Privacy Policy

ARTICLE 1: PREAMBLE

This Privacy Policy applies to the site: goodshifter.com.

The purpose of this Privacy Policy is to inform users of the site about:

  • How their personal data is collected and processed. Personal data refers to any data that can identify a user (name, surname, age, postal address, email, location, IP address, etc.);
  • Users’ rights regarding their data;
  • The data controller responsible for the collection and processing of personal data;
  • The recipients of this data;
  • If applicable, the site’s policy on “cookies.”

This Privacy Policy supplements the legal notices and Terms of Use, available at: goodshifter.com/en/terms-and-conditions.

ARTICLE 2: GENERAL PRINCIPLES REGARDING DATA COLLECTION AND PROCESSING

In accordance with Article 5 of the European Regulation 2016/679 (GDPR), the collection and processing of user data adhere to the following principles:

  1. Lawfulness, fairness, and transparency: Data may only be collected and processed with the user’s explicit consent. The user is informed of the purpose of the data collection when the data is submitted.
  2. Purpose limitation: Data is collected and processed for specific, explicit, and legitimate purposes.
  3. Data minimization: Only data strictly necessary for the purposes described is collected.
  4. Storage limitation: Data is stored for a reasonable duration, consistent with the purposes stated. If a specific duration cannot be determined, the criteria for determining it will be communicated.
  5. Integrity and confidentiality: Collected data is protected against unauthorized access, loss, or alteration.

To be lawful, the collection and processing of data must rely on one of the following legal bases:

  • The user’s explicit consent;
  • Necessity for the performance of a contract;
  • Legal obligation;
  • Protection of vital interests of the user or another individual;
  • Public interest or the exercise of official authority;
  • Legitimate interests of the data controller.

ARTICLE 3: DATA COLLECTED AND PROCESSED

A. Data collected

Personal data collected on the GoodShifter site includes:

  • First name, last name, email address;
  • Impact preferences (environmental, social, health);
  • Usual store, preferred shopping method (pickup, delivery, in-store);
  • Entered products, scanned ticket prices, and created shopping lists.

This data is collected through the following actions:

  • Creating or modifying a user profile;
  • Uploading a receipt;
  • Creating a shopping list.

B. Purposes

The data collected is used to:

  • Assess the environmental, social, and health impact of purchases;
  • Offer improved alternatives for those purchases.

C. Data sharing

Some data may be shared with third parties, such as:

  • Facebook and Google, for traffic analysis and marketing purposes.

D. Data retention period

Data is retained for a period of 24 months. After this period, the data is either deleted or anonymized.

E. Data hosting

Data is hosted by:

  • OVH, 2 rue Kellermann, BP 80157, 59053 ROUBAIX CEDEX 1 (France).
  • Data may be transferred outside the European Union when justified by the location of partner companies.

ARTICLE 4: DATA CONTROLLER

A. Identity

The data controller is: Ashley O’Mahony. Contact: ashley.omahony@goodshifter.com.

B. Obligations

The controller agrees to:

  • Protect collected data;
  • Inform users of any correction, deletion, or compromise of their data;
  • Notify users in the event of a data breach.

ARTICLE 5: USER RIGHTS

A. Overview of rights

  1. Right of access, rectification, and deletion: Users can view, modify, or request deletion of their data by contacting: hyacinthe.mutin@goodshifter.com.

  2. Right to data portability: Users may request the transfer of their data to another provider through the same procedure.

  3. Right to restriction and objection: Users may restrict or object to the processing of their data by sending a request to ashley.omahony@goodshifter.com.

  4. Right not to be subject to automated decision-making: Users may request human intervention in any significant decision made solely based on automated processing.

  5. Right regarding data after death: Users may provide instructions concerning the retention or deletion of their data after death.

  6. Right to lodge a complaint: Users may contact the CNIL in case of a dispute.

B. Minors’ personal data

According to Article 8 of the GDPR and the French Data Protection Act, only minors aged 15 or older can consent to the processing of their data. For those under 15, consent from a legal representative is required. The site may verify users’ age or parental consent.

ARTICLE 6: USE OF COOKIES

The site uses “cookies” to:

  • Process statistics and traffic information;
  • Improve navigation and user experience;
  • Provide personalized content.

For cookies involving personal data collection, user consent is required. This consent is valid for 6 months. After that period, new consent will be requested.

Users may withdraw their consent at any time by configuring their browser or through their personal account.

B. Disabling cookies

Users can also block cookies via their browser settings. Instructions for each browser are available at the following links:

C. Third-party cookies

While browsing the site, third-party cookies (such as from Google, Facebook, Instagram) may be stored. These files track interaction with the site and social media. Users are encouraged to review the privacy policies of these third parties.

ARTICLE 7: POLICY CHANGES

This policy may be modified to ensure compliance with current laws. The last update was on: 10/12/2024.