Protection of personal data

The Data Protection Policy is designed to provide information on IXO COLLECTIONS policy for the protection of personal data and the rights relating to the protection of personal data.

By using our Services and Sites, you accept the terms of this Data Protection Policy. If you disagree with any of its terms, you are free to stop using our Services, Sites.

1. DEFINITIONS AND SCOPE

1.1. Definitions

“APPs” means the Australian Privacy Principles set out in the Privacy Act.

"Cookie(s)": refers to all non-executable text files, plotters, web beacons and other technologies, such as transparent GIFs, clear GIFs or web-bugs, deposited on the browser (computer, tablet, smartphone, etc.) by IXO COLLECTIONS, Subcontractors, or Partners, subject to consent given by the User, when navigating within the Services via the Sites or when publicity is displayed. Information contained in this file can only be read and / or modified by the issuer.

"IXO COLLECTIONS": refers to the company IXO COLLECTIONS SAS (852 934 090 RCS Evry, head office at 14 Rue du Bois Guillaume 91000 Evry-Courcouronnes, France) and all companies controlled directly or indirectly by IXO COLLECTIONS, in line with article L233-3 of the French Commercial Code.

"Navigation Data": refers to all data relative to a terminal at a given time, even if we do not know directly which terminal is being used, or who you are at a given time. As part of the Navigation Data (s) collected, the following data may be collected:

• Identification and content of a cookie file stored by us/our Partners in your terminal;
• IP address of the terminal connected to the Service(s);
• Date, time and connection duration of a terminal to a part of the Service(s);
• Internet address of the referrer header of the terminal giving access to Service(s);
• Type of terminal operating system (e.g.: Windows, MacOS, Linux, Unix, BeOS, etc.)
• Type and version of the navigation software used by the terminal (Internet Explorer, Firefox, Safari, Chrome, Opera, etc.);
• Potential downloading errors;
• Language used for the navigation software used by the terminal.

"Personal Data (s)": refers to any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, an online identifier, etc and includes any “personal information” as defined in the Privacy Act. Regarding our Services, "Personal Data" refers to all data relating to you only at a given time, regardless of the terminal used.

"Partner(s)": refers to any company, other than a Subcontractor, selected by IXO COLLECTIONS or with whom it has contracted, to supervise the provision and protection of Personal Data.

“Privacy Act" means the Privacy Act 1988 (Commonwealth of Australia)

"Service(s)": refers to any online public communication service and / or content made available by IXO COLLECTIONS, in particular the australiancarcollection.com.au website.

"Site(s)": refers to the public communication service (s) published by IXO COLLECTIONS, accessible by a User via its connection terminal and located at the URL address(es) given below and / or to any other address which may be added to or substitute it. The Site(s) allow(s) access to the Service(s).

"Subcontractor(s)": refers to any company that may be required to process Personal Data or Navigation Data, on behalf of one of the companies of IXO COLLECTIONS, in accordance with instructions provided.

"User": refers to any natural person, over eighteen (18) years of age, accessing Services and Sites on a non-professional and non-commercial basis.

"User Account": refers to a space reserved for the User, which may be accessed following registration on our Services via an identifier (email address) and a confidential password, and allowing in particular (i) the User to place an order and / or (ii) to participate in competitions and / or (iii) to use other features.

1.2. Scope

The Data Protection Policy applies to all Users of the following Services:

- Ixo Collections, accessible via the following URL: australiancarcollection.com.au. The Data Protection Policy does not apply to our Partners sites, nor to the practices of third-party companies to IXO COLLECTIONS or companies over which IXO COLLECTIONS has no control.

2. IDENTITY AND CONTACT DETAILS FOR DATA PROCESSING OPERATORS AND THE DATA PROTECTION OFFICER

2.1. Identity and contact details for data processing operators

IXO COLLECTIONS as editor of australiancarcollection.com.au

2.2. Contact details of the data protection officer

IXO COLLECTIONS data protection officer (DPO) may be reached at the following address:

IXO Collections,

14 Rue du Bois Guillaume,

91000 Evry-Courcouronnes

France

Or, by email at: [email protected]

3. HOW DO WE COLLECT PERSONAL DATA?

We collect and process Personal Data with your consent, in order to execute the contract concluded (acceptance of the General Terms and Conditions , and on the basis of our legitimate interest in direct prospecting to Users for similar services.

When creating a User Account, or subscribing to certain services accessible on our Sites (such as a quiz, subscribing to a newsletter, etc.), you are informed of the collection and processing of Personal Data via an information notice.

In addition, you consent to the collection and processing of your Personal Data, as specified below, thanks to the acceptance of the Data Protection Policy, accessible in the Personal Data collection form.

4. WHAT TYPE OF INFORMATION IS COLLECTED?

Personal Data collected directly from you:

Amongst the Personal Data collected directly from you, upon subscription to or use of our Services, we collect the following data:

• Surname, first name, gender, email address, post code, age;
• User name(s), pseudonym(s) and password(s);
• Information on payment method(s) (such as credit card number) for Services concerned;
• Interests and preferences regarding sales prospection;
• Date(s) of participation and answer(s) given to quizzes;
• Comments, opinions on our Services, Sites;

When you browse on our Sites, we may collect, in accordance with the applicable legislation in force and with your full consent, Navigation Data. In order to collect this information, we use cookies. To learn more about this, we invite you to refer to our Cookie Policy.

5. WHY IS DATA COLLECTED?

Personal Data collected directly from you, in particular when creating a User Account or using our Services, may be processed for the following purposes:

• To create and manage your User Account, allow you to access content of Sites and use Services (subscription to a newsletter, a quiz, etc.) to which you have subscribed;
• To perform management operations concerning orders and delivery of products and / or services, invoicing, monitoring of the customer relationship;
• To send you, in accordance with applicable legal provisions and with your consent, when required by law:
• Marketing, advertising and promotional messages on our Services, Sites or those of our Partners, to whom your Personal Data has been communicated;
• Information relating to the use, updates, developments of our Services and Sites;
• Suggestions and advice on content, products or services likely to interest you, through creation of User profiles;

Navigation Data collected when using our Services, may be processed for the following purposes:

• In general, to allow you to browse and consult our Sites, adapt content or display of our Services to your terminal to improve navigation and optimize use of Sites;
• To memorize information relating to an already completed form (e.g., your User Account) or relating to products, services or information from our Services (e.g., content consulted, etc.);
• To personalize our content and advertising according to your interests;
• To establish statistics and audience measurements on use of our Sites;
• To allow you to share on social networks;
• To assess the effectiveness of the advertising messages we send;
• To ensure the security of our Services / Sites by detecting and tracking any malicious attempts, computer intrusion or violation of the General Terms and Conditions ;
• To fulfill our legal obligations, respond to any requests from third parties empowered by law to ask us to communicate Navigation Data and / or Personal Data of Users of our Services.

6. HOW LONG IS PERSONAL DATA KEPT FOR?

6.1. With the exception of the categories of Personal Data referred to in articles 6.2 to 6.4, Personal Data is kept for the following periods:

• Three (3) years after the closure of your User Account, or the end of the contractual relationship if applicable;
• Three (3) years after your final use of our Services and Sites, if User Account has not been closed (inactive account);

6.2. Data relating to credit cards is kept throughout the transaction and is then archived for thirteen (13) months from the date of debit or fifteen (15) months for deferred debit payment cards, in order to provide proof in case of dispute over the transaction.

6.3. The identity documents that you provide to us in the exercise of your rights are kept for a period of one (1) year from the request.

6.4. The cookies deposited on your terminal are kept for thirteen (13) months, from the date of the first deposit on the terminal. To find out more about the management of cookies, we invite you to refer to our Cookie Policy.

6.5. All Navigation Data is kept for a period of thirteen (13) months from collection.

7. WHO MAY ACCESS PERSONAL DATA?

The following may have access to your Personal Data:

• The editor of the Service, as data controller for Services.
• Only certain staff within IXO COLLECTIONS may access Personal Data, when necessary, and are subject to strict obligation of confidentiality.
• Subcontractors of technical services, payment services, suppliers of analytical solutions, etc.;
• Partners: advertisers, advertising agencies, data brokers; and any other recipient, having concluded a contract with part of IXO COLLECTIONS concerned with the provision of data or an agreement relating to data protection;
• Third parties, in limited and legally viable cases, such as judicial and / or administrative authorities or own internet access provider.

We may, from time to time, expand, reduce or sell our business, and this may involve the transfer of certain divisions or the whole business to other parties. Personal Data relating to you will, where it is relevant to any division so transferred, be transferred along with that division to prospective buyers and the new owner or newly controlling party will, under the terms of this Data Protection Policy, be permitted to use personal information relating to you for the purposes.

8. CHOICES OF CONTENT PERSONNALIZATION, TARGETED PUBLICITY AND EMAIL PROSPECTION

8.1. Personalized User experience

We inform you that your Personal Data may be subject to two types of processing operations:

• combined with Navigation Data, or other relevant information, in the possession of IXO COLLECTIONS, and which are essential for the fulfillment of processing operations about oneself;
• profiling for personalization / recommendations of content and targeted advertising. As such, we inform you that we analyse data provided or generated through use of our various Services, in order to build profiles (segments) corresponding to your centres of interest.

As a prerequisite for the implementation of personalization / recommendation of content, all operations are necessary for the execution of the contract concluded with you, the purpose of which is to offer a personalized experience.

In addition, it is in our legitimate interest to carry out these operations, because they also allow us to transmit advertisements, depending on profile and areas of interest previously identified. Targeted advertising is an important source of funding for all of our Free Services.

When an advertiser tries to reach a specific target audience, we can create audience segments (profiles), such as a specific age-group (for example, 16-34 year olds) or a group of people with special interests (for example, DIY enthusiasts). However, these segments are not shared with the advertiser, in a way that allows individuals to be identified directly. We also tell our advertisers how many people in the target audience have seen their specific ads, and we can provide them with your IP address, so they can verify that number of views is correct. This allows advertisers to assess the effectiveness of their advertising. We can also share with some of our advertisers, having concluded with us a contract framing the provision of data, Navigation Data and Personal Data "pseudonymized", in order to ensure better targeting of the advertisements on our Services. "Pseudonymisation" means that the relevant Personal Data is converted into an encoded version, so that it can no longer be attributed to a specific data subject, without having to resort to additional information. For example, we may create temporary advertiser identifiers for our users that we share with advertisers so that they can limit the number of times you see a particular advertisement. However, advertisers are unable to identify persons directly from these identifiers (IDs).

You can object, at any time, to the profiling of your Personal Data, for the purpose of targeted advertising, by:

o sending a request by email to [email protected] or, to the postal address given article 2.2,

In the event that you object to the profiling of your Personal Data, we inform you that you will continue to be the recipient of advertising, but that this will not be adapted to your profile and interests.

To learn more about this, kindly refer to our Cookie Policy.

8.2. Prospection by email and/or text message

When creating your User Account and / or when using certain Services, available on our Sites, you may choose to give us your consent, by providing information on preferences regarding the reception of emails relating to:

• targeted offers from IXO COLLECTIONS;
• targeted offers from IXO COLLECTIONS Partners;

If you wish to receive direct prospecting messages, by email, from IXO COLLECTIONS and / or its Partners, you can withdraw your consent at any time:

• By clicking on the unsubscribe hyperlink provided in each of our communications; or
• By sending your request by email to [email protected] or by post to the address given in article 2.2.

If you wish to receive direct prospecting messages, by text message, from IXO COLLECTIONS Partners, you can withdraw your consent at any time:

• By sending your request by email to [email protected] or, by post to the address given in article 2.2.

We inform you that it is in our legitimate interest, in accordance with article L.34-5 of the Post and Electronic Communications Code, to send an e-mail in the following cases:

• Information and communication of substantial updates to the General Conditions of Use of our Services and / or the Data Protection Policy;
• Sending newsletters to which you have subscribed, or other emails, concerning products and / or services similar to those we have provided to you through our Services, Sites and / or Applications. In this hypothesis, you may express your opposition to the reception of these requests:
• By clicking on the unsubscribe hyperlink provided in each of our communications; or
• By sending your request by email to [email protected] or, by post to the address given in article 2.2.

9. TRANSFER OF PERSONAL DATA

We hereby inform you that connection and localization data may be processed in the European Union.

Users in Australia should note that countries outside Australia where personal information relating to you may be stored and/or processed, or where recipients of personal information relating to you may be located, may have privacy and data protection laws which differ to those under the Privacy Act. By providing your personal information to us, you:

• accept that personal information relating to you may be transferred, stored or processed in this way. We take measures to ensure that any international transfer of information is managed carefully and in accordance with applicable data protection laws; and
• consent to us disclosing your personal information to any such overseas recipients for purposes reasonably in the course of operating our business, and agree that APP 8.1 will not apply to such disclosures. For the avoidance of doubt, in the event that an overseas recipient breaches the APP's, that entity will not be bound by, and you will not be able to seek redress under, the Privacy Act.

10. YOUR RIGHTS

You have the right to withdraw consent at any time, and you have right to the portability of your data, as well as rights of access, rectification, erasure, limitation, opposition and the right to define directives relating to the fate of your data in the event of death.

10.1. Contact

For this, please write to the following address:

• Email address: [email protected] or,
• By post, to the address given in article 2.2

10.2. Supporting Documents

In application of article 12§6 of regulation (EU) n ° 2016/679 of April 27, 2016, on the protection of personal data, when the operator suspects, beyond reasonable doubt, as to the identity of the natural person presenting the request referred to in article 10, the operator may request additional information in order to confirm the identity of the person concerned."

In order to identify your User Account, we invite you to provide us with the email address used to create the User Account.

We will respond within one (1) month following receipt of the request. This period can be extended by two (2) months given the complexity and the number of requests.

These rights are not absolute: they may be exercised within the legal framework provided and within the limits of these rights.

In some cases, we will unable to respond favourably to a request (legal obligation, respect of our commitments to you, etc.). If this is the case, you will be kept informed.

10.3. Right of access, rectification or data deletion

As creator of a User Account, you may access any Personal Data that collected directly from you in order to rectify, supplement or delete any inaccurate information by:

• Contacting us directly at the email and / or postal address (es) given above.
• Deciding to close the User Account at any time, by contacting us directly at the email and / or postal address(es) given above.
• You have the right to erase Personal Data when:
• The Personal Data is no longer necessary with regard to the purposes for which it has been collected or processed; or
• You have withdrawn consent for processing of Personal Data and there is no other legal basis for processing; or
• You have objected to processing and there are no compelling, legitimate reasons justifying the processing of Personal Data; or
• Personal Data must be erased in order to comply with a legal obligation provided for by the legislation of the European Union or its member states, to which lXO COLLECTIONS is subject; or
• Personal Data has been collected as part of the Services subscribed to.

10.4. Right to limit processing

You have the right to limit processing when one of the following conditions applies:

• A dispute over accuracy of Personal Data; or
• Processing is unlawful and you oppose deletion of your Personal Data, requesting rather the limitation of use; or
• IXO COLLECTIONS no longer requires Personal Data for the purposes of processing, but it is required by yourself, for the establishment, exercise or defence of your rights; or
• You have objected to processing of Personal Data, and a verification must be carried out in order to know whether the legitimate grounds of IXO COLLECTIONS prevail over yours.

10.5. Right to withdraw consent at any time

You may withdraw consent, at any time, as described in article 8.2, for the processing of your Personal Data, for the purposes of direct marketing for products and / or services which are different to those that we have provided via our Services, Sites and / or Applications.

10.6 Right of opposition to Personal Data processing

You may exercise right of opposition to Personal Data processing at any time, for the purpose of targeted advertising by:

o sending a request by email to [email protected] or, to the postal address given in article 2.2.

In the event of an objection to the processing of Personal Data, we inform you that you will continue to be the recipient of advertising, but that this will not be tailored to personal profile and interests.

For further information, please see the Cookie Policy.

10.6. Right to port Personal Data

In the event of difficulties, you have the right to port Personal Data, i.e. to receive any Personal Data provided, in a structured, commonly used and machine-readable format, for transmission to another controller.

To exercise right to port Personal Data, please send a request by email to [email protected] or, to the postal address given in article 2.2.

10.7. Right to lodge a complaint with the competent supervisory authority

You have the right to lodge a complaint with the CNIL: https://www.cnil.fr/fr/plaintes

10.8. Complaints process in Australia

If you are in Australia and you have any questions, concerns or complaints about this Data Protection Policy or how we handle your personal information, including if you believe we have breached the APPs, please contact us directly at the email and / or postal address(es) given above.

When contacting us please provide as much detail as possible in relation to your question, concern or complaint.

We take all complaints seriously, and will respond to your complaint within a reasonable period. We request that you cooperate with us during this process and provide us with any relevant information that we may need.

If you are dissatisfied with the handling of your complaint, you may contact the Office of the Australian Information Commissioner,

Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Telephone: 1300 363 992
Email: [email protected]

10.9. Guidelines on destination of Personal Data following death

Guidelines may be defined relative to destination of Personal Data following death.

To exercise this right, kindly send an email to [email protected]:

• entitled "Guidelines on destination of Personal Data following death";
• indicate the email address with which the User Account was created;
• indicate the name of a contact person (s) in the event of death, and provide instructions.

In the event of a User’s death without guidelines on destination of Personal Data, heirs may request closure of the deceased’s User Account, by contacting [email protected].

10.10. Changes

We review and amend our Data Protection Policy from time to time. Any changes we make to this Data Protection Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to this Data Protection Policy. The new terms may be displayed on-screen and you may be required to read and accept them to continue your use of our Sites.