Caran d’Ache confidentiality policy

Caran d’Ache (“Caran d’Ache”, “we” or “our”) attaches great importance to respect for your privacy.

The aim of the present Caran d’Ache confidentiality policy (“confidentiality policy”) is to provide you with all the necessary information concerning how your personal data is processed when you access one of our digital platforms (ex: e-boutiques or Creative Class platform) or when you visit us in our workshops or premises, when you contact our customer service or after-sales service, when we organise an event or when we collect your personal data via other channels.

Our confidentiality policy does not apply to personal data collected via third-party websites which may provide a link from our digital platforms. We have no control over and accept no responsibility with regard to how your personal data is processed by any such websites, which are governed by their own confidentiality policy.

Our confidentiality policy applies to all Caran d’Ache entities:

• Caran d’Ache SA
• Ecridor SAS
• CARAN d’ACHE Vertriebs GmbH Deutschland
• Caran d’Ache Japan Ltd

In accordance with the General Data Protection Regulation no. 2016/679 adopted within the European Union (“GDPR”) and the Federal Act of 19 June 1992 relating to data protection, as amended on 25 September 2020 (“FADP”), the Swiss company Caran D’Ache SA, chemin du Foron 19, CH-1226 Thônex-Genève, is responsible for processing your personal data.

1. Personal data that we collect

We can collect the following data that you provide directly and actively when you create an account on our digital platforms, complete our customer form in one of our stores, purchase a product or call our customer service or after-sales service, or that you communicate to us by e-mail or telephone:

• Identity and contact information: this includes data relating to your accounts on one or the other of our digital platforms and information which may enable us to contact you (surname, first name, username, avatar, password, postal address, e-mail address, mobile number or other telephone number).
• Payment information: except for the name associated with your payment card and information about the transaction (e.g., time of transaction, amount) payment information is collected directly by a third-party payment supplier and is not transferred to us;
• Data relating to our customer service and after-sales service (requests sent to our customer service or after-sales service, comments concerning the user experience with our products, complaints and repair/replacement history).
• Socio-demographic data, purchasing history and preferences: this refers to data specifying your personal status (title, date of birth, language preferences) and your behavioural characteristics (type and number of products purchased/returned, favourite products).
• The images, photographs, videos, comments and other content that you provide in connection with our products.

We can also collect other types of personal data indirectly (through third parties including websites and social networks) or using automated technologies:

• Information (such as that listed above) that we can obtain through our commercial partners.
• Information about you originating from sources in the public domain, including content on social media platforms. If you wish to stop sharing this information, we recommend that you consult the conditions of use of the social networks concerned.
• Contact details with which you provide us regarding family or acquaintances that you would like us to contact.
• Video-surveillance images of Caran d’Ache stores, workshops or premises.
• Data relating to the traffic on and use of our digital platforms (e.g.: IP address, browser name and type of device used) obtained by automated technologies such as cookies. Certain cookies are necessary to ensure that our digital platforms operate correctly while others are used for marketing or statistical purposes in order to offer you advertising adapted to your needs and wishes as well as ensuring an enhanced browsing experience taking account of your choices and preferences (cf. “How your personal data is used”). You can consult the following policies concerning the use of cookies to find out which cookies are used, how to manage consent and how to configure the relevant settings on each of our digital platforms:
- - For our e-boutiques (carandache.com), please read our cookie policy here.
- - For our Creative Class platform (creativeclass.carandache.com), please read the cookie policy here.

2. How your personal data is used

We collect and use the personal data described above (cf. “Personal data that we collect”) based on one of the following legal foundations:

• Your consent. This can be withdrawn at any moment (cf. “Your rights in relation to your personal data”).
• A contract between us (e.g.: purchase of a product from one of our e-boutiques or of a pack giving you access to our Creative Class platform), insofar as use of your personal data is necessary to perform this contract. • A legal obligation by which we are bound.
• Legitimate interests that we pursue (e.g.: performance and security of our digital platforms).

We can use this personal data for the following purposes:

• To process your orders, purchases and deliveries.
• To provide you with the services of our customer service or after-sales service
• To answer your requests, comments or complaints.
• To ask your opinion in relation to the products or services with which you have been provided and/or your browsing experience.
• To improve our products and services according to the history of your relationship with Caran d’Ache and your preferences.
• To inform you by e-mail, letter or newsletter of our news, new product features, services, partnerships or projects and special offers by providing you with content adapted to your needs and wishes, with your consent when this is required. We can use third-party services or tools such as cookies (cf. “Cookie policy for Caran d’Ache e-boutiques” and “Cookie policy for Creative Class platform”) or targeting methods to provide you with personalised advertising via the social networks or third-party websites you visit. The targeting methods we use match the e-mail address you communicate to us with the address you may have communicated to our service providers (e.g. if you have a Google or Facebook account). They also enable us to target other individuals with profiles similar to yours. You can choose not to receive this type of advertising by managing your consent or adjusting the cookie settings (cf. “Cookie policy for Caran d’Ache e-boutiques” and “Cookie policy for Creative Class platform”) and by logging out of the accounts of the service providers concerned. We nevertheless do not control the targeting technologies used by third parties, even if we use them for our digital platforms or advertising. We therefore suggest that you also consult the conditions of use and the confidentiality policies of these service providers.
• To meet our accounting obligations and any other legal or regulatory obligations.
• To prevent and combat any fraudulent or illicit activity, and in particular to take action against the resale of our products in breach of the rules applicable to our distribution network.
• To ensure the security of our stores, workshops and premises as well as IT security.
• To administrate and optimise our digital platforms, analyse and implement statistics relating to their use and enhance your browsing experience.
• To geolocate you in order to help you find the closest Caran d’Ache point of sale (insofar as you have consented to this via your browser).

We will never sell your personal data to anyone.

3. How your personal data is stored

We store your personal data for a limited period of time and, in principle, only for the amount of time necessary for the processing purposes described above (cf. “How your personal data is used”), unless we have a legal obligation to store the data for a longer period of time or we are authorised to store it for archiving purposes.

• In this case, storage of the personal data used to provide you with information relating to our news or to new features of our products and services or to send you our newsletter or personalised advertising shall not exceed three years from the end of your commercial relationship with Caran d’Ache or from your last contact with us if you are a citizen of a member state of the European Union or of Switzerland. This period shall increase to ten years if you are a citizen of the United States and five years if you are a citizen of Japan.
• The data relating to the management and history of your purchases and the services provided as well as to the handing of complaints shall be stored for a maximum duration of ten years from the last purchase or service provided.
• The personal data that we collect in order to manage your right of access to or rectification of your personal data shall be stored for a maximum time frame of three years.

The storage periods indicated above apply, unless you withdraw your consent beforehand (if personal data processing is based on consent) or unless you request that your personal data be deleted or no longer used before the expiry of the storage period (cf. “Your rights in relation to your personal data”).

4. Protection of your personal data

Transmission of data on the Caran d’Ache websites is governed by the HTTPS protocol (Hyper Text Transfer Protocol Secure). The HTTPS protocol allows the integrity and confidentiality of your personal data to be protected during transmission by encrypting it before it is sent to us.

Once your data has been sent, we protect it, within the limits of the technologies available and the implementation costs, in order to avoid any unauthorised access, loss, destruction, alteration or disclosure by taking technical and organisational measures. In particular, we have introduced security measures in order to control and limit access and have implemented procedures enabling us to control the data flows appropriately.

5. Protection of children’s personal data

We do not intentionally collect the personal data of children under the age of 16 or below any other age limit in accordance with the local regulations applicable. Where necessary, we immediately delete the personal data in question unless we have obtained parental consent or the consent of another legal representative.

6. How your personal data is shared

We can share your personal data within the Caran d’Ache entities in Switzerland, France, Germany and Japan. These entities are established in countries guaranteeing an adequate level of personal data protection.

Outside Caran d’Ache, we may be called on to share your personal data:

• With service providers to support us in our activities and our business (e.g.: execute your order, deliver your products, process your payments, organise events, analyse and improve our marketing strategy, send you our newsletter, e-mails, letters or personalised advertising, host, manage, maintain, secure our digital platforms and analyse their use, prevent and combat fraud and ensure the security of our stores, workshops and premises);

We demand that our service providers offer the necessary security and confidentiality guarantees and that they take the appropriate technical and organisational measures in accordance with the legislation in force.

These service providers are, for the most part, located and, where applicable, process your personal data in Switzerland or in the European Union. If we are required to share your personal data with service providers outside these countries, this will only occur in countries identified by the Federal Commissioner for Data Protection and Transparency or by the European Commission as ensuring an adequate level of personal data protection or, with regard to the United States, service providers with whom we have agreed appropriate guarantees. You can, at any time, request the list of countries to which we may be required to transfer your personal data for the purposes indicated above (cf. “How your personal data is used”) by contacting us (cf. “To contact us”).

Our service providers may only process the personal data we share with them in compliance with and within the limits of our instructions. In no event do they use or share the data we send them for their own interests.

• With a third party, a court of law or a public authority if the law so requires or to assert a legal claim within the framework of a court petition or legal proceedings or to combat fraudulent or illicit activities.

7. Your rights in relation to your personal data

You have the right to access your personal data in the possession of Caran d’Ache and to request a copy of it. You can also request that your personal data be rectified or deleted or oppose it being processed, in accordance with the laws applicable in terms of personal data protection, subject to a legal obligation or storage authorisation by which we may be bound and taking account of the technologies available and the implementation costs.

These requests must be sent to the postal or electronic address indicated below (cf. “To contact us”).

You also have the right to withdraw your consent at any time and thus to request that you no longer receive any information or offers from us by unsubscribing from our newsletter, by following the deregistration procedure described in the messages you receive from Caran d’Ache or by writing to us at the postal or electronic address indicated below (cf. “To contact us”).

Without prejudice to any other legal remedy, you have the right to file a complaint with the competent supervisory authority of the European Union for the application of the rules stipulated in the GDPR or to the Federal Commissioner for Data Protection and Transparency under the conditions provided for in the FADP.

8. Update of our confidentiality policy

We reserve the right to update the confidentiality policy at any time. We encourage you to consult this page on a regular basis in order to note any changes made.

9. To contact us

For all questions relating to our confidentiality policy, please contact us at the following e-mail address, info@carandache.com, or using the postal address Caran d’Ache SA, chemin du Foron 19, CH-1226 Thônex-Genève.

This document was updated on July 13th 2023.