This personal data protection policy applies to the website accessible at https://www.shine.lu and aims to inform in a transparent manner on how we use them.

Who is responsible for processing my data? Which services are concerned?

The company Shine S.àr.l.-S. whose registered office is located at 41 avenue de la gare L-1611 Luxembourg, operates the website intended to provide information on the services offered, which can be accessed at the address shine.lu. SHINE S.àr.l.-S. is in charge of processing your data.

The respect of your privacy is essential for SHINE S.àr.l.-S.

This privacy policy informs you about the services concerned by the collection of your personal data.

How do we collect your data? Which data is concerned?

1. A. Data collected from the order form

Data category	Detail of the data
Personal data: Identity, identification data.	Names, first names, geographical address, e-mail address
Personal data : Economic information.	Bank details
Personal data: Connection data.	IP address
Personal data: Location data	Mobile Phone Number

1. Data collected when you browse the website: Shine.lu

We collect data of a technical nature when using our services which may include:

• your application or terminal identifiers (cookies,),
• information about your origin URLs,

• your IP address,
• the characteristics of the devices you use to access our services (device model, type of operating system, browser type and version, language of use),
• the type of network connection you are using (Wi-Fi, 4G, Bluetooth …),

How long do you keep my data?

We have defined in the table below the different durations of conservation of your data:

Data concerned	The duration of the conversation
Data necessary for order management and invoicing Data necessary for order management and invoicing	Throughout the duration of the commercial relationship and ten (10) years for accounting obligations.
Data relating to means of payment	These data are not kept by the company SHINE S.àr.l.-S., they are collected during the transaction and are immediately deleted upon payment of the purchase.
Personal data:	This data is only deleted after 3 years.

What are my rights regarding my data?

In accordance with the General Rules for the Protection of Personal Data (RGPD), you have the following rights:

• right of access (article 15 RGPD), of rectification (article 16 RGPD), of update, of completeness of your data
• the right to block or erase your personal data (article 17 RGPD of the Data Protection Act), when they are inaccurate, incomplete, ambiguous, outdated, or whose collection, use, communication or retention is prohibited

• right to limit the processing of your data (article 18 RGPD)
• right to object to the processing of your data (article 21 RGPD)
• the right to the portability of the data you have provided us with, when your data are subject to automated processing based on your consent or on a contract (article 20 RGPD)

These rights may be exercised as described below.

Who are the recipients of my data?

The recipients are the persons entitled to obtain communication of your data because of their functions.

Within the framework of our activities, the departments in charge of order management and invoicing of the company SHINE S.àr.l.-S. are recipients of all categories of data.

The company’s subcontractors who are responsible for the delivery of its orders are recipients of the identity, address and telephone number of our customers.

Can I have additional information? Can I get help?

If you have any questions regarding the processing of your data bythe company SHINE S.àr.l.-S., you can contact the Data Protection Officer in complete confidentiality via this email address: hello@shine.lu

You also have the right to file a complaint with the Data Protection Authority under the conditions indicated on its website:
CNPD Public

How can I exercise my rights to my data?

You can exercise your other rights by email, specifying the right you wish to exercise in the subject line of your email: hello@shine.lu access, portability, limitation, opposition for reasons related to your particular situation. The exercise of your access and portability rights requires that the data for which you exercise your rights be linked to the email address used to carry out your request. A response will then be sent to you within 1 month following receipt of your request.