This notice describes how HANA GROUP (hereinafter “HANA GROUP” or “we”) collects, uses and protects the personal data of prospects and customers of HANA GROUP and its brands.
1. Identity and contact details of the data controller
The data controller is HANA GROUP SAS, 101 rue Jean Jaurès, 92300 LEVALLOIS PERRET, FRANCE, represented by Mr. Eduardo ROMERO.
For certain processing operations, HANA GROUP SAS and HANA GROUP US LLC are joint controllers. An agreement defining their respective obligations is concluded between HANA GROUP and HANA GROUP US LLC.
2. Contact details of the data protection officer
The HANA Group Data Protection Officer (DPO) can be contacted at the following address email@example.com.
3. Purposes of processing – legal basis for such processing
We process your personal data for the following purposes:
– to perform a contract or take measures in connection with a contract: when you place an order, and in particular:
• to process orders, inform you of the status of your order and organize the delivery of your order,
• to communicate with you in relation to these orders and respond to any comment you may make.
– when you give us your consent:
• to send you information about our products and services, our promotional offers, our special operations, etc.,
• to answer to your requests or questions, when you use the contact form on our website, and / or to answer to comments you may send us in this context,
• when you browse one of our websites, we may set cookies or similar technologies in accordance with our cookie notice,
• other times when we ask for your consent, we will use your data for the purposes that we will explain to you on a case-by-case basis,
• we may use your data for personalized advertising purposes on our site and on those of our partners such as Facebook via personalized audience tools.
– if HANA GROUP needs it to carry out its activity and to assert its legitimate interests, in particular:
• to respond to your comments and to help us improve our products,
• to monitor the use of our websites and online services,we use the information you provide to examine any claim you make about our websites or our products or services,
• we use the data in connection with rights that we intend to assert and for compliance, regulatory and investigative purposes if necessary; and
• we use the data of certain people to invite them to take part to market research, trials and surveys.
– for the purposes required by law:
• in response to requests from public authorities or law enforcement authorities in connection with an investigation,
• in response to requests for access from data subjects as provided for by the law in force.
4. Recipient or categories of recipients of the data
Personal data are accessible to staff of HANA GROUP and its various brands, duly authorized on the basis of necessity criteria and are communicated to other external entities in the following cases:
• when the communication is required by laws and regulations applicable with regard to third legitimate recipients of communications, such as authorities and public bodies for the respective institutional purposes;
• when communication is necessary to perform a contract or pre-contractual activities activated by your order, to enable it to provide you with the information, products or services ordered.
Your personal data are also shared with our service providers, for example for the performance of technical and organizational services for the sole purposes indicated above, as independent service providers (in particular IT provider or in charge of data hosting services).
Finally, please note that your personal data are never sold to third parties by HANA GROUP and its brands.
5. Retention period of personal data
Your personal data are stored and retained by HANA GROUP for the time strictly necessary to achieve the purposes for which the personal data were collected. The retention period of your personal data therefore varies depending on the data and the purpose of their collection:
• Prospect data and data collected when using the contact form are kept for 3 years from their collection,
• Customer data are kept for 3 years from the order during which the data were collected,
• Data from customer relationship monitoring (management of complaints and satisfaction surveys) are kept for 5 years from their collection,
• The cookies installed have a lifespan of 13 months and the data from these cookies are kept for 25 months.
Once these deadlines have expired, personal data will be automatically deleted or anonymized.
The laws impose obligations to store documents for accounting and administrative purposes. These data will be deleted at the expiration of the period of 10 years from the termination of the contract and the delivery of the order.
7. Your rights (access rectification erasure right to withdraw consent).
During the retention period by HANA GROUP of your personal data, you have the following rights:
• Right of access: this is your right to obtain confirmation that your data is being processed or not, and if so, to access this data.
• Right of rectification: this is your right to obtain, as soon as possible, that your inaccurate data be rectified, or be completed if they are incomplete.
• Right to request erasure / deletion: this is your right to obtain, as soon as possible, the erasure of your data, subject to our legal retention obligations.
• Right of limitation: this is your right to obtain the limitation of the processing when you oppose it, when you dispute the accuracy of your data, when you believe that their processing is unlawful, or when you need it for the establishment, exercise or defense of your legal rights.
• Right to object: this is your right to object at any time to the processing of your data by HANA GROUP based on its legitimate interest, except in the case of legitimate and compelling reasons of HANA GROUP. You can also object to the processing carried out for the purposes of commercial prospecting.
• Right to portability: this is your right to receive your data in a structured, commonly used, machine-readable and interoperable format, and to transmit it to another controller without opposition from us.
• Right not to be the subject of a decision based on automated processing: you have the right not to be the subject of a decision based exclusively on automated processing producing legal effects concerning or affecting you, except when this decision is necessary for the conclusion or execution of a contract, or is legally authorized.
These rights can be exercised by contacting the data controller at the following address : firstname.lastname@example.org.
8. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority to which you report.