Privacy Policy

Privacy Policy



Our privacy policy is designed to inform you about how we use your personal data. We also explain your rights and how to exercise them.



1. Who processes your data?


The data controller is UNAVELA

Registered office address: UNAVELA, 129 AV DU GAMOUNA, 31150 BRUGUIERES

Additional information: See the legal notice.



2. What data do we collect?


Postal address: when placing your order. This data will be transmitted to carriers in order to enable them to deliver your order.


Email address: when placing your order to inform you about the status of your order, when you submit a contact request so we can respond to it, and when subscribing to our commercial communications.


Identification data (first name, last name): when placing your order, in order to identify you, issue the invoice and send you the products. This data will be transmitted to carriers in order to enable them to deliver your order.


Payment information: when placing your order. This data is transmitted to our banking partners and payment service providers.


Transaction data: when placing your order in order to complete the transaction.


Cookies and other connection data: when browsing the website, in order to enable navigation on the Site and the management and traceability of services and products ordered by the user.



3. What processing activities are carried out?


3.1 Commercial management


  • Data concerned: First name, last name, postal address, telephone number, email address

  • Legal bases and purposes of processing:

  • Based on the performance of a contract: management of the contractual relationship, accounting management, after-sales service management, warranty management, complaint handling, management of requests relating to data protection rights.

  • Based on legitimate interest: statistical analysis, customer satisfaction surveys and customer studies.


3.2 Commercial prospecting


  • Data concerned: postal address, telephone number, email address


  • Legal bases and purposes of processing: 

    • Based on consent: commercial prospecting.

    • Based on legitimate interest: commercial prospecting for similar products and services.


When data are processed for marketing purposes, you may object at any time and without providing a reason to any commercial prospecting. For more information about opt-out lists:

https://www.cnil.fr/fr/les-listes-dopposition


Where processing is based on your consent, you have the right to withdraw it at any time.


Consumers are informed of their right to register on the telephone marketing opposition list:

https://www.bloctel.gouv.fr/


3.3 Website management


  • Data concerned: browsing data, data related to the management of technical services, cookies.

  • Legal bases and purposes of processing

    • Based on legitimate interest: functional cookies (website operation and security).

    • Based on consent: audience measurement cookies.


For more information about cookies: https://www.cnil.fr/fr/cookies-et-autres-traceurs


3.4 Social media account management


  • Data concerned: data visible on the relevant social media platforms.

  • Legal bases and purposes of processing: Based on legitimate interest: management of social media accounts, including technical administration of the accounts, interactions with users on social networks, and statistics.



4. How long do we retain data?


Personal data are stored in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which they are processed.


Data may be retained for longer periods in the following cases where retention is necessary:

  • For exercising the right to freedom of expression and information

  • For compliance with a legal obligation

  • For the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller

  • For reasons of public interest in the area of public health

  • For archiving purposes in the public interest

  • For scientific or historical research purposes or statistical purposes

  • Or for the establishment, exercise or defence of legal claims.


The criteria used to determine retention periods are as follows:

  • Legal or regulatory provisions

  • Guidelines and case law from supervisory authorities

  • Industry standards.



5. How are data transfers regulated?


5.1 Transfers to countries offering an adequate level of protection

Personal data may be transferred from the European Union to a country recognised as providing an adequate level of protection for personal data under adequacy decisions published by the European Commission, without any additional safeguards being required.


5.2 Transfers to third countries

In accordance with Articles 44 and following of the GDPR, any transfer of data outside the European Union:

  • Is based on an adequacy decision, or is governed by Binding Corporate Rules (BCR), standard contractual clauses, a code of conduct or a certification mechanism approved by the CNIL, or is governed by ad hoc contractual clauses previously authorised by the CNIL, or falls within one of the derogations provided for in Article 49 of the GDPR.



6. Who are the recipients of your data?


Our company: Data are processed internally by persons duly authorised to do so and within the limits of their respective responsibilities.


Authorised third parties: Data may be communicated to duly authorised French and or foreign authorities, particularly in the context of judicial or administrative proceedings (including arbitrators, mediators, relevant ministries, supervisory and regulatory authorities, and any public bodies authorised to receive such data).


Our service providers: Our service providers (processors) may be considered recipients of the data. Categories of recipients include:

  • Payment service providers and banks

  • Hosting service providers

  • IT service providers

  • Transport and delivery service providers.



7. What are your rights?


For more information about your rights regarding personal data, please visit: cnil.fr


7.1 Right of access  The right of access allows you to know whether personal data concerning you are being processed and to obtain a readable copy in an understandable format. It also allows you to verify the accuracy of the data.


7.2 Right to rectification (article 16 du RGPD). The right to rectification allows you to modify, correct or update data concerning you in order to limit the use or dissemination of inaccurate information.


7.3 Right to erasure (article 17 du RGPD). The right to erasure allows you to request the deletion of your personal data.


7.4 Right to restriction of processing (article 18 du RGPD). The right to restriction allows you to temporarily stop the use of data concerning you, for example while a dispute regarding the use of your data or a request to exercise your rights is being examined.


7.5 Right to data portability (article 20 du RGPD). The right to data portability allows you to receive part of your data in a machine-readable format, for your own use or to transmit it to another organisation.


7.6 Right to object (article 21 du RGPD). The right to object allows an individual to object to the processing of their data for a specific purpose.


7.7 Right not to be subject to automated decision-making (article 22 du RGPD). You have the right not to be subject to a decision based solely on automated processing. You may request human intervention, express your point of view and contest the decision.


7.8 Right to define directives regarding the fate of your personal data after your death.


7.9 Right to lodge a complaint with a supervisory authority (the CNIL in France).



8. How can you exercise your rights?


You may exercise your rights directly with the data controller:


  • By email: unavela.handmade@gmail.com

  • By post: UNAVELA, 129 AV DU GAMOUNA, 31150 BRUGUIERES


Where there are reasonable doubts regarding the identity of the person making the request, the data controller may request additional information necessary to confirm the identity of the data subject.


These rights may be exercised directly with the data controller, who shall provide the data subject with information on the actions taken following a request as soon as possible and in any event within one month of receiving the request. Where necessary, this period may be extended by two additional months, taking into account the complexity and number of requests.


For more information about your rights, please consult the CNIL website.


Update: This page may be modified at any time, particularly in order to reflect changes to our websites, regulations, guidance or any other reason deemed necessary. We recommend that you consult this page regularly to be informed of the latest updates.


Last update: 24 July 2023