Confidentiality Policy

• “Data”  or "Personal Data" means any information relating to an identified or identifiable individual, i.e. any person who can be identified directly (e.g. first and last name) or indirectly (by a telephone number, license plate, social security number, mailing address or email, etc.) by referring to an identifier.

• “CNIL”  means the French Data Protection Authority.

• “Publisher”  means ANNAYAKE SARL. 

• "GDPR Regulation" means the European Personal Data Protection Regulation, more specifically Regulation (EU) 2016/679 of the European Parliament and of the Council dated April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.

• “Site”  means the website https://annayake.com/fr/.

• “Services”  means the information and services made available to Users on the ANNAYAKE Website relating to ANNAYAKE products. 

• “User”  or “Internet  User” or “You”  means the internet user who uses and visits the Website.

INTRODUCTION AND PURPOSE OF THE PERSONAL DATA PROTECTION POLICY

When the User uses the Website, ANNAYAKE may collect certain information about them which may be classified as Personal Data pursuant to the GDPR. 

This Personal Data Protection Policy is intended to inform Users of ANNAYAKE's commitments regarding the processing of Internet Users' Personal Data, with respect for their privacy, and in accordance with the laws and regulations applicable in this area, specifically the French Data Protection Act dated January 6, 1978 and the GDPR. ANNAYAKE therefore respects the privacy of Internet users who visit the Website and complies with the provisions relating to personal data protection. 

This Personal Data Protection Policy may be amended in particular to take into account any changes in the applicable laws and regulations, and any developments in case law. 

When using the Website, Personal Data is collected and processed under the following circumstances: 

• When using the Website. For this purpose, certain Login Data, such as the IP address of the terminal from which You visit the Website and Your location, may be collected and processed. This Personal Data is processed to provide You with a personalized user experience.

• We collect technical data relating to your browsing habits, such as IP address and login data, as part of our cookie management procedures (see the section devoted to this subject under the heading "Cookie Policy"). The purpose is to improve browsing the Website and to obtain statistics on the number of visitors and the use of the Website's content/pages. 

• To create and manage Users' accounts when they register on the Website in order to use the Services and to communicate promotional offers and other information. 

• When using the “Contact” section of the Website. In this case, you will be asked to fill in certain fields with Personal Data in order to communicate with our teams when asking questions via a contact form. 

The legal basis for processing is what legally permits the processing to take place, which gives an organization the right to collect or use personal data. This can be referred to as the "legal grounds" or "legal basis" for processing. In this case, when the User uses the Website, the legal basis is the User's consent and, where applicable, the contractual relationship.  

Providing Personal Data for some of the purposes listed above is always optional, albeit necessary for those purposes. If you do not provide the information requested, you may not be able to use all the Services offered on this Website.

For all of the aforementioned purposes, the Data Controller may hire external service providers to whom only data which is strictly necessary for carrying out the duties entrusted to them shall be transmitted.

The Service Providers will act as Data Processors appointed pursuant to Article 28 of the GDPR.

The list of the Data Processors is available by sending a request to the Data Controller via the contacts indicated in this policy.

The data controller is ANNAYAKE SARL whose registered office is located at 49, Avenue Montaigne, 75008, Paris (France), registered with the Paris Trade and Companies Register under number 338452741.

The data processing related to the web services of this Website is carried out at ANNAYAKE’s registered office located at 49, Avenue Montaigne, 75008, Paris (France), and is only processed by the technical staff of the office in charge of data processing.

The data is stored on the company web server at the headquarters of Server Plan S.r.l., Via G. Leopardi, 22, 03043 Cassino (FR), Italy.

The information generated by subscribing to the newsletter is collected by Brevo and the processing location is in France. For more information, you can view that company’s privacy policy.

Data processing will be carried out by means of the operations indicated in Article 4 of the GDPR and more precisely: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

In relation to the purposes indicated above, the processing will be carried out on paper and computerized media by the Data Controller, the Data Processors and/or the processor(s) taking all precautionary measures to guarantee security and confidentiality.

The data controller and data processors process Users' personal data by implementing appropriate security measures to prevent unauthorized disclosure, alteration, or destruction of personal data or unauthorized access to it.

The processing may be carried out on the data controller’s behalf under the same terms and according to the above-mentioned criteria, by authorized personnel employed in the organization of the Website (administrative, commercial, marketing staff, system administrator) or by external persons (such as technical service providers, IT service companies, communications agencies) specifically designated as data processors within the meaning of Article 28 of the GDPR.

Users’ Personal Data may under certain circumstances be processed by third-party providers as part of the Services. 

Users are invited to read the conditions of use of third-party service providers ANNAYAKE may use and their data and cookie management policies, if applicable. 

Users’ personal data is kept for as long as is necessary for the purposes for which it was collected. Data retention periods depend on the purposes for which they are processed and may therefore vary. The criteria used to determine the applicable data retention period are as follows: Personal Data is kept for as long as is necessary to: (i) manage the accounts of users registered on the website, (ii) carry out website hosting and maintenance activities, (iii) search for job openings matching candidates' profiles based on their resumés and the information provided using the form, (iv) assert legal claims, and (v) for as long as is required by applicable laws. Data collected for prospecting purposes is stored for a maximum of 5 years from the time the data subject has given their consent. If the data subject does not confirm their consent to the processing of their data for direct marketing purposes after this period expires, it will be deleted. 

1. Browsing data

The computer systems and software procedures this Website uses to operate obtain certain personal data during their normal operation whose transmission results implicitly from the use of internet communications protocols. This is information that is not collected for the purpose of being associated with identified data subjects, but which, by its nature, could make it possible to identify Users through processing and reconciliation with data held by third parties. 

Users’ IP addresses are always anonymized.

The URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the operating system and the user’s operating system are used for the sole purpose of obtaining anonymous statistical information on the use of the site and make sure it is working properly. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the Website: except for this possibility, at present, the data on web contacts are stored for 24 months.

2. Data voluntarily provided by the user
The optional, explicit, and voluntary sending of requests via forms and email to the addresses indicated on the Website entails the subsequent acquisition of the sender's address which is necessary to reply to requests, as well as any other personal data included in the message. Specific summary information dedicated to particular services on request will be provided and/or displayed on the website pages.

3. Cookies

See the section on this subject entitled “Cookie Policy”.

Personal data may be communicated for the purposes indicated above to our collaborators and employees specifically appointed and within the scope of their duties.

Data subjects have the right, at any time, pursuant to Articles 15 to 22 GDPR, to exercise their right to: 

• Obtain confirmation from the Data Controller as to whether or not personal data relating to the data subject is being processed and, in this case, obtain access to it.

• Obtain information on the purposes and methods of processing, the categories of personal data provided, the recipients and/or the categories of recipients to whom the data have been or will be communicated and, where possible, the retention period.

• Have their data completed, corrected, and deleted.

• Limit the processing of their data.

• Data portability, i.e. receive the data from the Data Controller, pursuant to Article 20 of the GDPR 2016/679, "in a structured, commonly used and machine-readable format" and transmit it to another Data Controller without hindrance.

• Object to the processing of personal data at any time, even in the case of processing for direct marketing purposes.

• Revoke consent at any time without prejudice to the lawfulness of the processing based on the consent given prior to revocation.

• File a claim with the Italian Data Protection Authority in the event that they believe that the processing of personal data referring to them carried out through this Website is done in violation of the provisions of the Regulations.

Requests should be sent to the Data Controller by registered mail with return receipt to the following address: ANNAYAKE SARL whose registered office is located at 49, Avenue Montaigne, 75008 Paris (France) or via email to contact@annayake.fr .

This Website may interact with social media or other external platforms directly from the Website’s pages. 

The interactions and information obtained by this Website are always subject to the User’s privacy settings relating to each social media network. 

In particular, data entered via Facebook is subject to the conditions set out in the data protection policy available at the following link: Privacy Policy.

BREVO

Brevo is an address management and email service provided by Sendinblus SAS.

Personal data collected: First name, last name, cookies, date of birth, and email address.

Processing location: 106 boulevard Haussmann, 75008 Paris, France. 

“Privacy Shield” member company