Personvernerklæring
1 PREAMBLE
1.1 This Privacy Policy forms an integral part of the General Terms and Conditions, so the definitions used in the latter are reused in this Privacy Policy.
1.2 The purpose of this Privacy Policy is to inform Customers about the way in which their Personal Data is collected from the Site, its versions on various Devices, as well as when you make purchases in-store or, more generally, whenever you interact with us, how such data is processed by the Data Controller, and finally the Specific Rights enjoyed by Customers in relation to such processing, as defined below.
1.3 This Privacy Policy is in line with the European e-PrivacyDirective (transposed into French law) and the General Data Protection Regulation (GDPR).
1.4 This Privacy Policy may be amended or updated at any time. We recommend that you consult it regularly, in particular each time you interact with the departments concerned, in order to keep up todate with Personal Data protection practices and theprocedures for exercising your rights.
2 DEFINITIONS
2.1 The following terms, whether used in the singular or plural in this Privacy Policy, shall have the following definitions:
Intermediate Archiving: refers to the storage of Personal Data which is no longer required for the initial Purpose of its Processing, but which is still of administrative interest to the Data Controller, particularly in the event of a legal obligation to store it or for the management of disputes. This Personal Data is moved to a separate database, logically or physically isolated, to which access is strictly limited to authorised persons and which is subject to enhanced security measures. This archive is an intermediate stage prior to the permanent deletion of the Personal Data concerned or its anonymisation;
GTC: refers to the General Terms and Conditions;
Privacy Policy: refers to this privacy policy and policy on the protection of Customers' Personal Data implemented by the Data Controller;
Customer: refers to the natural person browsing the Site or making a purchase, whose Personal Data is processed by the Data Controller in accordance with the Privacy Policy. Where certain Processing operations are based on consent, the Customer warrants, in the event that they are under the age of 15, that they have obtained the authorisation of the holder of parental authority to consent to the Processing of their Personal Data as defined in the Privacy Policy;
Account: refers to the Customer's personal account, accessible on the Site via personal login details, which are confidential to the Customer and may not be disclosed to a third party, and from which the Customer may place an order;
Recipient: refers to any natural or legal person, public authority, agency or any other body to whom Personal Data is disclosed, whether or not they are a third party. The Recipient may use the data for its own purposes or pursuant to a legal obligation. However, authorities that may receive Personal Data in the context of a specific investigation are not considered recipients within the meaning of the GDPR.
Data or Personal Data: refers to the Customer's personal data, within the meaning of the Data Protection Regulations, collected and processed by the Data Controller in connection with the use of the Site;
Specific Rights: refers to the rights granted by the Personal Data Regulations to Customers regarding the processing of their Personal Data and set out in Article 12 of the Privacy Policy;
Purpose: refers to the main objective of the use of Personal Data;
Products: refers to the products offered for sale in-store or on the Site by LABORATOIRES SVR.
Personal Data Regulations: refers to Law No. 78-17 of 6 January 1978 on information technology, files and civil liberties, in accordance with the EU Regulation of 27 April 2016 published in the Official Journal of the European Union on 4 May 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as the "GDPR" for General Data Protection Regulation);
Data Controller: refers to the company which determines the Purposes and the essential means of the Processing of Personal Data (see paragraph 3 - Data Controller). The Data Controller ensures that the processing operations it carries out comply with the applicable regulations on the protection of Personal Data and ensures that data subjects are able to exercise their Specific Rights;
Site: refers to the Site and its local versions on which this Privacy Policy is hosted;
Processor: means any natural or legal person who processes Personal Data on behalf of the Data Controller and in accordance with its instructions. The Processor undertakes to process Personal Data solely for the Purposes determined by the Data Controller, to implement appropriate technical and organisational security measures, and to provide sufficient guarantees in terms of compliance with the GDPR.
Device(s): refers to the hardware equipment (computer, tablet, smartphone, telephone, etc.) used by the Customer to consult or view the Site.
Processing: refers to any operation or set of operations, whether or not carried out using automated processes, applied to Personal Data. This may include, in particular, the collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission or dissemination, alignment, restriction, erasure or destruction of Personal Data.
3. THE DATA CONTROLLER
3.1 LABORATOIRES SVR, a simplified joint stock company with capital of 17,501,502 euros, whose registered office is at 2 Rue de la Mare à Blot, ZAC de la Tremblaie, 91220 Le Plessis-Pâté, France, registered with the Evry Trade and Companies Register under number 617 080 098, is responsible for processing the Personal Data collected on this Site, unless otherwise stated.
4. DATA COLLECTED
4.1 In particular, when creating an Account, managing the Site or browsing, the Data Controller collects and processes the following Personal Data:
· Name,
· First name,
· Title,
· Date of birth,
· E-mail address,
· Telephone number,
· Username,
· Password,
· Delivery address,
· Billing address,
· Company name, if applicable,
· Information relating to an order (including purchase history, payment details via an online payment provider),
· Amount, date and time of transactions,
· Invoice,
· Customer login details when browsing the Site (including date, time, IP address, page viewed),
· Reason(s) for exclusion, where applicable (including all evidence demonstrating actions taken within the last month that justify the exclusion),
· Content saved in the Customer's Account (including correspondence with Customer Services, preferences, membership of the loyalty programme, health data),
· Any other Personal Data provided during communications or received from external suppliers.
4.2 This Personal Data is provided directly by the Customer or collected automatically whilst they are browsing the Site, in accordance with the applicable legal bases, and in particular where its collection is based on the consent of the data subject.
4.3 All Personal Data identified as such in the Account creation form is essential in order to benefit from the services of the Data Controller.
5. LEGAL BASIS FOR PROCESSING
5.1 In accordance with the Personal Data Regulations, the Processing operations set out in this Privacy Policy are supported by a specific legal basis.
5.2 Consent
5.2.1 Where required, the Processing of Personal Data is based on the Customer's free, specific, informed and unambiguous consent.
5.2.2 Customers consent to the Processing of their Personal Data for one or more specific Purposes, in particular:
· Sending newsletters and commercial communications;
· Participation in certain marketing campaigns;
· Registration for the loyalty programme.
5.2.3 The Site obtains the Customer's express consent prior to carrying out any specific processing, in accordance with the information provided at the time consent is obtained.
5.2.4 The Customer may withdraw their consent at any time, without having to provide a reason, and such withdrawal does not affect the lawfulness of Processing carried out prior to its exercise, subject to the conditions set out in paragraph 12 – Exercise of Specific Customer Rights.
5.3 Performance of a Contract
5.3.1 Some Processing is necessary for the performance of a contract to which the Customer is a party or for the performance of pre-contractual measures taken at the Customer's request.
5.3.2 In order to use the Site and benefit from its services, the Customer has accepted at least the GTC. These documents formalise a contractual relationship between the Customer and the Data Controller, serving in particular as the legal basis for the collection and processing of the Customer's Personal Data by the Data Controller.
5.3.3 This Data is required for a number of processing operations relating to the performance of the contractual relationship between the Customer and the Data Controller, including:
· Creating and managing a Customer Account;
· Processing and tracking orders;
· Delivery management;
· Invoicing and payments;
· After-sales service and returns.
5.4 Legal obligation
5.4.1 Some Processing is necessary to comply with legal obligations to which the Data Controller is subject, in particular:
· Keeping invoices and accounting documents;
· The fight against tax fraud ;
· Managing requests to exercise Specific Rights;
· Statutory warranty obligations.
5.4.2 The processing of Personal Data may also be necessary to comply with a legal obligation to which the Data Controller is subject, such as the retention of Site access logs, in accordance with Decree no. 2011-219 of 25 February 2011 on the retention and communication of data for the identification of any person who has contributed to the creation of content posted online.
5.5 Legitimate interest
5.5.1 Some Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, unless the interests or the fundamental rights and freedoms of the Customer which require the protection of Personal Data prevail, in particular when the Customer is a child.
5.5.2 The Data Controller may have a legitimate interest justifying the processing of the Customer's Personal Data, in particular:
· Securing the Site;
· Improving the Site and the user experience;
· Managing customer reviews;
· Combating payment fraud.
5.5.3 The Data Controller shall ensure that the Processing in question is indeed necessary for the pursuit of its legitimate interest and shall assess the consequences of such processing on the Customer, in particular by taking into account the nature of the data processed and the manner in which it is processed.
5.5.4 Customers may, at any time, object to all or part of the processing described in this Privacy Policy, or exercise their Specific Rights, under the conditions set out in paragraph 12 – Exercise of Customers' Specific Rights.
6 PURPOSES OF PROCESSING
6.1 The Customer's Personal Data is necessary to enable them to access, use and improve the Site, and to enable the Data Controller, in particular, to:
- Manage all operations relating to its commercial relationship with the Customer, i.e. concerning the issuing of invoices, accounting, and the management of the ‘customer relationship' with a Customer, such as conducting satisfaction surveys, handling complaints, the use of the Site and, more generally, the services, etc.;
- Enable the Customer to access their Account and provide them with all the information contained therein, such as their orders, address book, products they have saved, and preferences;
- Place orders and track product deliveries;
- Manage after-sales service, support requests and commercial complaints;
- Personalise communications to Customers, in particular via informational emails, based on their observed preferences, their use of the services and/or the Site;
- Carry out commercial marketing activities;
· Enable Customers to access personalised offers on Products;
- Compile commercial statistics, analyses and marketing tools (including classification, scoring, etc.);
- Optimise the Customer's browsing experience on the Site by remembering their preferences and simplifying any subsequent purchases on the Site;
- Manage Customer reviews and comments on the Site;
- Improve the quality of the Site, services and user experience, in particular through the analysis of browsing data;
- Ensure compliance with its legal obligations, in particular those relating to accounting and taxation;
- Manage requests to exercise Specific Rights under the conditions set out in paragraph 12 - Exercise of Customers' Specific Rights;
- Participate in the fight against fraud and money laundering;
- Manage outstanding payments, prevent payment defaults and handle debt recovery procedures;
- Prevent disputes and manage any litigation with the Customer;
- Ensure the security of the Site, detect and prevent fraudulent activities;
- Process any other Personal Data that the Customer provides during their interactions with customer service or the company; and
- Manage, where necessary, specific situations of exclusion from the service and the justification for these measures.
7 STORAGE OF PERSONAL DATA
7.1 The Site is hosted by the company whose contact details can be found by clicking here[LP2] .
7.2 Every precaution has been taken to store Customers' Personal Data in a secure environment and prevent it from being distorted, damaged or accessed by unauthorised third parties. Information transmitted by the Customer will never be passed on to third parties for commercial purposes, nor will it be sold or exchanged.
8 RECIPIENTS OR CATEGORIES OF RECIPIENTS, IF ANY
8.1 Under no circumstances does the Data Controller sell or rent Personal Data to third parties, in particular for commercial prospecting purposes.
8.2 For the Purposes listed below, the Data Controller shares Personal Data with:
|
Parties |
Purpose of the planned transfer |
|
|
Shopify |
Hosting service provider |
Site hosting |
|
BlackSwan |
Site development and management service providers |
Administration of the Site back office and management of the database containing Customer Personal Data |
|
BlackSwan |
IT integrator and maintenance |
Remote maintenance of the Data Controller's information system, including the Site |
|
Klaviyo |
Email routing service provider |
Sending of newsletters |
|
Klaviyo |
Call centre manager |
Monitoring of different calls and telephone flows |
|
ClinReal |
Support service for managing customer vigilance and complaints |
Customer complaint management and material safety |
|
__ |
Audit and regulatory compliance service provider |
Compliance of the information system with regulations on medical and cosmetic products |
|
__ |
Electronic document management service provider |
Electronic invoice management |
|
Colibri |
Publisher of IT tools for economic analysis |
Sales forecasts |
|
__ |
Social networks and advertising services, including management of social networks |
Management of communication and targeted advertising on the Facebook Site and Instagram mobile application |
|
Optimize matter |
Referencing service and statistical tools |
Site referencing and analysis of Site data |
|
Zee Agency |
Communication agency |
Communication consultancy |
|
Axeptio |
Cookie management service provider |
Collection of customer consent for the use of cookies and subsequent recognition of the customer and their consent |
|
Stripe |
Payment service provider |
Payments on the Site |
|
BigBlue Sage Shopify |
Publisher of warehouse logistics management software |
Connection of the IT system with the warehouses |
|
BigBlue |
Parcel delivery service provider |
Dispatch of products ordered by Customers |
9 TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
9.1 The Data Controller endeavours to process the Customer's Personal Data within the European Economic Area (EEA).
9.2 However, certain Recipients likely to be involved in Processing may be located outside the EEA or process Personal Data from a third country.
9.2.1 Any transfer of Personal Data to a country outside the EEA is governed by the provisions of Articles 44 et seq. of the GDPR.
9.2.2 These transfers can only take place:
· To countries subject to an adequacy decision by the European Commission; or
· Where appropriate safeguards to ensure full lawfulness have been put in place (in particular the Data Privacy Framework in the United States) and the Customer has enforceable Specific Rights and effective remedies; or
· In the cases exhaustively set out in the GDPR (Article 49), in particular where the transfer is necessary for the performance of a contract concluded with the Customer or where the Customer has given their explicit consent to the transfer.
9.2.3 The Data Controller shall ensure in all cases that appropriate technical, organisational and legal protection measures are implemented to ensure a level of protection substantially equivalent to that guaranteed in the EEA.
9.2.4 The Customer may obtain further information on transfers outside the EEA or on the applicable guarantees by contacting the Data Controller in accordance with the procedures set out in paragraph 12 - Exercise of Customers' Specific Rights.
10 RETENTION PERIODS
10.1 The Data Controller only keeps Personal Data for as long as is necessary to achieve the Purposes for which it was collected.
10.2 Personal Data may be kept for a longer period in intermediate storage when this is necessary for the management of a dispute or to meet a legal obligation.
10.3 For the Purposes listed below, the Data Controller retains Personal Data for:
|
Purpose of Processing |
Retention period in active database |
Retention period in interim archive |
|
Customer Account Management |
3 years from the last contact with the Data Controller |
5 years for proof in the event of a commercial dispute |
|
Order management (purchasing, delivery, after-sales service) |
Duration of the contractual relationship |
5 years for the civil limitation period |
|
Management of invoicing and accounting obligations |
10 years from the date the order is placed |
|
|
Bank card data stored on the Site (excluding security codes) |
Expiry date + 1 day (subject to the retention periods indicated below) |
|
|
Bank card data whether stored on the Site or not (excluding security codes), for the purpose of managing any complaints. |
- For immediate debit cards: 13 months from the date of payment; - For deferred debit cards: 15 months from the date of payment. |
|
|
Management of commercial prospecting |
3 years from the last contact with the Data Controller |
|
|
Cookies and trackers |
13 months from receipt of consent |
|
|
Identity document provided when exercising Specific Rights |
1 year from the date of receipt by the Data Controller |
|
10.4 At the end of these periods, Personal Data is deleted or made anonymous, unless otherwise required by law.
11 SECURITY
11.1 The Data Controller implements appropriate technical and organisational measures, proportionate to the nature of the Personal Data processed and the risks involved in processing it, in order to ensure its security and confidentiality. These measures are designed in particular to prevent any alteration, loss, destruction or unauthorised access to Personal Data.
11.1.1 To this end, the Data Controller may implement, as required, in particular:
· Strict control of access, limited to staff authorised by virtue of their duties;
· Specific contractual measures, in particular where a Recipient processes Personal Data on its behalf;
· Data Protection Impact Assessments (DPIAs) where required;
· Regular reviews of internal data protection practices and policies;
· Physical and logistical security measures, including strong authentication, the use of firewalls and antivirus software, pseudonymisation, the encryption of Personal Data, and any appropriate measures aimed at ensuring the integrity, availability and confidentiality of Personal Data.
11.2 In accordance with the GTC, the Site uses the technology of the various payment companies offered on the Site to secure Customers' bank transactions.
11.2.1 Consequently, when making a payment on the Site, the Customer's bank details are transmitted in encrypted form to the relevant payment provider.
11.2.2 To exercise their rights, such as those identified in paragraph 12 – Specific Rights, relating to their bank card details, Customers are invited to contact the payment company concerned directly.
12 SPECIFIC RIGHTS
12.1 In accordance with the Personal Data Regulations, the Customer may, at any time, exercise the following Specific Rights:
- information,
- access,
- rectification,
- erasure,
- restriction of processing,
- opposition,
- withdrawal of consent,
- portability,
- definition of post-mortem directives,
- lodging a complaint with a supervisory authority.
12.2 Information rights
12.2.1 The Data Controller shall provide the Customer with clear, transparent, comprehensible and easily accessible information concerning the methods of Processing their Personal Data, in accordance with articles 12 to 14 of the GDPR.
12.2.2 This information includes in particular: the identity and contact details of the Data Controller; the Purposes and legal basis of the Processing; the categories of Personal Data collected; the Recipients of the Personal Data; any transfers to countries outside the EEA; the length of time the Personal Data is kept; and the existence of Specific Rights available to Customers (access, rectification, deletion, limitation, portability, opposition, withdrawal of consent, etc.).
12.2.3 Customers are informed of these elements in this Privacy Policy at the time their Personal Data is collected or, where the Data is not collected directly from them, within a reasonable period of time after it is obtained.
12.3 Access rights
12.3.1 Customers may obtain confirmation from the Data Controller as to whether or not Personal Data concerning them are being processed and, where they are, access to said Personal Data, as well as the following information:
a) The purposes of the processing;
b) categories of Personal Data;
c) the recipients or categories of recipients to whom the Personal Data have been or will be disclosed;
d) where possible, the period for which Personal Data is to be kept or, where this is not possible, the criteria used to determine this period;
e) the existence of the right to request from the Controller the rectification or erasure of Personal Data, or a restriction on the processing of Personal Data, or the right to object to such processing;
f) the right to lodge a complaint with the personal data supervisory authority (in France, the CNIL);
g) where Personal Data is not collected from the Customer, any available information as to its source;
h) the existence of automated decision-making, including profiling, and, at least in such cases, useful information concerning the underlying logic, as well as the significance and expected consequences of such processing for the Customer;
12.3.2 When Personal Data is transferred to a third country or to an international organisation, the Customer has the right to be informed of the appropriate guarantees governing this transfer.
12.3.3 The Data Controller provides a copy of the Personal Data being processed.
12.3.4 The Data Controller may charge a reasonable fee based on administrative costs for any additional copies requested by the Customer or in the event of a request for transmission of Personal Data on paper and/or physical media.
12.3.5 Where the Customer submits their request electronically, the information shall be provided in a commonly used electronic format, unless the Customer requests otherwise.
12.3.6 The Customer's right to obtain a copy of their Personal Data must not infringe upon the rights and freedoms of others.
12.4 Rights of rectification
12.4.1 The Customer may request that the Data Controller rectify any Personal Data concerning them that is inaccurate.
12.4.2 They also have the right to have incomplete Personal Data completed, including by providing a supplementary statement.
12.4.3 The data controller undertakes to carry out this rectification as soon as possible and to inform, where applicable, any Recipient to whom the Personal Data has been communicated, except where this communication proves impossible or requires disproportionate efforts.
12.5 Right to erasure
12.5.1 The Customer may request that the Data Controller erase Personal Data concerning them as soon as possible where any of the following grounds apply:
a) The Personal Data is no longer necessary for the Purposes for which it was collected or otherwise processed by the Data Controller;
b) The Customer has withdrawn their consent to the Processing of their Personal Data and there is no other legal basis for the processing;
c) The Customer exercises their right to object under the conditions set out below and there is no overriding legitimate ground for the Processing;
d) The Personal Data has been processed unlawfully;
e) The Personal Data must be deleted to comply with a legal obligation;
f) The Personal Data has been collected from a child.
12.5.2 However, the right to erasure cannot be exercised when Processing is necessary:
· for the exercise of the right to freedom of expression and information;
· for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority;
· for reasons of public interest in the field of health;
· for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, where erasure is likely to render impossible or seriously impair the achievement of the purposes of the processing;
· for the establishment, exercise or defence of legal claims.
12.6 Rights to restriction
12.6.1 The Customer may request that the Data Controller restrict the processing of their Personal Data where any of the following grounds apply:
a) The Data Controller is verifying the accuracy of the Personal Data following a challenge by the Customer to the accuracy of the Personal Data,
b) The processing is unlawful and the Customer objects to the erasure of the Personal Data and instead requests the restriction of its use;
c) The Data Controller no longer needs the Personal Data for the purposes of the original processing but the Customer still requires it for the establishment, exercise or defence of legal claims;
d) The Customer has objected to Processing based on legitimate interest and the Data Controller is verifying whether the legitimate grounds pursued override those of the Customer.
12.6.2 Where Processing is limited, Personal Data may not, with the exception of its retention:
· be processed without the Customer's consent; or
· be processed for the establishment, exercise or defence of legal claims; or
· be processed for the protection of the rights of another natural or legal person; or
· be processed for important reasons of public interest of the European Union or a Member State.
12.6.3 The Data Controller shall inform the Customer before the restriction on Processing is lifted.
12.7 Opposition rights
12.7.1 Customers may object at any time, for reasons relating to their particular situation, to the Processing of their Personal Data based on the legitimate interests of the Data Controller. The latter will then no longer process the Personal Data, unless it can demonstrate that there are compelling and legitimate grounds for the Processing which override the interests and rights and freedoms of the Customer, or may retain them for the establishment, exercise or defence of legal claims.
12.7.2 The Customer also has an absolute right to object to the processing of their Personal Data for marketing purposes, including profiling where it is linked to such marketing. In this case, the Personal Data will no longer be processed for these purposes.
12.8 Right to withdraw consent
12.8.1 Where the Processing of certain Personal Data is based on the Customer's consent, the Customer may withdraw this consent at any time, without having to justify the reason for doing so.
12.8.2 Withdrawal of consent has no retroactive effect and does not affect the lawfulness of Processing carried out prior to its implementation.
12.8.3 Once consent has been withdrawn, the Personal Data concerned will no longer be processed for the corresponding Purposes.
12.9 Data portability rights
12.9.1 Customers have the right to receive their Personal Data from the Data Controller in a structured, commonly used and machine-readable format when:
a) The Processing of Personal Data is based on consent or on the performance of a contract; and
b) The Processing is carried out using automated processes.
12.9.2 The Customer has the right to have the Personal Data transmitted directly by the Data Controller to another Data Controller designated by the Customer, where this is technically possible.
12.9.3 The right to the portability of the Customer's Personal Data must not infringe upon the rights and freedoms of others and does not apply to Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
12.10 Rights to define post-mortem directives
12.10.1 The Customer may provide the Data Controller with instructions regarding the retention, erasure and disclosure of their Personal Data following their death; such instructions may also be registered with a “certified digital trusted third party”. These instructions, or a form of "digital will", may designate a person responsible for their execution; failing that, the Customer's heirs shall be designated.
12.10.2 In the absence of any instructions, the Customer's heirs may contact the Data Controller in order to:
- access the processing of Personal Data for the "organisation and settlement of the deceased's estate";
- receive communication of "digital assets" or "data resembling family memories, which may be passed on to heirs";
- have the Customer's Account on the Site closed and object to the continued processing of their Personal Data.
12.10.3 In any event, Customers may inform the Data Controller at any time that they do not wish their Personal Data to be communicated to a third party in the event of their death.
12.10.4 The Data Controller implements the duly recorded post-mortem instructions, under the conditions and within the limits laid down by the applicable regulations.
12.10.5 Specific instructions may be modified or deleted at any time by the Customer.
12.11 Right to lodge a complaint with a supervisory authority
12.11.1 Customers have the right to lodge a complaint with a competent supervisory authority, and in particular with the Commission Nationale de l'Informatique et des Libertés (CNIL) in France, if they consider that the Processing of their Personal Data constitutes a breach of the regulations applicable to the protection of Personal Data.
12.11.2 The Customer may exercise this right without prejudice to any other administrative or legal remedy.
12.11.3 The contact details for the CNIL are as follows:
· Commission Nationale de l'Informatique et des Libertés (CNIL) (French Data Protection Authority)
3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07 - France
Telephone: +33 (0)1 53 73 22 22
Site: www.cnil.fr
12.11.4 The Customer may also refer the matter to the supervisory authority of the European Union Member State in which they have their habitual residence, their place of work or the place where the alleged infringement occurred.
12.12 The Customer also has Specific Rights relating to Cookies, as set out in the Cookies Policy: https://fr.svr.com/pages/politique-des-cookies. [LP3]
13 THE EXERCISE OF CUSTOMERS' SPECIFIC RIGHTS
13.1 These Specific Rights may be exercised at any time by contacting the Data Controller:
- By e-mail at the following address: dpo@ydes-avocats.com
-
By post at the following address:
LABORATOIRES SVR
Service en charge de la protection des données
ZAC de la Tremblaie, 2 rue de la Mare à Blot - 91220 Le Plessis-Pâté - France
13.2 In order to exercise their Specific Rights in accordance with the conditions set out above, the Data Controller may ask the Data Subject to prove their identity by providing their surname, first name and email address, and to accompany their request with a copy of a valid identity document, as well as any information or document that may help to verify their identity.
13.3 A response will be sent to the Customer within a maximum of one (1) month following the date of receipt of the request.
13.4 If necessary, this period may be extended by two (2) months by the Data Controller, who will notify the Customer accordingly, taking into account the complexity and/or number of requests.
14 COOKIES AND TRACKERS
In order to improve the browsing experience and offer services tailored to its Customers' areas of interest, LABORATOIRES SVR uses cookies and other tracking technologies.
How these tools work, the purposes for which they are used, their retention periods, and the options available to the user to accept, refuse or configure these cookies are detailed in the Site's Cookie Policy.
Users are invited to consult this Cookies Policy at any time by clicking on the following link: https://se.svr.com/pages/cookie-policy.
Use of the Site implies acceptance of the terms and conditions for the use of cookies as defined in the said Policy.
Version: March 2026
