Privacy policy

2.2 Data Protection Contact

If you have any questions regarding the processing of your personal data or wish to exercise your rights (see Section 9), you may contact 45 RPM.R FRANCE using the following contact information:

- by email: info@45r.fr

- by Post: 45 RPM.R FRANCE – Personal Data – 1, rue d’Alger, 75001 Paris, France.

 

3. Data collected and purposes of processing

3.1 General principles

Personal data is defined as any information relating to an identified or identifiable natural person.
45 RPM.R FRANCE ensures that the data collected is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

 

3.2 Contact form

- Data collected:

- name (or any other data entered into the “name” free-text field);
- email address;
- content of the message, which may include any information you choose to provide.

- Purposes:

- receiving and processing your requests for information or questions;
- managing the relationship and communications (responding via email, maintaining a history of requests).

 

3.3 Newsletter subscription form

- Data collected:

email address.

- Purposes:

sending information and news regarding 45 RPM.R FRANCE, its collections, events, or services, via email;
managing mailing lists (subscriptions, unsubscriptions, preference management) using the Brevo (Sendinblue) platform.

3.4 Technical browsing data and strictly necessary cookies

When browsing the site, certain technical information may be collected automatically through cookies that are strictly necessary for the site’s operation and for managing consent.

 -  Data that may be processed:

technical session identifiers;
consent-related preferences (acceptance or refusal of certain cookies);
settings essential for the display and security of the site (e.g., load balancing, abuse prevention).

-  Purposes:

ensuring the proper technical functioning of the site;
enabling page display and navigation;
storing your choices regarding cookies;
ensuring the security of the site and its forms.

No analytics tools (such as Google Analytics, Matomo, Adobe Analytics, or equivalent) are used, and no advertising pixels or trackers intended for targeted advertising or marketing profiling are implemented on the 45R.fr website.

 

4. Legal bases for data processing

4.1 Contact form: legitimate interest

The processing of data collected via the contact form is based on 45 RPM.R FRANCE’s legitimate interest in responding to user inquiries, managing communications, and following up on the relationship.
This interest is balanced against your rights and freedoms, and the data collected is limited to what is strictly necessary to address your requests.

4.2 Newsletter: consent

Sending the newsletter is based on your consent, which is obtained at the time of registration when you enter your email address and take the positive action of submitting the form.
You may withdraw your consent at any time—for instance, by using the unsubscribe link included in every email or by contacting 45 RPM.R FRANCE (see section 2).

4.3 Strictly necessary cookies: legitimate interest and exception to consent

Cookies and trackers that are strictly necessary for the website to function or for the provision of a service you have expressly requested may be placed without obtaining your prior consent, provided that you are clearly informed about them.
Such processing is based on 45 RPM.R FRANCE’s legitimate interest in ensuring the security, availability, and quality of its website, as well as on the exception provided for trackers that are strictly necessary under Article 82 of the French Data Protection Act (*Loi Informatique et Libertés*).

 

5. Cookies and other trackers

5.1 General principle

In accordance with Article 82 of the French Data Protection Act (*Loi Informatique et Libertés*), the placement and reading of cookies or other trackers on your device generally require your prior consent, except when they are strictly necessary for the provision of a service expressly requested or for the technical operation of the site.

5.2 Cookies used on 45R.fr

On 45R.fr, only the following types of cookies are used:

- session and operational cookies, which are essential for displaying pages and navigating the site;

- security cookies, intended to protect the site and forms against certain types of abuse;

- consent management cookies, used to store your choices.

The site does not use:

-  analytics or audience measurement cookies;

- advertising cookies or pixels;

- social media trackers;

- trackers related to the display of videos or interactive maps.

5.3 Information and management of cookies

A banner or an information interface regarding cookies may be displayed during your first visit to inform you about the use of strictly necessary cookies and, where applicable, to allow you to manage your preferences.
The information provided is written in simple, understandable terms and specifies, in particular:

- the identity of the data controller;

 - the purposes of the cookies used;

- how to exercise your choices;

- the existence of your right to withdraw your consent, where it is required.

 

6. Data Recipients and Processors

6.1 Internal Data Access

Personal data collected via the website is accessible—within the scope of their respective duties—to authorized staff at 45 RPM.R FRANCE (for example, personnel responsible for communications, customer relations, or website management).

6.2 Processors Acting on Behalf of 45 RPM.R FRANCE

45 RPM.R FRANCE may engage technical service providers who act as "processors" (as defined under the GDPR), including:

- Shopify International Limited (Ireland): provision of the website hosting and management platform, technical infrastructure, and storage of data required for the operation of the website and its forms.

- OVH SAS (France): registration and management of the domain name 45R.fr.

- Brevo (Sendinblue): management of email campaigns for the newsletter (storing email addresses, sending emails, and managing unsubscribes).

These service providers process personal data solely based on instructions from 45 RPM.R FRANCE and are bound by strict obligations regarding confidentiality, security, and compliance with the GDPR and the French Data Protection Act (*Loi Informatique et Libertés*), as stipulated in written contracts.

 

6.3 Other potential recipients

Data may also be disclosed to competent administrative or judicial authorities when required by law.

7. Data transfers outside the European Union

7.1 General principle for international transfers

Transfers of personal data to a country located outside the European Economic Area (EEA) or to an international organization are governed by Chapter V of the GDPR (Articles 44 to 49).
Such transfers may only take place if:

- the European Commission has adopted a decision confirming that the third country offers an adequate level of protection; or

- appropriate safeguards are in place (standard contractual clauses, binding corporate rules, certification mechanisms, etc.); or

- a specific derogation provided for by the GDPR applies.

7.2 Transfers related to Shopify (including to Canada)

In the context of hosting and the technical operation of the site via Shopify, data may be transferred to and processed within the Shopify group—notably by Shopify Inc., based in Canada—or by other entities located outside the EEA.
When data is transferred to Canada, such transfers are made to a country that is the subject of an adequacy decision by the European Commission for certain types of processing, or, where applicable, on the basis of appropriate safeguards (such as standard contractual clauses).

 

7.3 Other potential transfers

Service providers involved in sending the newsletter or providing certain technical features may also use resources located outside the EEA. In such cases, 45 RPM.R FRANCE ensures that these transfers are governed by:

- an adequacy decision; or

- standard contractual clauses or another appropriate safeguard mechanism recognized under the GDPR.

You may obtain further information regarding these transfers and the safeguards in place by contacting 45 RPM.R FRANCE (see section 2).

8. Data retention periods

8.1 General principle

Personal data is retained only for the period strictly necessary for the purposes for which it was collected, plus, where applicable, any relevant statutory limitation periods.

8.2 Contact form

Data relating to inquiries submitted via the contact form is retained for the time required to process the inquiry, and subsequently archived for a period not exceeding the applicable statutory limitation period in the event of potential legal disputes.

8.3 Newsletter

Data relating to newsletter subscriptions (email address) is retained until you unsubscribe or until 45 RPM.R FRANCE discontinues the newsletter service. In the event of an unsubscribe request, the email address may be kept on a suppression list to ensure you do not receive further unwanted messages.

8.4 Cookies and technical browsing data

Strictly necessary cookies are retained for the duration of the session or for a limited period required for the technical operation of the site and to remember your preferences. 9. Rights of Data Subjects

9.1 List of Rights

In accordance with the GDPR and the French Data Protection Act (*Loi Informatique et Libertés*), you have the following rights regarding your personal data:

- Right to information: to receive clear, transparent, understandable, and easily accessible information regarding the processing of your data;

- Right of access: to obtain confirmation as to whether or not your personal data is being processed, and, if it is, to access such data along with certain additional information;

- Right to rectification: to obtain the correction of inaccurate or incomplete data concerning you;

- Right to erasure (“right to be forgotten”): in certain cases, to obtain the deletion of your data;

- Right to restriction of processing: in certain cases, to obtain a limitation on the processing of your data;

- Right to object: to object, on grounds relating to your particular situation, at any time, to processing based on the legitimate interests of 45 RPM.R FRANCE;

- Right to withdraw consent: where processing is based on your consent (for example, the sending of a newsletter), you may withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

- Right to data portability: where applicable, to receive the data you have provided in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller;

- Right to provide instructions regarding the fate of your data after your death, where provided for by national legislation.

9.2 Procedures for Exercising Your Rights

You may exercise your rights:

- by email at the address provided in section 2;

- by post at the 45 RPM.R FRANCE address mentioned in section 2.

Your request must clearly specify:

- the right you wish to exercise;

- the data or processing activities concerned;

- your full contact details so that we may respond to you.

45 RPM.R FRANCE may request additional information or proof of identity when necessary to verify your identity.

Responses will be provided in clear, concise, and understandable language within one month of receipt of the request. This period may be extended by two months, depending on the complexity or number of requests, in accordance with the GDPR.

9.3 Filing a Complaint with the Supervisory Authority

You also have the right to lodge a complaint with the competent supervisory authority—in particular, the *Commission nationale de l’informatique et des libertés* (CNIL) in France.

10. Data Security and Compliance

10.1 Security Measures

45 RPM.R FRANCE implements appropriate technical and organizational measures to ensure a level of security commensurate with the risks, including:

- securing access to the website (using secure protocols such as HTTPS);

- controlling access to data;

- raising awareness among authorized personnel;

- engaging service providers who offer sufficient guarantees regarding security and confidentiality.

The processors mentioned in section 6 are contractually obligated to implement security measures that comply with GDPR requirements.

10.2 Compliance and Documentation

45 RPM.R FRANCE maintains an ongoing compliance process, which includes:

- keeping internal documentation regarding the processing activities carried out; - regular updates to this privacy policy;

- the incorporation of data protection principles by design and by default, particularly when adding new features to the site.

11. Updating the Privacy Policy

11.1 Potential Changes

This privacy policy may be subject to change, notably to reflect legislative or regulatory amendments, recommendations from supervisory authorities, or developments in the site’s features and the services offered.

11.2 Notifying Users

In the event of a substantial change, 45 RPM.R FRANCE will notify users through any appropriate means (for example, by including a specific notice on the site). The date of the most recent update will be indicated at the top of this policy.