In accordance with Article 4.7 of the GDPR, BRUNE M. is the data controller for personal data collected on the website www.brune-m.fr. BRUNE M. determines the purposes and means of the processing activities.

BRUNE M. collects data for several explicit needs as set out below: analysis of website browsing behavior, sales operations, after-sales service, and commercial prospecting. Some data is collected automatically. You are then scrupulously informed in advance. Other collections are required by law and/or regulation (for example, for invoicing), and others are of strategic and commercial importance and require your prior consent.

In each case, BRUNE M. ensures compliance with regulations, the requirements of which vary from simple information to the prior collection of your agreement.

1. Automatically collected data
   In accordance with current legislative and regulatory provisions, we automatically collect certain information when you browse our site. This data includes:

• the device and browser used
• the IP address
• the date and time of your browsing
• your browsing history

For this data collection to be authorized by regulation, we provide you with an opt-out mechanism by updating your contact preferences in the “my account” section of our website or by contacting customer service. This option is available on all browsers and all types of devices (including smartphones and tablets). Contact us at contact@brune-m.fr if you experience difficulties using this mechanism.

In accordance with regulations, we also inform you that:

• The collected data is not cross-referenced with other processing (e.g., customer files or traffic statistics from other sites).
• The data collected by this means only results in the production of anonymous statistics.
• We do not track your browsing on other websites.
• The collected IP address does not allow for more precise geolocation than the scale of a city.
• This data is not retained beyond 13 months from your first visit.
• Raw traffic data associated with an identifier must also not be retained for more than 13 months.

Any data collection beyond that intended to feed these statistics requires your prior consent if it is not based on another legal ground.

1. Data collected when creating your customer account and when placing an order
   To create your account and access the ordering process, you will need to provide us with your company information as well as contact information, considered personal: your name, contact details (email and postal address, and telephone number), and bank details. The legal basis for this collection and processing is Article 6.1.b of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or "GDPR").
2. Data collected when you contact customer service

You may provide us with personal data when you contact customer service so that we can process your requests. Here again, the legal basis is Article 6.1.b of the GDPR. The legal basis for this collection and processing is Article 6.1.b of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or "GDPR").

In accordance with current regulations, BRUNE M. informs you that data will be stored for the period strictly necessary for their processing, in accordance with locally applicable regulations. For example, in accordance with French law, we are obliged to store payment and billing information for a period of 10 years.

BRUNE M. informs that it will process data in a lawful, fair, transparent, adequate, relevant, limited, accurate, and up-to-date manner. Therefore, BRUNE M. undertakes to take all reasonable measures to ensure that data is deleted or rectified without delay when inaccurate. An agent may contact you by telephone to ensure the conformity of the information provided.

BRUNE M. will process your data to fulfill its contractual obligations for printing your order and managing your customer account. Without this data, we may not be able to invoice the ordered services.

BRUNE M. will also process your information to send you promotional offers and product information if you have given consent to do so. You can withdraw your consent to receive marketing and product information at any time by updating your contact preferences in the "my account" section of our website or by contacting customer service.

In accordance with articles 15 to 22 of the GDPR, regarding the data we hold about you, you have the following rights:

– right of access (Article 15 of the GDPR)
– right to rectification (Article 16 of the GDPR)
– right to erasure (Article 17 of the GDPR)
– right to restriction of processing (Article 18 of the GDPR)
– right to notification of data: rectifications, erasure, restriction (Article 19 of the GDPR)
– right to data portability (Article 20 of the GDPR)
– right to object (Article 21 of the GDPR)
– right not to be subject to profiling (Article 22 of the GDPR)

You can exercise these rights by sending your request to the following postal address: BRUNE M. 18, rue de la Vallée 44700 Orvault or to the email address contact@brune-m.fr. Any request to exercise a right must be accompanied by a copy of a valid proof of identity to enable us to ensure that the request comes from the legitimate data subject. You can also contact the competent supervisory authority (CNIL) to lodge any complaint you deem appropriate.

BRUNE M. states that it may transfer data when necessary (for example, to subcontractors such as graphic designers and/or workshops, or carriers such as DHL, TNT, UPS, and La Poste).

This data transfer will be carried out in compliance with the guarantees, measures, and rights provided for by current legislation on personal data protection and in accordance with this privacy policy.

The retention periods for your data vary according to the state of the law and, when constraints are fewer, according to the recommendations of the CNIL and our needs. For example, we are legally required to keep invoices for 10 years. Billing data is therefore kept for 10 years.

This privacy policy was updated on May 13, 2019. From time to time, BRUNE M. may make changes to its privacy policy and update it on its website. Any update to this policy will be indicated by easily identifiable banners on our website and/or the sending of informational emails.