Preamble

When browsing the Guestspot website accessible from the domain name www.guestspot.tattoo (hereinafter referred to as the "Platform"), users are required to communicate personal data.

Consequently, the purpose of this privacy policy (hereinafter referred to as the "Privacy Policy") is to inform users of the conditions of use of their data and of their rights.

The Platform complies with French and European provisions relating to the protection of privacy and personal data, in particular French Law No. 78-17 of 6 January 1978 relating to information technology, files and civil liberties, as amended by Law 2004-801 of 6 August 2004, and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

I – Data controller

The controller of the personal data is Romain Monteil, a sole proprietorship, registered in the national business register under number 920 795 986 and whose registered office is located at 1 impasse José Wergifosse - 87110 Solignac (hereinafter referred to as the "Company").

II – Types of data collected

The data collected on the Platform is that which allows the Company to identify users directly or indirectly, but also that which allows the user to use the services offered by the Company (organizing guest sessions, posting reviews and comments, etc.).

This may be personal data such as last name, first name, email address, postal address, billing address, phone number, date of birth, or connection data such as the IP address and browser data such as cookies.

Users who communicate the personal data of a third party must confirm that they hold the consent of that third party regarding the use by the Platform, the publication and/or dissemination on the Platform of this data.

III – Purpose of processing

The personal data collected on the Platform is used for the following purposes. In accordance with Article 6 of the GDPR, each processing operation is based on a specific legal basis:

On the basis of the performance of the contract (Art. 6.1.b)

• Account creation and user authentication;
• Setting up and using the services offered by the Company;
• Contact with the user and customer relations;
• Providing support tools adapted to users' needs;

On the basis of a legal obligation (Art. 6.1.c)

• Setting up and managing accounting tools (billing, accounting);
• Managing user rights requests (right of access, rectification, deletion, objection, restriction and portability), disputes and litigation related to the use of the Platform and the services offered by the Company;
• Responding to the Company's legal and/or regulatory obligations;

On the basis of the Company's legitimate interest (Art. 6.1.f)

• Improving the quality of the Platform, the services offered by the Company and their functionality;
• Analyzing the user's account to provide a personalized and satisfactory service, to ensure customer relations, to set up satisfaction surveys and/or evaluations of the services offered by the Company;
• Interaction with social networks;

On the basis of the user's consent (Art. 6.1.a)

• Carrying out commercial prospecting and loyalty operations, selecting users for solicitation actions and enriching user data;

The user may withdraw their consent to processing based on it at any time, without affecting the lawfulness of the processing carried out before this withdrawal.

IV – Methods of collection

The personal data collected by the Company is freely communicated by the user.

Personal data is collected when using the Platform, in particular when the user:

• creates an account on the Platform;
• browses the pages of the site;
• sends a request to the Company;

V – Consent

The Privacy Policy is brought to the users' attention before they register on the Platform.

Creating an account constitutes acceptance of the processing necessary for the performance of the contract and compliance with the Company's legal obligations (legal bases Art. 6.1.b and Art. 6.1.c of the GDPR). This processing is essential to the provision of the Services and cannot be refused without preventing access to the Platform.

Processing based on consent (in particular commercial prospecting) is subject to a separate and explicit consent request at registration or later. The user may withdraw this consent at any time, without affecting the lawfulness of prior processing, by sending their request to dpo@guestspot.tattoo or from their Account settings.

The Company does not make access to the Platform or the Services conditional on acceptance of processing that is not necessary for their performance.

As the Platform is reserved for people aged at least 18, no data relating to minors is collected intentionally. Should the Company become aware of such data, the data concerned would be deleted without delay.

VI – Recipients and processors

The recipients of the personal data collected on the Platform are primarily the Company.

The Company uses processors to operate the Platform, in particular in the following categories:

• Hosting: OVHcloud (2 rue Kellermann, 59100 Roubaix, France) — hosting of the Platform and data;
• Payment: third-party payment provider — processing of transactions and billing data;
• Search engine: internal indexing tool — indexing and searching of user profiles;

These processors act only on the Company's instructions and are contractually bound to respect the confidentiality and security of the personal data entrusted to them.

In the event of a change of control of the Company, an acquisition, insolvency proceedings or a sale of the Company's assets, the personal data collected by the Company may be transferred to third parties.

In addition, third parties may have access to personal data in order to comply with a legal obligation. Where required by law, the user's consent will be collected, or an opportunity to refuse will be provided before any transmission of data.

Transfers outside the European Union: as far as possible, the data is hosted within the European Union. When a transfer to a third country is necessary, the Company ensures that appropriate safeguards are put in place (standard contractual clauses approved by the European Commission or countries benefiting from an adequacy decision). The user can obtain information on these safeguards by contacting the data protection officer at dpo@guestspot.tattoo.

VII – Retention period

The personal data collected from users is retained for a period of one hundred and eighty (180) days from the deactivation of access to the Services offered by the Platform, with the exception of data that the Platform would need to retain as evidence, for legal or administrative purposes or in accordance with the legislation in force.

By way of exception to the paragraph above, users are informed that:

• The billing data collected (including user account data on the Platform's billing tool) is retained for a period of five (5) years;
• The invoices associated with user accounts are retained for a period of ten (10) years in accordance with Article L.123-22 of the French Commercial Code;
• Cookies are retained for a maximum period of twelve (12) months after they are first stored on the user's terminal equipment;

VIII – Cookies

Cookies or other means of recording the browsing data collected are used by the Platform to identify users and record their preferences for the sole purpose of providing the Services requested by the User.

In addition, the Platform uses one (1) type of cookie:

• Functional cookies to ensure the operation of the Services;

Whatever the type of cookies, they are not retained for more than twelve (12) months after they are first stored on the user's terminal equipment.

At the end of this period, they are deleted, and the user's consent will be collected again if necessary.

Browser configuration software allows the user to be informed of the presence of a cookie, or even to refuse it.

It is therefore up to the users themselves to configure their browser to refuse cookies.

IX – Users' rights

In accordance with French Law No. 78-17 of 6 January 1978 relating to information technology, files and civil liberties, as amended by Law 2004-801 of 6 August 2004, and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, users have:

• A right of access to their personal data;
• A right to rectification of their personal data;
• The right to obtain the deletion of their personal data;
• A right to object to the use of their personal data;
• A right to restrict their personal data;
• A right to portability of their personal data;
• The right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the supervisory authority competent in France, via its website www.cnil.fr or by post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

Users who wish to exercise one of their rights can send their request by email to the following address: dpo@guestspot.tattoo.

For security reasons, if you request the deletion of your data, a confirmation email will be sent to the email address associated with your Account. Please reply to this email to confirm the deletion process.

When exercising one of these rights, users must provide the Platform with all the information necessary for their identification: name, email, login ID and possibly postal address. In addition, in accordance with the regulations in force, their request must be signed, accompanied by a copy of an identity document bearing their signature, and specify in detail the right of objection they wish to exercise and the address to which they wish the response to be sent.

The Company undertakes to respond within a maximum of one (1) month following receipt of the complete request. Given the complexity and number of requests, this period may be extended by two (2) additional months, provided that the Company informs the users, within one (1) month of receipt of the requests, of the reasons for this delay.

X – Automated decision-making and profiling

The Company does not use fully automated decisions, including profiling, that produce legal effects or significantly affect users within the meaning of Article 22 of the GDPR.

The Platform may use recommendation algorithms to suggest relevant Profiles to Users (for example when searching for Clients or Providers). This processing does not produce legal effects with respect to users and does not constitute profiling within the meaning of the GDPR.