This confidentiality policy sets out the policy applied by PISCINES DESJOYAUX SA in relation to the protection of personal data and privacy within the framework of operating the website www.desjoyaux.eu.

1. Who are we?

PISCINES DESJOYAUX SA is a public limited company with share capital of €6,940,520, entered in the SAINT ETIENNE Trade & Companies Register with the no. 351 914 379, with its registered office at 42 Avenue Benoît Fourneyron 42480 LA FOUILLOUSE, represented by its Chairman and Chief Executive Officer, Mr. Jean Louis DESJOYAUX. PISCINES DESJOYAUX SA is the publisher of the website www.desjoyaux.eu and, therefore, processes your data in various ways in its capacity as the data controller.

2. Which data do we collect and under what regime?

2.1 THE TYPE OF DATA THAT WE COLLECT. On our website, we may collect personal data relating to you: When you order a catalogue,
when you request a quote or a bespoke feasibility study,
when you use the configurator,
when you enter a competition, or
when you contact us for other reasons.
Depending on your request, we collect the data necessary to identify you and to process your request appropriately (surname/first name/address/tel./e-mail address) and, more broadly, all the details needed to process your request. Some data is essential in order to respond to your request. This is the reason why some information is mandatory: this information is identified as such when you provide us with your data. When you visit our website, tracking technology is used and data is collected (IP address, connection and browsing data, order history, cookies, location data). For more information in this respect, please read our cookie policy. 2.2 The legal basis for data collection. The legal basis for processing personal data set out in article 2.1 is, as applicable, your consent, compliance with our legal obligations or our legitimate interests, in particular in terms of canvassing, insofar as this is not detrimental to your fundamental interests, rights and freedoms. You may withdraw your consent for the processing of your data at any time. 2.3 The purpose of processing your data. The purpose of the processing carried out to collect data when you contact our customer service is to process your request, to manage our after-sales and warranty service, as well as commercial management of our customer database. The purpose of the processing carried out to collect data when you contact us is to process your request, direct marketing and advertising. The purpose of the processing carried out to collect data when you request a catalogue, enter a competition, request a quote or a bespoke feasibility study or when you use the configurator is to manage your request, manage our leads and customer database, direct marketing direct and advertising. 2.4 Data retention period. The data collected within the framework of implementing a contract (after-sales service management when contacting customer service) is retained for 5 years from the last activity. The data collected when requesting a catalogue, a quote or a bespoke feasibility study, or when using the configurator or entering a competition, is retained for 3 years from the collection date.

3. What are your rights and how can you exercise them?

Law no. 78-17 of 6th January 1978, as amended, known as the French Data Protection Act (“Loi Informatique et Libertés”), as well as Regulation 2016/679 of the European Parliament and the Council of 27th April 2016, known as the “General Data Protection Regulation” (GDPR) provides individuals with various rights relating to their personal data. As we are committed to protecting the privacy of our potential partners, we undertake to uphold these rights, and to ensure they are upheld by all our service providers, where applicable. 3.1 Right of access, right to query, restriction and rectification You can obtain confirmation that we are processing your data and ask us to provide you with data relating to you that we have collected in order to verify the content. Furthermore, should you notice an error, you have the right to request that we rectify inaccurate or incomplete information relating to you. In the case of inaccurate data, you can exercise your right to the restriction of processing until this data has been verified. 3.2 Right to the erasure of data Under certain conditions, you can require personal data relating to you to be erased. 3.3 Right to object The right to object allows you to object to us using your data for specific purposes. You must specify the reasons relating to your particular situation and justifying your request. In all cases, you have a right to object to commercial canvassing. 3.4 Right to data portability You can ask to receive the data you have provided us with, in a machine-readable format, for personal use or in order to transmit this data to a third party of your choice. 3.5 Right to lodge a complaint Finally, you have the right to lodge a complaint with the relevant supervisory authority, in this case the CNIL, which you can contact via the website www.cnil.fr Or at the following address: CNIL
3 Place de Fontenoy – TSA 80715 –
75334 PARIS CEDEX 07 – FRANCE
Tel.: 33 (0)1 53 73 22 22 3.6 Right to define instructions in the event of your death You also have the right to define instructions relating to the fate of your data after your death (storage, erasure and communication). You can send us specific instructions for processing your personal data, which we will follow. 3.7 How to exercise your rights 3.7.1 Who should I contact? For all requests relating to the protection of privacy, the regime for handling our customers’ personal data or exercising the rights set out above, please contact us via the following e-mail address: personaldata@desjoyaux.eu Or by post: PISCINES DESJOYAUX SA
Données personnelles – Personal Data
42 Avenue Benoît Fourneyron – CS50280
42484 LA FOUILLOUSE CEDEX – FRANCE 3.7.2 How can I submit a request? To enable us to comprehensively and effectively process your request, please provide us with your surname, first name and complete contact details. Furthermore, as exercising these right is purely personal, you must enclose a copy of a form of identity with your request. Finally, we recommend that you state very clearly, in the subject of your request, the right that you wish to exercise. 3.7.3 Response time We undertake to respond to your request as quickly as possible, and at the latest within one month from receipt of your request. We will keep you informed, by this deadline, of the steps we have taken to respond to your request.

4. Who do we share your data with?

We are the principal recipient of your data. However, please be aware that some of our activities may be subcontracted. In this case, we make use of third parties. Within the framework of our contractual relationships with our subcontractors, we attach particular importance to the security of your data and its use by our contractual partners is strictly limited to the task with which we have entrusted them. Please be aware that PISCINES DESJOYAUX SA never sells the data collected to third parties. As stated above, we occasionally make use of service providers with which we share some of your personal data to provide the following services: Hosting, operation and maintenance of the website,
managing the customer database,
canvassing, business development and targeted marketing,
following up requests submitted using a form, Some information may also be transmitted to our distribution network if one of our partners is involved in your request, in particular in the case of a request for a catalogue or a bespoke feasibility study. In this case, you are informed of this when we collect your data. These are the only organisations with which we share your personal data. In principle, we will not transfer any of your data outside the European Union, thereby guaranteeing effective security of the protection of your data. However, within the framework of our distribution network and in order to best process your request, we may transfer your data to one of our local dealers outside the European Union, depending on the location you have specified. In this exceptional case of a transfer of data outside the EU, we attach particular importance to requiring a degree of protection equivalent to that which we benefit from within the European Union, in order to guarantee the confidentiality, integrity and security of your data. We may transmit your data to public authorities where we have a legal obligation to do so.

5. We pay particular attention to the protection of your data

We pay great attention to the security of your personal data, in particular by: implementing the appropriate organisational and technical security measures, requiring the establishment of adequate security measures by our subcontractors, requiring, as far as possible, that your data is hosted within the European Union. Nevertheless, there is no such thing as zero risk, as the internet is not a completely secure environment, and we are unable to guarantee the security of the transmission or storage of your information. Please be aware that, pursuant to the applicable regulations, in the event of a breach of your data, we are fully transparent and obliged to report this to the CNIL. Furthermore, in the event of a breach of your data, which may pose a high risk to your rights and freedoms, you will be immediately informed of the incident, its potential consequences and the measures taken to limit these consequences.

6. Modifying and updating this confidentiality policy

We reserve the right to update this confidentiality policy. You will be advised of this by e-mail.