Confidentiality and cookies policies

This privacy policy explains how the company TIPITAKA (hereinafter the “Company”) processes the personal data of the people who use the TIPITAM platform (hereinafter the “Platform”), whether they are simply visitors or buyers. It supplements the buyer general terms of use and the general terms of sale. The data of professional sellers is covered by separate information.

It has been drafted in accordance with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés).

The data controller is the Company:

TIPITAKA

Join stock company with a capital of 1 000 euros

Headquarters : 3, rue Albert et André Claudot - 21000 Dijon – France.

Registered with the Registre du Commerce et des Sociétés of Dijon under the number 944 883 206.

Represented by its President, Monsieur Bassan DJIVAKOV.

E-mail address : tipitam@tipitam.eu

Phone number : +33 7 76 81 55 27

For any question about your personal data, you may write to: tipitam@tipitam.eu or by post to the address of the registered office.

The Company has not appointed a data protection officer.

· The Company is the controller for the processing necessary for the operation of the Platform: accounts, transmission of Orders, collection of payments and refunds on behalf of the Sellers, complaints, security, statistics, marketing communications and the Company’s own legal obligations.

· The Seller, that is, the professional seller from whom you buy an item, is a separate controller for the performance of their sales: preparation and dispatch of parcels by the carrier they choose, invoicing, legal guarantees and the after-sales service for which they are responsible. The Seller may use Buyers’ data only to perform Orders and to comply with their legal obligations.

· The payment service provider (Monetico, a service of CIC bank) processes payment data.

· The Company’s subcontractors process data only on the Company’s instructions, under a contract that complies with Article 28 GDPR (see Article 6).

3.1 Visitors to the Platform

• Browsing and technical data: IP address, browser and device type, pages viewed, date and time of connection, among other things. See details in Article 10.

• Data from cookies and trackers, depending on your choices. See details in Article 10.

• Data provided when reporting illegal content or an illegal offer: identity and contact details of the person making the report, content of the report.

3.2 Buyers

• Identity and contact details: surname, first name, e-mail address, telephone number, delivery and billing addresses.

• Buyer Account data: login credentials (the password is stored in encrypted form), Order history, preferences.

• Order data: items ordered, price, Seller concerned, delivery costs, delivery tracking.

• Payment data: transaction status and reference, payment method used. The Company has no access to bank card data, which is processed by the payment service provider.

• After-sales data: withdrawal requests, returns, refunds, complaints, messages exchanged, supporting documents provided.

• Published reviews and ratings.

• Choices regarding marketing communications.

The data marked as mandatory in the forms is necessary to create an account or to place an Order. Without it, the Company cannot provide the requested service. The other data is optional.

Your data is accessible only to authorised persons within the Company, to the extent necessary for their duties. It may be disclosed to the following recipients:

• The Sellers, for the performance of the Orders that concern them: name, delivery address, e-mail address, telephone number and content of the Order. The Seller passes on to their carrier the data necessary for delivery.

• The payment service provider: Monetico (CIC bank).

• The Platform’s hosting provider: OVH SAS, in France.

• The e-mail service provider: Brevo.

• The audience measurement provider: PostHog.

• The web development provider: the web agency TeaCode, in Poland.

• The consumer mediator, where a dispute is referred to it.

• Administrative and judicial authorities, where required by law: in particular the tax authorities, the DGCCRF (French consumer protection authority) and the judicial authorities.

The Company does not sell your data and does not pass it on to third parties for marketing purposes.

The data is hosted and processed in the European Union. It is not transferred outside the European Union.

The Company implements appropriate technical and organisational measures to protect the data against loss, unauthorised access, alteration and disclosure: encrypted connection (HTTPS), encrypted passwords, access restricted to authorised persons only, backups and confidentiality undertakings from processors.

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the following rights:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.

• Right to rectification: to have inaccurate or incomplete data corrected.

• Right to erasure: to have your data deleted, except where it must be kept to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

• Right to restriction of processing.

• Right to data portability for the data you have provided, where the processing is based on your consent or on the contract.

• Right to object to processing based on the Company’s legitimate interest and, at any time and without giving reasons, to direct marketing.

• Right to withdraw your consent at any time, without affecting processing already carried out.

• Right to give instructions regarding what happens to your data after your death.

To exercise your rights, write to tipitam@tipitam.eu. The Company may ask you for proof of identity if it has reasonable doubts about your identity. It will reply within one month, which may be extended by two months for complex requests; in that case, you will be informed.

You can unsubscribe from the newsletter at any time using the link included in each message.

If, after contacting the Company, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or with the data protection authority of the Member State of your habitual residence.

Buyers’ data passed to a Seller for the performance of an Order is also processed by that Seller under their own responsibility. You may exercise your rights directly with the Seller, or with the Company, which will forward your request.

The Company does not take any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The ranking of Offers is described in the general terms of use and in the dedicated section of the Platform.

The Company may amend this policy to take account of legal, regulatory or technical developments or changes in its practices. The version in force is the one published on the Platform, with its effective date. In the event of a significant change, account holders will be informed by e-mail before it comes into force.