1. Personal data and legal basis
The Platform (which includes the "Site" and "App") is used by both Users, sellers and buyers. The information we receive is collected as follows.
Claire collects user information that the user provides directly and information that is provided indirectly using Platform.
Information Users provide Claire directly:
- Log-in data: the email address provided by the User when creating an account on the Platform.
- User Profile Information: the information User adds to the Platform in order to be able to use Claire service, i.e. Company name, address, VAT, mobile phone, and delivery address. The User can view and edit the profile data at any time.
- Payment information: Claire does not store the User's credit card details, but these are provided to licensed electronic payment service provider (Stripe) who will directly receive the data included and store them to facilitate the payment process for the User and manage the same on behalf of Claire. Under no circumstances does Claire store these data on its servers. However, if the User decide to store its payment information for further use, then Claire will store the type, the last four digits and the expiration date of your card.
- Bank accounts: The registered users, acting as sellers in a transaction, may provide their bank account number which will appear on the corresponding pro-forma invoice, as part of the payment terms established for a transaction (sell) with another user acting as buyer. Under no circumstances Claire will make charges such a bank account and the data will remain encrypted in the platform's Data Bases.
- Additional information: information User may provide to Claire for other purposes. For example, health record to be provided in the case of sellers.
- Information about communications with Claire: Claire will have access to information that Users provide for the resolution of doubts or complaints about the use of the Platform.
The processing of these data by Claire is necessary in order to comply with the contractual relationship that is established. If the User does not provide them, the requested services may not be available and Claire will not be able to provide them.
Information Users provide Claire indirectly:
- Data resulting from the Use of the Platform: Claire may collect data derived from the User's use of the Platform each time the User interacts with the Platform.
- Application and device data: Claire stores the device and Application data that the User uses to access the services (i.e. IP address, information about your computer of mobile phone as internet connection, browser type, operating system or type of device, information on orders placed by Users, User’s browsing history or preferences, etc).
- Data resulting from support management: if the User addresses Claire via the Contact Form or Claire's telephone, Claire will collect the messages received in the format used by the User and may use and store them for handling present or future queries and/or incidents.
These data are processed in order to comply with the contractual relationship established with the User, as well as for the legitimate interests that Claire has for its processing.
The User states and assures that all the information that is supplied to Claire via the Platform is true, up-to-date and complete, and undertakes to notify Claire of any change or update to his data.
2. Purpose of the processing
Using the Platform
- Claire uses the data it collects from Users to enable them to access and communicate with the Platform and to provide the services they request through their Claire Platform account.
- Claire may use the information to investigate or analyse how to improve the services it provides to Users, as well as to develop and improve the characteristics of the service it offers. Internally, Claire uses the information for statistical purposes in order to analyse the behaviour and trends of Users, to understand how Users use the Platform, and to manage and improve the services offered, including the possibility of adding new features to the Platform.
The above processing is necessary for the execution of the contract that Users have signed with Claire through the Terms and Conditions when registering on the Platform. The execution of such contract is the basis that legitimates Claire to process Users data or by such third parties for the purpose of providing the services requested by the Users through the Platform.
Ensuring security and an appropriate environment for the secure provision of services
- Claire may use the data to ensure the accuracy of user profiles and compliance with health standards in the case of the seller if necessary.
- Claire may use the information to resolve questions, suggestions or complaints that may arise to the User and may be used to support the User if necessary.
Claire may use of the information that Users provide for the processing described above in the legitimate interest of protecting the good use of the Platform, complying with applicable legislation, as well as guaranteeing the correct and safe provision of services.
Sending news and updates
- Claire will be able to send you an email with all the new features arising in the Platform, as well as inform you of all the updates that are being integrated. If the Claire User does not wish to receive such information, the User may at any time opt-out of the "Unsubscribe" option in the email itself, and consequently, Claire will immediately cease sending such information.
The foregoing processing will be carried out in Claire's legitimate interest to perform marketing activities for the benefit of Users.
Sharing User data with third parties
- User data may be made available to IT service providers, such as hosting and Payment Platforms, transportation companies for deliveries or external accounting firms in order to process bills.
When a User inserts its card number into Claire Platform, it is stored directly by our Payment Gateways, which will allow the User's account to be charged. Such processing will be performed as necessary to execute the contract signed between the User and Claire established by the Terms and Conditions of the Platform.
Moreover, Claire grants access to User data to the following companies behind Claire that have signed the corresponding data processing contracts:
- Amazon Web Services (AWS): for hosting the Site, whose servers are hosted in Ireland. For further information visit: https://aws.amazon.com/privacy/.
- The Rocker Science Group LLC, which operates under the commercial name of Mailchimp: to distribute out newsletters and promotional emails whose servers are hosted in USA. Consequently, it is an international data transfer to which security measures are applied as necessary in accordance with the type of processing carried out. For further information visit: https://mailchimp.com/legal/privacy/.
- Stripe Inc: in order to process payment by credit or debit card whose servers are hosted in USA. Consequently, it is an international data transfer to which security measures are applied as necessary in accordance with the type of processing carried out. Stripe has been certified to PCI Service Provider Level 1, the most stringent level of certification available. You can find more information about Stripe's security at the Stripe’ website. For further information visit: https://stripe.com/privacy/.
Based on their legitimate interest, Claire reserve the right to change, remove or add service providers which may be located within or outside the European Economic Community. When they do, Claire shall apply all measures needed to ensure security in processing, applying standard clauses approved by the European Commission or any other suitable measures covering the type of processing carried out to guarantee that the providers offer suitable assurances in line with current legislation.
To maintain the security of your information, Claire use the Transport Layer Security (TLS) protocol, which is the same technology used in transmitting sensitive information by banks, governments, and online businesses. Once the information is in our system, it is accessible to authorized Claire's personnel only.
The data collected via the Platform shall be conserved by Claire for the period necessary and for as long as the User's account remains active on the Platform. Once an account has been deleted, or upon the exercise of the right of deletion, the data shall remain blocked until the statute of limitations governing the liabilities that may arise from the processing of data or the provision of the service has expired, pursuant to mandatory regulations (namely, up to: 3 years in relation to data protection; 5 years in relation to contracts; 4 years in relation to invoicing and 3 years in relation to eCommerce).
Exercise of rights
Within the legal limits, Users may exercise their rights to access, rectification, deletion, opposition, processing limitation and portability of data, and to not be subject to automated decisions, including the preparation of profiles, by contacting Claire using the means of contact shown in the Legal Notice. To this end, Users can contact Claire in order to exercise the aforementioned rights.
Inasmuch as processing of data is based on consent provided by Users, they may withdraw said consent at any time without this being detrimental to the legitimacy of the processing made prior to said withdrawal.
In addition, Users have the right to submit a claim to the data protection officer, including the Spanish Data Protection Agency (AEPD).