Last update: 17.02.2022

This privacy policy (hereinafter "Privacy Policy") governs how Luxembourg for Shopping GIE, a Luxembourg economic interest grouping with its registered office at 19-21 Boulevard Royal in L-2449 Luxembourg (Grand Duchy of Luxembourg), registered with the Luxembourg Trade and Companies Register under number C143, (hereinafter "Letzshop") collects, uses, stores and discloses information collected from buyers, sellers or simple users (hereinafter "User" as individuals or "Users" as a group) of the Letzshop platform (hereinafter "Website") accessible via the domain letzshop. lu, collects, uses, stores and publishes.

1. Compliance with laws governing the protection of personal data

Letzshop acknowledges and undertakes to comply with the laws and regulations governing the protection of personal data, including but not limited to Regulation (EU) 2016/679 of the Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "GDPR") and any other applicable national laws or regulations governing the processing of such personal data.

2. Contact

Letzshop acts as a data controller and has appointed a Data Protection Officer ("DPO") who can be contacted at the following email address: dpo@letzshop.lu

3. Why does Letzshop collect personal data from users?

The collection of personal data is not necessary for simply browsing the website. The collection of personal data is only required when a user registers on the website, a buyer purchases products or services online or a seller offers products for sale (hereinafter "Services").

4. Types of data collected

Letzshop collects and processes, in particular, surnames, first names, addresses, e-mail addresses, passwords, telephone numbers, IP addresses, registration and navigation data, order histories, preferences and interests, products called up, delivery incidents and complaints from users.

The obligation to collect the above data is indicated to the user by an asterisk. Some data is collected automatically based on the user's actions on the website.

Payment information (the first and last name of the holder, the number, the expiry date and the security code of the credit card) of the users is requested by the payment service provider only for the purpose of processing the purchases. This data is not stored by Letzshop, but by the payment service provider.

5. How Letzshop uses the Users' personal data

Users' personal data is used exclusively for the provision of the services and the proper operation of the website.

In this context, Letzshop may collect and use personal data for the following purposes:

(i) For the performance of the Services :

• When creating the user account: Only the use of an email address and password are required for the voluntary creation of a user account.

• When making a purchase: Letzshop collects the buyer's contact details and address. Letzshop will only pass on the personal data to the seller once the purchase has been confirmed and payment has been made.

• When collecting purchases ("Click&Collect" delivery option) : The user's telephone number and e-mail address may be used to inform him/her of the possibility of collecting the goods ordered.

(ii) To improve the quality of the website and any other online presence : Letzshop may use feedback provided by the user (e.g. through one-off surveys or through spontaneous comments submitted via messaging tools) to improve its products and services.

(iii) To send periodic emails and other text messages or communications if the User has registered to receive commercial offers. In the event that the user wishes to unsubscribe from this service at any time, Letzshop will include detailed unsubscribe instructions at the bottom of each email or text message.

The processing operations permitted and carried out within Letzshop are listed below:

1. The management of orders from buyers

	Types of data	Retention periods	Legal basis	Subcontractors
Case 1 : Order as registered user	1. personal data: Last name, first name, postal address, e-mail address, telephone number. 2. password (encrypted) 3. order details: Article, price, customer invoice, name of the shop 4. login details: session ID (records visitors' login, order and navigation status by recording landing pages) 5. payment method: credit card information used for online payments.	1. personal data: 10 years 2. password (encrypted): Until account is deleted 3. order details: 10 years 4. login details: Recorded only during the session 5. payment method: Terms of Stripe Payments Europe, Ltd	Art. 6 GDPR § 1, b: Fulfilment of the sales contract Art. 6 GDPR § 1, a: Consent of the user	- Stripe Payments Europe,Ltd - Michel Greco S.A. - Atalanda GmbH
Case 2 : Order as a guest	1. personal data: Surname, first name, postal address, e-mail address, telephone number. 2. order details: Item, price, customer invoice, shop name. 3. login details: session ID (records visitors' login, order and navigation status by recording landing pages) 4. payment method: credit card information used for online payments.	1. personal data: 10 years 2. order details: 10 years 3. login details: Recorded only during the session 4. payment method:Terms of Stripe Payments Europe, Ltd	Art. 6 GDPR § 1, b:Fulfilment of the sales contract Art. 6 GDPR § 1, a: Consent of the user	- Stripe Payments Europe, Ltd - Michel Greco S.A. - Atalanda GmbH

2. the sending of newsletters to users

Types of data	Retention periods	Legal basis	Subcontractors/Tools
personal data: E-mail address	personal data: Until deregistration from the service	Art. 6 GDPR § 1, a: Consent of the user	- Atalanda GmbH - E-connect Web Communication S.A. - Mailchimp (The Rocket Science Group)

3. the management of participating sellers on Letzshop

Types of data	Retention periods	Legal basis	Subcontractors
1. personal data: Surname, first name, postal address, email address, telephone number. 2. data for the creation of the account with Stripe: proof of identity and proof of postal address (if required by Stripe Payments Europe, Ltd). 3. password (encrypted) 4. login data: Session ID (Captures visitor login, order and navigation status by recording landing pages).	1. personal data: Until the termination of the membership contract. 2. data for the creation of the account with Stripe: terms and conditions of Stripe Payments Europe, Ltd 3. password (encrypted): Until the account is cancelled 4. login data: Recorded only during the session	Art. 6 GDPR § 1, b: Fulfilment of the membership contract	- Atalanda GmbH - E-connect Web Communication S.A. - Stripe Payments Europe, Ltd - easybill GmbH

6. Accuracy and minimisation of data

Letzshop undertakes to take reasonable steps to :

• ensure that users' personal data is accurate and updated when necessary;

• ensure that users' personal data is collected for the purposes set out in this Privacy Policy. The personal data will not be used for any other purpose unless the user has expressly consented to the further use of such personal data, including the email address for promotional purposes.

7. Transfer of personal data

Letzshop undertakes not to pass on users' personal data to third parties without their express consent.

Each user agrees that, in the context of providing the services, his/her personal data may be disclosed to vendors or subcontractors who assist Letzshop in providing the services, in particular payments and deliveries, provided that these subcontractors undertake to process this information only in accordance with Letzshop's instructions and to comply with the applicable laws on the protection of personal data.

List of subcontractors authorised to receive personal data about the user:

• Stripe Payments Europe, Ltd (provider of the electronic payment service).

• Atalanda GmbH (operator of the Letzshop platform)

• Michel Greco S.A. (provider of the delivery service)

• E-connect Web Communication S.A. (digital communication partner)

The following cookies generate traffic to a third country:

Name	Service provider	Purpose	Duration	Type
_fbp	facebook.com	Used by Facebook to display a range of advertising products, for example real-time bids from third party advertisers.	3 months	HTTP
_ga	google.com	Used to distinguish users.	2 years	HTTP
gac	google.com	Contains campaign-related information for the user.	90 days	HTTP
gat or dcgtmproperty-id	google.com	Used to throttle the request rate.	1 minute	HTTP
_gid	google.com	Used to distinguish users.	24 hours	HTTP

The cookies listed in the table above are part of the technically unnecessary functions on the website and are disabled by default. The user can accept or reject them in article 14. Cookies of this privacy policy.

Letzshop may also disclose the user's personal data if such disclosure is necessary to comply with the law, enforce the terms of use of the website or protect the rights, property or safety of the user or others.

Any other disclosure of personal data to third parties requires the express consent of the user.

All cases of disclosure of personal data, categorised according to the processing operations, can be consulted in the tables described in article 5: How Letzshop uses the Users' personal data.

8. How Letzshop protects users' personal data

Letzshop applies appropriate security practices and measures in the collection, storage and processing of data to protect against unauthorised access, falsification, disclosure or destruction of personal data in connection with the particular service (although some specific services may be provided by third parties).

9. Security and data transmission

Letzshop has implemented appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access and other forms of unlawful or unauthorised processing. It is also the responsibility of users to ensure that any personal data they submit is secure.

In the case of the subcontractors/applications Stripe Payments Europe, Ltd and Mailchimp (The Rocket Science Group), data transfer to third countries takes place. However, the data processing of both service providers complies with the EU-U.S. Privacy Shield Policy.

10. Storage period of the data

If the user requests the closure of his account, the account and all personal data contained therein will be deleted or anonymised in an irreversible process.

The storage period of personal data per processing operation can be consulted in the tables described in Article 5. How Letzshop uses the Users' personal data.

11. Rights of the users

In accordance with the GDPR, every user has, at any time and free of charge, the right to access, modify and object to the processing of their personal data, the right to erasure and the right to portability of their personal data by sending an email to dpo@letzshop.lu. Every user also has the right to withdraw his consent to this privacy policy at any time and free of charge. To do so, he must close his account via the "Settings" menu in his profile. The user may lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données https://cnpd.public.lu/fr.html.

12. Changes to this privacy policy

Letzshop may update this Privacy Policy at any time. In this case, Letzshop will change the date of the last update at the top of this page. Registered users will be notified by email of any changes to this Privacy Policy.

13. Consent to this privacy policy

The user's express consent to this Privacy Policy is a condition of using the Services. Consent is given by accepting the Terms and Conditions either when creating a user account or when purchasing as a guest.

Without consent to this Privacy Policy, Sellers will not be able to demonstrate and sell their products and services and Buyers will not be able to purchase from the Website.

14. Cookies

Letzshop uses "cookies" to improve the user experience on the website. Cookies are small text files that the user's internet browser stores in the internal memory of the user's terminal device (computer, mobile phone or tablet) to collect a range of data that is used to personalise navigation on the website and provide access to certain unique features. For example, the use of cookies allows the user to save the goods selected in their shopping cart and continue shopping.

A banner is displayed on the website giving the user the option to accept or reject cookies. If the user clicks on the "Accept" button, he/she agrees to the use of cookies and allows Letzshop to pass this data on to third parties. If the user clicks on the "Decline" button, only the technically necessary cookies will be used. This means that certain functions cannot be used or can only be used to a limited extent.

This is the complete list of technically necessary and non-necessary functions on the website. The latter are disabled by default and can be allowed or excluded by moving the slider in the desired direction. Cookies and similar technologies that are necessary for the proper functioning of the website require, among other things, the processing of personal data. The use of cookies that are not necessary is based on the user's voluntary consent in accordance with Art. 6 GDPR § 1, a.