Article 1 – General principles
The Company undertakes to comply with the GDPR and French law no. 78-17 of 6 January 1978.
Data is collected to view resources, obtain calculations, book appointments, follow teaching, purchase products and subscribe to numerology-related software.
Article 2 – Legal situation
2.1 Services offered on the Sites: SASU ICERNS is the data controller for page visits, account creation, course registration, online sales and site management. The Company acts as processor for the Practitioners regarding appointment booking and payment for consultations.
2.2 Numerology consultation: each Practitioner is the controller for the data collected in their professional practice, including exchanges with the Client and data exchanged during consultations.
Article 3 – Data subject to processing
3.1 Cookies: cookies collect browsing information. Users may set their choices or configure their browser to refuse cookies; mandatory cookies are not subject to consent. Functional cookies (mandatory): CONSENT (2 years), cmplz_choice (1 year), wordpress_logged_in (Session). Audience-measurement cookies: _ga (2 years), _gid (24 h), NID (18 months).
3.2 User data: First name, Last name, Email (consent, newsletter, kept until unsubscription); First name, Last name, Email, Phone, Message (legitimate interest, answering questions, until fully handled); Birth first/last names, Date of birth (performance of a contract, free Personal Tree calculation, until the keys are displayed).
3.3 Client data: First name, Last name, Email, Phone, Postal address, SIRET no. (performance of a contract, order processing and invoicing, kept 10 years after the first order); Birth first/last names and Date of birth of participants (performance of a contract, delivery of the service, kept 10 years after the order).
3.4 Subscribed Practitioner data: First name, Last name, Email, Phone, Photo, CV, Address, SIRET, bank details (performance of a contract, fulfillment of the contract terms, kept 10 years after signature); Available time slots (order allocation, 5 years after the service); Consultation recording consent (consultation preparation, 5 years after the order).
Article 4 – Data flows
4.1 Transmission to the Practitioner: Practitioners receive the participants' first and last names, the birth first/last names and date of birth, and the consultation-recording request.
4.2 Subprocessing — IT providers and host: Agence POLARIS, SARL, SIREN 883897985, 4 rue de la poissonnerie, 71100 Chalon sur Saône, Tel: 03 85 87 00 85; MACALINK, SARL, SIREN 797531 951, 11 rue des Tientres, 71620 Bey, Tel: 03 85 87 00 85; OVH, SAS, SIREN 424 761 419, 2 rue Kellermann, 59100 Roubaix. Payment organization: Crédit Agricole, LCL, Sofinco. Messaging host and web analytics: Google. The Company contractually requires its subprocessors to comply with personal-data regulations.
4.3 Consultation recording: the Practitioner undertakes not to record the videoconference unless expressly requested by the Client; the recording is transmitted via a secure transfer service within a maximum of 24 h, then destroyed immediately after sending.
Article 5 – Confidentiality and security of data
The Company implements organizational, material and IT measures to protect data against unauthorized access. Staff are bound by strict confidentiality. The Practitioner also implements these protective measures.
Article 6 – Reciprocal obligations of the parties
6.1 Controller's obligations: provide collection procedures, keep a processing register, document instructions, ensure compliance with obligations and supervise the processing. The register contains the purpose of each processing operation, the categories of data, the persons with access and the retention period.
6.2 Processor's obligations: process data only for the subprocessing purpose, in accordance with written instructions, guarantee confidentiality and ensure compliance by authorized staff. The processor notifies the Controller of any personal-data breach within a maximum of twenty-four (24) hours via the contact form.
6.3 Audit: the Parties may be subject to a CNIL audit and cooperate to provide the requested information and documents.
Article 7 – Rights of data subjects
The User, Client and Practitioner have the rights of access (GDPR art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20), objection to processing (art. 21) and withdrawal of consent (art. 13-2-c).
These rights are exercised via the “Contact us” form by selecting the subject “Personal Data Management”. Any person may lodge a complaint with the CNIL.
Article 8 – Amendment of the privacy policy
The Company reserves the right to make changes it deems useful or arising from legislative changes. Users must accept the policy in force. Users are notified by a dialog at each connection following an amendment.
