Cotton Bird makes protecting your personal data a key priority. It undertakes to ensure the highest level of protection possible for your personal data in compliance with the applicable French and European regulations concerning personal data protection.

For further information on personal data protection, you can also check the

website for the Commission Informatique et Liberté, France’s data regulatory body.

https://www.cnil.fr/.

Who is the Data Officer for my data?

The Data Officer is the company responsible for determining how and to what end your personal data is used. The personal data collected on the Cotton Bird website or upon placing an order by phone or post is processed by:

SARL EDITIONS CREATIVES

With head offices located at: 27 RUE GUSTAVE EIFFEL

66230 SALEILLES, FRANCE

Why does Cotton Bird need my personal data?

Cotton Bird uses your personal data for the following purposes:

• Managing orders and customer relations

We need information about you in order to handle your orders and order tracking (such as delivery, billing, accounting, and managing the Customer Areas, discount and special offer code schemes, customer follow-up via surveys, handling complaints and after-sales, selecting customers to take part in studies, surveys, and product testing).

•  Processing order payments

The payments you make on our websites are secure. Cotton Bird does not collect your payment details, it merely collects a unique payment identifier. All of your bank details are collected by our payment service provider alone (the CIC bank), which ensures payments are fully secure.

Payment upon purchasing:

When you pay for an order, our departments do not store details of the bank card used to pay.

• Personalising the content and services we bring you

Data about you enables us to improve and personalise the services we bring you and the communications we send you.

As an example, we may send you personalised emails or recommend products similar to items you have already bought or viewed that match your interests.

• Ensuring website security

We collect some browsing data to ensure our services remain secure and to

detect, prevent and track any attempt at security breaches or hacking, and any breaches of the general terms and conditions of use of our Services.

• Personalising online advertising (targeted advertising)

We may use data that cannot be used to identify you directly

(technical identifiers or sociodemographic data) in order to tailor the advertising you see on our website and partners’ websites. Your data may be cross-referenced with browsing data and other information gathered as part of our relationships with our partners (such as companies offering remarketing services, Google, etc.), before being anonymised prior to any use. This data may cover details such as your age range or gender, and is used to draw up a profile of you as a user that can then be linked to interests that will form the basis for advertisements you are shown on behalf of our advertising partners.

• Improving our understanding of our customers as well as our website’s statistics and performance

We may use some data to gain a deeper understanding of our customers or for statistical purposes, to analyse our website’s activity and improve the services we offer. We measure audience statistics, such as measuring the number of pages viewed, the number of visits to the website, visitor activity on the website, and returning visitor rates.

What personal data do you collect?

We collect and process your surname, first name, address, email address, password, phone number, IP address, log-on details and browsing information, order history, preferences and interests, products viewed, delivery incidents, and complaints.

Prior to the data being collected, you are informed as to whether this is mandatory or optional via an asterisk or a notification that appears when you send the form.

Some data is collected automatically as a result of your actions on the website. Other information may be shared by partners.

When is my data collected?

In particular, we collect the data you provide when:

• You set up a Customer Area on our websites
• You sign up for our newsletter
• You place an order on our websites
• You browse our websites and apps and view products
• You take part in a contest or competition
• You contact our Customer Service team
• You post a comment
• You request samples
• You view our ads

 

What content might I be sent?

• Information and newsletters
• Service emails

 

A follow-up email after placing an order or in the context of handling a commercial contract,

enabling you to track your order or check in with how your commercial contract is progressing (order confirmation, parcel delivery updates, information on subscription expiry, etc.).

These service messages are necessary to ensuring the orders and services you request run smoothly. Receiving this information is unrelated to the options you might have expressed regarding receiving our newsletters and special offers.

As an example, you might occasionally receive information needed to ensure

your current orders or events (weddings, christenings, etc.) are being managed efficiently.

• Cotton Bird newsletters

Once you have set up a customer account, and provided you have given your consent, you may receive Cotton Bird information and offers electronically (email, text message, etc.). These newsletters allow you to stay abreast of Cotton Bird’s latest news for products similar to those already ordered or recently viewed, and ‘just landed’ items.

We measure rates to see how often our electronic communication is opened to better tailor it to your needs.

• Partner newsletters

If you agreed to receive our ‘partner’ offers, you may receive offers from other companies within the group (vœux-creatifs.com, online sales of greeting cards) electronically (by email or text message), as well as offers from selected commercial partners.

• By post

If you agreed, you may receive information and offers by post from companies within the group and our commercial partners.

• By phone

If you did not decline, you may be contacted by our operators or partners with offers and services related to those you have already purchased (excluding automated calls, for which you must provide your express approval).

On what legal basis and for how long is my data processed?

Your personal data is processed on various types of legal basis based on how the personal data in question is used. Below, you’ll find a breakdown of the legal basis and time-limits for storing your data in the context of our main data processing procedures.

LEGAL BASIS FOR PROCESSING YOUR DATA

The applicable legal foundations include:

• Consent: When you agree to your data being processed by

giving your express consent (ticking a box, clicking through, etc.). You may withdraw your consent at any time either by unsubscribing via a link in an email footer, or in your My Account area.

• Legitimate interest

Cotton Bird has a legitimate, justified, well-balanced commercial interest in processing your data, which does not infringe on your right to privacy.  With some exceptions, you may oppose your data being processed on the basis of legitimate interest by notifying Cotton Bird of your wish to do so.

• Legal purposes

Processing your personal data is a legal requirement.

STORAGE TIME-LIMITS

Most of your data (such as information in your customer account and order history) is stored for as long as you remain an “active” customer and for a five-year period starting from the date of your last activity (such as sharing data) within the Cotton Bird group, for the purposes of customer profiling. The data is stored with restricted access for an additional period of time, for a limited number of reasons permitted by law (payment, warranties, complaints, etc.).  Beyond this time-frame, your data will be deleted.

Purpose of processing	Legal basis	Time-limits for storing data in an operational database	Archiving	Notes
Managing service/product orders	Contract	Five years from the date last active	Five to 15 years	When a customer is active, for instance when they proceed to make a purchase or log into their Customer Area, or for as long as a contract or warranty is still running.
Using the Cotton Bird Customer Area	Contract	Five years from the date last active		When a customer is active, for instance when they proceed to make a purchase or log into their Customer Area, or for as long as a contract or event is still active in their Customer Area.
Personalising our services (emails, recommendations for products on our website, etc.).	Contract	200 last views for website recommendations. Three years from the date last active for emails.
Sending messages by email or text message (electronic marketing).	Consent			You may withdraw your consent at any time via your Cotton Bird Customer Area.
Sharing data within the Cotton Bird group for customer profiling purposes.	Consent			You may oppose your data being shared within the Cotton Bird group at any time by notifying us of this through the Cotton Bird contact form.
Targeted advertising/advertising profiling	Consent	13 months from the date on which advertising cookies are stored.	Two years	You can configure your advertising cookies in line with the details provided on the cookie information page.
Preventing fraud	Legitimate interest	Three years from the date on which the customer signs up to a notification list	Two years	You may at any time share your comments following your order being cancelled or you signing up to a notification list.
Storing bank card details following a payment	Legal purposes	15 months under Article		L133-24 of the French Monetary and Financial Code. Your bank details are stored by a secure payment service provider.
Storing your bank card in an e-wallet for future purchases	Consent	Until consent is withdrawn or the bank card expires.		Your bank details are stored by a secure payment service provider.

Who is my data shared with?

The data we collect may be shared with service providers (sub-contractors) that Cotton Bird uses for conducting its services for the aforementioned purposes, such as managing, fulfilling, processing, and handling payment for your orders, as well as for marketing campaigns.

• Data shared within Cotton Bird:

The data collected on the Cotton Bird websites and apps are primarily shared with entities belonging to the Cotton Bird group with a view to getting to know and serving you better as a Cotton Bird-wide customer, and providing you with a seamless experience. By using the Cotton Bird Customer Area, you can tap into Cotton Bird’s services and make the most of the many benefits and advantages available as a result of the two brands’ relationship. In doing so, you agree to your data being shared by the Cotton Bird brands as a result of resource-pooling efforts made in the context of the organisations attempts at growing and aligning.

• Sharing data within the group:

Your data may also be shared with other subsidiaries within the Cotton Bird group for customer profiling purposes and market research. Please ask us for an up-to-date list of the group companies likely to be sent your data.

• Sharing data with our third-party partners

Some of Cotton Bird’s services are provided in partnership with third parties.

• For targeted advertising

We may share some of your unidentifying data with our partners, such as customer profiles (sociodemographic data), cookies, or technical identifiers, without these details identifying you by name. We do so for targeted advertising purposes on our website or on third-party websites (see the cookies and targeted advertising section).

• To improve our understanding of our customers

To enable us to link up your various devices (computers, phones, etc.), bringing you a streamlined experience across the different devices you might use.

You can also change your cookie preferences to manage your targeted advertising cookies directly via the cookies page.

How can I inform you of how I want my data to be used?

We’re actively working to improve your control over your preferences in your Customer Area, empowering you to better manage how your data is used.

You may withdraw your consent or oppose how your data is used as above:

• when registering for a Customer Area account via the dedicated boxes or links - and then at any point •
• Online, by heading over to the “My Personal Details” section in your Customer Area.
• Using the contact form: https://www.cottonbird.fr/apropos-cottonbird_contact.asp

By letter sent to:

Editions Créatives

27 rue Gustave Eiffel

66280 Saleilles, France

If you choose to use the online contact form or send us a letter, please give your surname, first name, email address and postal address, specifying your reason for getting in touch and/or the right you’d like to exercise.

You can also configure your cookies by heading over to the cookie manager area on the cookie page, or via the following websites:

http://www.networkadvertising.org/choices/

http://www.youronlinechoices.com/

What are my rights in terms of how my personal data is used?

In accordance with personal data protection regulations, you may exercise your rights (to access, rectify, delete, oppose, restrict, and for portability where applicable) and determine what becomes of your personal data following your death via the contact form

https://www.cottonbird.uk/contact

or by post:

Editions Créatives

27 rue Gustave Eiffel

66280 Saleilles, France

To help us get back to you as swiftly as possible, please provide your surname, first name, email address, postal address, and if possible, your customer reference number. Some requests to exercise your rights (such as the right to access your data) must be submitted along with a photocopy of signed proof of your identity, and an indication of the address where you would like our response to be sent. You will receive a reply within a month following receipt of your request.

You are entitled to file a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), notably via its website at www.cnil.fr. Cotton Bird employs a Data Protection Officer (DPO) tasked with ensuring your personal data remains protected. You may contact Cotton Bird’s DPO at hello@cottonbird.uk (except concerning matters surrounding exercising your rights, for which you should use the contact form).

Will my data be sent outside the European Union?

For the purposes given above, data concerning you may be sent to companies in countries outside of the European Union with data protection levels that are less stringent than those in force within the European Union. Prior to any data being transferred outside of the European Union, Cotton Bird shall make every effort and take all necessary precautions to ensure the transfers in question are secure.

How is minors’ data processed?

Cotton Bird’s services are not intended for minors. Consequently, Cotton Bird does not process data concerning minors specifically. For instance, we do not draw up marketing profiles for minors. Parents and all legal guardians are responsible for deciding whether or not their child or the minor under their ward is permitted to use Cotton Bird’s services.

What cookies are used for targeted advertising?

We use tracking technology and particularly cookies on our websites and our partners’ websites to tweak advertising to reflect your needs and interests.  We invite you to check the Cookies section for detailed information on how cookies and similar technologies are used, and to view the options at your disposal.