PRIVACY POLICY
General information
The protection of your privacy is of utmost importance to us. We wish, as much as possible, to inform you, respect your rights and allow you to control what happens to your Personal Data, in accordance with European Regulation 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of Personal Data and on the free movement of these data and the law of 30 July 2018 on the protection of individuals regarding the processing of Personal Data.
This Privacy Policy (hereinafter, the "Privacy Policy", or the "Policy") is therefore intended to inform all concerned natural persons, hereinafter referred to as "You" or "Yours", about how we collect and use such Personal Data and how the concerned natural person can control such use.
This Policy applies to data collected and processed through the use of the website www.treedys.com and www.fitsbest.app and the application FitsBest as well as body scanner systems available in our partners’ stores
You will find hereafter information about the data we collect, the reasons why we collect them, how long we keep them, your privacy rights and the ways you can exercise them.
Please keep in mind that the use of certain offered features may also be subject to additional terms and conditions for related services. Please consult these terms and conditions for any questions about these services.
By using our Products and Services, you expressly agree with the way we collect and process Personal Data.
1. Key Definitions
For the purposes of this Privacy Policy, the following words or groups of words have the meanings defined in this section. The definition of a word in the singular is valid when the word is used in the plural in this Privacy Policy and vice versa. When the defined words or groups of words are used in this Privacy Policy, the first letter of the word (or each word) is capitalized. When the same word is used in the Privacy Policy without capitalization, it does not have the meaning given in this article, but that of the common language.
Personal Data: means any information relating to an "identified" or "identifiable" natural person; an "identifiable" natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as name, age, sex, identification number, location data, online login, or to one or more elements specific to the physical, physiological, genetic, psychological, economic, cultural or social identity;
Website: refers to the website www.treedys.com or www.fitsbest.app
App : refers to the mobile application Fitbest;
Body Scanner : refers to the scanner systems used to scan the morphology and biometrics of the users;
Treedy's’ System : jointly refers to any software, solution, content, service and/or product offered via the App, the Body Scanner, and/or or the Websites ;
Products and Services : refers to :
· the App and its functionalities;
· the Websites;
· the Body Scanner; and/or
· any other Treedy’s System;
User : Means any natural or legal person that installs, downloads, accesses and/or uses, by any means (mobile device, computer and any other type of device) and for any purpose whatsoever, the Product and Services, regardless of whether he/she has created an account;
Form : the term "Form" refers to the contact form to be completed online by the User if he/she wishes to contact Treedy’s directly via the Website or App, the contact form to be completed online by the User if he/she wishes to obtain a quotation for products and be contacted again, as well as the registration form to be completed when creating an User Account on the Website and/or the App;
2. Scope of this Privacy Policy
This Privacy Policy sets out the principles and guidelines for the protection of your Personal Data collected as a result of the use of the Products and Services.
“Non-Personal Data" refer to information not allowing a natural person to be identified.
The use of the Products and Services as well as the Personal Data that You agree to provide on the App, Website and/or Treedy's’ System are subject to this Policy’s provisions.
3. Who is responsible for your data?
The controller of your data is Treedy's SA, whose registered office is located at 1050 Ixelles, Avenue George Bergmann 117, registered with the Banque Carrefour des Enterprises under number 0635.598.339 (described below as "Treedy's", "we" or "our").
4. Who is protected by this privacy policy?
This Privacy Policy applies only to Personal Data that we process as controller, i.e., when we determine the means and purposes of processing Personal Data.
5. What does "processing of Personal Data" mean?
By "processing of Personal Data" we mean any processing of data that can identify you as a natural person.
The notion of "processing" is broad and covers, inter alia, the collection, recording, organisation, storage, updating, modification, request, consultation, use, dissemination or any other form of making available, matching, combining, archiving, erasure or permanent destruction of such data.
6. What Personal Data can we process?
We process personal data voluntarily and involuntarily transmitted by you to us.
This can be done by various means, including when:
- you are browsing the Website;
- download and/or access the App;
- you create a Body Scan or use a Body Scanner;
- you are using the Treedy's’ System;
- you fill out a Form;
- you subscribe to our newsletter;
- you participate in a contest or action organised by Treedy's, whether online or offline.
- you participate in surveys and polls;
- you contact a Treedy's’ representative or agent (phone, email, etc.);
- generally speaking, you use the Products and Services (cf. art. 3 of the Terms of Use);
- etc.
In order to offer the best possible service and optimal use of the Products and Services, we process different categories of Personal Data:
· Navigation and technical data.
When you browse the Website, we are bound to process the following Personal Data: your IP address, the type and language of your browser, the software, the type and brand of device you use when connecting to our Website, the length of your visit to our Website and the Internet address from which you access our Website, the pages you visit, the links you click on and the other actions you take on our Website. For this purpose, we use cookies. You will find more information about the cookies we use and the choices you can make at this level by consulting the cookies policy available at the following link www.treedys.com/cookiespolicy .
When you use the App, we process the relevant data from your mobile device (mobile phone, tablet, etc.): the name, model and model number, operating system (OS) and kernel version, UDID (only applicable for iOS devices), the telecommunications network to which your device is connected, the time zone; the language registered in the OS: NL/FR/EN, the IP address, the IMEI code (International Mobile Station Equipment Identity), the telephone number, the serial number of your card, the ID or the token (i.e., the unique identifier of the App installed) the time and date the App was installed on your mobile device, the status of the App (active or not), the time of the last contact between the App and our related systems.
· Administrative Data :
It relates to the data that enable to identify you as a customer (for example, your identity, gender, age, username), to contact you (for example, your address, e-mail address and telephone number), it concerns also your billing and payment data and any other preferences you provide to us via the Website or the App or directly to our customer service department (for example, your language preference).
· Biometric Data
It concerns the data linked to your physical appearance collected while using the Body Scanners such as your morphology and shape, sex, height and body measurements, skin color, weight, bra size, ….
· Data related to clothing preferences and lifestyle
In order to enable the targeting of the products relevant to your dress preferences (color, shape, preferred brands, etc.) as well as your lifestyle, in particular with regard to your sporting activities.
· Track record of the use of the Products and Services
We collect and keep on your profile the history of the shops in which the Products and Services have been used.
· Data communicated by means of Form
We process the Personal Data you provide to us by means of Forms made available to all Users on the Website and the App or via email in order to contact our teams (identity, telephone number, user name, email, etc.).
When you contact us, we can be bound to request additional information to confirm your identity.
The information you give us through this channel is communicated to our staff members according to the purpose of your request. The information is then stored and processed if and to the extent necessary to respond to your request.
· Sensitive data
Due to the purpose of our products and services, we process Personal Data that are qualified as sensitive by the European Regulation. In this case, through profiling and scanning of your morphology, we can process biometric data as well as data relating to your racial and/or ethnic origin.
This data is of course processed with your consent, which you give us when you come to the scanning operations.
7. To what end do we use this Personal Data?
7.1. Proportional processing
We process Personal Data for various purposes. In this context, we process only those data that are essential to achieve the desired objective.
As such, we use Personal Data when necessary:
· in order to provide our Products and Services.
· in order to enable the use of the scanned data by our partners.
· in order to share the results of the scanned and collected data.
· in order to download, install and use the App or Website on all your devices;
· in order to apply the necessary and available updates;
· with a view to making contact directly requested by the User;
· to satisfy a request directly asked by the User for a quote for our Products and Services;
· to compile statistics and carry out data analyses, in order to improve the quality of our Website and our Products and Services;
· to provide you with offers and information on other Treedy's’ Products and Services, or on partners’ products or services;
· to be able to provide you with our Products and Services and to communicate with you (for example, to notify you that phishing emails are circulating);
· to comply with the legal or regulatory provisions to which we are subject;
· to defend our legitimate interests, in which case we always ensure that a balance is maintained between these interests and the respect for your private life, especially if you are an underage child.
If the processing of your Personal Data is not necessary for one of these purposes, we always ask for your permission to process these Data.
7.2. Our processing activities
We collect Personal Data for the following specific purposes:
· In order to process your request for information regarding the Products and Services.
The information we receive about you is only used to provide you with the requested information in the way you wish. Even when you decide to become a customer and/or User.
Purpose of the processing: Legitimate interests of the parties.
· The information you provide when you subscribe to our Products and Services allows us to record your license and help you when you call customer service.
We will use it to inform you of updates, new Products and Services or to provide you with other information that may be of interest to you.
Purpose of the processing: Contractual execution and legitimate interests of the parties
· Morphologic and biometric Data
These data are basic to the solution developed by Treedy’s for garments virtual fitting and the selection and promotion of clothes and accessories.
Purpose of the processing: Contractual execution
· Data linked to clothing preferences and lifestyle.
These data are collected in order to enable us to select and promote garments that could fit your preferences.
Purpose of the processing: Contractual execution – legitimate interest
· Direct marketing
The collected data enable us also, subject to your agreement, to send you, via e-mail campaigns, information about partners’ products you might be interested in and corresponding to your references and morphology.
Purpose of the processing: Consent
· Information about updates
We may contact you to verify if your information is still correct and, if necessary, to update your products and profiles.
Purpose of the processing: Contractual execution
· Information collected during the download and use of the Products and Services
We may use Personal Data to (i) authenticate and periodically verify your license rights in the Products and Services for anti-piracy purposes, (ii) determine if updates are available for your devices before sending you an update notice, and (iii) receive messages that you have requested to receive.
Purpose of the processing: Contractual execution
· In order to offer you the best Products and Services and to inform you of your possibilities of use
We use your data to establish, maintain and support our Products and Services as well as for our administration and litigation management.
Purpose of the processing: Contractual execution
· In order to optimise our Products and Services
We ensure the maintenance and improvement of our Products and Services. The analysis of their use provides us with essential information. We process your Personal data for technical and statistical analyses and prepare anonymous reports about the results of these analyses. We may also process your Personal Data to evaluate and improve our offer. For example, we examine your equipment to optimise the use of our products. This allows us to better tailor our Products and Services to your needs.
Purpose of the processing: Our legitimate and proportionate interest
· In order to inform you about our (new) Products and Services.
We may use your Personal Data to propose to you (in writing, by telephone or electronically) new products, services or special offers that may be of interest to you. For example, you can receive an email at a particular event or when your contract expires. We can also approach you if you are no longer a customer with us, up to a maximum of 2 years from the end of our relationship. Your privacy settings determine the extent to which you receive this type of message and how you can subscribe or unsubscribe.
Purpose of the processing: Your consent
· In order to fight against fraud and offences
When you become a customer, we ask you for a series of identification data so that we can determine your identity and prevent identity theft.
Purpose of the processing: Our legitimate and proportionate interest
· In order to monitor our performance
We may use your data and profile to evaluate our Products and Services. To this end, we use, among other things, customer feedback on our services (e.g., via market research), data we obtain during our interviews with you or interventions at customers' premises, customer questions, recording of calls from our customer service department (this is reported at the beginning of the call).
Purpose of the processing: Our legitimate and proportionate interest
· In order to meet our legal obligations.
In many cases, we are legally required to retain certain Personal Data about you and/or to share them with public authorities. In the context of a police or judicial investigation, we may be required to disclose in confidence certain data to the relevant authorities.
Purpose of the processing: Legal obligation.
· In order to keep studies, tests and statistics, in particular for trend analysis.
We may use your anonymous aggregated data for, for example, internal and external reporting on the use of our Products and Services. The data that are then used cannot be linked to a specific person. The information we obtain from these analyses is used to evaluate our current Products and Services portfolio and processes and modify them based on new developments.
Purpose of the processing: Our legitimate and proportionate interest
7.3. Automated decision-making process
Treedy's does not make automated decisions – whether or not based on profiling – that may have legal consequences for you or that affect you significantly.
8. How do we protect your personal data?
8.1. Our technical and organisational measures
We do our utmost to protect your Personal Data and privacy.
For the protection of your Data, we apply various technical measures to protect your Personal Data against access and unauthorized use, loss or theft, specifically: password protection, hard disk encryption software, firewall, antivirus, intrusion and anomaly detection and access controls for our employees. In the event of a data leak with harmful consequences for your Personal Data, you are personally notified as a User in the circumstances foreseen by law.
The number of employees in our company who have access to your personal information is limited and our employees are carefully selected. They only have access to your Personal Data to the extent that they need this information to perform their tasks correctly.
8.2. Where are your data stored?
Your Personal Data are stored on computer servers at Amazon SA – European desk (EU (Paris) west-3) as well as anonymized data on servers located at our head office.
9. On what legal basis do we collect and process your personal data?
Personal Data are collected with your consent with respect to the data you voluntarily provide by completing registration and contact forms as well as by performing the scanning process.
Where such processing is not based on consent, it is then based on Treedy's’ legitimate interests as a professional, including the information and monitoring of your files, management and fraud prevention, ensuring efficiency in performing our contracts, providing our services and complying with our legal obligations, identifying ways in which we can improve services to our customers, protecting Treedy's’ commercial, financial and economic interests.
10. For how long will your Personal Data be stored?
Unless otherwise provided, your Personal Data will only be retained for as long as necessary to fulfill our contractual or legal obligations or for the purposes for which it was originally collected or as long as we have a legitimate interest in retaining such data.
In all other cases, your Personal Data will be deleted or anonymized, except for those we must keep in order to comply with the legal retention periods. However, in this case, we will limit the processing of the data, i.e., your data will only be used to comply with legal obligations.
In this context:
- Your exchanges with customer service are kept for up to 30 days.
- Administrative and accounting data are kept in order to comply with our legal obligations with regard to our accounting, tax, responsibilities and consumer protection for a period between 5 and 10 years according to the legal retention periods;
- Connection data are kept according to the retention periods foreseen in the cookies’ policy available on following link: www.treedys.com/cookiespolicy;
- Morphologic and biometric data are kept during the entire period of utilisation of our Products and Services and are automatically deleted after observation of a period of 36 months without a connection to the user profile. This ensures that you may track your morphologic evolution on a reasonable period of time without having to regularly access and/or use the Products and Services ;
- The statistical data are anonymised and kept for research purpose as well as improvement of our Products and Services.
After the applicable retention periods, Personal Data will be deleted or anonymised.
Some former customers’ data may be used for a period of 2 years after cancellation of the contract to recognise the former customer and inform him/her of new Products and Services and/or commercial offer and/or promotions, unless the customer has indicated his/her lack of consent.
11. Do we sell your data to third parties, or do we pass on your data?
11.1. Data transfer
In general, we do not sell, share or transfer Personal Data to third parties. Only Personal Data which have undergone an anonymisation process – and therefore do not qualify as “personal data” under data protection law – may be sold, shared or transferred to third parties, such as the partners suppliers of clothing and/or accessories, for the sole purpose of providing the Products and Services as described in article 3 of the Terms of Use.
Nevertheless, we wish to draw your attention to the interaction of our Products and Services with different commercial companies. Indeed, the purpose of the Products and Services is to be able to use your morphologic and biometric data (such as size, height, age, preferences, …) with various companies. Against this background, to ensure a perfect operability of the process, we are meant to share some of the data that we process after it has undergone anonymisation.
We also share some information with our suppliers and technical, IT, accountant and, if need be, legal subcontractors within the framework of specific missions.
Finally, provided you agree, you are able to share your data with other users.
While we are very attentive to the complying to the rules by these companies and partners as expressed in this Privacy Policy, we refer you to the privacy policies of the companies with which you access and/or use the Products and Services.
11.2. International processing of your personal data
To the extent that Personal Data are processed outside the European Union, we ensure by contractual or other measures that such Data are afforded an appropriate level of protection comparable to the protection they would enjoy in the European Union in accordance with European regulations.
12. How do you determine which Personal Data we may use for commercial purposes and how?
12.1. Privacy settings
Each User may determine how we may use their Personal Data for commercial purposes by sending an e-mail to fitsbest@treedys.com
12.2. Opt-out for the newsletter
You do not want to receive any form of commercial communication. You always have the right to object, without having to justify yourself, to the use of your Personal Data for direct marketing purposes. To this effect, you can always contact our services.
You can also:
· if you no longer wish to receive our newsletter, you can inform us by sending an email to fitsbest@treedys.com
· if you no longer wish to receive our newsletter: use the “unsubscribe” option in the email in question. To increase the effectiveness of e-mail campaigns, we use a software to measure whether our e-mails have been opened and which links have been clicked on.
13. Security measures in the event of subcontracting
When a processing operation is to be carried out on behalf of a controller, Treedy's only employs subcontractors who provide sufficient guarantees that appropriate technical and organisational measures will be implemented to ensure that the processing operation meets the requirements of this Policy and guarantees the protection of your rights.
The subcontractor does not hire another subcontractor without the prior, specific or general, written agreement of Treedy’s. In the case of a general written authorisation, the subcontractor shall inform Treedy's of any planned changes regarding the addition or replacement of other subcontractors, thereby giving Treedy's the opportunity to object to such changes.
Processing by a subcontractor is governed by a contract or other ad hoc legal act, which binds the subcontractor to Treedy's, defines the purpose and duration of the processing, the nature and purpose of the processing, the type of Personal Data and the categories of persons concerned, and Treedy's’ obligations and rights.
This contract or other legal act specifies, in particular, that the subcontractor:
(a) only processes Personal Data with Treedy's’ documented instructions, including transfers of Personal Data to a third country or international organisation, unless it is required to do so under European Union law or the law of the Member State to which the subcontractor is subject; in this case, the subcontractor shall inform Treedy's of this legal obligation before processing, unless the law concerned prohibits such information on important grounds of public interest.
(b) ensures that persons authorised to process Personal Data are committed to respect confidentiality or are subject to an appropriate legal obligation of confidentiality.
(c) takes all necessary measures with regard to the security of the processing.
(d) complies with the conditions referred to in the preceding paragraphs for recruiting another subcontractor.
(e) takes into account the nature of the processing operation, and shall assist Treedy's, through appropriate technical and organisational measures, to the greatest extent possible, in fulfilling its obligation to comply with requests submitted by the persons concerned in order to exercise their rights;
(f) assists Treedy's in ensuring compliance with the obligations laid down, considering the nature of the processing and the information available to the subcontractor;
g) at Treedy's' choice, deletes all Personal Data or returns them to the controller at the end of the processing service and destroys existing copies, unless Union law or the law of the Member State requires the retention of the Personal Data;
(h) makes available to Treedy's all information necessary to prove compliance with the obligations under this Article and to enable audits, including inspections, to be carried out by Treedy's or another auditor it has appointed, and to contribute to such audits.
To this end, the subcontractor shall immediately inform Treedy's in writing if, in its opinion, an instruction constitutes a breach of this Policy or other provisions of E Union law or of the law of the Member States relating to data protection.
When a Treedy's’ subcontractor recruits another subcontractor to carry out specific processing activities on behalf of Treedy's, the same data protection obligations as those attached to the contract or other legal act between the controller and the subcontractor, are imposed on such other subcontractor by contract or by another legal act under E Union law or the law of a Member State, in particular as regards providing sufficient guarantees as to the implementation of appropriate technical and organisational measures to ensure that the processing operation complies with the requirements of this policy.
When this other subcontractor does not fulfil its data protection obligations, the original subcontractor remains fully liable.
14. What are your privacy rights and how can you exercise them?
14.1. Overview of your privacy rights
The following section explains your rights. The various rights are not absolute and each is subject to certain exceptions or reservations. We will grant your request only to the extent that it follows from our assessment of your request that we are allowed and required to do so under data protection laws. Nothing in this Privacy Policy is intended to provide you with additional rights to your rights under data protection laws.
Rights
What does it mean?
1.The right to be informed
You have the right to be provided with clear, transparent and easily understandable information about how we use your data and your rights.
2. The right of access
You have the right to obtain a copy of your data (if we are processing them), and other certain other information (similar to that provided in this Privacy Policy) about how it is used.
This is so you are aware and can check that we are using your information in accordance with data protection law.
We can refuse to provide information where to do so may reveal Personal Data about another person or would impact another person's rights.
3. The right to rectification
You can ask us to take reasonable measures to correct your Personal Data if they are inaccurate or incomplete.
4. The right to erasure
This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your data where there’s no compelling reason for us to keep using them or their use is unlawful. This is not a general right to erasure; there are exceptions, e.g., if we need to use your Personal Data in defense of a legal claim.
5. The right to restrict processing
You have the right to ‘block’ or suppress further use of your Personal Data when we are assessing a request for rectification or as an alternative to erasure. When processing is restricted, we can still store your Personal Data, but may not use them further. We keep lists of people who have asked for further use of their Personal Data to be ‘blocked’ to make sure the restriction will be respected in future.
6. The right to data portability
You have the right to obtain and reuse certain Personal Data for your own purposes.
7. The right to object
You have the right to object to certain types of processing, on grounds relating to your particular situation, at any time insofar as that processing takes place for the purposes of legitimate interests pursued by us or by a third party. We will be allowed to continue to process your Personal Data if we can demonstrate “compelling legitimate grounds for the processing which override your interests, rights and freedom” or if we need it to establish, exercise or defend legal claims.
14.2. In practice
How can I exercise my privacy rights?
You can send us an email to the following address fitsbest@treedys.com.
In order to exercise your right of access and to prevent any unlawful publication of your Personal Data, we must verify your identity. In case of doubt or inaccuracy, we will first ask you for additional information (preferably a copy of the front of your identity card).
Are there any fees involved?
You may exercise your rights of confidentiality free of charge, unless your request is manifestly unfounded or exaggerated, in particular because of its repetitive nature. In this case, we have the right and choice – in accordance with privacy legislation (i) to charge you reasonable compensation (considering the administrative costs of providing the requested information or communication and the costs of taking the requested action), or (ii) to refuse to comply with your request.
In what format will I receive a reply?
If you submit your request electronically, the information is transmitted electronically, if possible, unless your request specifies otherwise. In any case, we will provide you with a concise, transparent, understandable and easily accessible answer.
When shall I receive a reply?
We will respond to your request as soon as possible, and in any case within one month of receiving your request. Depending on the complexity and number of requests, this period may be extended by two months if necessary. In the event of an extension of the deadline, we will inform you within one month of receipt of the request.
What can I do if Treedy's does not answer my request?
We will always inform you, in our reply, about the possibility of lodging a complaint with the supervisory authority (cf. art. 7 of the Terms of Use) and/or appealing to the judge.
15. Ask Treedy's questions
For more information about this Privacy Policy or for any complaint regarding the processing of your Personal Data, you may contact Treedy's via fitsbest@treedys.com
16. Stay informed about adaptations
Treedy's may amend this Privacy Policy from time to time, for example in response to market developments and new processing activities of Treedy's. We therefore invite you to always consult the latest version of this Policy on our Website. It goes without saying that we will inform you in advance via our website or other current communication channels of any changes in content and, where required by law, we will seek your prior consent for our (new) processing activities.
17. Supervisory authority
For complaints about the processing of your Personal data by Treedy's, you may contact the Data Protection Authority, rue de la Presse 35, 1000 Brussels / +32 (0)2 274 48 00 / contact@apd-gba.be / www.autoriteprotectiondonnees.be.