Data protection charter

1. Definition and nature of personal data

When you use the website cuure.com (hereinafter: the “Site”), we may ask you to provide us with personal data about you in order to use the services offered on the Site.



2. Purpose of this charter

The purpose of this charter is to inform you about the means we implement to collect your personal data, with the strictest respect for your rights.

In this respect, we inform you that, when collecting and managing your personal data, we comply with French Law no. 78-17 of 6 January 1978 on data processing, data files and individual liberties, as amended (hereinafter: the “French Data Protection Act”), as well as Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the “GDPR”).


3. Identity of the data collection controller

The controller responsible for collecting your personal data is GROUPE WELL, a simplified joint-stock company (SAS) registered with the Paris Trade and Companies Register under no. 849 602 917, with its registered office at 83, boulevard Sébastopol - 75002 Paris (hereinafter: “We”).

4. What personal data do we collect about you?
For the purposes listed below, we collect the following categories of personal data:
Identification data: in particular your last name, first name, gender, age, postal address, email address, country;
Payment data: in particular data relating to your bank card,
Connection data: your passwords,
Data relating to your lifestyle and habits in relation to taking food supplements,
Data relating to your orders: your order history, the products we recommended to you following the online test.

As part of the test available on our Site to determine your personalised Cuure according to your needs, we may collect health data (such as whether or not you have deficiencies, allergies, pregnancy status, fatigue, digestive issues, skin problems, concentration or vision disorders, or whether you suffer from diabetes or joint problems).

This data is collected only with your explicit consent via the checkbox available at the start of the questionnaire. You can withdraw your consent at any time by writing to us using the contact details described in Article 10. If you don’t want us to collect data relating to your health status in order to offer you the Cuure best suited to your needs, you can select your supplements yourself by going to the “Our supplements” tab available at the top left of the Site.


5. For what purpose(s), on what legal basis/bases, and for how long do we keep your personal data?
Determine and offer you a personalised Cuure suited to your needs based on your answers to the online test on the Site:
Legal bases:
Performance of pre-contractual measures taken at your request
Performance of a contract concluded with you or your explicit consent for the collection of health data
Retention periods:
For customers: the data is kept for the entire duration of the subscription, plus a period of 3 years from cancellation or the end of your subscription.
However, your health data is kept only for the duration of your subscription.
In addition, your account is automatically deleted if it remains suspended or inactive for a period of 2 years.
For prospects: the data is kept for 3 years from its collection or from the last active contact, except for health data which is kept for 1 year from its collection.
Your data may be anonymised for statistical purposes.

Process your order, carry out operations relating to customer management regarding contracts, orders, deliveries, invoices, loyalty programmes and customer relationship follow-up:
Legal basis: Performance of a contract you have subscribed to
Retention periods:
Personal data is kept for the entire duration of the subscription, plus a period of 3 years from cancellation or the end of your subscription.
In addition, your account is automatically deleted if it remains suspended or inactive for a period of 2 years.
Personal data may be archived for evidential purposes for a period of 5 years.
As for data relating to your bank card, it is kept by our payment service provider for the duration of your subscription.
Data relating to the visual cryptogram or CVV2 shown on your bank card is not stored.

Managing people’s reviews of products, services or content:
Legal basis: Our legitimate interest in developing and promoting our business
Retention periods:
Personal data is kept for the entire duration of the subscription, plus a period of 3 years from cancellation or the end of your subscription.
Your data may be anonymised for statistical purposes.

Building a file of customers and prospects:
Legal basis: Our legitimate interest in developing and promoting our business
Retention periods:
For customers: the data is kept for the entire duration of your subscription and is deleted after a period of 3 years from cancellation or the end of your subscription.
If you suspend your account or it remains inactive, your data is deleted after a period of 2 years.
For prospects: the data is kept for a period of 3 years from your last active contact.

Sending newsletters, solicitations and promotional messages:
Legal bases:
Our legitimate interest in developing and promoting our business, when you are already a customer of our services
Your consent, if you are not yet a customer
Retention period: Data is kept for 3 years from your last active contact.

Managing requests to exercise rights:
Legal basis: Our legitimate interest in complying with our legal obligations
Retention periods:
If we ask you for proof of identity: we keep it only for the time needed for identity verification. Once verification has been carried out, the proof is deleted.
If you exercise your right to object to receiving marketing: we keep this information for 3 years.

Responding to your requests for information:
Legal basis: Our legitimate interest in providing you with a quality service
Retention period: Data is kept for the time needed to process your request for information and deleted once the request has been processed.

Responding to your support requests via the help centre:
Legal basis: Our legitimate interest in providing you with a quality service
Retention period: Data is kept for the time needed to process your support request and deleted once the request has been handled.

Producing commercial and traffic statistics for our services:
Legal basis: Our legitimate interest in improving our services
Retention period: Data is kept for the entire duration of the subscription.

When we collect your personal data, we tell you whether certain data must be provided or whether it is optional. Mandatory data is necessary for the services to operate. For optional data, you are completely free to provide it or not. We also tell you what the possible consequences of not replying might be.


6. Recipients of the data collected
The following will have access to your personal data:

the staff of our company, the departments responsible for audits (including the statutory auditor);
our processors: our hosting providers, our CRM and newsletter sending tool, our payment service providers, our customer support tool provider, our order preparation provider, our order logistics centre, our review collection provider, our visualisation tool, our telephony tool and our order tracking tool;
the provider we use to deliver your orders.

Public bodies may also be recipients of your personal data, exclusively to meet our legal obligations, as well as legal auxiliaries, ministerial officers and organisations responsible for debt collection.


7. Security

We inform you that we take all useful precautions, appropriate organisational and technical measures to preserve the security, integrity and confidentiality of your personal data and, in particular, to prevent it from being altered, damaged, or accessed by unauthorised third parties. We also use secure payment systems in line with current best practice and applicable regulations.


8. Hosting

We inform you that your data is kept and stored within the European Union for the entire duration of its retention via AMAZON WEB SERVICE and GoogleBigQuery.

As part of the tools we use (see Article 5 on recipients regarding our processors), your data may be transferred outside the European Union. Transfers of your data in this context are secured by means of the following tools:

Either this data is transferred to a country deemed to offer an adequate level of protection by a decision of the European Commission;
Or we have entered into a specific contract with our processors governing transfers of your data outside the European Union, based on the standard contractual clauses between a controller and a processor approved by the European Commission.
Or appropriate safeguards as listed in the GDPR have been put in place to govern said data transfer.


9. What are your rights regarding your personal data?
You have the following rights regarding your personal data:

Right to information: this is precisely why we have drafted this charter.

Right of access: you have the right to access all of your personal data at any time.

Right to rectification: you have the right to rectify inaccurate, incomplete or outdated personal data about you at any time.

Right to restriction: you have the right to obtain restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.

Right to erasure: you have the right to require that your personal data be erased, and to prohibit any future collection.

Right to lodge a complaint with a competent supervisory authority (in France, the CNIL), if you consider that the processing of your personal data constitutes
a breach of the applicable texts.

Right to define instructions regarding the retention, erasure and communication of your personal data after your death.

Right to withdraw your consent at any time: for purposes based on consent, you can withdraw your consent at any time. This withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

Right to data portability: under certain conditions, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to request its transfer to the recipient of your choice.

Right to object: you have the right to object to the processing of your personal data. Note, however, that we may continue processing despite this objection for legitimate reasons or for the defence of legal claims.

You can exercise these rights by writing to us using the contact details below. On this occasion, we may ask you to provide additional information or documents to prove your identity.

10. Personal data contact point
Contact email: service.clients@cuure.com

Postal address for pen-and-paper lovers: 136 rue d’Aboukir 75002 Paris


11. Changes

We reserve the right, at our sole discretion, to modify this charter at any time, in whole or in part. These changes will take effect from the publication of the new charter. Your use of the Site after these changes come into effect will constitute acknowledgement and acceptance of the new charter. Failing that, if this new charter does not suit you, you must no longer access the Site.


12. Effective date

This charter came into force on 27/05/2021.


APPENDIX - COOKIE POLICY

1. What is a Cookie?

When you browse our Site, cookies, pixels and other trackers (hereinafter collectively referred to as “Cookies”) are placed on your browser.

A Cookie is a small file, often encrypted, stored in your browser or on your device and identified by a name. It is placed when you visit a website or an application. Each time you return to the website or application in question, the Cookie is retrieved from your browser or device. This means that each time you visit the website or application, the browser is recognised.

Placing these Cookies may allow us to access your browsing data and/or personal data relating to you.


2. Identifying Cookies

a. Technical and functional Cookies

Technical and functional Cookies are necessary for the Site to work properly and to provide you with our services. They are used throughout your browsing in order to make it easier and to perform certain functions.

A technical Cookie may, for example, be used to remember the answers you entered in a form or your preferences regarding the language or how the Site is displayed, where such options are available.

b. Advertising Cookies

Advertising Cookies can be created not only by our Site but also by other websites and applications that display adverts, announcements, widgets or other elements on the page displayed.

These Cookies may be used in particular to personalise and measure the effectiveness of advertising or to carry out ad targeting.

c. Social network Cookies

Social network Cookies allow you to share content from our Site on social networks and to show, on those networks, your opinion or your consultation of our Services by clicking, in particular, on the “like” and “share” links.
These Cookies may also make it possible to track users’ browsing on the Site.

We invite you to consult the privacy policies of the social networks that originate these Cookies, to understand the purposes for which they use the browsing information they may collect through these Cookies and how to exercise your rights with these social networks.

d. Analytics Cookies

These Cookies allow us to measure the number of visits, the number of pages viewed and user activity. Where applicable, they may collect your IP address to determine the city from which you connect. Analytics Cookies allow us to generate statistics on traffic and navigation on our Site in order to improve our performance. The Cookies used also help identify browsing issues and, ultimately, fix them.


3. Your Cookie preferences

a. Cookies that can be placed without consent

Some Cookies don’t require your consent. This is the case for:
Technical and functional Cookies that are necessary for the Site to operate;
Certain audience measurement Cookies or Cookies that allow different versions of the Site to be tested for the purpose of optimising editorial choices.

b. Accepting or refusing Cookies subject to your explicit consent

All other Cookies require your consent. These include advertising Cookies, social network Cookies and certain audience analytics Cookies. You are free to choose whether to accept or refuse the use of these Cookies.

You can accept or refuse these Cookies when you first browse the Site.

Your choices to accept or refuse Cookies will be stored for a period of six (6) months.

c. Setting up your browser

It is also possible to set your browser so that it accepts or refuses certain Cookies.
Each browser offers different configuration options.