Privacy policy
Sellers
1. INTRODUCTION
KOHORTPAY complies with all applicable provisions on the protection of privacy and personal data, in particular the amended Act of January 6, 1978 on Data Processing, Data Files and Individual Liberties(Loi Informatique et Libertés) and EU Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(RGPD).
This policy describes the Personal Data that may be processed by KOHORTPAY concerning Sellers who use the KohortPay payment solution on their e-commerce sites.
2. DEFINITIONS
"Customer User": refers to any natural person making a purchase on a KOHORTPAY partner merchant site and who uses the KohortPay payment solution.
"Consent" of the data subject: any free, specific, informed and unambiguous expression of will by which the data subject accepts, by a declaration or by a clear positive act, that personal data concerning him or her may be processed.
"Recipient": the natural or legal person, public authority, department or other body that receives personal data, whether or not it is a third party. However, public authorities which may receive personal data in the context of a particular investigation in accordance with Union law or the law of a Member State are not considered as recipients; the processing of such data by the public authorities in question complies with the applicable data protection rules according to the purposes of the processing;
"Personal data" (hereinafter " personal data ") means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an "identifiable natural person" is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.
"File": any structured set of personal data accessible according to specific criteria, whether centralized, decentralized or distributed functionally or geographically.
"Controller" means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing; where the purposes and means of such processing are determined by Union law or by the law of a Member State, the controller may be designated or the specific criteria applicable to his designation may be laid down by Union law or by the law of a Member State.
"Sub-processor": the natural or legal person, public authority, department or other body that processes personal data on behalf of the data controller.
"Processing" means any operation or set of operations which is performed upon personal data or sets of data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
" Vendor ": refers to any legal entity partnering with KOHORTPAY and offering the KohortPay payment method to the Customer-User on its e-commerce site.
3. DATA CONTROLLER
The company responsible for processing personal data is KOHORT SAS.
SIRET: 920 650 025 00025
Head office address: 61 Boulevard des Dames - 13002 MARSEILLE 2
Represented by Mr Thomas Andrews, in his capacity as Chairman.
The data controller can be contacted as follows:
- By post to: Kohort SAS, 8 Rue de Stockholm, 75008 Paris
- By telephone, on 07 67 01 95 60 and/or 06 34 19 24 19
- By e-mail: dpo@kohortpay.com
4. CATEGORIES OF PERSONAL DATA OF CUSTOMERS USING KOHORTPAY
KOHORTPAY collects your Personal Data as part of your registration to the site in order to benefit from KohortPay services.
KOHORTPAY may also collect your Personal Data if you correspond with us, in particular by e-mail or telephone. In this case, we may keep a copy of this exchange.
The categories of Personal Data we process are as follows:
- Identification data: surname, first name, telephone number (if given to the Seller), e-mail address
- Data on contact and interaction with us: messages, emails, calls, interactions on our site.
- Connection and technical data: IP address, logs, terminal identifiers, time-stamp information.
- Navigation data: (cookies, audience measurement). To find out more about our policy on the use of cookies, please consult our "Cookie processing policy" available at www.kohortpay.com.
5. PURPOSE AND LEGAL BASIS
KOHORTPAY processes your Personal Data for specific, explicit and legitimate purposes.
| Goals | Categories of data processed | Legal basis |
|---|---|---|
| To fulfill the contracts between the Seller and KohortPay and to provide you with the services requested. | Identification data | This processing is necessary for the performance of our contractual obligations. |
| Send you information about our services by e-mail, SMS or any other means of communication. | Identification data | This processing is necessary for the performance of our contractual obligations. |
| Collect payments from Customer Users and forward to you the sums collected on behalf of the Vendor. | Identification data Contact and interaction data | This processing is necessary for the performance of our contractual obligations. |
| Conduct satisfaction surveys with you on the use of the KohortPay solution by telephone, SMS or e-mail. | Identification data Contact and interaction data | This processing is based on our legitimate interests in learning more about the preferences of Customer users in order to improve our services. |
| To analyze data in order to develop and improve KOHORTPAY services. The data is also subject to statistical analysis after anonymization. | Identification data Order data Connection data Navigation data | This processing is based on our legitimate interests in learning more about the preferences of Customer users in order to improve our services. |
| In accordance with applicable legislation, and with your consent where required, we may use the data you provide for marketing purposes (for example to send you our newsletters, invitations to our events or any other communication likely to be of interest to you). | Identification data | This processing is based on our legitimate interests or, in accordance with applicable legislation, on your consent where required. You may withdraw your consent at any time by (i) clicking on the unsubscribe link provided in each of our communications or (ii) contacting us at dpo@kohortpay.com. |
6. ADDRESSEES OR CATEGORIES OF ADDRESSEES
Only the authorized and specified persons mentioned below may have access to some of your Personal Data:
- KOHORTPAY's authorized personnel, who are bound by a confidentiality agreement regarding your Data;
- KOHORTPAY's subcontractors who act in the name of and on behalf of KOHORTPAY, and with whom KOHORTPAY requires that Personal Data be processed in accordance with its confidentiality and data security commitments;
- Authorized third parties, such as the courts concerned, mediators, chartered accountants, auditors, lawyers, bailiffs, debt collection companies, in order to meet its legal obligations and in particular if it is required to do so by court order;
Your Personal Data will not be communicated, exchanged, sold or rented to anyone other than those mentioned above.
7. DATA STORAGE AND DATA TRANSFER OUTSIDE THE EU
KOHORTPAY limits as much as possible the choice of Subcontractors who process Personal Data in a country outside the European Union.
For all that and in cases where KOHORTPAY uses Subcontractors located outside the European Union, we undertake to ensure that our Subcontractors present protection measures recognized as sufficient within the meaning of the RGPD. In particular, this may involve Sub-Processors located in any other country recognized by the European Union as providing an adequate level of protection for personal data ("Adequacy Decision"), subject to a data transfer agreement that complies with the standard contractual clauses adopted by the European Commission or, any other protection measure recognized as sufficient by the European Commission.
Transfers of your Personal Data outside the European Union concern the use of the following tools:
- Google Analytics
- Clerk
- Hotjar
- Better Stack
- Cloudfare
- Stripe
8. DATA RETENTION PERIOD
KOHORTPAY retains your Personal Data only as long as is necessary for the purposes for which it is to be used.
KOHORTPAY therefore keeps your Personal Data for the duration of the contractual relationship.
The following categories of Personal Data may also be stored for different periods of time:
- Data used for commercial prospecting purposes may be kept for a period of three years, unless you have decided to exercise your right to object under the conditions set out below.
- Data enabling us to establish proof of a right or contract, or kept to comply with a legal obligation, may be subject to an intermediate archiving policy in order to meet our legal, accounting and tax obligations. This applies in particular to the 5-year limitation period provided for under article 2224 of the French Civil Code.
- In the event of legal proceedings, your Personal Data, as well as any information, documents or exhibits containing Personal Data, may be kept for the duration of the proceedings, including for a longer period than that indicated above.
9. DATA SECURITY
KOHORTPAY implements appropriate technical and organizational measures to ensure the security, confidentiality, integrity and availability of services and to protect data against destruction, loss, alteration, unauthorized disclosure of personal data transmitted, stored or otherwise processed, or unauthorized access to such data.
10. YOUR RIGHTS
In accordance with the regulations on Personal Data, you have the right :
- access (article 15 of the RGPD),
- of rectification (article 16 of the RGPD),
- erasure (article 17 of the RGPD),
- limitation of processing (Article 18 of the RGPD),
- opposition (articles 21 and 22 of the RGPD),
- post-mortem directives (Law no. 78-17 of January 6, 1978 on data processing, data files and individual liberties);
Access rights
You have the right to obtain from KOHORTPAY confirmation as to whether or not Personal Data relating to you are being processed and, where they are, access to said Personal Data as well as the following information:
- the purposes of the processing ;
- data categories ;
- the recipients or categories of recipients to whom the data have been or will be disclosed;
- where possible, the planned data retention period or, where this is not possible, the criteria used to determine this period ;
- the existence of the right to request KOHORTPAY to rectify or delete data, or to restrict the processing of your data, or the right to object to such processing;
- the right to lodge a complaint with the CNIL;
- where the data is not collected from you, any available information as to its source; the existence of automated decision-making, including profiling, and, at least in such cases, useful information regarding the underlying logic, as well as the significance and anticipated consequences of such processing for you.
- Where data is transferred to a third country or to an international organization, you have the right to be informed of the appropriate safeguards with regard to this transfer.
Your right to obtain a copy of your Data must not, however, infringe the rights and freedoms of others.
Rectification rights
You have the right to obtain from KOHORTPAY, as soon as possible, the rectification of any Personal Data concerning you that is inaccurate. You may also request that incomplete Data be completed, including by providing an additional declaration.
Erasure rights
You have the right to obtain from KOHORTPAY the deletion, as soon as possible, of Personal Data concerning you when one of the following reasons applies:
- the data is no longer required for the purposes for which it was collected or otherwise processed by KOHORTPAY ;
- you have withdrawn your consent to the processing of this data and there is no other legal basis for the processing;
- you exercise your right to object under the conditions set out below and there is no compelling legitimate reason for the processing;
- the data has been processed unlawfully ;
- data must be deleted to comply with a legal obligation;
- data were collected from a child.
Limitation rights
You have the possibility to obtain from KOHORTPAY the limitation of the processing of your Personal Data when one of the following reasons applies:
- KOHORTPAY verifies the accuracy of the data following your objection to the accuracy of the data;
- the processing is unlawful and you object to the deletion of the data and request instead that their use be restricted;
- KOHORTPAY no longer requires the data for the purposes of processing, but it is still necessary for the establishment, exercise or defence of legal claims;
- You have objected to the processing under the conditions set out below and KOHORTPAY is checking whether the legitimate reasons pursued prevail over your alleged reasons.
Right to object
You have the right to object at any time, for reasons relating to your particular situation, to the processing of data concerning you based on KOHORTPAY's legitimate interests. KOHORTPAY will then no longer process the Personal Data, unless it can demonstrate that there are compelling legitimate grounds for the processing which override your interests and your rights and freedoms, or may retain them for the establishment, exercise or defense of legal claims.
You may opt out of receiving communications from us. We provide several unsubscribe links for this purpose.
Please note that you do not need to pay a fee to access your Personal Data or exercise your rights. However, we may charge a reasonable fee if your request is manifestly unfounded, repetitive or excessive.
We may also contact you to request further information about your request in order to respond to you. You will receive a reply within one month. Exceptionally, we may exceed this one-month deadline if your request is particularly complex.
11. RIGHT TO APPEAL TO A SUPERVISORY AUTHORITY
If you wish to submit a request to the CNIL, please find below our contact details:
CNIL (COMMISSION NATIONALE DE L'INFORMATIQUE ET DES LIBERTÉS)
Tel.: 01 53 73 22 22
12. CONDITIONS FOR MODIFYING THE PRIVACY POLICY
KOHORTPAY reserves the right to modify this policy at any time in order to ensure that users of the site comply with applicable law.
The most current version governs our use of your Personal Data and will always be available on the website or on request from KOHORTPAY.
Users are invited to familiarize themselves with this Policy each time they use our services, without having to be formally notified.