose registered office is located at 5 Route de la Roche Péréandre – 07100 Annonay – France, registered in the Aubenas Trade and Companies Register under the number 329 294 953, and/or
• Mégisserie Jullien, a Simplified Joint Stock Company [Société par actions simplifiée] with a share capital of €7,622.45, whose registered office is located at 3 avenue Hoche – 75008 Paris – France, registered in the Paris Trade and Companies Register under the number 393 367 172, and/or
• Tanneries du Puy, a Simplified Joint Stock Company [Société par actions simplifiée] with a share capital of €190,452, whose registered office is located in Chadrac BP 31-43 000 – Le Puy-en-Velay – France, registered in the Puy en Velay Trade and Companies Register under the number 533 947 529.

CCP, Tannerie d’Annonay, Mégisserie Julien, and Tanneries du Puy are companies of the HCP Group (hereinafter the “Companies of the HCP Group”). HCP is the holding company of the HCP Group. HCP is a Simplified Joint Stock Company [Société par actions simplifiée] with a share capital of €6,400,000 whose registered office is located at 3 avenue Hoche – 75008 Paris – France, registered in the Paris Trade and Companies Register under the number 398 142 695.
The term “Vendor(s)” refers to the Company or Companies of the HCP Group with which you make a purchase on the Website.

Depending on the context, the terms “we” and “our,” the “Vendor” and the “Vendors” that we use herein refer to the Companies of the HCP Group, either independently or collectively. You will find our contact details in the “How to contact us” section hereinafter.

3. What personal data do we collect, and how is it collected ?

Personal data is information pertaining to an identified or identifiable individual. They include, for example, the name, address, and gender of a person.Your personal data may be directly collected from you (for example, when you purchase a product on the Website) or indirectly (for example, from your electronic devices that interact with the Website).

3.1 Data that you provide us with directly

You may provide us with data :

• when you create an online account on the Website,
• when you subscribe to our newsletter,
• when you use the Website,
• when you purchase products on the Website,
• when you participate in one of our events,
• when you use our contact form.

Depending on what you provide us with, said information may include :

• your identity (including your first name, surname, sex),
• legal information regarding your company (including the corporate name, place of business ID [Siret], the legal form and the intracommunity VAT number),
• your contact details (including your postal address, email, and telephone numbers),
• your personal status (including your title),
• your purchases (including the history of your purchases, the details of the order),
• your preferences,
• certain payment data (including invoicing data, the type or the method of payment, the credit or debit card number), – other information that you may provide when filling out forms or when contacting us (including your comments or other communications with us).

We will inform you when your information is necessary to process your request, to respond to your requests or to provide you with our products and services. If you do not provide this information, this may delay the processing of your request, the response to your questions and the provision of products or services or make these impossible.
We endeavour to ensure that the personal data we hold is accurate at all times. We therefore encourage you to update your data in the event of any changes. We may also ask you to update your data from time to time.
We recommend that you provide only the data requested or necessary for your request, with the exception of sensitive data regarding race, ethnic origin, political opinions, religious or philosophical beliefs, and data regarding health, sex life and sexual orientation.

3.2 Data collected indirectly

We may collect data when you use our Website, notably your IP address or other browsing data (including the browser, the operating system, and the device model), via cookies or similar technologies placed on your device. Certain cookies are necessary for the proper functioning of the Website and others are used for analysis purposes that help us to provide you with more personalised services and a better digital experience. For more information on the cookies and to know how to modify your preferences, please read our Cookie Policy.

3.3 Minimum age

We remind you that we do not, directly, or indirectly, collect personal data from persons younger than 18 years, without prejudice to any local law setting a different minimum age. We therefore request that you do not provide us with personal data of persons that do not meet this criteria.
Moreover, we do not, directly, or indirectly provide our services or products to persons under 18 years of age.

4. Why we collect your personal data and how we use it

We collect and use your personal data based on one or more of the following legal bases :

• we have obtained your prior consent (for example, when you subscribe to our newsletter). Please note that with this particular legal basis, you have the right to withdraw your consent at any time (see hereinafter “What are your rights regarding your personal data?”),
• the processing is necessary as part of a contract between you and the Vendor (for example, when you make a purchase),
• we have a legitimate interest in carrying out the processing and this legitimate interest is not outweighed by your interests, fundamental rights or freedoms (for example, the prevention of payment fraud),
• we must process your personal data in order to comply with the laws and regulations in force.

4.1 CCP may use your personal data for :

4.1.1 The management of the Website

• To create and manage your client account on the Website,
• To manage the events for which you have registered and/or in which you have participated, – To detect, prevent and fight against fraudulent or illegal activity, including to protect your transactions from payment fraud, act against the counterfeiting and the resale of our products in violation of our general conditions and/or our distribution network.
• To comply with our legal obligations, which include providing information to regulatory bodies when the law so requires, notably to comply with our legal obligations regarding the prevention and fight against fraud, money laundering and the financing of terrorism,
• To monitor and improve our Website,
• To produce statistical analyses, notably to adapt our offer of products and services.

4.1.2 The distribution of orders and the redirection towards the after sales department in question on behalf of Vendors

• To carry out checks to identify you and to verify your identity,
• To direct you to the Vendor concerned by your after-sale service requests and complaints,
• To respond to your questions, suggestions, and requests, notably your requests to exercise your rights,
• To improve our products and services.

4.1.3 The sending of marketing communications, with your prior consent (see the “Marketing Communications” section)

4.2 The Vendors, including CCP when it acts as a Vendor, also process your personal data

To :

• Provide you with the products and services that you have requested,
• To manage your reimbursement requests,
• To provide you with an after-sale service,
• To respond to your questions, suggestions, and requests, notably your requests to exercise your rights,
• To manage claims and disputes,
• To detect, prevent and fight against fraudulent or illegal activity, including to protect your transactions from payment fraud, act against the counterfeiting and the resale of our products in violation of our general conditions and/or our distribution network.
• To improve our products and services,
• To comply with our legal obligations, which include providing information to regulatory bodies when the law so requires, notably to comply with our legal obligations regarding the prevention and fight against fraud, money laundering and the financing of terrorism.

5. Marketing Communications (newsletter, invitations, etc.)

With your express prior consent (generally obtained by ticking a particular box on a form), you may receive information regarding the offers, services, products, or events sent by the Companies of the HCP Group.
We rely on your consent to process the personal data that you provide us with for this purpose. Consequently, if you no longer wish to receive such information, you can withdraw your consent at any time (see hereinafter “What are your rights regarding your personal data?”).
We may request that you confirm or update your marketing preferences if you ask us to provide other products and/or services in the future, or if there are changes in the law, the regulations, or the structure of our company.

6. How long do we retain your personal data ?

Your personal data is processed throughout the period required for the purposes for which it was collected, to comply with legal and regulatory obligations, and for the duration of any period necessary for the establishment, exercise, or defence of legal rights.In order to determine the most appropriate retention periods for your personal data, we have specifically considered the quantity, the nature and the sensitivity of your personal data, the reasons for which we collected your personal data, the service that you deserve and expect from us, as well as the applicable legal requirements.

For example :

• Regarding our prospects (potential clients): your data is retained for three (3) years as from your last action, then deleted or archived in compliance with legal retention obligations,
• Regarding our clients: your data is retained throughout the duration of our commercial relationship and for up to five (5) years, then deleted or archived in compliance with legal retention obligations
• Regarding the cookies used on the digital Platforms: they are stored for up to thirteen (13) months from the moment that they are installed on your device.

7. How do we disclose and transfer your personal data ?

We may only disclose your personal data to the parties referred to hereinafter and for the following reasons :

• We disclose your personal data to CCP employees as part of the management of the Website, as well as the Companies of the HCP Group acting as Vendors that require access to your personal data, that are authorised to process it for the abovementioned purposes, and who undertake to respect the confidentiality thereof.
• CCP is required to disclose your personal data to departments of companies in the Hermès Group in charge of customer relations, retail, e-commerce, communications, legal affairs, finance, internal audit, IT management and security, for the purposes set forth in this Privacy policy.
  As part of the fight against payment fraud, your personal data is communicated to CCP to process your order and to fight against any attempts of online payment fraud. As part of our legitimate interests in the fight against payment fraud, CCP, as a data controller, may transmit your financial data to an external service provider with a fraud detection tool in order to authenticate a payment. Said service provider is bound by a confidentiality obligation.
• We may also be required to communicate personal data to third parties acting on the behalf of the Companies of the HCP Group and authorised by the Companies of the HCP Group. All this processing is based on our prior instructions set forth in a binding contract that complies with the requirements of the applicable law. Said disclosures are carried out for various reasons, notably :
  • IT development and assistance,
  • The hosting and performance of marketing studies, economic studies, and marketing campaigns,
  • The verification of your information, the authentication of your payments and the processing of orders and payments by third parties that provide solvency reports, payment services or the performance of orders,
  • Delivery services, etc.

These service providers undertake to respect the confidentiality of your personal data and are not authorised to use it for any other purpose. We also impose the application of appropriate security measures to protect your personal data.
Some of these service providers are located outside of your country, and more precisely, outside of the EU. We have taken measures to ensure that all personal data is adequately protected and that all transfers of personal data, including outside of the EU, are carried out legally. When we transfer personal data outside of the EU to a country that is not indicated by the European Commission as providing a sufficient level of personal data protection, the transfers shall take place within the framework of an agreement that covers the obligations imposed by the EU for the transfer of personal data outside the EU, notably the model contractual clauses approved by the European Commission or within the framework of other appropriate guarantees.

To obtain a description of the appropriate protection measures, you can send us your request using the data in the “How to contact us” section hereinafter:

• We may be bound by the mandatory provisions of an applicable law or as part of legal proceedings or another legal request, to disclose your personal data to the authorities or to third parties.
• We may also disclose or process your personal data in accordance with the applicable law to defend our legitimate interests (for example, as part of civil or criminal proceedings). We may, for example, disclose said personal data if necessary to identify, contact or initiate legal proceedings against an individual or a legal entity that does not comply with our General Conditions of Sale and of Use, or that disturbs other users of our digital Platforms, or causes them harm.
• In the event of the acquisition of one of the Companies of the HCP Group by a third-party, or of all or part of their assets, your personal data may be included in the transferred assets.

8. How we protect your personal data

All your personal data is strictly confidential and shall only be accessible, when necessary, solely by personnel of the Companies of the HCP Group and the other duly authorised entities of the Hermès Group, as well as the independent service providers acting in our name as part of the appropriate technical and organisational security measures.
Security measures have been implemented to protect your personal data against any unauthorised access or use. We follow appropriate security procedures in the retention and the disclosure of your personal data in order to prevent any unauthorised access by third parties and to avoid the accidental loss of your data. We limit the access to your data to persons that genuinely require access to it for professional reasons. The persons that access your data shall be subject to a duty of confidentiality.

Procedures have also been implemented to process any alleged breach of data security. We shall inform you, as well as any competent supervisory authority, in the event of any alleged breach of data security where imposed by law.
We also require the persons to whom we transfer your data to comply with the foregoing. Unfortunately, the transmission of information via the Internet is not fully secure. We therefore cannot guarantee the security of your personal data that you have transferred to us via the Internet. Such a transmission is carried out at your own risk, and you acknowledge and accept that we decline any liability in the event of the unauthorised use, distribution, damage or destruction of your data, except to the extent that the law requires us to assume such a liability. Once we have received your personal data, we will apply the abovementioned security measures.

9. What are your personal data rights ?

In accordance with the law applicable to data protection, you can request to access, rectify, and delete your personal data, as well as the portability thereof, or to limit or object to the processing thereof.

A summary of these rights is listed hereinafter :

• Your right of access: the right to receive a copy of your personal data.
• Your right of rectification: the right to ask us to rectify any error in your data or to complete it. Your right to be forgotten: the right to ask us to delete your personal data, in certain situations.
• Your right to the limitation of processing: the right to ask us to limit the processing of your personal data in certain circumstances, for example, if you wish to dispute the accuracy of the data.
• Your right to the portability of data: the right to receive the personal data you have provided us with, in a structured format, which is commonly used and legible by a machine and/or to transmit this data to a third party, in certain situations.
• Your right to object to processing: the right to object: at any time during the processing of your personal data for direct marketing purposes; in certain other situations, when processing personal data, for example, the processing is carried out on the basis of our legitimate interests.

When the processing of your personal data is based on your consent, you can decide to withdraw it at any time. If your consent is withdrawn, this shall not affect the processing of your data based on other legal bases, such as the performance of your orders and the retention of your order data in accordance with the applicable law.

If you no longer wish to receive our advertising or promotional information, you are reminded that you can withdraw your consent to direct marketing at any time, directly using the unsubscribe link included in every advertising email that we send. If you do this, we shall rapidly update our databases and take all reasonable measures to respond to your request as quickly as possible, however we may continue to contact you to the extent necessary in connection with any product or service that you have requested.

You also have the right to file a complaint with your local data authority in the event of an alleged breach of the data protection rules applicable to you.
To exercise one of these rights, please contact us using the contact details hereinafter (see “How to contact us”).
Please note that if you exercise one of the rights mentioned hereinabove, you will be asked to inform us which right you wish to exercise and to provide us with certain information (copy of your ID card, passport or other form of legally recognised ID) for identification purposes to process your request and protect you against fraudulent requests from third parties.

10. How to contact us

Whichever the Vendor in question, for any question pertaining to your account, to withdraw your consent, to ask any general questions or to file a complaint, please contact the HCP customer service department :

• By email: paris@groupehcp.com
• By telephone: (+33) 01 58 56 36 00
• By post: Compagnie des Cuirs Précieux – 3 avenue Hoche 75008 Paris FRANCE

For questions specifically regarding advertising emails, you are reminded that you can unsubscribe directly via the “unsubscribe” link included in all the advertising emails that we send to you.
If you have any questions or concerns regarding our Privacy policy or the processing of data, you can contact the Data Protection Officer of the HCP Group at the following address: privacy@hermes.com.

11. Modifications of the Privacy policy

This privacy policy reflects our current practices and may be modified and updated from time to time. When we publish changes to this Privacy policy, we will modify the “Date of entry into force” at the top of this Privacy policy to indicate when such changes entered into force.
If we substantially modify this Privacy policy, we will inform you thereof via a modification notice at the beginning of this privacy policy and on the home page of the Website.