Saranguerel, acting as the Data Controller, within the meaning of European Regulation No. 2016-679 of April 27, 2016, and the amended "Informatique et Libertés" law of January 6, 1978 (hereinafter, together, the "Regulation"), attaches great importance to the protection of your personal data and your privacy.

The purpose of this policy is to inform you about how we collect, use, and protect the personal data you provide us via our website https://saranguerel.com.

To ensure a high level of protection in accordance with the applicable Regulation, this Policy may be updated. Therefore, we invite you to consult this page regularly. We will inform you by email of substantial changes. Substantial changes are considered to be all modifications concerning the main characteristics of personal data processing.

Should any clause of the Policy be declared void or contrary to the regulations, it shall be deemed unwritten but will not invalidate the other clauses of the Policy.

1. Definitions

The User is informed that the following terms or expressions, whenever they begin with a capital letter in the body of the Policy (including its appearances and preamble), whether used in the singular or plural, masculine or feminine, will have the meaning attributed to them below:

"Data" means any information relating to an identified or identifiable natural person within the meaning of Article 4.1 GDPR.

"Policy" refers to this personal data protection policy.

"Regulation" refers to the set formed by European Regulation No. 2016-679 of April 27, 2016, and the amended "Informatique et Libertés" law of January 6, 1978.

"Data Controller" refers to the natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of the processing as defined in Article 4.7 of the GDPR.

"GDPR" refers to the General Data Protection Regulation 2016/679 dated April 27, 2016.

"Site" refers to our website https://saranguerel.com.

"Processor" refers to the natural or legal person, public authority, service or other body which processes personal data on behalf of the data controller as defined in Article 4.8 of the GDPR.

"User" refers to the users of our Site.

2. What Data do we collect?

We may collect the following Data directly from you:

• Identification data: name, email or postal address, telephone number, and social media of the data subject.
• Transaction data: order amount and payment information.
• Connection data: logs, IP address, functions used, pages visited, selected configurations, visit timestamps, and search terms.
• Economic and financial information: bank details, financial situation, etc.
• Navigation data: cookies, trackers, audience measurement, etc.

Saranguerel does not share your personal data. The collected Data is used solely within the framework of the commercial relationship between you and Saranguerel, and is under no circumstances transferred, sold, or transmitted to third parties for commercial purposes.

Indirectly, we may collect your Data via tracking tools such as browser cookies and other similar technologies on our Site https://saranguerel.com and in communications we send to you. To learn more, we invite you to consult our Cookies Policy.

3. Why do we collect your Data?

The legal basis that allows us to process your personal data depends on the purpose for which it is collected.

We collect your Data:

• When necessary for the performance of a contract concluded with you.
• When necessary to comply with a legal obligation.
• When you have expressly consented to the processing of your Personal Data.
• When necessary to protect our legitimate interests.
• When necessary for reasons of public interest.

4. Who are the recipients of your Data?

Internal recipients

Your Data may be processed by our internal employees.

Shopify — Host and processor

Our site is hosted on Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada. Your data is stored via Shopify's data storage system, its databases, and the general Shopify application, on a secure server behind a firewall. To learn more about Shopify's privacy practices, see: https://www.shopify.com/legal/privacy.

Payment

If you make a purchase on our site, payment data is processed by Shopify Payments. Credit card information is stored in encrypted form in accordance with the PCI-DSS standard. Shopify Inc. complies with the PCI-DSS standard as managed by the PCI Security Standards Council.

Transfers outside the European Union

As Shopify is a Canadian company, your data may be transferred and stored in Canada. Canada benefits from an adequacy decision by the European Commission, meaning it offers a level of personal data protection equivalent to that of the European Union.

Confidentiality commitment

We never share your data for commercial purposes. However, we may be obliged to disclose it only if expressly required by law.

5. Cookies

Our site uses cookies necessary for its proper functioning (shopping cart management, user session, language preferences). Shopify also uses its own technical cookies to ensure the operation of the store. You can configure your browser to refuse cookies, but some site functionalities may no longer be available.

6. How do we secure your data?

We have implemented technical and organizational security measures to guarantee the security, integrity, and confidentiality of your Data.

• Data encryption
• Password policy
• Security vulnerability management

7. What are your rights regarding the processing of your Data?

In accordance with the provisions of the Regulation, you have a right of access and a right of rectification regarding your Data. You also have the right to define directives concerning the fate of your Data in the event of death.

Furthermore, subject to the conditions provided by the GDPR for the exercise of these rights, you benefit from:

• A right to erasure of your Data
• A right to restriction of processing of your Data
• A right to object to the processing of your Data for legitimate reasons, in accordance with Article 21 of the GDPR
• A right to data portability for the Data you have provided

When the processing of your Data is based on your consent, you can withdraw it at any time. However, you acknowledge that processing carried out before the revocation of your consent remains perfectly valid.

In accordance with Article 12.6 of the GDPR, for the exercise of these rights, we reserve the right to ask you to justify your identity.

You can exercise these rights by sending an email to saranguerel@saranguerel.com or a letter to the following address:

12 rue Jean Rostand, 91300 Massy France

We have one month to respond to any request regarding the exercise of your rights. This period may be extended by two months due to the complexity or the large number of requests.

Finally, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), particularly on its website www.cnil.fr.