Data Protection Policy

Data Protection Officer

Personal data on the Site is collected by CROSSCALL as the data controller, in accordance with Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, applicable from May 25, 2018, and Law No. 2018-493 of June 20, 2018.

Data controller contact details

CROSSCALL SA
245 Paul Langevin Street
Les Milles business area
13290 Aix en Provence
SIRET: 518 706 890 00069
Representative: Mr. Cyril VIDAL in his capacity as president

Processing of Collected Personal Data

CROSSCALL may collect your personal data through this site for various purposes, namely:

1. Create your customer account and manage your orders

Purpose of collection Purposes Data collected Legal basis Retention period
Customer account creation Necessary data is collected to create an account Mandatory: Last name, first name, date of birth, title, and email address / optional: address, mobile phone number, employment status, sports practiced, children Consent Until consent is withdrawn
Order management Necessary data is collected to process and track your orders on the website Account creation data
Credit card number, cardholder name, security code		 Contract execution Credit card payment: 540 days from the transaction date (by partner Ogone Worldline)
PayPal payment: Personal data used in the ongoing relationship between you and PayPal is stored for the entire duration of the relationship plus an additional 10 years
Commercial documents retained for 10 years from the last contact
Installment payment management Necessary data is collected to verify your creditworthiness and authorize installment payments Last name, first name, address, date and place of birth, credit card number, cardholder name, security code, etc. Legitimate interest ONEY: If payment is accepted, data is kept for the entire loan duration plus 5 years for proof in case of dispute / 6 months if payment is refused
Withdrawal management Necessary data is collected to process your withdrawal requests for products purchased online and to inform you about this process Last name, first name, address, email, phone number, product reference and model Contract execution Commercial documents retained for 10 years from the last contact
Claims/disputes management Necessary data is collected to process your claims Last name, first name, address, email, phone number, IMEI, and purchase date Contract execution / legitimate interest In case of disputes, data is retained for the duration of the contract plus the statute of limitations period


2. Responding to your requests

Purpose of collection Purposes Data collected Legal basis Retention period
Contact form management Necessary data is collected to respond to internet users' requests (obtain information about their order, invoice, or referral), allow people to chat with a CROSSCALL employee, make Partnership/Ambassador requests, and receive CROSSCALL news upon consent. Name, first name, email, message
For partnership/ambassador requests, discipline and profession are also collected		 Legitimate interest Until the request is processed
Manage quote requests Necessary data is collected to respond to quote requests and send promotional offers if you have consented. Mandatory: Name, first name, phone number, email, country, company name, position, desired product and volume, project description Consent 3 years following your last contact / until commercial information is unsubscribed
Manage rights exercise requests Necessary data is collected to process the rights exercise request submitted via the dedicated form Mandatory: Nature of the request, email, name, account or order number
Identity document for access rights requests		 Legal obligation Identity document if requested: Deleted immediately after verification
1 year in active database and 5 years in intermediate database before deletion
Manage requests made via the chatbot Improve service quality

Ensure personalized service by consulting conversation history		 Conversations (content of exchanges, number of conversations, duration, date)

Visitor's IP address (for evidence purposes in case of dispute)

Data is provided directly by the visitor (for example identity, email, phone number)		 Consent Data is retained for the time needed to provide a response and for a maximum duration of 1 year


3. Process your requests with customer service

Purpose of collection Purposes Data collected Legal basis Retention period
Manage requests made by phone Necessary data is collected to contact you and process your request Mandatory: Name, first name, address, email, phone number, IMEI, purchase invoice Consent Data is retained for the time needed to provide a response and for a maximum duration of 2 years
Manage after-sales service requests for repairs Necessary data is collected to handle the product, contact you, and return the repaired product Mandatory: Name, address, email, phone number, IMEI, purchase invoice Warranty contract / Legitimate interest Time to process your request + 2 years / 2 years after the end of warranty if the device is under warranty
Manage customer service requests made via the chatbot Respond to requests related to the after-sales service (SAV) of products Conversations (content of exchanges, number of conversations, duration, date)

Visitor's IP address (for evidence purposes in case of dispute)

Data is provided directly by the visitor (for example identity, email, phone number)		 Consent Data is retained for the time needed to provide a response and for a maximum duration of 5 years


4. Manage recruitments

Purpose of collection Purposes Data collected Legal basis Retention period
Application Management The necessary data is collected to process applications online or by mail Name, first name, email CV data: address, phone number, age, gender, family status, education, and professional experience Legitimate interest 2 years from the receipt of your CV


5. To offer you promotional offers and contests

Purpose of collection Purposes Data collected Legal basis Retention period
Management of marketing and promotional communications

The necessary data is collected to send marketing communications or promotional offers by email and/or messaging 
personalized (SMS/WhatsApp).

Data may also be used to analyze your interactions with our communications and, if applicable, your purchasing behaviors, to personalize the offers and messages addressed to you.  

 Identification and contact data: name, first name, email address, phone number 
 
Data related to marketing interactions: opens, clicks, unsubscribes 
 
Browsing and activity data on the site associated with marketing campaigns: pages viewed, navigation path 		 Consent Data deleted upon unsubscribing or 3 years after last contact
Management of contests The necessary data is collected for running the promotions and sending the prizes won Name, first name, email address, phone number, and postal address (depending on the contest purpose) Consent Data deletion 2 months after prize delivery
If consent to the newsletter: until unsubscribing
Management of refund offers The necessary data is collected to reimburse you and send newsletters based on your consent Name, email address, phone number, and postal address (depending on the contest purpose) Consent Data deletion within a maximum of 3 years after the end of the contract / until unsubscribing from the newsletter if consent to the newsletter is given


As part of our marketing and campaign management activities, we may use a marketing automation provider (e.g., Klaviyo), who may process certain data outside the European Union, notably in the United States. In this case, transfers are governed by appropriate safeguards (e.g., standard contractual clauses of the European Commission and/or applicable recognized mechanism).

6. To allow us to manage the loyalty program

 Purpose of collection Purposes Data collected Legal basis Retention period
Loyalty program management

The management of registration and participation in the loyalty program. 

The tracking the accumulation and use of loyalty points.

 L’allocation benefits such as discount coupons or accessories.

 La customer relationship management within the program. 

last name, first name, address e‑email, date birthday (optional), history of purchases made from the date of joining the program. 

 Consent During the membership period of the program

 
As part of the loyalty program, certain personal data processed by Yotpo on behalf of CROSSCALL may to be hosted or accessible from countries outside the European Union, notably the States‑United. 

These data transfers are governed by the conclusion of standard contractual clauses adopted by the European Commission, as well as, where applicable, by the implementation of additional technical and organizational measuress to ensure an adequate level of personal data protection in accordance with applicable regulationsble.

7. To allow us to improve our products and services

Purpose of collection Purposes Data collected Legal basis Retention period
Opinion survey management The necessary data is collected to understand your use of our products Name, email address and phone number, company name and profession Consent Deletion after processing the survey results / If consent is given to be recontacted, data is deleted upon unsubscribing
User experience management The necessary data is collected to gather your user experience feedback on products in order to improve them / contact you for clarifications on your responses Gender, First name, email address, country Consent 2 years then anonymization
Participation in the community of innovators The necessary data is collected to manage registrations and recruitment for the community of innovators, conduct market, satisfaction, needs, and usage studies Name, first name, email, date of birth, city, country, Children Y/N, Sports practiced, frequency, Other possible and optional: apartment/house, type of car (and desired), desired clothing brand, Professional category, working hours, work environment, Income bracket Consent then contract execution / Legitimate interest Until unsubscribe


RECIPIENTS

The recipients of this data are:

  • The provider in charge of the campaign management marketing (Klaviyo) ;
  • The provider responsible for managing the loyalty program (Yotpo) ;
  • The provider supplying the Customer Relationship Management (CRM) system and the Marketing Cloud system;
  • The provider supplying the online questionnaire deployment tool;
  • The provider implementing online payment solutions;
  • The provider responsible for order delivery;
  • The repair centers;
  • The provider supplying the application management solution;
  • The external DPO of CROSSCALL in the context of a rights request.

 

TRANSFER TO THIRD PARTIES AND OUTSIDE THE EUROPEAN UNION

Your personal data is preferably processed within the European Union.

Within the scope of the aforementioned purposes, some of your personal data may nevertheless be transferred to third-party entities established in countries outside the European Union (e.g., subcontractors of the company involved in the aforementioned processing, etc.).

Some of these recipients of your personal data are considered to provide a sufficient level of personal data protection because they are established in a country whose personal data protection regulations have been recognized as providing an adequate level of protection for said data (see European Commission adequacy decisions)

Furthermore, if the country of the entity receiving your personal data does not offer an adequate level of protection for said data, we ensure that appropriate security and confidentiality measures are taken to guarantee the continued protection of your data.

Also, in these cases, you are informed that the transfers of your personal data to other entities outside the European Union are governed by the implementation of appropriate safeguards such as the conclusion, with the recipients of this data, of contractual clauses in accordance with the recommendations of the European Commission, allowing us to ensure that appropriate safeguards are taken regarding the protection of said data.

We also inform you that transfers of personal data outside the European Union are lawful if (i) the transfer is necessary for the performance of a contract between the data subject and the Data Controller or for the implementation of pre-contractual measures taken at the data subject's request, if (ii) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and another natural or legal person, or if (iii) the data subject has given explicit consent to the proposed transfer after being informed of the risks that this transfer may entail for them due to the absence of an adequacy decision and appropriate safeguards.

CROSSCALL may be required to transmit personal data to competent services and authorities in the context of information requests or administrative or judicial decisions.

 

DATA SECURITY

CROSSCALL ensures the security of your personal data hosted on its servers. The company strives to take the necessary technical and organizational security measures to guarantee the integrity, confidentiality, and availability of your data.

CROSSCALL employees who have access to users' personal data due to their role commit to the highest level of confidentiality in this regard.

The CROSSCALL website uses the TLS encryption protocol to ensure the confidentiality and integrity of your data transmitted via the site and also to ensure client-server authentication.

You can view our security certificate, issued by a third party, by clicking on the padlock icon in your browser's address bar.

 

PEOPLE'S RIGHTS AND HOW TO EXERCISE THEM

In accordance with Law No. 78-17 of January 6, 1978, relating to Information Technology, Files and Freedoms (articles 38, 39, 40), and the General Data Protection Regulation, you have various rights regarding the use of your personal data. These rights are as follows:

  • Access: Exercising the right of access allows the User to verify the accuracy of the data and, if necessary, have it corrected or deleted;
  • Correction: Exercising the right to modification allows the User to update their data;
  • Portability: Exercising the right to data portability allows the User to transfer their data to a third party of their choice;
  • Deletion: Exercising the right to deletion allows the User to obtain the deletion of their data;
  • Objection: Exercising the right to object allows the User to oppose the use of their data for a specific purpose;
  • Restriction: Exercising the right to restriction allows the User to request an organization to temporarily freeze the use of certain data.

These rights can be exercised with the data protection officer of CROSSCALL by filling out the form available on the following page: Personal Data Management

Note that CROSSCALL also offers you the possibility to modify your personal information and withdraw your consent to commercial and promotional offers directly from your customer account. It is also possible to unsubscribe from any communication by clicking the unsubscribe link at the end of received emails.

If you believe, after contacting the data controller or the data protection officer of CROSSCALL, that your data protection rights are not respected, you can file an online complaint with the National Commission on Informatics and Liberty (CNIL) or by postal mail at 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07

 

ABOUT COOKIES

This site uses cookies for proper site operation and user experience: normal site navigation, video playback, content sharing on social networks, page audience measurement. Strictly necessary cookies are those related to site operation.

This site also uses analytics cookies to improve site functionality. All data collected by these cookies is anonymous.

Advertising cookies are used to display ads tailored to users' interests and to measure the effectiveness of advertising campaigns.

See the cookie policy to learn more.

 

PRIVACY POLICY MODIFICATION

CROSSCALL may modify this privacy policy. We therefore invite you to consult it regularly to be aware of its latest version.