Personal data

When you use our Website and our online product sales services, or when you seek to contact us, we collect personal data in accordance with European Regulation No. 2016/679 of April 27, 2016.

Only authorized persons within Les Jardins de Gaïa will have access to this data for strictly internal purposes.

Please note that all personal data is communicated to an external organization, namely: Agence 86 (web project development agency).

Personal data may also be communicated to our service provider iAdvize SAS, which is responsible for managing the online chat and the AI-based conversational assistant, for the sole purpose of providing these services.

We collect the information you voluntarily provide to us for a specific use that remains strictly professional.

This data will be kept for a maximum of 3 years from the date of the last order.

Please note that you can also submit reviews of the products we sell or even of the Les Jardins de Gaïa brand. Only a pseudonym is required here. However, you can choose to provide your personal data if you wish.

In accordance with Articles 15 et seq. of the General Data Protection Regulation, you have the right to access, rectify, and erase all data concerning you (see Article 2.6).

Cookie management

A cookie is a small text file placed on your computer when you visit a website.

We use the following cookies:

Example of purpose:

• Cookie for storing browsing data, allowing you to move from one page to another without losing information. It is only used for the proper functioning of the site.
• Cookie protecting the site against spam. It is used solely for the proper functioning of the site.
• Google Analytics + Google Tag Manager cookie that collects anonymous visit statistics to improve content accessibility, navigation, and user experience on the site. Potentially intrusive to your privacy, this cookie requires your consent to be stored.
• Hotjar cookie to analyze information about browsing behavior and mouse movements. Potentially intrusive to your privacy, the placement of this cookie requires your consent.

You can accept, restrict, block, or delete cookies from the Les Jardins de Gaia website at any time by changing the settings using our module.

Privacy

This policy describes the practices implemented by Les Jardins de Gaïa in connection with the use of its website www.jardinsdegaia.com.

The term "personal data" refers, within this policy, to any information relating to an identified or identifiable natural person, either directly or indirectly.

1. Data controller

Your personal data is collected by Les Jardins de Gaïa, which is the data controller, whose registered office is located at ZA - 6, rue de l'Ecluse 67820 WITTISHEIM - FRANCE

RCS Colmar 398 560 375.

Represented by Mr. Karrame BELHIDAOUI, Manager.

2. Collection and processing of your data

2.1. Data collection

Les Jardins de Gaïa collects some of your personal data in the following cases:

• Creation of a customer account: last name, first name, and email address
• Ordering products and after-sales service: last name, first name, postal address, email address, city, country, postal code, telephone number
• Ordering or using a gift card: last name, first name, postal address, email address, city, country, postal code, telephone number of the purchaser and, where applicable, of the recipient when this information is provided by the purchaser
• Upon receipt of the gift card, the recipient is informed of the processing of their data and may exercise their rights in accordance with Article 2.6 hereof
• Booking and participation in a Tea School course or workshop: last name, first name, email address, phone number, mailing address (if materials are to be sent), and, where applicable, technical log in data for online courses (IP address, session identifiers, audio/video recording if accepted by the Customer)
• Posting online reviews: last name, first name, or pseudonym chosen by you
• Newsletter subscription: email address
• Bank details in the event of payment by credit card (not stored)
• Customer service contact on forms: last name, first name, email address, phone number
• Use of online chat and chatbot: data relating to conversations (message content, date, duration, number of conversations, responses to satisfaction surveys where applicable), data you choose to provide (last name, email address, phone number), and your IP address for conversations conducted via web or mobile chat only, for use as evidence in the event of a dispute. Browsing data (type of device, type of browser, pages viewed, language, browsing duration) may also be associated with your session when you have consented to the iAdvize VUID conversational cookie being stored.
• Browsing the Website (see Article 5 COOKIES)

This data is collected for the purpose of informing you about our new products, ensuring the proper processing of your order, delivering the products ordered, carrying out payment transactions, and communicating with you about orders placed.

The information requested and marked with an asterisk is mandatory as it is necessary for processing your order. The other information requested is optional.

2.2 Commercial offers

If you have subscribed to the newsletter, Les Jardins de Gaïa will send you commercial offers by email. With each email, you will have the option to unsubscribe with a single click.

By providing us with your telephone number, you agree to be contacted (by phone call or text message) for any matter relating to your order or for occasional commercial offers.

2.3 Recipients of the data

The information is collected by Les Jardins de Gaïa, which is responsible for processing it.

Certain data, particularly personal data, may be communicated in a secure manner to technical partners linked to Les Jardins de Gaïa by contract for the performance of subcontracted tasks necessary for the management of your account, the execution of your orders, the delivery of goods and the provision of services, the fight against fraud, or the execution of payments.

As part of the chat and AI assistant service, your data is processed by our service provider iAdvize SAS and hosted on secure servers located in the European Union (AWS – Frankfurt).

The artificial intelligence features are based on Microsoft Azure OpenAI technology, used exclusively by iAdvize to provide the service.

2.4 Purposes and legal basis for processing

2.5 Hosting of personal data

Your personal data is stored on secure servers located at our hosting provider.

Data from the chat and AI assistant is hosted by iAdvize SAS on AWS servers located in Frankfurt, Germany.

Artificial intelligence processing is carried out via Microsoft Azure OpenAI, in compliance with European data protection rules.

In accordance with legal obligations, this information is stored under enhanced security conditions and for a limited period of time, proportional to the purposes for which you have provided it to us.

As part of your order, your data may be transferred to service providers, in particular our host, in which case Les Jardins de Gaïa will take appropriate measures to maintain the security of your personal details during the transfer and upon receipt of this information.

Subcontractors and service providers are bound by contract with Les Jardins de Gaïa, which will include contractual clauses relating to the protection of your personal data. They are required to guarantee an optimal level of security.

2.6 Your rights

In accordance with the GDPR and the amended French Data Protection Act of January 6, 1978, you have various rights:

• Right of access: the right of the data subject to access the personal data that has been collected about them and to exercise this right easily and at reasonable intervals, in order to be aware of the processing and to verify its lawfulness.
• Right of communication: the ability for the data subject to obtain a copy of the personal data being processed. When the data in question consists of documents, the right to obtain a copy of the data "implies the right to obtain a copy of extracts from documents, or even entire documents or extracts from databases that contain, among other things, said data, if the provision of such a copy is essential to enable the data subject to effectively exercise the rights conferred on them by the [GDPR], it being emphasized that the rights and freedoms of others must be taken into account in this regard."
• Right to rectification: If data is inaccurate, the data subject may have it corrected "without undue delay." This right is essentially exercised by writing to the organization holding the information, and the data controller must then provide evidence that it has made the requested corrections and, at the request of the data subject, send a copy of the modified record free of charge.
• Right to erasure: The data subject has the right to obtain the erasure, as soon as possible, of personal data concerning them, for example when the personal data is no longer necessary for the purposes for which it was collected or processed. Exceptions remain when processing is necessary to comply with a legal obligation or for the establishment, exercise, or defense of legal claims.
• Right to restriction of processing: In certain limited cases, the data subject may request that the processing of personal data be restricted. Restriction allows the data to be "frozen" for the necessary period of time: it will only be stored but may no longer be processed without the consent of the data subject. Restriction may be requested in four cases:
  • when the person disputes the accuracy of the data, for the time necessary to make corrections;
  • when the processing is unlawful but the data subject does not want the data to be erased;
  • when the data is no longer necessary for the processing for which consent was given, but the person wants it to be retained so that it can be produced in court;
  • when the person exercises their right to object to the processing.

• Right to data portability: the right of the data subject to receive the personal data concerning him or her that he or she has provided to a controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
• Right to object: the right of the data subject to object, at any time, to the processing of their personal data on grounds relating to their "specific situation." However, the data controller may override this right if they can prove that there is a legitimate reason that outweighs that put forward by the data subject and therefore prevails over the interests, rights, and freedoms of the data subject.

You can exercise your rights by contacting us:

• • By email: confidentialité@jardinsdegaia.com
  • By mail: GDPR Officer Les Jardins de Gaïa, ZA - 6, rue de l’écluse F-67820 WITTISHEIM

In this context, you will need to provide us with all your contact details (surname, first name, address, email) so that we can take the necessary action as soon as possible.

You can access, modify, or even delete your contact information at any time, as well as manage your newsletter subscription, in your customer area under the "My Account" section.

These rights may also be exercised by any person whose personal data has been transmitted by a third party, in particular when ordering a gift card.

Similarly, when a person is registered for a course or workshop to replace the original participant, their data may be communicated to Les Jardins de Gaïa by the latter. The replacement person is then informed, upon confirmation of their participation, that they may exercise their rights in accordance with Article 2.6 hereof.

2.7 Data retention period

Personal data is retained for periods proportionate to the purposes for which it is processed.

3. Use of an AI-based assistant

The website www.jardinsdegaia.com offers a chatbot that uses artificial intelligence technologies provided by our service provider iAdvize via Microsoft Azure OpenAI.

Some responses may be generated automatically.

The data exchanged is used solely to respond to your requests and is not used to train artificial intelligence models.

You are informed of the use of AI in accordance with the requirements of Regulation (EU) 2024/1689 on artificial intelligence (AI Act).

4. Payment security

Les Jardins de Gaïa has opted for SSL (Secure Socket Layer) encryption, which is the current standard for data encryption on the Internet. As a result, the banking information you provide is encrypted on your own computer and does not circulate unencrypted on the Internet.

Your credit/debit card number is therefore entered on a secure page hosted by the bank and is not known to Les Jardins de Gaïa.

To ensure payment security, Les Jardins de Gaïa uses the services of PCI-DSS certified providers, which guarantees the absolute confidentiality of the information we hold.

Les Jardins de Gaïa, in order to ensure the highest level of security for payments made with credit/debit cards, is up to date with PCI DSS certification, which is renewed annually.

In addition, Les Jardins de Gaïa uses the 3D-Secure security standard, which is based on the verification of information known only to the cardholder (such as a 4-digit code) and which will be requested by their bank during online transactions.

5. Cookies

Cookies (small text files sent by the site to your browser and stored on your computer) do not allow us to identify you, but they record information based on your use of our site, namely:

• The type of device used
• The device's operating system
• Your internet service provider
• The browser used
• The IP address of your device
• The geolocation of your device
• Your language preferences

Les Jardins de Gaïa uses cookies to collect this information for analytical and functional improvement purposes, in order to optimize your online experience.

As part of the online chat service and conversational assistant, a specific cookie called "iAdvize VUID" is used to enable the chat to open, recognize your session, and store the conversation history.

This cookie is non-essential and is only stored after you have given your consent via the cookie banner or when you activate the chat. The iAdvize VUID cookie is stored for 12 months.

By clicking on "accept and continue on the site," you agree to the use of cookies. You can also choose to accept only cookies that are essential for browsing, which are not subject to consent, such as:

• Trackers that store the choice expressed by users regarding the placement of trackers
• Trackers intended for authentication with a service, including those intended to ensure the security of the authentication mechanism, for example by limiting automated or unexpected access attempts
• Trackers intended to remember the contents of a shopping basket on a commercial site or to bill the user for the product(s) and/or service(s) purchased
• Trackers for personalizing the user interface (e.g., for choosing the language or presentation of a service), when such personalization is an intrinsic and expected part of the service
• Trackers that enable load balancing of equipment contributing to a communication service
• Trackers that allow paid sites to limit free access to a sample of content requested by users (predefined quantity and/or for a limited period)
• Certain audience measurement trackers, provided they meet certain conditions

This message will only appear when you first visit our website.

You can configure your browser to accept or refuse cookies on a case-by-case basis before they are installed.

You can also regularly delete cookies from your device via your browser.

Each browser has different settings for managing cookies and user choices. These settings are described in the help menu of the browser you are using and allow you to find out how to change your cookie preferences.

For example:

• For Internet Explorer™ for Internet Explorer 7 and 8
• For Internet Explorer 9
• For Chrome™
• For Firefox™
• For Opera™
• For Safari™

6. Social networks

Our website contains links to social networks such as Facebook, Instagram, YouTube, Google My Business, Twitter, and LinkedIn.

When you visit a page on the site that contains such a button, your browser establishes a direct connection with the servers of the social network concerned.

We invite you to consult the privacy policies of these social networks to learn about their purposes of use, including advertising.