Privacy Policy

Last updated : July 1st 2024 

Preamble

Le Collectionist, a société par actions simplifiée (simplified joint stock company) with share capital of €1,026,550.70, registered with the Paris Trade and Companies Registry under number 789 370 152, having its registered office at 65 rue de la Victoire - 75009 Paris (hereinafter, "Le Collectionist", "We", "Us", "Our") takes very seriously the protection of the personal data of its customers and prospective customers on the one hand and of property owners wishing to offer or offering their properties (hereinafter the "Properties") for seasonal rental through its intermediary on the other hand (hereinafter the "Users", "You", "Your"). 

Personal data means any information about a person from which that person can be directly or indirectly identified ("Personal Data").

Le Collectionist carefully monitors compliance with the provisions relating to the protection of Personal Data, and more specifically with the provisions of the amended French Data Protection Act of 6 January 1978, the General Data Protection Regulation 2016/679 ("GDPR") and the recommendations issued by the CNIL (hereinafter the "Legislation in force").

As the data controller, Le Collectionist wishes to use this privacy policy (the "Privacy Policy") to inform Users of the way in which we may collect, use and process their Personal Data transmitted when using the website https://www.lecollectionist.com/ (the "Website") or more generally during our exchanges concerning our services (the "Services"). 

1. WHAT PERSONAL DATA DO WE COLLECT ?

The Personal Data we collect from Users is as follows:

- your surname(s) and first name(s),

- your date of birth

- your gender 

- your family composition

- your postal address,

- your e-mail address,

- your telephone number(s),

- a copy of your identity card,

- your booking history,

- your bank details,

- where applicable, special category data such as health data (disability, allergy, etc.) or data that may indirectly enable us to obtain information concerning the religion, beliefs or personal convictions of the persons concerned (diet, travel restrictions on certain dates, etc.),

- web behaviour and consumption data

- any other information that you may provide when using the Website or our Services.

We may also collect Personal Data from third parties. When you use our Services, you have the option of providing the contact details of one or more other persons (in particular, other participants in the trip). In this case, you guarantee to Le Collectionist that the other persons whose data you provide are informed of this transmission and accept it.

2. WHAT ABOUT THE COOKIES ? 

2.1 What are the cookies ?

Cookies are trackers consisting of small sets of data stored in the User's browser. Cookies are very useful and enable a website to recognise you, to connect when you visit a particular page, to provide a secure connection to a website and to improve your user experience by improving your browsing comfort and/or by adapting the content of a page to your centres of interest.

2.2 How the cookies are used ? 

We use cookies for operational purposes, statistical analysis and to offer you a customised experience.

Where prior consent is required for their use, the period of validity of consent to the deposit of cookies is 6 months. At the end of this period, we will ask you again for your consent.

The retention period for an audience measurement cookie that does not require consent is 13 months. However, the information collected by means of these cookies is kept by us for a maximum of 25 months, in accordance with the applicable regulations.

2.3 How can you manage the use of cookies?

On your first visit to our Website, you will be asked for your consent to the use of your data by cookies via a window that will be displayed visibly at the bottom of the page.

Using the "Accept all", "Personalise" and "No thanks" buttons, you can accept, personalise or refuse the use of cookies via our partner Axeptio.

You can change your choice at any time by clicking on "Cookie management" at the bottom of the page on our Website.

3. HOW DO WE COLLECT YOUR PERSONAL DATA ?

3.1 Collection by Le Collectionist 

We may collect your Personal Data directly from you:

- when you create a Customer Area on the Website or when you make a reservation request for a Property with Le Collectionist;

- when you create an Owner Space on the Website or when you contact us to rent your Property;

- when you contact our teams by email, telephone or Whatsapp as part of a future reservation or during your stay.

3.2 Collection by third parties

We may also obtain information about you from other sources detailed below by type of service:

3.2.1 Displaying content from external platforms

This type of service allows you to view and interact with content hosted on external platforms directly from the pages of the Site. If such a service is installed, it may still collect data relating to web traffic on the pages, even if the User does not use it.Nous pouvons également obtenir des informations à votre sujet auprès d'autres sources détaillées ci-dessous par type de service :

• Google Fonts (Google Ireland Limited)

Google Fonts is a font display service provided by Google Ireland Limited which enables the Site to incorporate content of this nature on its pages.

Personal data processed : cookies; usage data.

Place of processing : Ireland – Privacy Policy.

3.2.2. Analysis 

The services contained in this section enable Le Collectionist to monitor and analyse web traffic and track changes in User behaviour.

• Meta Events Manager (Meta Platforms Ireland Limited)

Meta Events Manager is an analytics service provided by Meta Platforms Ireland Limited. By integrating the Meta pixel, Meta Events Manager can provide Le Collectionist with a measure of the audience and traffic on the Website.

Personal data processed : cookies; données d'utilisation.

Place of processing :  Ireland – Privacy Policy – Opt out.

• Advertising reporting capabilities in Google Analytics (Google Ireland Limited)

Google Analytics has advertising reporting features enabled on this Site which collect additional information through the DoubleClick cookie (web activity), and through device advertising identifiers (app activity). This enables Le Collectionist to analyse specific behaviour and interest data and, if activated, demographic data (information on age and gender).

Users can opt out of Google's use of cookies by consulting the Google ad settings .

Personal data processed : various types of data indicated in the service's privacy policy; unique identification of the device for advertising purposes (e.g. Google advertising identifier or IDFA); cookies.

Place of processing : Ireland – Privacy policy – Opt out.

• Google Analytics 4 (Google Ireland Limited)

Google Analytics 4 is a web analysis service provided by Google Ireland Limited ("Google"). Google uses the data collected to monitor and analyse the use of the Site, to prepare reports on its activities and to share them with other Google services.

Google may use the data collected to contextualise and personalise advertising on its own advertising network. In Google Analytics 4, IP addresses are used at the time of collection and then deleted before the data is recorded on a server or in a data centre. To find out more, Users can consult Google's official documentation.

Personal Data processed: usage data; device information; browser information; latitude (of the city); longitude (of the city); number of Users; session statistics; cookies; city.

Place of processing : Ireland – Privacy Policy – Opt out.

• Amplitude Analytics (Amplitude Inc.)

Amplitude Analytics is an analysis service provided by Amplitude Inc.

Personal Data Processed: email address; usage data; approximate location; connection history; browsing history; User ID; unique universal identifier (UUID); unique device identification for advertising (e.g. Google Ad ID or IDFA); master account information; device information; last name; phone number; first name; cookies.

Place of processing : France – Privacy Policy.

3.2.3. User database management

This type of service allows Le Collectionist to create user profiles from an email address, a person's name or other information provided by the User via the Site, and to track the User's activities through analytical features. This Personal Data may also be compared with publicly available information about the User, such as social network profiles, and used to create private profiles that Le Collectionist may display and use to improve the Site. Some of these services may also activate the sending of timed messages to the User, such as emails based on specific actions performed on the Site.

• HubSpot (HubSpot, Inc.)

HubSpot is a User database management service provided by HubSpot, Inc.

Personal Data processed : physical address; e-mail address; various types of data indicated in the service's privacy policy; usage data; purchase history; current location; User name; surname; company name; telephone number; country; profession; first name; gender; cookies.

Place of processing : United States – Privacy Policy.

3.2.4. Managing data collection and online surveys

This type of service enables the Website to manage the creation, deployment, administration, distribution and analysis of online forms and surveys in order to collect, record and re-use the data of any User who responds.

The Personal Data collected depends on the information requested and provided by Users in the corresponding online form.

These services may be integrated into a wide variety of third-party services to enable Le Collectionist to take further action with the data processed - e.g. contact management, sending messages, analyses, advertising and payment processing.

• Typeform

Typeform is a survey creator and data collection platform provided by TYPEFORM SL, a Spanish company whose registered office is located at C/ Can Rabia 3-5, 4th floor, 08017 - Barcelona (Spain).

Typeform may use cookies to track User behaviour. Users have an option to opt-out of Typeform cookie tracking accessible here: https://www.typeform.com/ 

Personal Data processed: e-mail address; data communicated when using the service; usage data; surname; first name; cookies.

Place of processing : Spain - Privacy Policy

3.2.5. Tag management

This type of service enables Le Collectionist to manage the tags or scripts required on the Website centrally. 

Consequently, Users' Personal Data passes through these services, which may result in the retention of this data.

• Google Tag Manager (Google Ireland Limited)

Google Tag Manager is a tag management service provided by Google Ireland Limited.

Personal data processed: usage data; cookies.

Place of processing : Ireland – Privacy Policy.

3.2.6. Managing contacts and sending messages

This type of service makes it possible to manage a database of e-mail addresses, telephone numbers or any other contact details for communicating with the User. These services may also collect data concerning the date and time at which the User views the message and the time at which the User interacts with the message, for example by clicking on the links included in the message.

• Postmark (Wildbit LLC)

Postmark is an e-mail address management and message sending service provided by Wildbit LLC.

Personal data processed: e-mail address; various types of data; surname; first name.

Place of processing : USA– Privacy Policy.

• Twilio (Twilio, Inc.)

Twilio is a telephone number and communication management service offered by Twilio, Inc.

Personal data processed: telephone number.

Place of processing : USA – Privacy Policy.

3.2.7. Heatmap and sessions recordings

Heatmap services are used to display the areas of the Website with which Users interact most often. In this way, points of interest are located. The services make it possible to monitor and analyse web traffic and track changes in User behaviour.

Some of these services may record sessions and make them available for later viewing.

• Hotjar Heat Maps & Recordings (Hotjar Ltd.)

Hotjar is a session recording and heat map service offered by Hotjar Ltd. Hotjar respects "Do Not Track" headers. This means that your browser can instruct its script not to collect any of the User's data. This parameter is available on all the main browsers. You can find more information about Hotjar's commitment here.

Personal data processed: various types of data indicated in the service's privacy policy; usage data; cookies.

Place of processing : Malta – Privacy Policy – Opt out.

3.2.8. Web hosting and backend infrastructure

The purpose of these types of services is to host data and files that allow the Website to function, to be distributed and to provide a ready-to-use infrastructure for specific functions or parts of the Website to operate.

Some of these services operate through geographically dispersed servers, making it difficult to determine the actual location where Personal Data is stored.

• Amazon Web Services (AWS) (Amazon Web Services, Inc.)

Amazon Web Services (AWS) is a hosting and backend service provided by Amazon Web Services, Inc.

Personal data processed: various types of data indicated in the service's privacy policy.

Place of processing : France & Ireland – Privacy Policy.

• Heroku (Salesforce.com, inc.)

Heroku is a hosting service provided by Salesforce.com, inc.

Personal data processed: various types of data indicated in the service's privacy policy.

Place of processing : Europe – Privacy Policy.

• Algolia (Algolia SAS)

Algolia is a service for searching for information on the site provided by Algolia SAS.

Personal data processed: various types of data indicated in the service's privacy policy.

Place of processing : France – Privacy Policy.

3.2.9. Interaction with online surveys platforms

These types of services allow Users to interact with online survey platforms directly from pages on the Website. 

If one of these services is installed, it may collect browsing data and Usage data on the pages on which it is installed, even if Users do not actively use this service.

3.2.10. Traffic optimisation and distribution

These types of services enable the Website to distribute its content using servers located in different countries and to optimise their performance. The question of which Personal Data will be processed depends on the characteristics and the way in which these services are implemented. Their function is to filter communications between the Website and the User's browser.

Given the wide distribution of this system, it is difficult to determine where content that may contain the User's Personal Data is transferred.

• Cloudflare (Cloudflare)

Cloudflare is a traffic optimization and distribution service offered by Cloudflare Inc.

The way in which Cloudflare is integrated means that it filters all traffic through the Website, for example the communication between this Site and the User's browser, while also allowing the Website's analytical data to be collected.

Personal data processed: different types of data indicated in the service's privacy policy.

Place of processing : USA – Privacy Policy.

3.2.11. Advertising

This type of service makes it possible to use the User's Personal Data for advertising communication purposes. These communications are displayed in the form of banners and other advertisements on this Website, possibly according to the User's interests. This does not mean that all Personal Data is used for this purpose. The information and conditions of use are described below.

Some of the services listed below may use cookies to identify the User. They may also use a behavioural targeting technique, for example to display advertisements tailored to the User's needs and behaviour, including those detected outside this Website. Please consult the privacy policies of the services concerned for further information.

In general, this type of service offers the possibility of refusing this advertising tracking. In addition to any opt-out functionality provided by any of the services mentioned below, the User can find out more about the options available to them for refusing to receive advertising targeted by centres of interest by consulting the dedicated section of this document: "How to refuse advertising targeted by centres of interest".

• Google AdSense (Google Inc.)

Google AdSense is an advertising service provided by Google LLC or Google Ireland Limited, depending on how Le Collectionist manages the processing of Personal Data. This service uses the "DoubleClick" cookie, which tracks the use of this Website and the User's behaviour with regard to advertisements and the products and services offered. 

Users may decide to deactivate all DoubleClick cookies by visiting: Ad settings. To understand how Google uses data, please consult Google's partner policy.

Données Personnelles traitées : cookies; données d'utilisation.

Place of processing : USA – Privacy Policy – Opt out.

• Conversion tracking from Google Ads (Google Inc.)

Ads conversion tracking is an analysis service provided by Google LLC or Google Ireland Limited, depending on how Le Collectionist manages data processing, which links data from the Google Ads advertising network to actions carried out on this Website.

Personal data processed: usage data; cookies.

Place of processing : USA – Privacy Policy.

• Microsoft Advertising (Microsoft Corporation)

Microsoft Advertising is an advertising service offered by Microsoft Corporation.

Personal data processed: usage data; cookies.

Place of processing : USA – Privacy Policy – Opt out.

• Conversion tracking of Meta ads (pixel Meta) (Meta Platforms Ireland Limited)

Meta ads conversion tracking (Meta pixel) is an analytics service provided by Meta Platforms Ireland Limited, which links Meta ad network data to actions taken on this Site. The Meta pixel tracks conversions that can be attributed to ads on Facebook, Instagram and the Audience Network.

Personal data processed: usage data; cookies.

Place of processing : Ireland – Privacy Policy – Opt out.

• Pinterest Ads (Pinterest, Inc.)

Pinterest Ads is an advertising service provided by Pinterest, Inc, that allows Le Collectionist to run advertising campaigns on the Pinterest advertising network.

Users can disable behavioural advertising features through their device settings, their Pinterest personalisation settings.

Personal Data Processed: email address; usage data; User ID; unique device identification for advertising (Google Ad ID or IDFA, for example); device information; cookies. 

Place of processing : USA – Privacy Policy – Opt out.

3.2.12. Remarketing and behavioural targeting

This type of service enables the Site and its partners to distribute, optimise and present advertisements based on the User's previous use of the Site. This activity is facilitated by tracking usage data and using cookies to collect information, which is then passed on to the partners managing the remarketing and behavioural targeting activity.

Some services offer a remarketing option based on lists of e-mail addresses.

In addition to any opt-out functionality provided by any of the services below, Users may withdraw their consent by visiting the Network Advertising Initiative opt-out page.

Users may also opt-out of certain advertising features through applicable device settings, such as mobile device advertising settings or general advertising settings.

• Meta personalised audience (Facebook, Inc.)

The Meta Custom Audience is a remarketing and behavioural targeting service provided by Meta Platforms, Inc. or Meta Platforms Ireland Limited, depending on how Le Collectionist manages the processing of Personal Data, which connects activity on this Site with Meta's advertising network.

Users may opt-out of the use of cookies by Meta for ad personalisation by visiting the opt out page.

Personal Data processed: e-mail address; cookies.

Place of processing : USA – Privacy Policy – Opt out.

• LinkedIn Website Retargeting (LinkedIn Corporation)

LinkedIn Website Retargeting is a remarketing and behavioural retargeting service provided by LinkedIn Corporation, which links activity on this Website to LinkedIn's advertising network.

Personal data processed: usage data; cookies.

Place of processing : USA – Privacy Policy – Opt out.

4. WHAT ARE THE LEGAL BASES FOR PROCESSING YOUR PERSONAL DATA?

The processing carried out by Le Collectionist has the following legal bases, in accordance with Legislation in force :

5. WHO WILL RECEIVE YOUR PERSONAL DATA ?

Your Personal Data is intended for Le Collectionist departments concerned by your requests. We ensure that only duly authorised persons have access to your Personal Data when this is necessary for the aforementioned purposes.

Le Collectionist undertakes not to transfer or sell your Personal Data to non-partner third parties.

We may share your Personal Data with the following third parties in compliance with the Legislation in force:

- with our affiliated entities in order to provide you with the requested Services;

- with our business partners, in particular suppliers of reserved services or technical service providers (IT, hosting, email distribution, online payment service providers, etc.). We take particular care to ensure that these third parties provide sufficient guarantees to ensure the protection and security of your Personal Data;

- duly authorised French or foreign authorities (e.g. the tax authorities or the CNIL), particularly in the context of legal proceedings or a request for information.

6. THIRD PARTY WEBSITES AND DATA TRANSFERS

6.1 External links

The Website may contain links to other websites operated by third parties. Please note that this Privacy Policy applies only to Personal Information collected by Le Collectionist. We are not responsible for Personal Data that third parties may collect, store and use on their own websites or applications. We recommend that you carefully read the privacy policy of each website and/or application that you visit.

Furthermore, Le Collectionist is not responsible for hypertext links to the Site that third-party websites and/or applications may include, even if Le Collectionist has authorised the third-party publisher of the said third-party website and/or application to place such a link.

6.2 Transfer to partners

In its capacity as data controller, Le Collectionist uses the following subcontractors to manage its customers' personal data:

● Stripe, USA, Web payment software. Standard contractual clause (https://stripe.com/privacy-center/legal#data-transfers)

● Gmail, USA, Email service. Standard contractual clause: https://policies.google.com/privacy/frameworks

● Google Calendar, USA, Electronic diary management service. Standard contractual clause: https://policies.google.com/privacy/frameworks

● Google Drive, USA, Cloud service for storing and sharing files. Standard contractual clause: https://policies.google.com/privacy/frameworks

● Google Sheets, USA, Cloud-based spreadsheet software. Standard contractual clause: https://policies.google.com/privacy/frameworks

● Amazon Web Services, USA, Cloud data storage service, hosting provider. Standard contractual clause: https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice_French_2020-08-15.pdf

● Apple, USA, Sending electronic messages. Standard contractual clause: https://www.apple.com/fr/legal/privacy/fr-ww/

● Whatsapp, USA, Sending electronic messages. https://www.whatsapp.com/legal/privacy-policy-eea 

● Heroku, USA, Cloud data storage service, hosting provider. Binding Corporate Rules: https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/EU-Data-Transfer-Mechanisms-FAQ.pdf

● Slack, USA, Internal communication web services. Standard contractual clause: https://slack.com/intl/fr- en/privacy-shield-notice

● Dotfile, France & USA, Continuous LCB-FT filtering service https://dotfile.notion.site/Privacy-Policy-ff98c837722b46eb966e40e5095cd505 

● Mindee, France & USA, Artificial intelligence service to convert data scanned from identity documents into data: https://www.mindee.com/privacy-policy

6.3 Transfer on requisition or court order

The User is informed of the fact that Le Collectionist may be required to communicate the data collected to any person, at the request of a government authority or by court order.

6.4 Transfer as part of a merger or acquisition

If Le Collectionist is involved in a merger, sale of assets, financing operation, liquidation or bankruptcy or in an acquisition of all or part of its business by another company, the User consents to the data collected being transferred by Le Collectionist to that company and to that company carrying out the personal data processing referred to herein.

7. HOW IS YOUR PERSONAL DATA PROCESSED OUTSIDE THE EUROPEAN UNION?

We may transfer your Personal Data to countries outside the European Economic Area ("EEA") solely for the purposes described in this Privacy Policy.

Where Personal Data is transferred outside the EEA, we will take appropriate steps to ensure that the recipient adequately protects your Personal Data in accordance with this Privacy Policy. These measures may include:

(a) obtaining your specific consent;

(b) the existence of an adequacy decision from the European Commission in the event of a transfer outside the EEA, which means that the recipient country is deemed to provide adequate protection for this Personal Data;

(c) the conclusion of a data transfer agreement within our group that complies with the European Union's standard contractual clauses; or

(d) the conclusion of standard contractual clauses published by the European Commission.

8. HOW IS THE SECURITY OF YOUR PERSONAL DATA ENSURED?

As the party responsible for processing your Personal Data, Le Collectionist implements all the technical and organisational measures necessary to respect the protection of your Personal Data and takes care to limit the amount of data processed in relation to the finalities pursued. We have procedures in place to deal with any suspected breach of data security and will notify you and any relevant supervisory authority of a suspected breach where we are legally required to do so.

However, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of an account you have with us has been compromised), please notify us immediately by contacting us using the details below.

9. HOW LONG WILL YOUR PERSONAL DATA BE KEPT BY LE COLLECTIONIST?

We will only retain your Personal Data for as long as is necessary for the purposes for which it was collected, including to meet any legal or accounting requirements.

In determining the appropriate retention period for Personal Data, we take into account the amount, nature and sensitivity of the Personal Data, the potential risk of harm arising from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and the possibility of achieving those purposes by other means, as well as applicable legal requirements.

We retain Personal Data for the maximum periods indicated below:

- For Users who have only subscribed to the newsletter: 3 years from the date of last contact between the User and Le Collectionist, unless unsubscribed earlier via the link to that effect;

- For Users who have made an unsuccessful booking request: 10 years from the date of last contact between the User and Le Collectionist.

- For Users who have confirmed at least one reservation with Le Collectionist : 

- 10 years from the date of last contact between the User and Le Collectionist

- 1 month after the end of the stay for copies of identity documents, unless otherwise requested by the User

- 10 years for rental contracts and invoices (legal obligation)

- 10 years after the end of the stay in the event of personal injury occurring during the stay (legal obligation)

- In the event of legal proceedings, until the proceedings have been completed.

After the time limits set out above, and unless the Data Subject requests deletion, Personal Data is either deleted or kept after being made anonymous, in particular for statistical purposes. It may be retained in the event of pre-litigation or litigation. It should be noted that deletion or anonymisation are irreversible operations and that Le Collectionist is not subsequently able to restore them.

10. WHAT RIGHTS DO YOU HAVE TO YOUR PERSONAL DATA?

As a Data Subject, the Legislation in force grants you various rights. These rights are not absolute and each of these rights is subject to certain conditions in accordance with the GDPR and applicable national laws.

10.1 Right of Access

You have the right to obtain confirmation from us as to whether or not your Personal Data is being processed by us, as well as certain other information (similar to that provided in this Privacy Policy) about how it is used. You also have the right to access your Personal Data by requesting a copy of the Personal Data concerning you. This allows you to know and verify that we are using your information in accordance with data protection laws. We may refuse to provide information where it may reveal Personal Data about another person or negatively impact another person's rights.

10.2 Right to Rectification

You may ask us to take steps to correct your Personal Data if it is inaccurate or incomplete (for example, if we have the wrong name or address).

10.3 Right to Erasure

Also known as the "right to be forgotten," this right allows you, in simple terms, to request the deletion or removal of your Personal Data where, for example, there is no compelling reason for us to continue using it or its use is unlawful. However, this is not a general right to erasure and there are exceptions, for instance, where we need to use the information to defend a legal claim or to comply with a legal obligation.

10.4 Right to Restrict Processing

You have the right to "block" or suppress further use of your Personal Data where we are evaluating a rectification request or as an alternative to erasure. Where processing is restricted, we may still store your Personal Data, but we may not use it further.

10.5 Right to Data Portability

You have the right to obtain and reuse certain Personal Data for your own purposes across different companies (which are separate data controllers). This applies only to Personal Data you have provided to us, which we process with your consent and for the performance of a contract, processed by automated means. In this case, we will provide you with a copy of your data in a structured, commonly used, and machine-readable format or (where technically feasible) we may transfer your data directly to another data controller.

10.6 Right to Object

You have the right to object to certain types of processing, for reasons related to your particular situation, at any time, to the extent that such processing is carried out for the purposes of legitimate interests pursued by Le Collectionist. We will be allowed to continue processing Personal Data if we can demonstrate that the processing is justified by compelling and legitimate reasons that override your interests, rights, and freedoms, or if we need it for the establishment, exercise, or defense of legal claims. If you object to the processing of your Personal Data for direct marketing purposes, we will no longer process your Personal Data for such purposes.

10.7 Right to Withdraw Consent

Where we process your Personal Data solely based on your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of the processing that took place before this withdrawal.

10.8 Right to Provide Instructions on the Use of Your Personal Data After Your Death

In France, you have the right to provide us with instructions on the management (e.g., storage, deletion, and disclosure) of your data after your death. You may modify or revoke your instructions at any time.

11. HOW TO EXERCISE YOUR RIGHTS?

If you have any questions about this Privacy Policy, about how we process your Personal Data, or if you wish to exercise any of your rights, please email us at: myprivacy@lecollectionist.com or send a postal letter to the following address: Le Collectionist - Data Protection Officer - 65 rue de la Victoire 75009 Paris.

Any request will be reviewed within the timeframes stipulated by the applicable law. Please note, however, that certain personal data may be exempt from such requests under certain circumstances, particularly if we need to continue processing your Personal Data for our legitimate interests or to comply with a legal obligation. Exercising your right of access (or any other right) will not incur any fees. For your information, we may not comply with your request if it is manifestly unfounded or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access this information (or to exercise your other rights). This is an appropriate security measure to ensure that Personal Data is not disclosed to a person who does not have the right to receive it.

If you are not satisfied with our response to your complaint or if you believe that the processing of your Personal Data is not in accordance with the applicable legislation, you can file a complaint with the competent data protection authority. The Commission Nationale Informatique et Libertés ("CNIL") is the lead data protection authority for Le Collectionist.

12. MODIFICATION OF THE PRIVACY POLICY

Le Collectionist may amend this Privacy Policy occasionally to reflect changes in our practices and/or to comply with changes in applicable law. When we modify this Privacy Policy, we also update the "Last Updated" date at the top of this page. We encourage you to regularly review this Privacy Policy to stay informed about how Le Collectionist protects your Personal Data.