INFORMATION NOTICE ON THE PROCESSING OF APPLICATION USER DATA
The purpose of this information notice (hereinafter the "Notice") is to set out the conditions under which the company Cloz S.A. (hereinafter "we" or "Cloz") processes and protects the personal data of users (hereinafter "you") of its virtual dressing room application CloZ (hereinafter the "Application"), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, known as the General Data Protection Regulation (hereinafter the "GDPR"), as well as the law of August 1, 2018 organizing the National Commission for Data Protection and implementing the GDPR and any other subsequent regulations (hereinafter together the "Applicable Legislation").
More specifically, the Notice explains when and why we need your personal data, what data we collect, how and for how long we process it, to whom we transmit it, what your rights are in relation to this processing and how you can exercise these rights.
We may amend the Notice at any time to adapt it to any changes in legislation or in our data processing practices. The date of the update appears at the top of the document. In the event of significant modifications, you will be informed by the appropriate means at the appropriate time.
In the context of the processing operations listed in point 3 of the Notice, Cloz S.A., registered with the Luxembourg Trade and Companies Register under number BX280899, having its registered office at 2 rue Jean Engling L-1466 Luxembourg, acts as data controller within the meaning of Article 4.7 of the RGPD.
Cloz has appointed a data protection officer who can be contacted :
Personal data is any information that can be used to identify, directly or indirectly, a natural person (hereinafter referred to as "Personal Data" or "Data").
We collect your Personal Data directly from you when you provide it via our Application or another means of communication, such as mail (electronic or otherwise).
More specifically, we process the following categories of Personal Data:
Personal identification and contact data*: first name, last name, e-mail address, telephone number, age, gender, login details (user name and password), etc.
We will not necessarily process all the Personal Data described above. Indeed, with the exception of those that are mandatory for the creation of a user account/profile (identified above by *), the Personal Data processed by Cloz depend on the information you voluntarily provide on the Application: they may therefore evolve according to the use you make of the latter.
You are only obliged to provide us with the Personal Data that is necessary to enter into a relationship or to perform the contract(s) entered into with us as well as that which we are required to collect and process by law. Please note, however, that personalizing your user experience is an integral part of the services offered by Cloz. Therefore, if you do not wish to provide us with certain information, this may impact the ability to enter into and/or continue to perform the contract(s) or the ability for us to offer or provide certain services to you.
The table below lists the purposes for which your Personal Data is processed, the legal basis for processing it and the length of time it is retained.
Your Personal Data is processed internally for the above-mentioned purposes by duly authorized persons, within the limits of their respective responsibilities and in accordance with the "need to know" principle.
We may also transmit some of your Personal Data to the extent strictly necessary and for the purposes listed below.
In principle, we do not transfer your Personal Data outside the European Union, except in the situations mentioned below.
This type of transfer will nevertheless be carried out if required by law and/or, after appropriate safeguards have been put in place, when we use service providers located outside the European Union to provide you with the services you have requested. The services concerned are listed below.
Bubble hosts the Application on cloud servers of the U.S. provider Amazon Web Services, Inc. which also adheres to the EU-US Data Privacy Framework adopted on July 10, 2023 by the European Commission and thus also undertakes to comply with a detailed set of personal data protection obligations.
In accordance with the Applicable Legislation and within the limits provided therein, you have rights as a data subject that you may exercise at any time and free of charge (except in the case of manifestly unfounded or excessive requests), which are described below.
Right of access: you have the right to obtain confirmation as to whether or not Personal Data concerning you is being processed and, if so, access to said Personal Data, as well as information on the purposes and categories of Personal Data being processed. You may also obtain information about the recipients to whom your Personal Data is disclosed and for what purposes, the retention period, the sources from which we have obtained your Personal Data where this is not from you, any transfers outside the EU and the guarantees relating thereto, and the existence of automated decisions. You can also obtain a copy of your Personal Data.
Right of rectification: you may request that inaccurate or incomplete Personal Data concerning you be rectified, corrected or completed.
Right of portability: you have the right to receive the Personal Data you have provided to us in electronic form when the processing is based on your consent or pre-contractual/contractual measures and is carried out using automated processes.
Right to erasure of data: you have the right to obtain the erasure (total or partial) of your Personal Data under the conditions set out in Article 17 of the RGPD. This is the case, for example, (a) if the Data is no longer necessary with regard to the purposes for which it was collected or processed, (b) if you withdraw the consent given for the processing of certain Data, (c) if the Data has been processed unlawfully or (d) if you object to processing based on our legitimate interest as indicated below. However, such a request will not be granted if the processing of your Personal Data is, for example, necessary (a) to comply with a legal obligation to which we are subject or (b) to establish, exercise or defend our legal rights.
Right to limit processing: You have the right to request the limitation of the processing of your Personal Data (a) when you dispute its accuracy, (b) when the processing of Data is unlawful but you object to its erasure and prefer a limitation, (c) when we no longer need the data but it is still necessary for you to establish, the exercise or defense of your legal rights, or (d) when you have exercised your right to object to the processing during the verification as to whether the legitimate reasons pursued by us prevail over your own. Where Data processing has been restricted in this way, your Personal Data may only be processed in certain circumstances provided for in Article 18 of the RGPD.
Right to object: you may, for reasons relating to your particular situation, object to the processing of your Personal Data carried out on the basis of our legitimate interests. You will find the processing carried out on this basis in the table above. To exercise this right, you must indicate in writing to which specific processing you object and for what reasons related to your particular situation. However, your request will be refused (a) if we can demonstrate that there are compelling legitimate grounds for processing your data which override your rights and freedoms, or (b) for the establishment, exercise or defense of legal claims.
Right to withdraw consent: If you have given your consent to the processing of your Personal Data, you also have the right to withdraw this consent at any time and within the limits provided by Applicable Legislation. It should be noted, however, that such withdrawal has no retroactive effect and therefore does not entail the deletion of Data previously processed on the basis of consent.
Note that the right to object, or even the right to withdraw consent, always exists when Personal Data is processed for commercial prospecting purposes. Thus, if marketing communications are sent to you by e-mail and you no longer wish to receive this type of communication, you can unsubscribe at any time by clicking on the unsubscribe link in each e-mail.
If you have any questions, comments or complaints about the processing of your Personal Data, or if you wish to exercise your rights as set out in point 6 of the Notice, please contact us immediately by :
We reserve the right to ask you to provide us with additional information necessary to confirm your identity (e.g. a scan/paper copy of your identity document), so that we may, in case of reasonable doubt, verify your identity before processing your request.
If your complaint to Cloz remains unanswered or proves difficult/impossible due to the circumstances, you also have the right to lodge a complaint with the Commission nationale pour la protection des données (CNPD), Service des réclamations, 15, Boulevard du Jazz L-4370 Belvaux. We recommend that you submit such a complaint using the CNPD's online form.
