The Conseil Interprofessionnel du Vin de Bordeaux (Bordeaux Wine Council – “CIVB") is an organizing body created by the Law of 18 August 1948 amended by Decree 2016-915 of 4 July 2016. Among its activities, the CIVB manages the Ecole du Vin de Bordeaux (“EVB" – Bordeaux Wine School).

In order to promote the EVB and the diversity of Bordeaux wines, the CIVB operates a website available at the URL www.ecoleduvindebordeaux.com (the “Site"), for (i) booking training programs taught by EVB partners, (ii) organizing training programs taught by accredited professionals and (iii) purchasing products related to the EVB and Bordeaux wines.

The purpose of this document is to inform users about the processing of personal data performed by the CIVB in the context of these activities.

We treat the protection of the personal data we process with the utmost importance and care.

1 DEFINITIONS AND VOCABULARY

This section aims to define the terms that are used the most in our personal data policy.

• “CIVB" (“we", “our", “ours"): refers to the Conseil Interprofessionnel du Vin de Bordeaux (Bordeaux Wine Council), Site operator.
• “Order": refers to the purchase of a Product or Gift Voucher by a User or a Training Program by a Member.
• “Account": refers to the User’s personalized online space on the Site.
• “EVB": refers to the Bordeaux Wine School.
• “Tutor": refers to the self-employed worker, legally practicing in France or abroad, qualified by the Site or by other means, and offering one or more Training Programs to Members via the Site.
• “Training Program": jointly refers to the EVB Training Programs and Third-Party Training Programs available on the Site, to which the Member may register.
• “EVB Training Program": refers to Training Programs provided by Tutors in the name and on behalf of the EVB, to which the Member may register.
• “Third Party Training Programs": refers to Training programs independently provided by Tutors via the Site, to which the Member may register.
• “Delivery": refers to the shipment of a Product or gift voucher to the Member.
• “Member": refers to any person who has personally created an Account in order to benefit from Training Programs, to purchase a Product or to benefit from other services provided by the CIVB.
• “Product": refers, where applicable, to items promoting Bordeaux wines and their diversity available on the Site, as well as products offered for sale on the Tutor E-Shop.
• “Regulations": refer to (EU) Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR) and law n°78-17 of 6 January 1978 relating to data processing, data files, and individual liberties.
• “Site": refers to the website www.ecoleduvindebordeaux.com and all of its components.
• “User": refers to the Member or Tutor.

Where terms covered by the rules on personal data are concerned, they must be understood in relation to the meaning outlined by the Regulations. For example, personal data date should be understood as any information relating to an identified or identifiable person.

If you would like to know more about specific personal data vocabulary, please refer to the glossary created by the CNIL, available at the following address: https://www.cnil.fr/en/english-french-glossary-data-protection.

You can also view the GDPR regulation at the following URL: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679.

2 IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The CIVB is responsible for all personal data processed on the Site.

If you have any questions concerning your personal data, please contact the CIVB data protection officer at the following email address: dpo@vins-bordeaux.fr .

We will make every effort to provide a prompt reply.

3 PERSONAL DATA COLLECTED

Most of the personal data collected by the CIVB is collected while using the Site. For example, Members need to fill in their identity data in order to create an Account and Tutors are required to fill in information about their professional experience.

We may also collect “cookies" and other tracking data. For more information about cookies, please refer to our cookie management policy available at the following URL: www.bordeaux.com/gb/Bordeaux-Cookie-Policy

With this in mind, the CIVB collects, directly or indirectly, the following personal data.

3.1 For Members

• Identity and identification data – title, surname, first name, date of birth, gender, email address, private or professional status, password, IP address, company name (optional).
• Contact details – postal address, telephone number.
• Payment details – bank card number.
• Behavior-related data – pages visited on the Site, device used, browser used, fields of interest.
• Operational data – Members’ interactions with the CIVB, in particular customer support via the chat, email and telephone services, as well as feedback left at the end of the Training Programs.

3.2 For Tutors

• Identity and identification data – title, surname, first name, date of birth, gender, email address, password, profile photo, IP address.
• Contact information – postal address and/or head office address, telephone number, email address.
• Business identification data – name of the Tutor’s company, SIREN number, intra-community VAT number, the Tutor’s professional website, past experience, position in the Tutor’s company, date on which the Tutor joined the company, elements describing the Tutor’s company.
• Data relating the Tutor’s social media – Facebook, LinkedIn, Instagram or other profiles provided by the Tutor.
• Data proving the Tutor’s skills – languages spoken, including level of proficiency, qualifications, experience in enological training, links with professional organizations.
• Payment details – bank card, IBAN.
• Behavior-related data – pages visited on the Site, device used, browser used, fields of interest.

4 HOW WE PROCESS DATA, THE PURPOSE AND LEGAL BASES

The table below details the various ways in which the CIVB processes user data, their purpose, and their legal basis as well as the specific categories of data for each type of processing.

The purpose of data is determined by the CIVB. This is the specific purpose for which we process the data in question.

Nevertheless, the legal bases are listed exhaustively in the GDPR (in Article 6) and the legal basis on which each of these processing operations is based is detailed below.

5 DETAILS ABOUT PROSPECTING AND MARKETING

The CIVB uses some of your personal data to send you personalized requests, in particular by email, post and on social media or third-party websites.

In compliance with the rules relating to prospecting provided for by Directive 200/58/EC of 12 July 2002 and Article L.34-5 of the French Code on electronic publications and communications, your explicit consent to be electronically prospected by the CIVB is obtained upon the creation of your Account to: (i) receive offers by the CIVB by email and (ii) receive offers by CIVB partners to whom your contact details will be sent.

In principle, the CIVB will not send you personalized messages if you do not specifically agree to this.

However, we may send you personalized messages without your consent applying the previous two rules in the following two cases: (i) if you place an Order on the Site and the direct marketing concerns products similar to those that we sent to you and (ii) if you are a professional and the direct marketing is in keeping with your profession.

In this case, we may send you a personalized message advertising similar products and services, which may include, for example, promotional offers related to the EVB.

6 RECIPIENTS OF YOUR PERSONAL DATA

Some of your personal data may be sent to third parties or CIVB subcontractors.

6.1 Third parties

Third parties are all persons outside the CIVB who may receive a copy of your personal data and who act on their own behalf.

This includes, in particular, the CIVB’s commercial partners who may receive a copy of your personal data if you have expressly agreed to this when you created your Account by ticking the relevant box on the Site.

6.2 Subcontractors

The CIVB also works with various subcontractors as stipulated in the regulations, including:

• Tutors: when they teach a Training Program, some of your personal data required to provide the Training Program will be sent to Tutors.
• Payment Service Providers: the CIVB works with service providers that have the necessary authorization to manage transactions on the Site. Depending on the purpose, your payment data may be sent to Stripe.
• Service providers offer solutions facilitating the management of User relations: We use various software to contact our Members and Tutors (e.g. “CRM", customer relations management software), which helps us facilitate our customer relations (in particular sending promotional emails, managing claims and feedback from Members, etc.)
• Our service providers: we use service providers to carry out maintenance operations and technical developments on the Site, as well as managing the shipping of Orders. Within this context, some of your data may also be sent to them.

Your data may be sent to Third Party companies although this information will only be communicated for the purpose of using IT tools or services supplied by third party services providers.

Within this context, the CIVB has implemented organizational and contractual measures to ensure that third parties who have access to your personal data respect the applicable regulations regarding the protection of personal data. For example, we have entered into a personal data subcontracting agreement with all of our tutors.

7 STORAGE PERIOD OF PERSONAL DATA

We process Users’ personal data throughout the duration of their agreement with the CIVB.

We continue to process Members’ personal data as long as their Account remains active and they continue to place Orders. We will continue to process our Tutors’ data as long as their service contract and general terms and conditions of use agreed upon are in force.

A Conservation of Personal Data Policy will only come into effect following the end of our agreement.
Our agreement may be ended in the following circumstances:

• For Members: you explicitly express your desire to terminate the general terms and conditions of use or request that your Account is deleted along with all associated personal data, or your Account remains inactive for a period of 3 years.
• For Tutors: the service contract and general terms and conditions of use that you entered into with the CIVB have been terminated.

Following the end of our agreement, we will continue to store your personal data for a period of 5 years.

8 DATA SECURITY

The CIVB shall implement the appropriate technical and organizational measures to guarantee the rights and liberties of Users, in particular by protecting personal data against non-authorized access, destruction, loss, alteration, unauthorized disclosure of personal data transmitted, stored or otherwise processed.

The CIVB has installed a robust security system to ensure maximum security of data collected and detect data breaches. This includes the physical security of buildings housing our systems, the security of IT systems to prevent external access to your data, and holding secure copies of your data.

When employing subcontractors, the CIVB shall ensure that they respect data protection regulations.

9 EXERCISING YOUR RIGHTS

9.1 Your rights

In accordance with the applicable regulations, you are protected by a certain number of rights regarding your personal data, which mainly include:

• Right to access: you have the right to know which data the CIVB holds about you and obtain a copy.
• Right of rectification and erasure: you have the right to request that erroneous or obsolete personal data concerning you be rectified and deleted.
• The right to object and restrict the processing of your personal data: you have the right to object to the manner in which the CIVB processes your personal data or request that the processing of your personal data is restricted where applicable, subject to legitimate and imperative reasons that the CIVB can justify for the purpose of processing your data.
• The right to object to prospecting: you have the right to object to being the subject of direct marketing when you set up your Account (by ticking the relevant box when you create your Account, by clicking on the link to unsubscribe included in every email we send you or to your Account or by contacting us at the address listed above. In the event that the right to object to the use of personal data for direct marketing is exercised, the User shall be informed that they will continue to receive direct marketing although this will no longer be targeted according to their centers of interest.
• Right to data portability: you may ask InMemori to send you your personal data in an organized, commonly used and machine-readable format in order to send this data to another controller, under the condition that this is possible.
• The right to lodge a complaint to a supervisory authority: you can contact a personal data protection authority if you consider that the CIVB has not respected the applicable regulations. If you are located in France, you can also contact the CNIL (French National Data Protection Commission) on their website: https://cnil.fr
• The right to decide what happens to your data following your death: you may write general or particular directives relating to the storage, erasure and transmission of your personal data.

9.2 Exercising your rights

The exercise of your rights is not unlimited (we have the right to not respond to requests that are clearly unfounded or excessive) and each right must respond to the conditions imposed by the applicable regulations.

Some of these conditions apply to most of your rights and you will be required to respect them for all requests. With this in mind, we would like to inform you of the following:

• Your identity: you must provide proof of identity for each of your requests and indicate the address at which the CIVB should send a reply (except if you send an email, in which case we will reply to the email address provided). This is an elementary right that enables you to prevent your personal data from being disclosed to third parties. We would like to inform you that we have the right to ask you for additional information to verify your identity. The rights relating to your data are strictly personal, however, if you would like a third party to exercise these rights on your behalf, you will need to provide a mandate, as well as your identity and the representative’s ID.
• Speed of reply: the CIVB will aim to reply to you within a reasonable amount of time, in principle within a month. However, this period may be extended by two further months depending on the complexity or number of requests you submit.
• No fees: in principle, you can exercise your rights free of charge. However, we may ask you to pay some fees if your requests incur significant costs on our behalf, particularly if you request multiple copies of the information.

In addition to these general rules, the exercise of each of your rights may be restricted or limited due to certain conditions specific to that right.

For example, the right to erasure stipulated in article 17 of the GDPR (also called the “right to be forgotten") can only be exercised in certain, well-defined situations, in contrast, for example, to the right of access, which has a broader scope (but which also requires certain conditions to be filled).

In any event, these conditions, which are specific to each right, will be examined on a case-by-case basis and we will do our utmost to provide you with the clearest answer possible.

10 THE CIVB’S PERSONAL DATA PROTECTION OFFICER

The CIVB’s data protection officer is in charge of respecting the regulations and rules described in this general data protection policy.

They are responsible, in particular, for preparing a record of the processing activities on personal data carried out at the company and ensuring that they comply with the regulations and any eventual changes.

They work on team awareness of the applicable regulations and respond to Users wishing to exercise their rights concerning their personal data collected by the CIVB.

If you have any questions relating to this privacy policy or any requests relating to your personal data, please contact our personal data protection officer at: dpo@vins-bordeaux.fr