Data Protection Policy
Personal Data Controller
The website's personal data is collected by CROSSCALL in its capacity as data controller, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, applicable from 25 May 2018, and Law No. 2018-493 of 20 June 2018.
Data controller's contact details
CROSSCALL SA
245 rue Paul Langevin
Les Milles business park
13290 Aix-en-Provence
SIRET: 518 706 890 00069
Representative: Mr. Cyril VIDAL in his capacity as chairman
Processing of Collected Personal Data
CROSSCALL may collect your personal data through this website for various purposes, namely:
1. Create your customer account and manage your orders
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Customer account creation | The necessary data is collected to create an account | Required: Last name, first name, date of birth, title, and email address / optional: address, mobile phone number, employment status, sports practiced, children | Consent | Until consent is withdrawn |
| Order management | The necessary data is collected to process and track your orders on the website | Account creation data Credit card number, cardholder's name, security code |
Performance of the contract | Payment by bank card: 540 days from the transaction date (by the partner Ogone Worldline) Payment via PayPal: Personal data used in the ongoing relationship between you and PayPal is stored for the entire duration of the relationship plus an additional period of 10 years Commercial documents retained for 10 years from the last contact |
| Management of payment in several monthly installments | The necessary data is collected to assess your creditworthiness and authorize payment in several monthly installments | Last name, first name, address, date and place of birth, credit card number, cardholder's name, security code, etc. | Legitimate interest | ONEY: If payment is accepted, for the entire duration of the loan + 5 years for evidentiary purposes in the event of a dispute / 6 months if payment is refused |
| Management of withdrawals | The necessary data is collected to process your requests to withdraw from purchases made on the website and to inform you about this process | Last name, first name, address, email address, telephone number, product reference and model | Performance of the contract | Commercial documents retained for 10 years from the last contact |
| Management of complaints/disputes | The necessary data is collected to process your complaints | Last name, first name, address, email address, telephone number, IMEI, and purchase date | Performance of the contract / legitimate interest | In the event of litigation, the data is retained for the duration of the contract plus the limitation period |
2. Respond to your requests
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Management of the contact form | The necessary data is collected to respond to requests from website users (obtain information about their order, invoice, or referral), allow people to chat with a CROSSCALL employee, submit Partnership / Ambassador requests, and receive CROSSCALL news with their consent. | Last name, first name, email address, message For partnership / ambassador requests, the discipline and profession are also collected |
Legitimate interest | Until the request has been processed |
| Management of quote requests | The necessary data is collected to respond to quote requests and send promotional offers if you have consented to this. | Required: Last name, first name, telephone number, email address, country, company name, position, desired product and volume, project description | Consent | 3 years following your last contact / until you unsubscribe from commercial information |
| Management of requests to exercise rights | The necessary data is collected to process the request to exercise a right submitted via the dedicated form | Required: Nature of the request, email address, name, account or order number Identity document as part of an access rights request |
Legal obligation | Identity document if requested: Deleted immediately after verification 1 year in the active database and 5 years in the intermediate database before deletion |
| Management of requests made via the chatbot | Improve the quality of the services Provide a personalized service by consulting the conversation history |
Conversations (content of exchanges, number of conversations, duration, date) Visitor's IP address (for evidentiary purposes in the event of a dispute) The data is provided directly by the visitor (for example, identity, email address, telephone number) |
Consent | The data is retained for the time needed to provide a response and for a maximum period of 1 year |
3. Process your customer service requests
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Management of requests made by telephone | The necessary data is collected to contact you again and process your request | Required: Last name, first name, address, email address and telephone number, IMEI, proof of purchase | Consent | The data is retained for the time needed to provide a response and for a maximum period of 2 years |
| Management of after-sales service repair requests | The necessary data is collected to process the product, contact you, and return the repaired product | Required: Last name, address, email address and telephone number, IMEI, proof of purchase | Warranty contract / Legitimate interest | Time required to process your request + 2 years / 2 years after the end of the warranty if the device is under warranty |
| Management of requests related to customer service made via the chatbot | Respond to requests related to the after-sales service (SAV) for products | Conversations (content of exchanges, number of conversations, duration, date) Visitor's IP address (for evidentiary purposes in the event of a dispute) The data is provided directly by the visitor (for example, identity, email address, telephone number) |
Consent | The data is retained for the time required to provide a response and for a maximum period of 5 years |
4. Manage recruitment
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Application management | The necessary data is collected to process applications submitted online or by mail | Last name, first name, email address CV data: address, telephone number, age, gender, marital status, education and professional experience | Legitimate interest | 2 years from receipt of your CV |
5. Offer you promotional offers and prize draws
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Management of marketing and promotional communications | The necessary data is collected to send marketing communications or promotional offers by email and/or messaging services personalized (SMS/WhatsApp). The data may also be used to analyze your interactions with our communications and, where applicable, your purchasing behavior, in order to personalize the offers and messages sent to you. |
Identification and contact data: last name, first name, email address, telephone number** Data relating to marketing interactions*: opens, clicks, unsubscribes Browsing and website activity data associated with marketing campaigns: pages viewed, browsing path |
Consent | Data deleted upon unsubscribing or 3 years after the last contact |
| Management of prize draws | The necessary data is collected to run the promotional activities and send the prizes won | Last name, first name, email address, telephone number and postal address (depending on the purpose of the prize draw) | Consent | Data deleted 2 months after the prizes are awarded If you consent to the newsletter: until you unsubscribe |
| Management of reimbursement offers | The necessary data is collected to reimburse you and send newsletters with your consent | Name, email address, telephone number and postal address (depending on the purpose of the prize draw) | Consent | Deletion of data within a maximum period of 3 years after the end of the contract / until unsubscribing from the newsletter if consent to the newsletter has been given |
*Use of tracking pixels in our electronic communications
When we send you electronic communications (newsletters, commercial offers, etc.), we use tracking pixels embedded in our emails.
These trackers allow us to determine whether an email has been opened, which links have been viewed, and to measure the overall performance of our campaigns (open statistics, click statistics, unsubscribe rates, delivery errors).
The information collected in this way may include: whether or not the message was opened, the date and time it was opened, the links clicked, and a technical identifier associated with your email address. This information is used to measure the effectiveness of our communications, improve their content, and adapt our communication activities.
We do not use these pixels to track your browsing on other websites or to create a detailed profile of your activities outside our electronic communications.
The use of these pixels and the processing of the resulting data are based on your prior consent to receive our electronic communications, in accordance with the applicable framework governing electronic direct marketing and CNIL recommendations.
You may withdraw this consent at any time:
– by clicking the unsubscribe link included in each of our marketing emails, or
– by contacting us using the contact details provided at the end of this policy.
Withdrawing your consent does not affect the lawfulness of processing already carried out, but it will stop our marketing emails from being sent and the use of the associated tracking pixels going forward.
As part of our marketing and campaign management activities, we may use a marketing automation provider (e.g., Klaviyo), which may process certain data outside the European Union, particularly in the United States. In such cases, transfers are governed by appropriate safeguards (e.g., the European Commission’s standard contractual clauses and/or an applicable recognized mechanism).
**We do not sell, rent, or share your personal information, including your mobile service registration data and your consent to receive SMS messages, with third parties for advertising purposes.
6. Enable us to manage the loyalty program
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Management of the loyalty program |
The management of registration for and participation in the loyalty program. The monitoring the accumulation and use of loyalty points. Lthe awarding of benefits such as discount coupons or accessories. Lthe customer relationship management as part of the program. |
last name, first name, address and‑email address, date birthday history purchase history from the date of enrollment in the program. |
Consent | During the period of enrollment in the program |
As part of the loyalty program,Certain personal data processed by Yotpo on behalf of CROSSCALL may be hosted or accessed from countries located outside the European Union, notably the United‑States.
These data transfers are governed by the conclusion of standard contractual clauses adopted by the European Commission, as well as, where applicable, by the implementation of additional technical and organizational measuress in order to ensure an adequate level of protection for personal data in accordance with applicable regulationsble.
7. Enable us to improve our products and services
| Purpose of collection | Purposes | Data collected | Legal basis | Retention period |
|---|---|---|---|---|
| Management of opinion surveys | The necessary data are collected to understand your use of our products | Name, email address and telephone number, company name and occupation | Consent | Deletion once the survey results have been processed / If you consent to being contacted again, data will be deleted when you unsubscribe |
| Management of user experiences | The necessary data are collected to gather your user feedback on the products in order to improve them / contact you again for clarification about your answers | Gender, first name, email address, country | Consent | 2 years, then anonymization |
| Participation in the community of innovators | The necessary data are collected to manage registration and recruitment for the community of innovators, and to conduct market, satisfaction, needs, and usage studies | First name, last name, email address, date of birth, city, country, Children Y/N, sports practiced, frequency, Other optional information: apartment/house, car type (and desired type), desired clothing brand, professional category, working hours, work environment, income bracket | Consent, then performance of the contract / Legitimate interest | Until unsubscribed |
RECIPIENTS
The recipients of this data are:
- The service provider responsible for campaign management marketing (Klaviyo) ;
- The service provider responsible for managing the loyalty program (Yotpo) ;
- The service provider making the Customer Relationship Management (CRM) system and Marketing Cloud system available;
- The service provider making the online questionnaire deployment tool available;
- The service provider implementing online payment solutions;
- The service provider responsible for delivering orders;
- Repair centers;
- The service provider making the application management solution available;
- CROSSCALL's external DPO in connection with a data subject rights request.
TRANSFERS TO THIRD PARTIES AND OUTSIDE THE EUROPEAN UNION
Your personal data is preferably processed within the European Union.
For the aforementioned purposes, some of your personal data may nevertheless be transferred to third-party entities established in countries located outside the European Union (e.g., the company's processors involved in the aforementioned processing activities,...).
Some of these entities receiving your personal data are considered to provide a sufficient level of personal data protection because they are established in a country whose personal data protection regulations have been recognized as ensuring an adequate level of protection for said data (see European Commission adequacy decisions)
Furthermore, if the country of the entity receiving your personal data does not provide an adequate level of protection for said data, we ensure that appropriate security and confidentiality measures are taken to guarantee that your data remains protected.
Additionally, in these circumstances, you are informed that transfers of your personal data to other entities outside the European Union are governed by the implementation of appropriate safeguards, such as entering into contracts with the recipients of this data containing clauses compliant with the recommendations of the European Commission, enabling us to ensure that appropriate safeguards are in place for the protection of said data.
We also point out that transfers of personal data outside the European Union are lawful if (i) the transfer is necessary for the performance of a contract between the data subject and the Controller or for the implementation of pre-contractual measures taken at the data subject’s request, if (ii) the transfer is necessary for the conclusion or performance of a contract concluded in the data subject’s interest between the Controller and another natural or legal person, or if (iii) the data subject has given explicit consent to the proposed transfer after being informed of the risks that the transfer may entail for them due to the absence of an adequacy decision and appropriate safeguards.
CROSSCALL may be required to transmit personal data to the competent services and authorities in response to requests for information or administrative or judicial decisions.
DATA SECURITY
CROSSCALL takes care to ensure the security of your personal data hosted on its servers. The company takes the necessary technical and organizational security measures to ensure the integrity, confidentiality and availability of your data.
CROSSCALL employees who have access to the personal data of Site users by virtue of their duties undertake to maintain the strictest confidentiality in this regard.
The CROSSCALL website uses the TLS encryption protocol to ensure the confidentiality and integrity of your data transmitted via the site, as well as client-server authentication.
You can view our security certificate, issued by a third party, by clicking the padlock icon in your browser’s address bar.
DATA SUBJECT RIGHTS AND MEANS OF EXERCISING THEM
In accordance with French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (Articles 38, 39 and 40), and the General Data Protection Regulation, you have various rights regarding the use of your personal data. These rights are as follows:
- Access: Exercising the right of access enables the User to check the accuracy of their data and, where necessary, have it rectified or erased;
- Rectification: Exercising the right to modification enables the User to update their data;
- Data portability: Exercising the right to data portability enables the User to transmit their data to a third party of their choice;
- Erasure: Exercising the right to erasure enables the User to have their data deleted;
- Objection: Exercising the right to object allows the User to object to the use of their data for a specific purpose;
- Restriction: Exercising the right to restriction allows the User to ask an organization to temporarily suspend the use of certain data.
These rights may be exercised with the data protection officer of CROSSCALL by completing the form available on the following page: Personal data management
Please note that CROSSCALL also allows you to modify your personal information and withdraw your consent to commercial and promotional offers directly from your customer account. You can also unsubscribe from all communications by clicking the unsubscribe link at the end of the emails you receive.
If, after contacting the data controller or the data protection officer of CROSSCALL, you believe that your data protection rights are not being respected, you may submit a complaint online to the French Data Protection Authority (CNIL) or by post to 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07
ABOUT COOKIES
This site uses cookies to ensure the proper functioning of the site and a good user experience: normal browsing on the site, video playback, content sharing on social networks, and page audience measurement. Strictly necessary cookies are those related to the operation of the site.
This site also uses analytics cookies to improve the site’s functionality. All data collected by these cookies is anonymous.
Advertising cookies are used to display advertisements tailored to users’ interests and measure the effectiveness of advertising campaigns.
See the cookie policy to learn more.
AMENDMENT OF THE PRIVACY POLICY
CROSSCALL may amend this privacy policy. We therefore invite you to consult it regularly to keep up to date with its latest version.