YOUR PERSONAL DATA
Privacy
policy.
1. Who is responsible?
For data collected at sign-up and in managing the subscription, the data controller is:
- Controller
- annais paris cosmetica SL (the “Publisher”), a limited liability company governed by Spanish law, NIF: B19819564, Calle Burgos 21, 28036 Madrid, Spain
- Data contact
- contact@annaisparis.com
2. Data collected at sign-up
When you sign up, we collect only the following information: the pharmacy’s name, your first and last name, your email address, the pharmacy’s postal code, city and country, its average footfall (in ranges of people per day) and, if you wish, its SIRET number (optional).
Creating and running your pharmacy space
- Purpose
- Create the space, send you the one-time login link, support you.
- Legal basis
- Performance of the contract.
- Retention
- During the subscription, then two years after its termination
Pharmacy activity, usage statistics and possible leaderboard
- Data
- Average pharmacy footfall (in ranges of people per day).
- Purpose
- Gauge the pharmacy’s level of activity, compile usage statistics and, where applicable, run a usage leaderboard between pharmacies.
- Legal basis
- For the usage leaderboard between pharmacies: the Publisher’s legitimate interest in developing its service and making it known to professionals. You may object to this at any time, as stated under “Your rights”.
- Retention
- During the subscription, then two years after its termination
Managing the subscription and billing
- Data
- Plan chosen, subscription status and dates, invoices, customer identifier with our payment provider.
- Purpose
- Manage the subscription, invoice, keep the accounts.
- Legal basis
- Performance of the contract for managing the subscription and invoicing; legal obligation for keeping accounting and tax records.
- Retention
- Statutory period applicable to accounting records
Responding to your requests
- Data
- Messages you send to contact@annaisparis.com, and the information entered in the demonstration request form (pharmacy name, your name, email address, optional phone number).
- Purpose
- Responding to your requests and getting back to you about a demonstration request.
- Legal basis
- For demonstration requests: the Publisher’s legitimate interest in developing its service and making it known to professionals. You may object to this at any time, as stated under “Your rights”.
3. Payment
Payment is processed by Stripe (bank card or SEPA direct debit). Your card or bank account details are entered directly on Stripe’s payment page: we do not collect or store them ourselves. Stripe sends us the necessary subscription information (status, plan, dates).
4. The pharmacy customers’ journey
The pharmacy’s customers use the OFFY journey from their smartphones, without creating an account. Depending on the module, they answer questions and take guided photos (Skin module), or start from an ingredient, a product’s barcode or a concern (Supplements module). In the Skin module, the result is emailed only with their consent.
Analyses are not kept beyond what is necessary for the product to operate. To produce the recommendations, OFFY may use third-party providers for certain technical processing.
5. Referral invitations
The referral programme between pharmacies, described in the General Terms of Sale, involves two processing operations on personal data: the invitation sent to a person named by a pharmacy, and the information given to pharmacies about the progress of a referral.
Inviting a person to discover OFFY
- People concerned
- The person whose professional email address is entered by a pharmacy that is an OFFY customer, in order to send them an invitation.
- Controller
- The Publisher, as stated in section 1
- Purpose
- Send a person named by a pharmacy an invitation to discover OFFY, with a single-use referral code created for that invitation, and check that the code is used only once and that a pharmacy does not refer itself.
- Legal basis
- The Publisher’s legitimate interest in developing its service and making it known to professionals. You may object to this at any time, as stated under “Your rights”.
- Source of the address
- The address is entered by the inviting pharmacy, not by the person invited.
- Data
- The email address, for the time it takes to send the message, and the content of the message (the name of the inviting pharmacy, the single-use referral code created for the invitation and, if it wrote one, a short personal sentence). OFFY does not record the address in its database: only an irreversible fingerprint (salted hash) is kept, to avoid sending the same invitation twice and to tie the code to the invitation. When a pharmacy signs up with that code, the sign-up address is compared, by fingerprint, with the invited address, only to report a difference to the OFFY team: a difference does not prevent the sign-up. When a pharmacy enters a code while signing up, an irreversible fingerprint of its email address is also kept on the code for the duration of the payment (about an hour), so that a code serves only one payment at a time, and is then erased. The opt-out list works the same way.
- Sent copy
- The message is sent through OFFY’s email account: the email as sent, with its recipient’s address, may remain in the sent history of that email account
- Retention
- Fingerprint kept for 120 days, long enough to avoid duplicates; unused single-use code deleted after 120 days at the latest; opt-out list kept for as long as it protects the person who objected
- Right to object
- Every invitation contains a one-click unsubscribe link, valid for all pharmacies. You can also write to contact@annaisparis.com to object to this processing, or to exercise the other rights described under “Your rights”.
Informing pharmacies of the progress of a referral
- Data
- For each referral, the name of the referring pharmacy, that of the referred pharmacy and the status of the referral.
- Purpose
- Inform each pharmacy, by email and in its pharmacy space, of the stages of the referral: the referrer is told the name of the pharmacy that subscribes with the code of its invitation, whatever the state of the referral; the referred pharmacy is told the name of the pharmacy that referred it while its third free month is planned or granted, but not in the message informing it that the referral has not been accepted.
- Legal basis
- The Publisher’s legitimate interest in developing its service and making it known to professionals. You may object to this at any time, as stated under “Your rights”.
- Retention
- During the subscription, then two years after its termination
6. Recipients and third-party providers
Your data is accessible to:
- the Publisher’s team, within the limits of their duties;
- Stripe, for payment;
- Google Cloud, for hosting;
- third-party providers involved in operating the service;
- authorities, where the law requires it.
These providers act only for the needs of the service. Your data is not sold.
7. Hosting
The pharmacy space data is hosted on Google Cloud, in the europe-west1 region (Belgium).
The service’s data is hosted in the European Union.
8. Retention periods
We keep your data for as long as is necessary for each purpose described in sections 2 and 5. After termination, the account data is kept for two years and then deleted, apart from data that the law requires us to keep (in particular accounting data).
9. Security
Access to the pharmacy space is through a one-time login link, valid for 72 hours, then through a password you choose (if your address is already associated with an OFFY account, you log in with your usual credentials).
10. Your rights
You have the following rights over your data:
- access to and a copy of your data;
- rectification of inaccurate data;
- erasure, in the cases provided for by law;
- portability of your data;
- objection to processing based on legitimate interest;
- restriction of processing, in the cases provided for by law;
- withdrawal of your consent at any time, where the processing is based on it.
To exercise them, write to contact@annaisparis.com stating your request; we may ask you to prove your identity. We reply within one month. If you are a pharmacy customer and your request concerns a result obtained through the advice journey, you may also contact that pharmacy directly.
If you believe your rights are not being respected, you may lodge a complaint with the competent supervisory authority, in particular the Spanish Data Protection Agency (AEPD, www.aepd.es (opens in a new tab)).
12. Updates
This policy may change. The date of the last update appears at the top of the page. In the event of a significant change, the persons concerned are informed by email.