Privacy Notice

Contents

1. Introduction
2. Who we are
3. Data Protection Contacts
4. What personal information does Rosemood collect?
5. Why we collect your personal information
6. Data Retention
7. Marketing
8. Group companies
9. Cookies
10. Our external service providers
11. Your rights

1. Introduction

Protecting your data, privacy and personal information are very important to us here at Atelier Rosemood, and we ensure that we respect all relevant regulations to make sure that your data is secure. This privacy notice outlines what personal data we collect from you, how it is used in the processing of your order and how your personal information is stored and shared. Please read this privacy notice carefully to understand the types of personal information we collect from you and your rights in relation to the personal data you provide to us.

2. Who we are

Rosemood is an established French company specialising in the creation and production of personalised wedding and baby stationery, as well as photo books, prints and notebooks.

Address: 12 Boulevard Gisele Halimi, 44200 Nantes, France

Email: atelier@rosemood.fr

Tel: +33 2 52 20 00 00

3. Data Protection Contacts

For this Privacy Notice, Atelier Rosemood is the Data Controller. If you have any questions or issues about how we process your personal data or this Privacy Notice you can contact us using the contacts below:

Atelier Rosemood: rgpd@rosemood.fr

You can also contact our UK Data Protection Representative:
Privacy Partners Limited
info@privacypartners.uk

We will always try to resolve any issue or question directly with you first, however if you remain unhappy with how we’ve used your data after raising a complaint with us or our Data Protection Officer, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

4. What personal information does Rosemood collect?

We collect the following information about you under the following circumstances:

When you email us

If you contact us directly by email with any questions, we will maintain a record of these emails. You are able to request deletion of these emails at any time.

The lawful basis for processing this information is our legitimate interest to carry out our day-to-day business in managing communications with our customers.

When you personalise our online products without creating an account

When you visit our website without creating an account and personalise our products (such as photo books) with your own photos and text, we gather and store this personal data to our server. We only store the data (text and images) you have provided. As you have not yet created an account with us, the personal data you have uploaded at this stage is not linked to any additional data such as your name, address, email or telephone.

Please note – the images and text that you provide will be saved to our servers, therefore you should be mindful of exactly what content you are prepared to save in these circumstances. You should not use any images or text that you do not wish to share.

If you leave the website without creating an account, you are able to retrieve your personalised product as we use cookies which are placed on your computer which recognise your computer, so the next time you visit your items are still available for further actions. Please see the Cookies section of this Privacy Notice below for more information.

You can delete this personal information you have uploaded at any stage when you revisit the site. We store the text and photographs used in our editing tool for one year, after which it is deleted. You can contact us to delete your personal data at any time.

The lawful basis we use for this processing under UK GDPR is Article 6 – Consent, in conjunction with Article 9 (which covers any potential special category data) – Explicit Consent. You have the right to withdraw your consent at any time (please see Section 11 – Your rights, below).

If the registration serves the fulfilment of a contract to which you are party, or the fulfilment of pre-contractual measures, then the lawful basis for processing the data is Article 6 – Performance of a Contract.

The lawful basis for the processing the data of a child under the age of 13 is Article 6 and Article 8 – Consent, which is only valid if the consent is provided by the holder of an individual with parental responsibility for the child.

When you create an account on our website

When you create an account, we will store the email address that you have provided as part of your log in details. Otherwise, the data we collect from you will depend on what information you provide within your personal account. If provided, we will store your name, address, telephone number, your photos and how you came across our website.

The lawful basis we use for this processing under UK GDPR is Article 6 – Consent, in conjunction with Article 9 (which covers any potential special category data) – Explicit Consent. You have the right to withdraw your consent at any time (please see Section 11 – Your rights, below).

If the registration serves the fulfilment of a contract to which you are party, or the fulfilment of pre-contractual measures, then the lawful basis for processing the data is Article 6 – Performance of a Contract.

The lawful basis for processing the data of a child under the age of 13 is Article 6 and Article 8 – Consent, which is only valid if the consent is provided by the holder of an individual with parental responsibility for the child.

When you create an account and save a draft of your personalised product

As well as the personal data stored in the event of creating an account, we will also store any photos that you have uploaded to your stationery or photo book, as well as any text that you have added. This will allow you to retrieve your drafts by simply logging into your account.

For all drafts created, you can delete your text and photos at any time, meaning that they will also be deleted from our servers.

The lawful basis we use for this processing under UK GDPR is Article 6 – Consent, in conjunction with Article 9 (which covers any potential special category data) – Explicit Consent. You have the right to withdraw your consent at any time (please see Section 11 – Your rights, below).

If the registration serves the fulfilment of a contract to which you are party, or the fulfilment of pre-contractual measures, then the lawful basis for processing the data is Article 6 – Performance of a Contract.

The lawful basis for the processing the data of a child under the age of 13 is Article 6 and Article 8 – Consent, which is only valid if the consent is provided by the holder of an individual with parental responsibility for the child.

When you submit an order on our website

As well as the data stored when creating an account and saving a draft, we will also keep a record of your payment history, (but never the details of your payment cards). We will, therefore, store the date and time of any payments made, as well as the total amount paid. We will also keep a record of all the products that you have ordered from our website.

The lawful basis we use for this processing under UK GDPR is Article 6 – performance of a Contract, where the processing of the data is necessary to conclude your contract and purchase with us.

When you sign up to our newsletter without creating an account

You can provide us with your email address or create an account via our website to subscribe to our newsletters and latest offers. In this case, we will store your email address, solely for the purpose of sending you our electronic communications. We use consent for this purpose, as we always ask you for your consent before processing. You may withdraw your consent and unsubscribe to this service at any time.

The lawful basis we use for this processing under UK GDPR is Article 6 – Consent.

When you participate in our giveaways on social media

If you participate in any of our giveaways on our social media platforms, then we will ask you to provide us with your email address so that we can contact you in the event that you are chosen as our winner. In the case of a physical prize, we will also ask for your postage address. Your email and postage addresses will not be used for any other purpose. We will only ever process this data with your consent, and you may withdraw that consent and opt out at any stage.

In the event of a competition or giveaway, we may also ask you whether or not you wish to receive our newsletter. If you decide to opt into our newsletter, we will store your email address, solely for the purpose of sending your our electronic communications.

The lawful basis we use for this processing under UK GDPR is Article 6 – Consent. For the processing of your personal data in order to generally communicate with customers and interested parties is Article 6 – Legitimate Interest. It is in our legitimate interest to provide you with the correct and requested information.

Any other communications relating to your purchase and product once you have signed up is based on UK GDPR Article 6 – Performance of a Contract.

5. Why we collect your personal information

Depending on the above scenarios, we will use your personal information in order to:

• Allow you to produce draft products without creating an account

• Create an account with us

• Manage your online account

• Process your orders, including payment, delivery and eventual returns

• Communicate with you about your order

• Send you our newsletters and offers

6. Data Retention

We will only keep and use your data for as long as it is necessary.

Personal Data we collect when you create drafts products on our website without creating an account is kept for one year, after which it is deleted from our servers

Personal Data we collect when you create an account with us via our website is kept for 6 months, after which it is reviewed and deleted if no longer necessary.

Personal data we collect when you subscribe to our marketing newsletters is kept for 6 months, after which it is reviewed and deleted if no longer necessary.

Personal data we collect when you opt in to our giveaways and competitions via our social media platforms is kept for 6 months, after which it is reviewed and deleted if no longer necessary.

Rosemood maintains a Data Retention Policy and Schedule which details all the data we collect and maintain, plus our methods of and schedule of destruction. You can request what information we hold about you, and also request your data is deleted, please see your rights in the section below.

7. Marketing

We will only send you newsletters if you have personally subscribed to opt in to this service, either through your account, or through the website if you have not created an account. You may opt out at any time.

We will only contact you in regard to giveaways or competitions either through our website or social media platforms if you consent and provide us your information to allow you to participate. You may opt out at any time.

Rosemood will never sell your data to any third parties. Rosemood will never share your data with any third parties without your knowledge and consent, unless we are lawfully required to do so by a legal obligation.

8. Group Companies

Your personal data is only accessible to the group of companies of Rosemood, Celebrate, Celebrate Printing, Kartenmacherei employees who look after accounting, the sending of newsletters and those who process your orders. More generally, your personal information can be accessed by all those who will be involved in the management of our relationship with you. The data is only used for the management of the services we provide you, and will not be used for any other purpose or marketing.

To ensure a smooth service offering, your personal data may be processed between ROSEMOOD SAS and our affiliated companies, the German legal entities:

• celebrate company GmbH, Friedrichshafener Straße 5, 82205 Gilching, Germany

• celebrate digital printing GmbH, Spittelbronner Weg 95, 78056 Villingen-Schwenningen, Germany

• die kartenmacherei GmbH, Friedrichshafener Straße, 82205 Gilching, Germany

As part of a group of companies we have a legitimate interest in sharing personal data within the group to carry out the functions outlined above.

9. Cookies

What are cookies?

If you are just browsing our website, we may collect your data using cookies or other tracking technologies.

Cookies are small text files that are placed on your device, such as your computer, phone, or tablet, when you view pages on our website. These cookies allow us to track some of your browsing preferences and optimise how website works.

What types of cookies are there?

First Party Cookies

First party cookies hosted on the website you are visiting. They are only set or retrieved by the website while you are visiting it, so they cannot normally be used to track activity or pass data from one site to another. However, the owner of that website can still collect data through their cookies and use that to change how the website appears to the user, or the information it displays.

Third Party Cookies

Third party cookies are where the host domain or address is not the same as the website you are visiting. They are usually placed in a website via scripts or tags added into the web page. Sometimes these scripts will also bring additional functionality to the site, such as enabling content to be shared via social networks.

Online advertising is the most common use of third-party cookies. By adding their tags to a page, which may or may not display adverts, advertisers can track a user (or their device) across many of the websites they visit.

Our use of Cookies

While we are not looking identify you using cookies as the focus is on your device, it may be possible for us to identify you or infer information about you. Unless the cookies are “strictly necessary” to make our website function, we will always ask for your consent before they are placed on your device.

We ask you to approve the use of cookies on your first visit to our website via our cookie banner. If you do not wish for us to record this personal data, you can deactivate the cookies in your browser. You will still be able to use all of our services, but you will be unable to come back to any drafts that you may have started on the website. You can also delete any information stored by your computer cookie by clearing your browser’s cache and cookies. Alternatively, you can opt to enable private browsing on your computer before accessing our website.

10. Our external service providers

Whilst we are experts in producing high-quality personalised stationery, like all companies, we don’t know how to do everything! We, therefore, work with multiple external subcontractors, who we trust with some of your personal data, with the aim of being able to meet your needs. We ensure that our partners respect the required data protection regulations and law, and provide the equivalent protection as provided by the UK GDPR.

Where any data is transferred to a country outside of the UK or EU (called a 3rd country, such as the USA for example), that country will either have an Adequacy Agreement in place, (in the case of the USA the EU/UK-US Data Privacy Framework) to ensure the same level of data protection, or there will be the necessary documentation, agreements and regulations in place with that 3rd country provider to ensure the same level of data protection.

Here is a list of our partners, with information about which elements of your personal data they store or process. You can consult their privacy policies on their websites, using the links provided:

Amazon Web Services: we use this service to stock your personal photos.

Google Analytics: we use this service for tracking our webshop.

Maxcluster: we use this service for hosting applications.

SvenSenders: manages our standard deliveries to UK. We provide them with your name, delivery address, telephone number and email.

Royal Mail Group: manages our standard deliveries to UK. We provide them with your name, delivery address, telephone number and email.

Payone, PayPal: HiPay, PayOne, PayPal manage all payments made via our website & app, and store all relevant data about your payment history.

Further external recipients of your personal data include, in particular:

Processors

• Dixa, Vimmelskaftet 41a 1st floor, Copenhagen, Denmark

• Magento Commerce International Limited, 21 Charlemont Place, D02 WV10, Dublin, Ireland

• Parcel Perform Europe PPE GmbH, Brunnenstrasse 194, 10119 Berlin, Germany

Affiliated companies

• celebrate company GmbH

• celebrate digital printing GmbH

• Rosemood SAS

Production Partners

• Elanders Donauwörth GmbH, Am Stillflecken 4, 86609 Donauwörth, Germany

• Picture Perfect, 62 bd Davout, 75020 Paris, France

11. Your rights as a UK data subject under the UK GDPR

• Your right of access

  • You have the right to ask us for copies of your personal data.

• Your right to rectification

  • You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Your right to erasure

  • You have the right to ask us to erase your personal data in certain circumstances.

• Your right to restriction of processing

  • You have the right to ask us to restrict the processing of your personal data in certain circumstances.

• Your right to object to processing

  • You have the right to object to the processing of your personal data in certain circumstances.

• Your right to data portability

  • You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.

• Your right to withdraw consent

  • When we use consent as our lawful basis you have the right to withdraw your consent.

You don’t usually need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you.

To make a data protection rights request, please contact us using the data protection contact details at the top of this privacy notice.

Atelier Rosemood Privacy Notice
Version 1.0
Date: 25th July 2024