Privacy Policy

B-WARDS® Loyalty Program

Date of issuance: January 14^th, 2020

The security and protection of your Personal Data is one of the top priorities of the Company.

This is why We use privacy by default standards and undertake to store your Personal Data in a secured manner and to process your Personal Data with all appropriate care and attention in accordance with the Federal Data Protection Act (RS 235.1), the Ordinance on the Federal Data Protection Act (RS 235.11) and, where applicable, the General Data Protection Regulation (hereafter: “GDPR”).

Please read this Policy carefully to understand our policies and practices regarding your Personal Data and how the Company will treat and process them.

Capitalized terms defined in the Terms apply to this Policy.

1. Definitions

2. Principle for processing Personal Data

While Processing Personal Data, the Company will respect the following general principles:

2.1 Fairness and lawfulness

When Processing Personal Data, the individual rights of the Data Subjects will be protected by the Company. Personal Data will be collected and Processed lawfully, in a fair manner, in good faith and must be proportionate to the objective.

2.2 Restriction to a specific purpose

Personal Data handled by the Company should be adequate and relevant to the purpose for which they are collected and Processed. This requires, in particular, ensuring that the types of Personal Data collected are not excessive to the purpose for which they are collected. Subsequent changes to the purpose are only possible to a limited extent and require substantiation.

2.3 Transparency

The Data Subject must be informed of how his/her Personal Data is being handled by the Company. When the Personal Data is collected, the Data Subject must be informed of:

• the existence of this Policy;
• the identity of the Data Controller(s);
• the purpose of Personal Data collection and Processing;
• how, where and by whom the Personal Data is being Processed;
• Third-parties to whom your Personal Data might be transmitted.

2.4 Consent of the Data Subject

Personal Data must be collected directly from the Data Subject concerned and, when required, the Consent of the Data Subject must be granted before Processing Personal Data. The Consent must be obtained in writing or electronically for the purposes of documentation. The Consent is valid only if given voluntarily. If, for any reason, the Consent of the Data Subject is not given before Processing Personal Data, the Company should be informed in writing as soon as possible after the beginning of the Processing.

Personal Data can be processed without Consent if it is necessary to enforce a legitimate interest of the Company, to execute a contract or if any national or international law or regulation requests, requires or allows it.

2.5 Accuracy

Personal Data kept on file must be correct and if necessary, it must be kept up to date. Inaccurate or incomplete Personal Data should not be kept on file and deleted.

3. Acceptance

During your use of the App and its Functionalities, the Company may collect a certain number of Personal Data that relate to you and Process them in accordance with this Policy.

This Policy shall apply to anyone participating to the Program, to any use of the App and/or to any use of its Functionalities, whatever the method or medium used. It details the conditions at which, the Company may collect, Process, keep, use and save your Personal Data.

By participating to the Program and by using the App and its Functionalities, you acknowledge that you have read and understood this Policy and agree to be bound by it and to comply with all applicable laws and regulations. You also acknowledge that you have read and understood the Terms that apply to the Program, the App and its Functionalities and agree to be bound by them.

The Member clearly understands and agrees that he/she potentially may be bound by Third parties’ policies and terms & conditions, in particular the policies and terms & conditions of his/her bank, the policies and terms & conditions of his/her Payment provider and the policies and terms & conditions of the Partner with whom the Member concludes the Transaction.

Under no circumstances shall the Company be held liable for the activities of the Members’ banks, the Member’s Payment provider and the Partner with whom the Member concludes the Transaction, as well as for the adequacy of the policies and terms & conditions of these latter.

4. Collected Data

4.1 Registration data

The use of the App requires to create your Member Account.

The creation of your Member Account requires that you provide Us with the following Registration data:

- mandatory data:

• your first name;
• your last name;
• your email address; and
• your mobile phone number (with the country code).

(the “Mandatory Registration Data”).

- optional data:

• your date of birth;
• your gender; and
• your profile picture.

(the “Optional Registration Data”).

4.2 Payment data

The Company does not process, nor does it have access to any information provided in relation with the online payment of the Member.

However, you may transmit via the App Payment data when purchasing products and/or services to Partners’ Shop and/or Partners’ E-Shop and/or when purchasing Points. The Payment data includes (without limitation) your credit card information such as:

• type of credit card;
• credit card number;
• expiration date; and
• CVC number of the credit card.

(the “Payment data”).

Credit card payments are processed by the Payment provider. We do not have access to Payment data. The Payment data which you provide are encrypted prior to the sending of your post to the payment server.

We do not register and We do not request banking data, credit card data or banking card data. The Payment provider carries out credit card payments. Regarding such Payment data, the general conditions and the privacy policy of the Payment provider are solely applicable.

We do not act as a financial intermediary or as a payment institution for the transactions which take place via the App, said transactions being processed by the Payment provider and your Transaction being solely concluded with the Partner of your choice. If We contact you in relation with your payment or the Transaction, you understand and agree that We only operate on behalf of the Partner.

You understand and agree that the Company and/or the Partner may process payments via external service providers and that you shall transmit to said external provider your Personal Data for the sole purpose of making the Transaction and/or for the sole purpose of purchasing Points. You expressly agree to send your Payment data to the payment service provider, as well as send all information which the latter shall require from you.

You hereby expressly agree to comply with the general conditions of external service provider in charge of processing the payment, to pay it the commission provided therefore and to grant it all banking authorizations required to carry out the payment with your credit or banking card.

The Company shall not be held liable for the content of the privacy policy and the general conditions of the Payment provider.

Your credit card transaction is made at your sole risk. The Company shall in no way or manner be held liable for any delay in the banking authorization relating to your banking card or of any damage or loss which may arise in relation with the Transaction made with a Partner and/or in relation with the purchasing of Points via the App.

4.3 Transfer data

By transferring Points to another Member, you understand and agree that the App may have access to your contact list.

By ticking the box“I agree that the App accesses to my contact list”, you expressly Consent that We Process the information contained in your contact list,i.e.the name of your contact, the phone number you assigned to them and any other information contained in your contact list.

5. Use of the Personal Data

5.1 Purpose of use of Personal data

The following paragraphs describe the various purposes for which We collect and use your Personal Data, and the different types of Personal Data that are collected for each purpose. Please note that not all of the uses below will be relevant to every individual.

Generally, We use your Personal Data, in accordance with applicable laws, to provide you with the Functionalities of the App, to enter into contract with you, to run our business and our activities, to communicate with you and for other general business purposes, such as conducting internal marketing and demographic studies and measuring the effectiveness of advertising campaigns.

We also use your Personal Data for security purposes and to insure a peaceful use of the App by all the Members.

Considering the scope of our activities, We also have to collect some of your Personal Data to fulfill with legal requirement and to be compliant with all the suitable laws and regulations.

a. Consent

The following uses of Personal Data are based on your Consent:

- Optional Registration data:

• your date of birth;
• your gender; and
• your profile picture.

Considering that providing Us with these Personal Data is optional, you understand and agree that at the moment you provide Us with these Personal Data you expressly Consent that We Process them.

- Transaction data:

• the name of your contact;
• the phone number you assigned to your contact; and
• any other information contained in your contact list.

Considering that you ticked the box“I agree that the App accesses to my contact list”, you expressly Consent that the App access to your contact list in order to allow you to proceed to a Points’ transfer to another Member.

b. Contract

By enjoying the Program and using the App and its Functionalities, you understand and agree that We Process and use the following Personal Data:

- Mandatory Registration data:

• your first name;
• your last name;
• your email address; and
• your mobile phone number (with the country code).

By contracting with a Partner in the context of a Transaction and/or by purchasing Points through the App, you understand and agree that We Process the following Personal Data:

- Payment data:

• type of credit card;
• credit card number;
• expiration date; and
• CVC number of the credit card.

These Personal Data are collected and Processed for the sake of executing the contractual engagement (including communicating with you and charging your credit card).

The above-mentioned Personal Data are absolutely essential to build the contractual relationship between you and the Company and for allowing you to proceed to the payment of the Transaction price due to the Partner in the context of a Transaction.

By communicating with Us the above-mentioned Personal Data, you understand and Consent that without them We are in the impossibility to provide you with the Program, the App and the Functionalities.

You also understand that these Personal Data allow Us to provide you with personalized support and to propose you tailormade Functionalities.

Your intention to contract with the Partner through the App confirm that you Consent that We process and use these Personal Data for the conclusion and execution of the Transaction.

5.2 Type of use of Personal Data

a. Creation of your Member Account

We use any of the Registration data to create your Member Account and provide you with the Program, the App and its Functionalities.

We use your Registration data about your usage of our App and your contact information to provide you with our Newsletter and/or our Marketing communications.

You may revoke your Consent at any time for any use of your Personal Data by the Company. Please note that the withdrawal of your Consent will not affect the lawfulness of the Processing of your Personal Data based on your Consent before its withdrawal. The Company cannot guarantee that your use of the App will be the same as before your revocation of Consent.

The Registration data are used in order to know who interacted with the App and to ensure that there is no cyber-security threat and in order to have an initial verification of the Member. If a cyber-security threat occurs at a particular moment, it would be possible to identify the whereabouts of the threat.

The Registration data are also used to enforce the Terms. We have a legitimate interest that you entirely respect the Terms.

b. Interaction & communication

We will be using your Personal Data in order to carry out online sales, to provide you with the App and its Functionalities, to interact with you, including by means of telephone, and to respond to your requests. Your Personal Data may also be used for fraud detection purposes. By becoming a Member, you understand and agree that We may Process and use your Personal Data to contact you, in particular by sending emails containing general information and/or by Newsletter (provided you subscribed to it).

c. Marketing

The Company will use your Personal Data to send you information regarding its services and any promotional offers. Your Personal Data may also be used in relation with the development of our partners in order to test your interest in the creation of new services, products or activities based on elements of your profile, your interests or your use of the App. Your Personal Data may also be used in order to improve the Functionalities offered by the Company and to prepare statistics, including for big data and/or artificial intelligence purposes.

By expressly agreeing to receive Marketing communications, you understand and agree that your email address will be used for electronic advertising purposes by the Company. The Company will always endeavor sending the Members advertising material tailored to his/her interests.

If you decide that you no longer wish to receive newsletter and/or Marketing communications, you can unsubscribe from receiving marketing-related communications at any time, by following the instructions provided in each such communication or by sending an email to info@woorfee.com.

To unsubscribe from Newsletters and/or Marketing communications sent by any medium, including Third-party social networks, you can also opt out at any time by logging into the App and adjusting your user preferences in your Member Account profile by unchecking the relevant boxes. Please note that, even if you opt out from receiving Newsletters and/or Marketing communications, you may still receive administrative communications from the Company, such as order or other transaction confirmations, notifications about your Member Account activities (e.g. account confirmations, password changes, etc.), notifications about new versions of the Terms and/or of the Policy, and other important announcements.

d. Personalization

We use your Personal Data in order to analyze your preferences and your patterns, to personalize your experience on the App, as well as to optimize the App. We may also suggest to you content which is best suited to your interests.

We use your Personal Data (i) to analyze your preferences and habits, (ii) to anticipate your needs based on our analysis of your profile, (iii) to improve and personalize your experience on our App, (iv) to ensure that content from our App is optimized for you and for your electronic device; and (v) to allow you to participate in interactive features, when you choose to do so.

If you wish to have your Personal Data used by the Company to provide you with a personalized experience on the App, you can indicate so through the relevant tick box located on the App.

Even if you have opted in, you can opt-out from benefitting from the personalization of your experience at any time. You only have to adjust your user preferences in your Member Account to no longer benefiting from the personalization of your experience.

e. Customer service

We use your Personal Data for customer service purposes, including responding to your enquiries. This typically requires the use of certain personal contact information and information regarding the reason for your inquiry ( e.g. order status, technical issue, product question/complaint, general question, etc.).

f. Reviews

When you leave a review on the App, We collect it and use it to optimize the App.

g. Internal research, analytic, security

In accordance with applicable laws, We may use your Personal Data for other general business purposes, such as conducting internal marketing and demographic studies and measuring the effectiveness of advertising campaigns.

We also use your Personal Data to ensure our security.

h. Legal reasons or merger/acquisition

In the event that the Company or its assets are acquired by, or merged with, another company including through bankruptcy, We may share your Personal Data with any of our legal successors. We may also disclose your Personal Data to Third-parties (i) when required by applicable law; (ii) in response to legal proceedings; (iii) in response to a request from a competent law enforcement agency; (iv) to protect our rights, privacy, safety or property, or the public; or (v) to enforce the terms of any agreement or the Terms.

6. Third-party disclosure

The Company may share your Personal Data to relevant Third-parties, in particular if We are requested to do so to comply with a court order or law enforcement authorities request, or if We find it necessary, as determined in the Company’s sole discretion, to investigate, prevent or take action regarding illegal activities, to defend our interest, in case of violations of the Terms or as otherwise required or permitted by law.

In any case where cross-border transfer is done, the Company ensures that an adequate protection is guaranteed for Personal Data to be transferred outside of Switzerland and EEA. In some specific cases when this level of protection is not guaranteed, the Company will obtain your prior consent or establish with the recipient of Personal Data a contractual framework or sufficient safeguards that ensure an adequate level of protection abroad. You may request access to a copy of these safeguards by contacting the Company.

Unless otherwise stated, the Third-parties who receive data from the Company are prohibited to use this Personal Data beyond what is necessary to provide the Program to you, directly or by participating to the Company’s activities.

7. Minors

The Program and the App are prohibited to Minors.

The use of the App by Minors is subject to the approval of a guardian and/or legal representative.

By creating a Member Account and/or logging in as a Minor, you represent and warrant that you are entitled to act on behalf of the Minor and to validate his/her acts legally.

Should the Company realize that it controls or Processed Minors’ data without legal representative’s approval, it will erase them immediately and/or closed the Member Account immediately.

8. Storage of your personal data

Your Personal Data will be stored in the United Kingdom and processed for hosting purposes by Rackspace Inc.. You agree that the Company may store your Personal Data in any other country of the European Economic Area (“EEA”), including Switzerland and the United Kingdom, in the event of brexit.

The storage as well as the Processing of your Personal Data may require that your Personal Data are ultimately transferred/transmitted to, and/or stored at, a destination outside of your country of residence, in particular in the country where the Partner is located. Where permitted by law, by accepting the terms of this Policy, you agree to such transferring, transmission, storing and/or Processing by the Partner. You also agree that such activities may take place to or in countries offering a lower level of protection than your country of residence.

9. Retention of your personal data

In accordance with applicable laws, the Company will use your Personal Data for as long as necessary to satisfy the purposes for which your Personal Data was collected or to comply with applicable legal requirements. Personal Data used to provide you with a personalized experience will be kept for a duration permitted by applicable laws.

When you delete your Member Account, your Personal Data is kept for a period of 12 (twelve) months in order to comply with legal requirements.

10. Security of your Personal Data

The Company applies high industry standards and will always apply adequate technical and organisational measures, in accordance with applicable laws to ensure that your Personal Data is kept secure.

In particular, you shall be solely responsible to keep your password and other information relating to your Member Account confidential and allow only authorized individuals to access and use your Member Account.

In the event of a Personal Data breach, the Company shall without undue delay, and where feasible, not later than 72 hours after having become aware of it, notify the breach to the competent supervisory authority, unless said breach is unlikely to result in a risk to your rights and freedoms. If the breach is likely to result in a high risk to your rights and freedoms, the Company shall communicate this breach to you without undue delay.

11. Access to your Personal Data and information rights

You have the right to request access to or information about the Personal Data related to you which are Processed by the Company.

You can access, review, correct, update or delete your Personal Data at any time by accessing your Member Account.

Where provided by law, you, your successors, representatives and/or proxies may (i) request deletion, correction or revision of your Personal Data; (ii) oppose the data Processing; (iii) limit the use and disclosure of your Personal Data; and (iv) revoke Consent to any of our data Processing activities if the Company is relying on your Consent and does not have another legal basis to continue Processing your Personal data.

These rights can be exercised by contacting Us through our contact form or writing to Us at:

info@woorfee.com

, attaching a copy of your ID. If the request is submitted by a person other than you, without providing evidence that the request is legitimately made on your behalf, the request will be rejected.

The request is free of charge unless your request is unfounded or excessive ( e.g. if you have already requested such Personal Data multiple times in the last twelve months or if the request generates an extremely high workload). In such case, the Company may charge you a reasonable request fee according to applicable laws.

The Company may refuse, restrict or defer the provision of Personal Data where it has the right to do so, for example if fulfilling the request will adversely affect the rights and freedoms of others.

12. Portability of your Personal data

You also have the right to receive your Personal Data, which you have provided to the Company with, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company.

This right can be exercised by contacting Us through our contact form or writing to Us at:

info@woorfee.com

, attaching a copy of your ID. If the request is submitted by a person other than you, without providing evidence that the request is legitimately made on your behalf, the request will be rejected.

The request is free of charge unless your request is unfounded or excessive ( e.g. if You have already requested such Personal Data multiple times in the last twelve months or if the request generates an extremely high workload). In such case, the Company may charge you a reasonable request fee according to applicable laws.

The Company may refuse, restrict or defer the provision of Personal Data where it has the right to do so, for example if fulfilling the request will adversely affect the rights and freedoms of others.

13. Privacy by design and by default

The Company will, both at the time of the determination of the means for Processing and at the time of the Processing itself, implement appropriate technical and organizational measures, such as pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the Processing in order to meet the requirements of the GDPR and protect your rights.

The Company will implement appropriate technical and organizational measures for ensuring that, by default, only Personal Data which are necessary for each specific purpose of the Processing are Processed. This obligation applies to the amount of your Personal Data We collect, the extent of their Processing, the period of storage and their accessibility. These measures will ensure that by default your Personal Data are not made accessible without your intervention to an indefinite number of Third-parties.

14. Contacting the Company and complaints

The Company hopes to be able to answer any questions or concerns you have about your Personal Data. You can get in touch with the Company at the following postal address or email address:

Woorfee SA
Avenue du Casino 32
1820 Montreux
Switzerland.
info@woorfee.com

You have the right to make a complaint if you feel your Personal Data has been mishandled or if the Company has failed to meet your expectations. You are encouraged to contact the Company about any complaints or concerns but you are entitled to complain directly to the relevant supervisory authority.

15. Changes to the Terms and Privacy Policy

The Company may modify the Terms or this Policy from time to time and will post the most current version on the App. You will be notified such changes in accordance with the procedures set forth in our Terms, by using the e-mail address you provided Us with upon registration and We will ask you to Consent to these modifications. You expressly Consent to receive new versions of the Terms or of this Policy in the e-mail address you provided to Us.

16. Data controller

The Personal Data controller is Woorfee SA, Avenue du Casino 32, 1820 Montreux, Switzerland.

17. Data processor

You understand and expressly Consent that Maison-B-More, United Arab Emirates, Shop No. 520-521, Ground Floor, Wafi Mall, Dubai (the “Maison-B-More”) is a Processor of your Personal Data.

All the rights and obligations applicable to the Company are fully applicable to the Maison-B-More while Processing your Personal Data.

As a consequence, you understand and agree that Maison-B-More is legitimate to Process your Personal Data for its own interests, in particular for statistic reason, for marketing purposes, to analyse the market, to send you tailor-made offer (by email, by mail, by phone, through the social media, etc.), to contact you, to send you its own newsletter or for any other reason based on the law, on a legitimate interest of Maison-B-More or on your Consent.

You understand and expressly Consent that Maison-B-More is legitimate to communicate to all the companies of its Group and to all its subsidiaries. Maison-B-More must adopt binding corporate rules applicable to its Group and its Subsidiaries.

18. Data transfer agreement

Considering that Maison-B-More is a Processor of your Personal Data, the Company signed with this latter a Data transfer agreement.

Pursuant to this agreement, the Company undertake to transfer to Maison-B-More all your Personal Data collected and Processed in accordance with this Policy.

Maison-B-More expressly warrants and undertakes that:

• it stores and Processes your Personal Data in Dubai, which ensures an adequate protection of your Personal Data;
• it has in place appropriate technical and organizational measures to protect your Personal Data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and which provide a level of security appropriate to the risk represented by the Processing and the nature of the data to be protected;
• it has in place procedures (particularly but not only by the adoption of binding corporate rules applicable to its Group and its Subsidiaries) so that any Third-party it authorizes to have access to your Personal Data, including Processors, will respect and maintain the confidentiality and security of your Personal Data;
• it Processes your Personal Data for the sole purposes described in this Policy.

19. EU Representative

The Company’s representative in the EU for the purposes of the GDPR, where applicable, is DPR Group, 1-2 Marino Mart, Fairview, Dublin 3, Ireland and can be contacted by email at contact@dpr.eu.com .

20. Links

The App may contain links which direct you to Third-party sites. The Company rejects any liability relating to the privacy policy in force on said Third-party sites, the collection and use of your Personal Data by the latter and relating to the contents of said sites (whether the links are hypertext links or deep-links).

21. Jurisdiction and governing law

This Policy and any questions relating thereto shall be governed by the laws of Switzerland, to the exclusion of any rules of conflict resulting from private international law.

Any dispute relating to the Privacy Policy must exclusively be brought before the courts of Lausanne, subject to an appeal to the Swiss Federal Court.

22. Contact

To ask questions or make comments on this Policy or to make a complaint about our compliance with applicable privacy laws, please contact Us through our contact form or writing to Us at: info@woorfee.com

. We will acknowledge and investigate any complaint pursuant to this Policy.

***