Privacy and Cookie Policy

We work with other companies or persons or instruct them to carry out the processing and recording of data. They may have access to your personal data or user data, but only insofar as that is necessary for them to carry out their tasks.
We can use and transmit the information you have supplied and your personal data or your user account data to companies in the Lucrin group (Lucrin SA, Lucrin Spain SL, Lucrin Mauritius Ltd, Lucrin Hong Kong Ltd, Lucrin USA, Lucrin India Ltd and Lucrin Japan) for the purposes of evaluation, improvement and organisation according to the needs of our services and for the purposes of personalisation and marketing.

In addition to this, we transmit your data where necessary to third parties for the performance of the contract. For this purpose, we might send the required data to transport companies, banks and other service providers. These service providers use your data exclusively for the processing of the order and not for any other purposes. Insofar as it is necessary for the objectives cited in the first paragraph, the data may also be transmitted abroad, for the delivery of merchandise for example. You will find further information concerning the transmission of data abroad later in the document.

The personal data which you put at our disposal is neither sold nor leased nor exchanged. With the exception of the transmissions described beforehand, we only send your personal data if you have expressly consented to this, if there is a legal obligation so to do or if we need to do so in order to uphold our rights, particularly those arising from any contractual relationship.
In the case of sale, fusion or any other reorganisation of all or part of the asset values of our company, personal data can be transferred, sold or shared by other means with third parties as an element of the said transaction or reorganisation. In the case of an anticipated benefit, for example in the case of a purchase on invoice, we obtain a credit investigation as appropriate for the safeguarding of our legal interest, carried out according to a mathematical and statistical method by an intelligence agency. To do this, we send the personal data necessary for carrying out a credit investigation to an intelligence agency and use the information received relating to the statistical probability of non-payment to make a decision on the validity, the execution or the termination of the contractual relationship. The credit investigation may include probability scores (value scores) which are calculated on the basis of scientifically recognised mathematical and statistical procedures and which include in their calculations address data, among other data. Your rights to the protection of your data are taken into account in accordance with all legal provisions.

The aim of the Lucrin companies is to continually improve the digital services offered, to structure them in the safest way according to need. To this end, various analysis tools may be implemented to make a link between user-specific data, future and past, which we have available and to analyse, aggregate, pseudonymise and anonymise user behaviour across our services. In order to keep our database up-to-date, we are likely to make use of publicly available data or data from third party service providers. The findings from your use of our services may be used and evaluated as part of the analysis of user behaviour by other participating companies. This data processing relies primarily on pseudonymised or anonymised data. Its chief objective is to send you or to display anonymised advertising on one of our websites, as well as to improve the security of our websites.

We are entitled to send your personal data to third party companies (authorised service providers) located abroad, as soon as this is opportune for the processing of the data described in the current declaration on data protection. These companies are subject to the obligation to protect the data in the same way as ourselves. If the level of data protection in one country does not correspond with that of Switzerland, we ensure, through contracts, that the protection of your personal data corresponds with the level of protection in Switzerland. We call upon one or several of the following measures in order to do this:

by concluding UE-type contractual clauses with authorised service providers, cf.
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-transfer-personal-data-third-countries_fr

by ensuring that the authorised service providers are certified by the Swiss-US or EU-US Privacy Shield (insofar as the recipient of the data has its headquarters in the USA or if the data will be kept there), cf.
https://www.privacyshield.gov/

by the presence of Binding Corporate Rules (BCR) recognised by a European data protection authority among authorised service providers, cf.
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/binding-corporate-rules_en

You have the right to assert your data protection rights at any time and to request information regarding the personal data relating to you which we are processing.

You can also, at any time, have your personal data corrected, blocked or deleted by informing us in writing, with proof of your identity, to the following address:

We reserve the right to correspond with you regarding this. Please note that we sometimes have to keep some of your personal data as part of our legal and contractual storage obligations (for example, for the purposes of invoicing) even after your request to block or delete and in this case we only proceed to block your personal data insofar as required. Moreover, the deletion of your personal data could have the effect of preventing you from continuing to have access to or using the services which you have registered. Under certain conditions, you can ask us to send your personal data to you in standard format, or to a third party specified by you.

You can also oppose the processing of your data for marketing and advertising purposes at any time, as well as the transmission of your data within the Lucrin group. Such an opposition does not entirely exclude the collection of personal data. By using the following link, you can prevent the collection of your user data. The opposition only excludes personal data gathered being processed in a non-anonymised way for marketing purposes, as well as its transmission to other companies for this objective and its being processed by the latter. In order to totally exclude or, at least, reduce the collection of personal data, the steps mentioned in the section relating to the deactivation of cookies need to be carried out. This may have the effect of preventing you from using the services which you have ordered. In addition, you have the right to take action against the processing of data with the appropriate surveillance authorities. You can do this with your local surveillance authority, that linked to your place of work or the location of the alleged data protection infringement.

We only retain your data for the legal duration or that necessary for its processing. During analyses, we only store your data until the end of the process. If we store your data by virtue of a contractual relationship with you, we only keep it for the duration of this relationship and, at most, up to the deadline of any eventual claims in our favour or as stipulated either by the law or by the provisions in our contract.

We employ appropriate technical and organisational security measures in order to protect your personal data recorded by us against any unintentional, illegal and unauthorised manipulation, deletion, modification, access, transmission or use and against its total or partial loss. Our security measures are continuously adapted and improved in line with technological progress. We decline any responsibility in the case of loss of data or its communication to third parties and its use by them. If you register with us as a user, access to your user account is only possible with your personal password. We recommend that you always keep your payment and access information confidential and close down your browser when you have ended your communication with us, particularly when you are using a shared computer. We also pay serious attention to internal data protection. Our staff and that of service providers authorised by us are required to maintain confidentiality and respect of legal provisions for data protection.

Cookies help us to organise your visit to our websites better to make it easier, more pleasant and more relevant. Cookies are files containing information which the internet browser records automatically on your computer's hard disk when you visit our internet website.

Cookies do not damage your computer's hard disk and neither do we transmit users' personal data. As an example, we use cookies to know who has visited our portal and can infer from that how frequently some pages or services are visited, which parts of the portal are particularly enjoyed and how the portal is used. We use other cookies so that you can navigate freely around our website and use its functions, such as having access to protected areas for example. Cookies such as this also allow us to use the choices that you have made or the decisions that you have taken as parameters in order to make your visit to our portal more pleasant. Generally, cookies are used to improve our services and to make them more efficient and more secure. Cookies also allow the collection of information with a view to proposing advertising which might be of interest to you. Most internet browsers automatically accept cookies.

However, you can configure your browser so that no cookies are recorded on your computer or so that you are always informed when you receive a new cookie.

The use of our digital services is further measured and analysed by various technical systems, principally by third party suppliers such as Google Analytics. These measures can be carried out anonymously or not. It is therefore possible that the data collected may be transmitted to third parties for processing purposes. The most commonly used analysis tool is Google Analytics, a service of Google Inc. In principle, the data collected can thus be transmitted to a Google server in the United States, but IP addresses are anonymised by an ad-hoc process so that no association is possible. Google will therefore not be able to associate the IP address transmitted by your browser within the framework of Google Analytics to other data which it holds regarding you. By visiting the following internet website, it is possible to oppose the collection and processing of this data by Google Analytics by installing a cookie opt-out which prevents the future collection of your data when you are browsing:

https://tools.google.com/dlpage/gaoptout?hl=en

Please find below more information regarding the systems we use:

• AWS (our websites' data servers)
  https://d1.awsstatic.com/whitepapers/Security/AWS_Security_Whitepaper.pdf
• Braintree (a gateway for secure payment)
  https://www.braintreepayments.com/legal/braintree-privacy-policy
• Saferpay (a gateway for secure payment)
  https://www.six-payment-services.com/fr/services/legal/privacy-statement.html#country=ch
• Google analytics (Google's analysis system)
  https://static.googleusercontent.com/media/www.google.com/en//intl/en/policies/privacy/google_privacy_policy_en.pdf
• Salesforce (Marketing Analysis / CRM)
  https://help.salesforce.com/servlet/servlet.FileDownload?file=0150M0000041AzeQAE
• Microsoft Dynamics Nav (ERP, production and order shipping)
  http://www.microsoft.com/EN-US/privacystatement/DynamicsNAV/Default.aspx
• Fresh Desk (Online chat)
  https://www.freshworks.com/privacy/

We only process your personal data within the framework of the principles of data processing and if there is a legal foundation for so doing. This legal foundation exists at the stages of the preparation and execution of our contract.
In addition to this, we have an interest in constantly improving our services, adapting them to your needs and circulating advertising likely to be of interest to you. This is necessary in order to continue to develop and finance our services and to guarantee their security. We therefore start from the premise that our interests prevail. This is admissible if you have consented to the processing of your data.

If you have any questions relating to the protection of data on our internet websites, if you would like to obtain information or to request the deletion of your data, please make contact with our data protection manager by sending an e-mail to the following address:

The contact details of our data protection manager are as follows:

Lucrin SA
Data Protection Manager
24 Chemin du velours
1231 Conches
Geneva
Switzerland

The development of our internet website or the implementation of new technology can make the modification of the current data protection provisions necessary. Each important modification of these provisions is announced to registered users by e-mail to the e-mail address indicated at the time of registration or via a corresponding reference appropriately placed after connection to the user account. In addition to this, you can consult the data protection provisions currently in force at any time via our website and print them.
The original declaration of confidentiality is in French. The purpose of the translated versions is to facilitate its better understanding. In the case of any discrepancy, the French text is legally binding.

Geneva, 25th October 2018.