1. DATA CONTROLLER

Data Controller : WINE DESTOCK, recorded under the number 879909323 RCS Reims, head office at 50 rue Robert 51450 Bétheny, France, represented by its Chairman (below « CASHISWINE »).

CASHISWINE, via its website www.cashiswine.fr (the « WEBSITE ») implements the collection and processing of certain personal data relating to its users (« USER »).

Personal data is any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more specific elements such as his/her identity.

In accordance with the General Regulation of the European Parliament and of the Council on Data Protection n° 2016/679 of April 27, 2016 (the « GDPR ») and the law n° 78-17 du January 6, 1978 known as « General Data Protection Regulation » in its current version, the Personal Data & Cookies Charter (« CHARTER ») is to inform USERS about the data collected by CASHISWINE concerning them, the processing carried out and its purpose, the retention periods, the recipients and the rights they have.

2. GENERAL PRESENTATION OF THE CHARTER

The CHARTER completes the contractual conditions governing the website www.cashiswine.fr, in particular the General Conditions of Use and the General Conditions of Sale.

Modification of the CHARTER: The CHARTER may be modified at any time. The version in force is the one available on the website www.cashiswine.fr

In the event of a significant change to the CHARTER, USERS will be informed within seven (7) reasonable days by email, banner or web push notification on the website.

CASHISWINE may ask USERS, at any time and by any means that can be recorded, to confirm that they have read and understood the CHARTER.

3. PERSONAL DATA COLLECTED

CASHISWINE collects data directly from USERS but also from third parties, advertising partners and social networks depending on the authorizations granted.

On the website www.cashiswine.fr, the compulsory nature of the data to be provided is indicated at the time of collection by an asterisk.

Failure to fill in the mandatory fields will prevent the USER from benefiting from all the services offered by CASHISWINE.

Below is the list of data collected and processed by CASHISWINE according to the use of the WEBSITE by the USER :

• Identity and account creation information : User name ; Email address ; Password ; Date of birth and confirmation of majority ; Sex ; Type of contract subscribed (buy-back / deposit-sale) ; Company name and identity of the legal representative for professional sellers ; Siret and VAT number for professional sellers.
• Device, account and activity information : IP address ; Session information ; Cookies and trackers ; Consent and opt-out, date and time of consent ; User profile ; Language ; Preferences ; Browser used on device ; Content and URLs during logins ; Date and time of logins ; Model and manufacturer of device ; Operating system used by device (iOS, Android).
• Information about interactions between CASHISWINE and other USERS : Name of USER ; Notice ; Rating ; Date and time of notice ; Response to notice ; Drinking habits.
• Information about items being purchased and/or deposited : Product description ; (photos and prices) ; Proof of product authenticity.
• Payment Information : Item price ; Customs and freight charges ; Withholding tax rate based on buyer’s location ; Payment method information selected ; Bank account number ; First six and last four digits of your credit card number ; Expiration date ; Security code number (CVV/CVC) ; Invoice.
• Redemption and Sales Information : History of repurchased, returned and refunded items ; Reason for refunds ; Revenue generated from resale of items to CASHISWINE.
• Information related to the transportation of the items : Delivery option ; Address of the shipping point and the delivery point of the package ; Tracking number of the package ; Confirmation of the delivery of the package ; Date and time of delivery of the package ; Location of the package ; Other delivery information required by the chosen transportation service provider ; In case of a dispute with the carrier : a sworn statement and a copy of your valid ID.
• Anti-fraud information : Information contained in a photo of the credit card : Full name, expiration date of the card and the last four digits of the card number, and other information visible on the front of the ID card ; Information contained in a photograph/screen shot of the bank statement listing the most recent charges : Date and description of most recent payments made by CASHISWINE ; Information contained in the proof of address : Cardholder’s first and last name, physical address, Date proof issued.
• Information related to the management of disputes : Requests and complaints sent to CASHISWINE’s customer service ; Date of receipt of requests and complaints ; Information contained in the answers given ; Complaint from a USER (content, reason, date and time).
• Information provided as part of the sponsorship : The name of the sponsored person and his/her email address ; The link with the sponsored person.
• Sensitive data : CASHISWINE does not collect sensitive data. Any personal data of a sensitive nature that may be collected and/or processed by us will be done so exclusively on the basis of the USER’s explicit consent and never without his or her knowledge. In all cases, CASHISWINE invites USERS to communicate only strictly necessary information.
• Specificities for spontaneous online applications : Full name ; Email address, Phone number ; Curriculum vitae ; Cover letter ; Authorization to work in France ; Work permit ; Salary expectations ; All other information brought to the attention of CASHISWINE by candidates.

The processing of personal data by CASHISWINE is necessary to carry out the pre-contractual measures to the General Conditions of Use and the General Conditions of Sale.

CASHISWINE processes personal data for :

• Create an account ;
• Manage and use an account from creation to deletion and all related events ;
• Inform about updates and modifications to the T&Cs ;
• Inform about services and features through emails and notifications ;
• Conclude contracts (purchase and sale of items) ;
• Benefit from all the features of the WEBSITE (redemption, shipping, customer service, etc.) ;

• Carry out transactions ;

• Inform on the nature of the transactions according to the different statuses ;
• Carry out and track shipments ;
• Manage returns and refunds ;
• Manage disputes and claims ;
• Perform additional checks to authenticate a product ;
• Manage shopping cart website ;
• Manage purchase vouchers ;
• Manage sponsorship ;
• Answer all questions.

CASHISWINE processes personal data on the basis of legitimate interests. Three cumulative conditions must be met :

• The interest pursued must be legitimate, i.e. lawful, clearly and precisely determined, real and present ;
• The data processing implemented must be necessary ;
• The processing must not adversely affect the rights and interests of the data subjects.

For the complete information of USERS, CASHISWINE details below the processing operations and the corresponding legitimate interests, ensuring that these processing operations do not infringe fundamental rights and freedoms.

CASHISWINE processes personal data without consent for :

• Seek for the best possible user experience ;
• Improve services and features ;
• Customize the USER experience ;
• Offer special deals ;
• Inform USERS about buyback and sale transactions ;
• Offer to participate in surveys (satisfaction, opinion, poll, etc.) ;
• Collect feedback from USERS to improve the WEBSITE ;
• Settle various disputes and fight against fraud and counterfeiting ;
• Guarantee the security of the WEBSITE and of the USERS ;
• Defend the rights and interests of CASHISWINE ;
• Conduce security checks for fraud ;
• Enable professional sellers to fulfill their legal and accounting obligations.

CASHISWINE processes personal data on the basis of consent for :

• Make statistics and marketing and performance analysis, in order to seek the best user experience ;
• Improve services and features ;
• Customize the USER experience ;
• Send notifications on products set up from the account (deactivation at any time from the account) ;
• Personalize ads via cookies (deactivation by modifying the cookie settings (see paragraph “Cookies” of the CHARTER) ;
• Analyze responses to surveys (satisfaction, polls, functionality tests, etc.) ;
• Respect the legal conditions and to cooperate with the tax or judicial authorities acting in particular within the framework of their missions of control and investigation ;
• Carry out a verification of identity of the USERS and, if necessary of the salesmen, when a product or articles of an amount higher than 750€ transit via our warehouses.
• Generate the sales summary and send it to USERS so that they can share certain information with the French Tax Authorities in accordance with Article 242 bis of the General Tax Code ;
• Process requests to exercise rights under the GDPR (see “USERS’ Rights” section below).

The shelf life of the personal data by CASHISWINE :

• For the strict duration necessary to achieve the purpose of the processing concerned ;
• For the duration of the business relationship and until the account is deleted ;
• During three (3) years for the accounts remained inactive (no connection on the WEBSITE, no opening of the sent emails etc.), the accounts considered as inactive can be removed after a notification by email remained without action on behalf of the USER during three (3) months ;
• During the entire duration of the commercial relationship for specific contracts and archived according to the applicable legal statute of limitations ;
• For ten (10) years within the framework of our legal obligations (for example : invoices are kept for 10 (ten) years) ;
• For one (1) year in the context of tax reporting obligations until they are sent to the tax authorities once a year, and then archived for the strict limitation periods applicable ;
• For as long as it takes to resolve disputes and manage claims ;
• For three (3) days for documents required for identity checks in the context of the fight against fraud ;
• For the duration of the anonymized surveys ;
• For the time necessary to carry out the commercial operations. For specific commercial operations, a specific personal data policy may apply and will be available on the web page dedicated to the operation. The data collected thanks to the cookies and tracers of the WEBSITE are kept in accordance with the section “Cookies” of the CHARTER ;
• For two (2) years for data related to applications and then deleted ;
• Without time limit for the collected data kept in a form that does not allow the identification of the USER (anonymization) for study and statistical purposes.

In some cases, CASHISWINE may retain certain personal data concerning USERS after the account has been deleted, by legal obligation, or if there is an overriding interest (problem concerning the account, presence of an unresolved claim or dispute, defense and exercise of rights, etc.). In these cases, the data necessary for the resolution of the case will be kept as long as the dispute lasts within the limits of the applicable rules on prescription.

In the course of its activities, CASHISWINE may transmit USERS’ personal data to service providers and to third parties. CASHISWINE ensures that only those persons who are authorized to do so by virtue of their duties or functions may have access to personal data :

• Transportation and logistics providers ;
• Anti-fraud providers ;
• Customer relationship management providers ;
• Communication service providers ;
• IT, technical and hosting providers ;
• External legal counsel ;
• Advertising platforms and business partners (with consent) ;
• Banking and payment services organizations ;
• To authorized third parties, particularly in the context of investigations into offences ;
• To professional sellers so that they can meet their legal, tax and accounting obligations ;
• To third parties, buyers or investors, in case of restructuring of CASHISWINE, including total or partial transfer of assets, merger, absorption, acquisition, demerger and more generally any capital operation ;
• To public bodies and the tax authorities as part of our legal obligations.

Some of these recipients are responsible for processing the personal data we provide to them. They process the data in accordance with our agreements and their personal data protection policy. This is notably the case for service providers who carry out banking transactions on the WEBSITE.

Personal data will not be sold to third parties under any circumstances.

4. THE COOKIES

A cookie is a small file stored by a server in the terminal (computer, telephone, etc.) of a USER and associated with a web domain, i.e. in most cases with all the pages of a single website.)

Generally speaking, the cookie contains certain directly or indirectly identifying information, such as the name of the server that deposited it, a session identifier, an expiry date, and even information on navigation within the website you are visiting, such as the pages visited, for example, a terminal identifier, an advertising identifier, etc.

Cookies have multiple uses: they can be used to memorize your advertising ID, the contents of your shopping cart, the language in which the web page is displayed, to track your navigation for statistical or advertising purposes, to personalize the content, etc. For the sake of simplicity, we use the term cookies to designate all types of tracers.

Who can place cookies on the terminal ?

• CASHISWINE
• CASHISWINE’s partners

Cookies may be deposited during navigation on the WEBSITE.

How do I set cookies ?

When the USER accesses the WEBSITE for the first time, a banner is displayed so that he/she is informed about the categories of cookies that are used and gives him/her the possibility to accept or refuse the related cookies :

• To the measurement of the audience ;
• To the personalization of the contents ;
• To personalized advertising ;
• To sharing on social networks.

Once the choice is made by the USER, a necessary cookie is deposited on the terminal to keep it in memory for 6 months. This avoids the need to ask the USER to set cookies each time he/she visits the WEBSITE.

The USER can change the settings later. To do so, he/she must clear the browser’s cache so that the banner appears again and thus access the cookie management platform.

Browser or terminal settings

The USER can also configure the browser or your terminal to manage cookies in general, regardless of the website or application concerned. The configuration of each browser is different. It is described in the browser’s help menu, which allows you to find out how to modify your wishes regarding cookies. The refusal or deletion of cookies may prevent the WEBSITE from functioning properly.

The CNIL informs you here : https://www.cnil.fr/fr/les-conseils-de-la-cnil-pour-maitriser-votre-navigateur

What are the cookies and the processing done on CASHISWINE ?

The cookies are necessary (not configurable). These cookies are installed by default: the USER cannot set them via the WEBSITE. These cookies are either necessary for the operation of the WEBSITE or installed as a response to actions performed by the USER and which constitute a request for services.

These cookies are based on CASHISWINE’s legitimate interest in allowing the best possible functioning of the WEBSITE and ensuring its security.

The retention period is generally the time of the session and does not exceed 13 months.

Consequence in case of blocking: the USER may no longer be able to access the WEBSITE and/or the WEBSITE services.

Details of the purposes of the cookies :

• Keep the choice expressed on the tracer deposit ;
• Allow the USER to stay logged in while navigating from one page to another ;
• Keep track of the contents of the shopping cart ;
• Invoice the purchased product(s) ;
• Customize the user interface (for example, to choose the language or the presentation of the services); save the format and dimensions of the screen and your windows in order to display the WEBSITE correctly ;
• Authenticate the USER to a service, including those aimed at ensuring the security of the authentication mechanism, for example by limiting robotic or unexpected access attempts ;
• Fight against spam and phishing attempts, allowing us to identify computers used to create a large number of fake accounts ;
• Detect computers infected with malware and prevent them from causing damage ;
• Implement security measures, such as requiring you to log in to a content or service again after a certain period of time ;
• Detect navigation problems and consequently to improve the ergonomics of our services;
• Secure transactions and fight against fraud (prevention of payment fraud, identity theft, etc.) ;
• Balance the load of equipment contributing to a communication service ;
• Route traffic between servers and understand the loading speed of our pages ;
• Facilitate communication via the WEBSITE ;
• To measure the audience, the frequentation and to carry out statistics of the WEBSITE and the services, in particular to improve the functionalities of the WEBSITE ;

Audience cookies (subject to your prior consent) make it possible to collect information on the use of the WEBSITE (number of visits, pages visited, time spent on the website, etc.) in order to carry out statistical analyses, on a global basis, of the number of users and the way in which USERS navigate the WEBSITE.

Cookies do not directly store personal data, but are based on the unique identification of the browser and the terminal. They make it possible to deduce your user profile and to recommend products, services and content that best meet USERS’ preferences, and to offer certain promotional offers on the WEBSITE.

With USERS’ consent, CASHISWINE may send push notifications that use this information to personalize them (targeting or advertising cookies).

Personalized advertising cookies are set on the WEBSITE by our advertising partners to profile your interests and offer you relevant products. These cookies allow us to display products that best meet your preferences. Your profile is also enriched with navigation information.

Personalized advertising cookies also track the total number of users who clicked on each product and any subsequent actions taken by those users.

Personalized advertising cookies make it possible to adapt the advertising content of the WEBSITE as well as our offers, according to the navigation on the WEBSITE, the purchases made and/or according to the location data (longitude and latitude) transmitted by your terminal (with your prior consent).

Personalized advertising cookies make it possible to associate personal data with browsing information in order to send, for example, electronic prospecting or to display on your terminal, personalized advertisements that are specifically intended for USERS and likely to interest them personally.

Social network sharing cookies (subject to your consent) may include computer applications from third parties on the WEBSITE that allow the sharing of WEBSITE content with other people or that allow the USERS’ consultation data and their opinion regarding WEBSITE content to be made known to other people. CASHISWINE has no control over the process used by third parties to collect information about USERS’ browsing of the WEBSITE and associated personal data held by them. USERS are invited to consult the privacy policies of the social networks in order to learn about the purposes of use, including advertising, of the browsing information that they may collect through these application buttons. These protection policies must notably allow USERS to exercise their choices with these social networks, notably by setting up their user account for each of them.

How are USERS’ personal data protected ?

CASHISIWINE undertakes to implement and maintain appropriate technical and organizational measures for the processing and security of personal data, in accordance with Articles 32 to 34 of the GDPR, to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. CASHISWINE passes on these obligations to its service providers and subcontractors.

Transfers of personal data outside the European Union

Some of the data collected, mainly identification data (personal and professional identity), data relating to personal preferences, data necessary for payment, data relating to the follow-up of the commercial relationship, are transferred to recipients, service providers and/or entities that may be located within the European Union (“EU”), or in a country outside the EU.

Prior to any transfer outside the EU, CASHISWINE has ensured that :

• The destination countries ensure an adequate level of protection of personal data recognized by the European Commission ;
• The countries of destination ensure an appropriate level of guarantees and have been adopted by the European Commission or authorized by a supervisory authority).

5. USERS’ RIGHTS

In accordance with the GDPR, USERS have the following rights :

• A right of access and rectification allowing to modify, complete or update the personal data ;
• A right to delete data that are inaccurate, incomplete, ambiguous, outdated, or whose collection, use, communication or storage is prohibited ;
• A right to object to the processing of data for legitimate reasons ;
• A right to object, without reason, to the use of the data for prospecting purposes ;
• A right to set out instructions about what to do with your personal information after your death ;
• A right to data portability, in a structured, commonly used and readable format (however, this right can only be exercised with regard to the data provided by the USER and undergoing automated processing.
• A right to limitation of processing, under the terms and conditions referred to in Article 18 of European Regulation No. 2016/679 of April 27, 2016 ;
• The right to lodge a complaint with the competent supervisory authority, namely the Commission Nationale de l’Informatique et des Libertés (“CNIL”).

To exercise his rights (excluding the right to complain to the CNIL), the USER is invited to contact CASHISWINE at the following address : sav@cashiswine.fr

CASHISWINE will respond to your requests by return email as soon as possible and within a maximum of one (1) month (subject to the longer periods provided for by the GDPR).

To facilitate the process, CASHISWINE suggests that USERS write from the email address used to create the account on the WEBSITE. Otherwise, CASHISWINE will not be able to verify the identity of USERS (account holder). In this case, CASHISWINE will ask the USER to prove his identity by completing a form and providing a copy of an official identity document.

Important information on identity checks: In case of doubt or to fight fraud, CASHISWINE will ask for proof of identity, domicile, purchase/sale or credit card. Only the departments that need to know these documents will process the data. CASHISWINE will keep these documents only for the time necessary for verification and will then delete them immediately.

6. CONTACT

If you have any further questions about how CASHISWINE collects and processes personal data about USERS, please send an email to the following address : sav@cashiswine.fr