Privacy Policy of Black Elephant
This Policy covers the processing of personal data of visitors to our website and users of our services.
What is data protection?
Any information that can be used to identify you, either directly (your first and last names, an online handle, etc.) or indirectly (for example, by cross-referencing different types of data about you) constitutes personal data within the meaning of European law.
European law guarantees you, on the one hand, the protection of this data against any malicious or abusive use, and on the other hand, a power of control over their use by third parties.
In accordance with Regulation (EU) 2016/679 on the protection of personal data, known as the "General Data Protection Regulation" (the "GDPR"), you are thus entitled to know the identity of the persons processing your personal data, the use that is made of it and for what purposes, whether your data is transferred outside the EU. You also have rights that you can exercise by contacting the person responsible for processing your data.
This policy aims to inform you on the processing activities carried out by Black Elephant or under its responsibility and to provide you all the necessary information so that you can fully exercise your rights.
Data controller
The data controller is the company:
Black Elephant
18, rue Rambuteau
75003 Paris
France
You can contact Black Elephant:
By email, at info@blcklphnt.com.
By post, at the address: 18, rue Rambuteau, 75003 Paris, France.
Processing activities, data processed, purposes and storage periods
| Purpose | Data processed | Legal basis | Data storage period |
|---|---|---|---|
| Operate our website | Data collected by our cookies: Language selection Beginning and end of a browser session |
Black Elephant’s legitimate interest in ensuring our website is functional and safe (art. 6(1)(f) GDPR) | Duration of a session on the Black Elephant website. Cookies are deleted when you close your internet browser. |
| Allow users to sign up | Data provided when creating an account: Identity: first and last name Authentication data: email address or username, password Contact information: email address, telephone number Languages spoken Adult status (over 18 years old) Photograph (if provided) Declared location: City, country, postal code (if provided) Data on your personal or professional situation: occupation category, education level, biography (text field) Gender | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account. |
| Allow users to find other users (search tool) | Account information: first and last name, handle, email address, photograph (if provided), spoken languages, declared location, contacts, number of parades organised, number of participants to the parades | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account |
| Allow users to compile a list of contacts | Profile data: first and last name, handle, email address, photograph (if provided), spoken languages, declared location, contacts, number of parades organised, number of participants to the parades | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account |
| Allow users to organise parades | Data on the parade: date, time, location or virtual parade, name of the parade, spoken language Data on the participants: first and last name of the host, first and last name of the guests | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account |
| Select additional participants to a parade | Account information Identity: first and last name Languages spoken Declared location: city, country, postal code Data on your personal or professional situation: occupation, education Gender | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account |
| Notify guests of invitations | Contact information: telephone number (if you have selected this option) Account information: invitations accepted directly in the user’s personal space | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) For SMS texts: Consent (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account |
| Manage RSVPs | Account information: invitations accepted directly in the user’s personal space | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | Your account and all associated data are deleted: When you close your account directly on our platform At your request when you have sent us a deletion request By default, after 2 years of inactivity of your account |
| Provide customer service and manage requests pertaining to our services | Identification data and contact information: first and last name, email address, telephone number (depending on the form and nature of the request) Data necessary to process the request: contents of the request, account information, technical data on a session | Black Elephant’s legitimate interest in answering its users’ requests (art. 6(1)(f) GDPR) | 5 years from Black Elephant’s response to your request (storage period based on Black Elephant’s legitimate interest to defend its interests in case of a dispute (art. 6(1)(f) GDPR). |
| Manage requests pertaining to data protection | Identification data and contact information: first and last name, email address, telephone number (depending on the form and nature of the request) Data necessary to process the request: contents of the request, account information | Black Elephant’s compliance with its legal obligations (art. 6(1)(c) GDPR) | 5 years from Black Elephant’s response to your request (storage period based on Black Elephant’s legitimate interest to defend its interests in case of a dispute (art. 6(1)(f) GDPR). |
| Manage disputes | Identification data and contact information: first and last name, email address, telephone number (depending on the form and nature of the request) Data necessary to manage the dispute: account information, invoices, subject of the dispute, information gathered to manage the dispute | Black Elephant’s legitimate interest in defending its interests (art. 6(1)(f) GDPR) | In case of pre-litigation, your data is kept for a period of 5 years from the appearance of the dispute (storage based on the legitimate interest of Black Elephant to defend its interests in case of a dispute (art. 6(1)(f) GDPR)). In the event of litigation, your data is preserved for the duration of the appeal deadlines (storage based on the legitimate interest of Black Elephant to defend its interests in case of a dispute (art. 6(1)(f) GDPR)). |
| Technical interventions and website maintenance | Account information, technical data on a session | Performance of the terms and conditions of sale and use (art. 6(1)(b) GDPR) | No data storage |
| Advertising and commercial communication | Identity: First and last name Contact information: email address | Your consent (art. 6(1)(a) GDPR) | Your data is stored until you withdraw your consent or for 2 years from your last interaction with Black Elephant. |
Data recipients
Technical service providers: SendGrid, Twilio
Payment service provider: Stripe
With the exception of our technical service providers, and subject to potential legal obligations, Black Elephant does not share your data with third parties.
Transfers of data outside of the EU
Black Elephant does not transfer your data outside of the European Union.
Your rights
| Right of access | You have the right to ask us what data we have about you and to obtain a copy. |
| Right to rectification | You have the right to ask us to correct any errors in your personal data or to update your data if your situation changes. |
| Right to erasure | You have the right to ask us to erase your data if it is no longer necessary for the purpose for which it was collected, or if you have withdrawn your consent to the processing of your data or if you have objected to the processing of your personal data. However, in some cases we will not be able to comply with your request, for example where the processing is necessary to fulfil a legal obligation of Black Elephant. |
| Right to object | Where a processing operation is based on the legitimate interests of Black Elephant (see table above), you can object to the processing of your personal data. Black Elephant will then stop processing your data for the associated purposes, unless there are compelling legitimate grounds for the processing or the processing is necessary for the establishment, exercise or defense of legal claims by Black Elephant. In this case, Black Elephant will inform you of the reasons why it is unable to comply with your request. |
| Right to withdraw your consent | Where processing is carried out with your consent, you may withdraw your consent at any time. Black Elephant will then immediately stop processing your data for this purpose from the moment of withdrawal of your consent. |
| Right to restriction of processing | You can request the restriction of the processing of your personal data, i.e. the temporary suspension of the processing, when you have exercised your right to object or you want your data to be corrected. |
| Right to data portability | Where processing of your personal data is carried out on the basis of your consent or by means of automated processes, you may request to receive a copy of your data in a structured, commonly used and machine-readable format, or request the transfer of such data to another controller. |
| Right to give instructions on your data after your death | You have the right to give us instructions on what to do with your data, and in particular your personal account, after your death. |
| Right to lodge a complaint with the competent supervisory authority | If you are not satisfied with the way Black Elephant handles your personal data, you can lodge a complaint with your national data protection authority (for residents of the European Union) or with the French authority (the CNIL): Commission nationale de l’informatique et des libertés (CNIL) – 3, place de Fontenoy, TSA 80715, 75334 Paris CEDEX 07 However, we invite you to contact us if you have any questions or comments before turning to a supervisory authority. |
Changes to the Privacy Policy
This Policy may change from time to time to reflect changes in our services. If you have a Black Elephant account, you will automatically be notified of any changes to the Privacy Policy. By continuing to use our services, you agree to these changes.
Frequently Asked Questions
What is this Policy for?
The purpose of this Policy is to inform you about all the treatments carried out by Black Elephant on your personal data as well as the rights you have on your data and how to exercise them.
How can I learn more?
For any questions pertaining to the processing of your personal data, don’t hesitate to contact Black Elephant through one of the following channels:
By Email: info@blcklphnt.com
By post: 18, rue Rambuteau, 75003 Paris, France
When and how can I object to the processing of my personal data?
You can object to the processing of your data when the processing is based on the legitimate interest of Black Elephant. In this policy you will find a table showing which processing is based on the legitimate interest of Black Elephant.
You can object to the processing of your data in several ways:
Using the mechanism provided for this purpose when such a mechanism exists (for example, by clicking on the link at the bottom of an email presenting the services of Black Elephant).
By contacting Black Elephant directly through one of the following channels:
By Email: info@blcklphnt.com
By post: 18, rue Rambuteau, 75003 Paris, France
When and how can I ask for my data to be erased?
You may request the deletion of your data:
When it is no longer necessary for the purpose for which it was collected.
When you have withdrawn your consent.
If you have objected to the processing of your data.
If your data is processed unlawfully.
If the deletion of your data constitutes a legal obligation for Black Elephant.
However, certain exceptions may apply that justify Black Elephant not deleting your data. Black Elephant will then inform you of the circumstances that justify the retention of your data.
To request the erasure of your data, please contact us through one of the following channels:
By Email: info@blcklphnt.com
By post: 18, rue Rambuteau, 75003 Paris, France
What "profiling" is carried out by Black Elephant?
In order to organise the dinners and to ensure the quality of the parades by guaranteeing a diversity of participants, Black Elephant designates for each parade organized in a random way two participants among all its users.
The criteria taken into account for the selection are education, occupation, age, gender, declared location. Please note that not all of these criteria are equally weighted in the selection algorithm.
Last updated: 7 March 2023