crunchyvita Privacy Policy

Alteora ("Alteora", "our", "we" and "us") and our partners respect your privacy. We ask that you carefully read this privacy policy to understand how your personal data is collected, processed, and retained when you use this crunchyvita website, accessible at https://www.crunchyvita.com/fr.

The term "personal data" refers to any information relating to a natural person that allows them to be identified, directly or indirectly, from a single piece of data or by cross-referencing several pieces of data. This includes elements such as name, address, email address, location data, online identifiers, etc.

All personal data collected on this website is processed under the responsibility of Alteora, a French simplified joint-stock company (SAS) with share capital of 10,000 €, registered with the Trade and Companies Register of Antibes under number 993112952, with its registered office at 1460 Chemin des Terriers, 06600 Antibes, France, and in accordance with Law No. 78-17 of January 6, 1978 on data processing, data files, and civil liberties, as amended, as well as Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Within the meaning of the regulations applicable to personal data, Alteora is therefore the data controller.

This privacy policy describes:

How Alteora uses your personal data
How Alteora shares your personal data
How Alteora protects your personal data
Where Alteora hosts and transfers your personal data
How you can exercise your rights regarding your personal data
Updates to the privacy policy
How to contact us

I. How Alteora uses your personal data

Alteora may use your personal data for the following purposes:

creating your customer account on this website
managing orders for products and/or services
carrying out the actions necessary to manage contracts, invoices, and customer relationship follow-up
publishing and managing your reviews and/or comments left on the website
responding to your contact requests made through our website
establishing a loyalty program
offering you advertising and content tailored to you
building a file of users, prospects, and customers
developing sales and traffic statistics
managing any unpaid invoices and disputes
complying with our legal obligations

The data collected is necessary for the performance of the contract entered into with Alteora when you use our website to order the products and/or services available for sale on the site.

When you voluntarily provide us with personal data, the collection of your personal data is based on the following legitimate interest: responding more effectively to your requests for information.

The processing of your personal data to send you our newsletter is, however, based solely on your consent to receive our newsletter, which you can withdraw at any time. If you do not consent to receiving the newsletter, please note that this will not prevent you from creating your customer account and placing orders on our website.

Legal basis

The processing of your data is based on:

your consent (Article 6(1)(a) of European Regulation 2016/679 (General Data Protection Regulation - GDPR)) for sending the newsletter,
the performance of a contract or pre-contractual measures (Article 6(1)(b) of the GDPR), when it comes to providing you with products or services through our site.
Certain processing may also be based on Article 6(1)(f) of the GDPR, when the processing is necessary for the purposes of the legitimate interests pursued by Alteora, unless the fundamental rights and freedoms of the data subject override those interests. This may in particular concern the improvement of our services, customer relationship management, or fraud prevention.

II. How Alteora shares your personal data

Within Alteora, and with regard to each processing purpose, personal data concerning you is collected, processed, and stored by Alteora's authorized staff, solely within the scope of their respective duties, and in particular by the customer service, marketing, and IT departments.

We do not share personal data with other companies, organizations, or individuals, unless one of the following circumstances applies:

sharing with prior consent: after obtaining your consent, Alteora will share the information you have authorized with the specific third parties or categories of third parties identified when your consent was collected.
sharing with our service providers: Alteora may also disclose your information to companies that provide services for us or on our behalf. These service providers include companies that offer IT services, such as our hosting provider or our email delivery provider, delivery services for our products, or companies that carry out marketing activities on our behalf. These service providers may use your information solely to provide services on behalf of Alteora.
in performance of a legal obligation, sharing in accordance with laws and regulations: Alteora may share your information as required by laws and regulations, in order to resolve legal disputes, or as required by judicial or administrative authorities under the law.

Alteora will ensure the lawfulness of any sharing of personal data through data processing clauses with the companies with which your personal data is shared, requiring them to comply with this privacy policy and to take appropriate security and confidentiality measures when processing personal data.

III. How Alteora protects your personal data

Alteora attaches great importance to the security of your personal data and has adopted standard industry practices to protect your personal data and prevent unauthorized access, disclosure, use, alteration, damage, or loss of this information.

We have also taken appropriate precautions, through our hosting provider, to preserve the security and confidentiality of the data, and in particular to prevent it from being distorted, damaged, or disclosed to unauthorized persons.

Alteora also adopts the following organizational measures:

we take reasonable and practicable measures to ensure that the personal data collected is minimal and relevant to what is necessary, given the purposes for which it is processed;
we retain your personal data for the period strictly necessary in view of the purpose of the processing, unless the retention of your data is required or permitted by law. For example, we retain data related to the fulfillment of your orders for the period required by law for the retention of accounting records, namely a maximum of 10 years from the relevant financial year; and
we deploy access control mechanisms to ensure that only authorized staff can access your personal data;

in the event of a personal data breach, Alteora will comply with the legal and regulatory requirements applicable to notifying personal data breaches to the competent supervisory authorities and/or to the data subjects concerned.

IV. Where Alteora hosts and transfers your personal data

Your personal data will be hosted on the hosting infrastructure of our hosting provider, OVH, located in France.

V. How you can manage your rights regarding your personal data

You have the right to access, rectify, erase, restrict, and object to the processing of your personal data, as well as the right to define directives regarding the fate of your data after your death and the right to the portability of your personal data.

The CNIL (French Data Protection Authority) defines personal data as "any information relating to an identified or identifiable natural person. But because it concerns individuals, they must retain control over it."

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) for France, or with a competent supervisory authority for any other Member State, depending on your habitual residence, place of work, or the place where the alleged infringement of your rights occurred, if you believe that the processing of your data does not comply with applicable law. This complaint may be lodged without prejudice to any other remedy before an administrative or judicial court, which is also a right available to you.

You may contact us at any time using the addresses indicated in the "How to contact us" section below in order to exercise your rights regarding your personal data under the conditions set out by applicable regulations. You must indicate which right you wish to exercise, along with all the details necessary for us to respond to your request.

These rights are exercised under the conditions set out by applicable regulations.

The right of access means that you may ask us at any time to tell you whether we process personal data concerning you and, if so, to inform you which personal data is concerned as well as the characteristics of the processing carried out.

The right to rectification means that you may ask us to rectify your personal data when it is inaccurate. You may also request that your personal data, where incomplete, be completed to the extent relevant to the purpose of the processing in question.

The right to erasure means that you may request the erasure of your personal data, in particular when:

its retention is no longer necessary for the purposes for which it was collected;
your personal data is processed on the basis of your consent, you wish to withdraw that consent, and there is no other legal basis capable of justifying the processing;
you have objected to the processing of your personal data and consequently wish for it to be erased;
your personal data has been processed unlawfully;
your personal data must be erased to comply with a legal obligation under either European Union law or French law.

The right to restriction means that you may ask us to restrict the processing of your personal data:

when you contest the accuracy of your personal data, for a period allowing us to verify its accuracy;
when, following processing established as non-compliant, you prefer restriction of the processing to complete erasure of your personal data;
when we no longer need your personal data for the purposes of processing, but you still need it for the establishment, exercise, or defense of legal claims;
when you have objected to the processing of your personal data and wish for a restriction of processing for the period allowing us to verify whether the legitimate grounds you invoke are justified.

Restriction of processing means that the processing of your personal data will then be limited to storage only. We will no longer carry out any other operation on the personal data concerned.

The right to object means that you may object to the processing of your personal data when such processing is based on Alteora's pursuit of a legitimate interest. The right to object is exercised subject to demonstrating legitimate grounds relating to your particular situation. We will then stop the processing in question unless there are compelling legitimate grounds justifying its continuation in accordance with applicable regulations.

The right to define directives regarding the fate of your data after your death allows you to communicate your instructions regarding the retention, erasure, and disclosure of your personal data after your death.

The right to data portability means that you may ask us, under the conditions set out by applicable regulations, to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to you, or to ask us to transmit it directly to a third party of your choice where this is legally and technically possible.

Where we process your personal data on the basis of your consent, you also have the right to withdraw your consent at any time by contacting us at the addresses indicated in the "How to contact us" section, or by clicking on the unsubscribe link included in each of our communications.

However, the withdrawal of your consent does not affect the lawfulness of processing carried out before such withdrawal.

VI. Updates to this privacy policy

Alteora reserves the right to modify or update this privacy policy, in whole or in part, at any time, due to changes in the regulations applicable to the protection of personal data or to the data processing carried out.

Any substantial modification of the privacy policy will be notified to you by email where you have provided us with a valid email address, and will be published on the website. We recommend that you regularly review this privacy policy in order to stay fully informed of our commitments regarding the security and protection of your personal data.

VII. How to contact us

If you have any questions, comments, or suggestions, please contact us by visiting our contact page or by submitting them to contact@crunchyvita.com.

You may also write to us by post at: Alteora, 1460 Chemin des Terriers, 06600 Antibes, France.

If you are not satisfied with Alteora's response to a request to exercise your rights in accordance with Section V above, or if you wish to report a breach of applicable data protection regulations, you have the right to lodge a complaint with the CNIL by post (CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07) or on its website (www.cnil.fr), or with the data protection authority of the country in which you habitually reside or work.