Source Edition ("SE") operates a platform accessible via the website https://source-edition.com/ ("the Site"), which allows for the online ordering of furniture, lighting, accessories, and any other home furnishing and decoration items related to design and art. As part of its activities, SE processes personal data and is committed to handling it securely and responsibly, in accordance with applicable regulations, including the French Data Protection Act of January 6, 1978, as amended, and the European Regulation of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR).

 This privacy policy outlines the principles according to which SE processes your data and the measures implemented to ensure its security and confidentiality. It provides you with the mandatory information regarding the processing of personal data carried out by SE. 

Reminder: Any data relating to an identified or identifiable natural person is considered personal data. A person is identifiable if they can be identified directly or indirectly, particularly by reference to an identifier, such as location data, an online identifier, etc. Data processing refers to any operation or set of operations performed or not performed using automated processes and applied to personal data or sets of data (collection, recording, transmission, storage, retention, retrieval, consultation, use, interconnection, segmentation, etc.). 

As the data controller, SE determines the purposes and means of processing your personal data. This data is collected directly from you, notably via the Site, by phone, at trade shows, or through exchanges with SE's customer service, or indirectly through public sources. In the latter case, this typically involves professional email addresses obtained via their website. This privacy policy will be communicated to you in the first email SE sends you. It is brought to your attention when you create your account and can be consulted at any time on the Site. SE reserves the right to modify this privacy policy at any time and will inform its customers through appropriate means. 

1. Source Edition's Commitments Regarding Personal Data 

In general, SE is committed to complying with applicable regulations and implements internal procedures to adopt the basic principles of data protection, including: Collecting only data necessary for specific, explicit, and legitimate purposes, Collecting only the data essential for the intended purposes, Processing this data lawfully, fairly, and transparently, Taking all reasonable measures to ensure the accuracy and updating of data, Retaining data for a limited and proportionate period relative to the purpose of processing, Implementing all technical and organizational measures to ensure data security, protecting it against unauthorized processing, loss, and destruction. 

2. What Personal Data is Processed by SE? 

2.1 In Connection with the Provision of Products or Services Offered by SE 

To benefit from the products or services offered by SE, you must create an account and provide SE with personal data about yourself. The categories of data that may be processed in this context include: Registration information: Username and email address (the password, if collected, is then irreversibly encrypted and not stored as such), Identification data: Name, first name, date of birth, language, postal address, email address, mobile and/or landline phone number, Billing data: Billing address, proof of address in case of suspected fraud, Order data: Transaction number, purchase details, purchase date, purchase amount, invoice payment data (payments, unpaid amounts, discounts), product returns, Data necessary for loyalty programs and prospecting actions: Purchase history, Identity document: In the context of exercising your rights over your data and in compliance with anti-money laundering regulations and KYC ("Know Your Customer") procedures, Communications between you and SE through available channels, such as postal correspondence, emails, and SMS. Regarding the banking information required for payment of products via the Site, it is collected and processed directly by payment service providers (Adyen, Alma, Fintecture, or PayPal) through the online payment form available on the Site. SE does not have access to your banking information at any time. The personal data collected, which is essential to respond to your requests, is identified by an asterisk on the data collection form or specified orally during collection in-store or by phone. If you do not complete these mandatory sections, SE will not be able to respond to your requests. 

2.2 In Connection with the Use of the Site 

When you access, register, and/or use the web services offered by SE, SE collects and processes personal data about you, provided you have accepted the storage of corresponding cookies on your device. The information that may be collected includes: the IP address assigned during your connection, the date and time of access to the Site, pages visited, type of browser used, operating system installed on the device, search engine, and keywords used to find the Site. For more information on cookies, see Article 7.

 2.3 Recording of Telephone Conversations 

Telephone conversations between you and SE staff may be recorded for training, quality control, and/or evidence of commercial transactions. The personal data collected and/or communicated by you is exclusively intended for SE. You may exercise your rights regarding these recordings in accordance with the terms outlined in Article 9. 

2.4 Collection of Anonymous Information 

SE may automatically collect anonymized information, such as the type of internet browser you use. SE may also collect anonymized statistical information that you have submitted to the Site (e.g., the city where you live), your behavior when using the Services (e.g., clicks, time spent on a page, domain names, and paths through which you use or access the Services). This data does not directly or indirectly identify you and is used solely to help SE provide an effective service on the Site. 

3. Legality and Purposes of Data Processing 

SE collects the personal data listed in Article 2 in order to respond to your requests and provide you with the best possible service. The list below gives you an overview of how your data is processed : 

• User names, first names, email addresses, and languages are collected for sending newsletters and commercial offers, based on consent. This data is retained for the duration of the business relationship and up to three years after the last purchase.
  
• Names, first names, email addresses, shipping and billing addresses, and purchase history are used for the loyalty program, based on SE’s legitimate interest. This information is also retained during the business relationship and for three years after the last purchase.
  
• Names, first names, email addresses, shipping addresses, ordered products, and payment methods are used for order management and invoicing, under the execution of the contract (T&Cs) and legal obligations. This data is retained for the duration of the business relationship, then archived according to legal retention periods.
  
• Names, first names, email addresses, transaction amounts, last digits of payment cards, and transaction statuses are processed to ensure payment tracking. This processing is based on tax and accounting obligations as well as SE’s legitimate interest. The data is retained during the business relationship and then archived according to the legal retention period (10 years for accounting obligations).
  
• Names, first names, email addresses, shipping addresses, and information about desired projects or products are used for preparing quotes and commercial follow-ups, based on pre-contractual measures and SE’s legitimate interest. This data is retained for three years from the quote request.
  
• Session data, demographic data, interests, and geographic information are collected to improve the website experience, perform analyses, and promote services. This processing is based on SE’s legitimate interest and user consent. Trackers have a maximum duration of 13 months, and data is retained for up to 25 months.
  
• Phone conversations may be recorded for training purposes, transaction verification, and service quality improvement, always based on SE’s legitimate interest. These recordings are retained for three months.

In the case of processing based on SE's legitimate interest, SE has verified the strict necessity of the data collected in relation to its legitimate interest. Thus, SE has weighed the rights and interests involved and has ensured that its interests do not override the rights and interests of the individuals concerned.

4. Data Recipients and Subcontractors

 The personal data collected and processed by SE may be communicated to the following recipients or categories of recipients:

• Individuals authorized by SE to process your data, after signing a confidentiality agreement, including SE employees, Payment providers (Adyen, Alma, Fintecture, PayPal), who act as separate data controllers, 
• SE's external advisors: lawyers, accountants, auditors, etc., bound by confidentiality obligations, 
• Authorities: Your data may be disclosed to competent authorities in accordance with the law, regulations, and/or a court decision, 
• Any third party in the event of a merger/acquisition, total or partial asset transfer, change of direct or indirect control, or any other form of restructuring implemented by SE, 
• Service providers to whom SE subcontracts all or part of the processing of your data, including: The Site's hosting provider and operator, Email service providers, Logistics providers for order preparation and return tracking, Carriers, Delivery tracking services, Customer service providers for managing complaints and calls. 

SE ensures that its subcontractors provide all necessary guarantees for the protection of personal data. Thus, SE has implemented the necessary contractual measures to require its subcontractors to strictly respect the security and confidentiality of personal data and to use it only according to SE's instructions. SE's subcontractors only have access to the data necessary for the performance of their services and are not authorized to process your data for other purposes. Personal data is never transmitted to any business partner of SE, whether free of charge or for payment, without prior consent.

 5. Security Measures

SE has implemented the necessary technical and organizational measures, considering the nature of the data processed, to ensure its security and confidentiality. When you enter your information on the Site, its transmission is secured by the SSL (Secure Socket Layers) protocol. SSL ensures that the data exchanged cannot be read by third parties. 

Within SE, access to your data is strictly limited to individuals whose roles require it. These individuals are bound by a confidentiality agreement. In the event of a personal data breach that may result in a high risk to your rights and freedoms, you will be informed as soon as possible of the following: The nature of the breach, The categories and approximate number of individuals concerned, The categories and approximate number of files concerned, The likely consequences of the breach, The measures taken to remedy the breach and, where applicable, to mitigate its consequences. 

6. Cookies 

SE recommends that you consult its cookie policy, available below (see APPENDIX). 

This section concerns cookies that may be placed on your device. It allows you to learn more about: 

• The origin and use of browsing data processed during your navigation on the Site.
• The origin and use of browsing data processed during your access to the Site via SE advertising content. 

When visiting the Site or when displaying SE advertising content on third-party sites, data related to your browsing may be recorded by files called "cookies" stored on your computer, provided you have consented to the storage of these cookies based on the purpose of the processing.

Only cookies necessary for the functioning of the Site may be stored without your consent.

7. Your Rights Regarding Personal Data 

The Site is operated by Source Edition, registered under the Siret number 91414101500026, with its registered office located at 117 Rue d'Aboukir, 75002 Paris, France. Any request concerning your data must be sent by email to the following address: info@source-edition.com.