DATA PRIVACY POLICY

Morphea, a simplified joint-stock company with a capital of 100 euros, registered in the Paris Trade and Companies Register under number 907553911, with a share capital of 100€, whose registered office is located at 33, rue de prony and whose VAT number is FR76907553911 (“ MORPHEA BED ”, “ we ”, “ us ”) respects the privacy of any person providing it with personal data.

This privacy policy (“ Privacy Policy ”) describes how we collect and use personal data relating to visitors to our website www.morpheabed.com (the “ Site ”), our customers and suppliers (“ you ”, “ your ”) in accordance with French and European standards relating to the protection of privacy and personal data, and in particular with Law No. 78-17 of January 6, 1978 relating to information technology, files and freedoms, amended by Law 2004-801 of August 6, 2004 and European Regulation 2016/679 relating to the protection of individuals with regard to the processing of personal data and the free movement of such data (“ GDPR ”).

It also describes the legal bases we rely on to process personal data, who we share it with and how it is stored.

We are the data controller. This means we decide how we store and use your personal data. We are required under the GDPR to provide you with all the information in the Privacy Policy.

It is important that you read this Privacy Policy, together with any other information we may provide on specific occasions when we are collecting or processing your personal data, so that you are aware of how and why we are using that data.

How is your personal data collected?

We may collect personal data about you directly from you or through third parties, such as social media, public websites, etc.

Furthermore, we publish the Site through which we may collect personal data using cookies. To learn about our use of cookies, please read our cookie policy (Article 9 of the Privacy Policy).

We may collect this information in a variety of ways. For example, data may be collected through forms, online account creation, order forms, correspondence with you, and browsing the Site.

Type of personal data, purposes and legal bases

By personal data we mean any information about an individual from which that individual can be identified. This does not include data for which the identity has been removed (anonymous data).

 

Below is an overview of:

• categories of personal data about you that we use and store;
• purposes for which this personal data is collected;
• legal bases on which the processing is based.

Category of persons concerned	Type of personal data	Purpose of processing	Legal basis for processing
SITE VISITORS	·your name, first name ·Your email address ·your IP address and connection, navigation or location data (computer used for navigation, connection method, type and version of Internet browser, operating system and other technical identifiers or the URL address of connections, including date and time, as well as the content accessed, etc.) (cookies)	·enable the proper functioning of our Site (including handling questions and contact requests, managing requests relating to individual rights, enabling dispute resolution, handling complaints)	·our legitimate interest: management of prospect/customer service
		·allow you to access or use our Site (cookies)	·our legitimate interest: cookies strictly necessary to provide the service you have expressly requested
		·store information about your preferences (cookies)	·our legitimate interest: to offer a (cookies preferably exempt from the collection of consent)
		·prepare reports or compile statistics in order to improve our goods and services (cookies)	·your consent (cookies)
		·send commercial communications (including our newsletter) regarding our products or services	·for individuals: your consent collected when collecting the email address ·for professionals: our legitimate interest, to develop our business
CUSTOMERS / FUTURE CUSTOMERS	·your name, first name ·Your email address ·your postal address ·your phone number ·your IP address and connection, navigation and location data (computer used for navigation, connection method, type and version of Internet browser, operating system and other technical identifiers or the URL address of connections, including date and time, as well as the content accessed, etc.) (cookies)	·provide you with relevant goods or services (including confirming and processing orders, managing your account with us, and invoicing)	·in performance of a contract we have entered into with you
		·send non-commercial communications relating to an order	·in performance of a contract we have entered into with you
		·Send an alert regarding the availability of a product	·Your consent: the sending of these emails is generated by a specific request from you on the said product
		·send commercial communications regarding our products or services	·our legitimate interest: to develop our business
		·send commercial communications	·for individuals: your consent collected when creating the account
		·Organize possible competitions, promotions, surveys;	·your consent collected when creating the account
		·manage your queries or problems regarding our products and services, including any questions regarding how we collect, store and use your personal data, or any request for you to obtain a copy of the data we hold about you	·our legitimate interest: customer service management
		·ensure network and data security	·our legitimate interest: security management
		·conduct statistical analyses and market research	·our legitimate interest: to know our market to develop our business
		·for the detection and prevention of fraud, other criminal offenses and for risk management purposes	·compliance with a legal obligation and our legitimate interest

When users are the subject of commercial prospecting (individuals or professionals), they are hereby informed that they are able to oppose this processing. See article 7 of the Confidentiality Policy.

We believe that the risk associated with the personal data we process based on our legitimate interests is not excessive or overly intrusive. In particular, we have implemented measures to protect your rights by applying appropriate retention periods and ensuring appropriate security controls.

If you fail to provide personal data

If you choose not to provide the personal data we request, we may not be able to provide you with the products and/or services you have requested or fulfill the purposes for which we requested the personal data.

When certain information is mandatory to access specific features of the Site, this mandatory nature is indicated at the time of data entry.

Recipients of your personal data

Access to your personal data is strictly limited to MORPHEA BED employees and agents, authorized by virtue of their duties and bound by an obligation of confidentiality.

In addition, we will share your personal data with third parties when required to do so by law or when it is necessary to manage the contractual relationship we have with you or when we have another legitimate interest to do so. We will share your personal data with the following categories of third parties:

• other parties such as legal, governmental or regulatory authorities, tax advisors, auditors, lawyers and other external professional advisors; and

• companies that provide us with products and services, such as:

• banks; and

• providers of IT systems and support to our business, including providers of delivery services, email archiving, backup and disaster recovery and cybersecurity services, hosting and maintenance, marketing and advertising services.

Some of these companies may use your data in countries outside the European Economic Area. See Section 5 below.

We will also disclose your personal data to third parties:

• if we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets;

• if MORPHEA BED or substantially all of its assets are acquired by a third party, in which case personal data held by MORPHEA BED will be one of the transferred assets; and

• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, any lawful request from government or law enforcement authorities and if it may be necessary to meet national security or law enforcement requirements or to prevent illegal activity.

The third parties with whom we share your personal data are limited (by law and by contract) in their ability to use your personal data for the specific purposes we have identified. We will always make every effort to ensure that the third parties with whom we share your personal data are subject to confidentiality and security obligations consistent with this Privacy Policy and applicable laws. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Except as expressly stated above, we will never share, sell, or rent your personal data to any third party without notifying you and/or obtaining your consent. If you have given us your consent to use your information in a particular way, but later change your mind, you should contact us and we will stop doing so.

Data transfers

We do not carry out a direct transfer of data outside the EEA.

However, MORPHEA BED may transfer your personal data to partners whose headquarters are located outside the EEA. Where applicable, data transfers are governed by necessary transfer tools such as standard contractual clauses or adequacy decisions, where applicable.

You can request further details of the safeguards we have in place regarding transfers of personal data outside the EEA and, where applicable, a copy of the standard contractual clauses we have signed by contacting us at contact@morpheabed.com.

Duration of storage of your personal data

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

• Visitors:

• Questions, claims, complaints : we delete your personal data two years after your claim, question, complaint has been closed;

• Cookies : We will delete cookies after 13 months unless you give us your consent to their use again after this period.

• Customers: three years from the last commercial contact with the customer.

 

Before permanently deleting a customer's or potential customer's personal data, we will send them an email offering to continue keeping their customer account active or to continue sending them a newsletter to which they have subscribed.

Beyond these periods, we may keep your data in archived databases (without sending marketing emails) in order to meet our tax, accounting and social obligations (from 5 to 10 years maximum).

 

Your rights

As a data subject, you have certain rights regarding your personal data. These rights are not absolute and each of these rights is subject to certain conditions in accordance with the GDPR and applicable national laws.

• The right of access : You have the right to obtain from us confirmation as to whether or not your personal data is being processed by us, as well as certain other information (similar to that provided in this Privacy Policy) about how it is being used. You also have the right to access your personal data, by requesting a copy of the personal data held about you. This allows you to know and check that we are using your information in accordance with data protection laws. We may refuse to provide information where doing so may reveal personal data about another person or adversely affect another person's rights.

• The right to rectification : you can ask us to take steps to correct your personal data if it is inaccurate or incomplete (for example, if we have the wrong name or address).

• The right to erasure : Also known as the “right to be forgotten,” this right allows you, in simple terms, to request the erasure or deletion of your personal data when, for example, there is no compelling reason for us to continue using it or its use is unlawful. However, this is not a general right to erasure and there are some exceptions, for example, when we need to use the information to defend a legal claim or to be able to comply with a legal obligation.

• The right to restrict processing : You have the right to “block” or prevent further use of your personal data while we are assessing a request for rectification or as an alternative to erasure. When processing is restricted, we may still retain your personal data, but we may not use it further.

• The right to data portability : You have the right to obtain and reuse certain personal data for your own purposes across different companies (which are separate data controllers). This only applies to personal data you have provided to us, which we process with your consent and for the purpose of performing the contract, which is processed by automated means. In this case, we will provide you with a copy of your data in a structured, commonly used and machine-readable format or (where technically feasible) we may transmit your data directly to another controller.

• The right to object : You have the right to object to certain types of processing, for reasons relating to your particular situation, at any time, as long as such processing is carried out for the purposes of the legitimate interests pursued by MORPHEA BED. We will be authorized to continue processing personal data if we can demonstrate that the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms or if we need it for the establishment, exercise or defense of legal claims. If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for such purposes.

• The right to withdraw your consent : When we process your personal data based on your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of processing that took place before its withdrawal.

• The right to provide us with instructions on how we use your personal data after your death : You have the right to provide us with instructions on how we manage (e.g., retention, erasure, and disclosure) your data after your death. You can change or revoke your instructions at any time.

If you would like further information about your rights, if you wish to exercise any of them or if you have a complaint, please contact us at the following address: contact@morpheabed.com or by post to: 33, rue de prony 75017 Paris.

If you are not satisfied with our response to your complaint or if you believe that the processing of your personal data does not comply with applicable data protection laws, you may lodge a complaint with the competent data protection supervisory authority. The French Data Protection Authority (CNIL) is the data protection authority in France.

We will review all such requests and provide our response within the timeframes provided for by applicable law. Please note, however, that certain personal data may be exempt from such requests in certain circumstances, including if MORPHEA BED must continue to process your personal data for its legitimate interests or to comply with a legal obligation.

You will not have to pay a fee to access your personal data (or to exercise any other right). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. We may also refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access that information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

Security of your personal data

MORPHEA BED is committed to protecting personal data against loss, misuse, disclosure, alteration, unavailability, unauthorized access, and destruction, and takes all reasonable precautions to protect the confidentiality of personal data, including appropriate organizational and technical measures. Although we make every effort to protect the personal data you provide to us, the transmission of information over the internet is not completely secure. As such, you acknowledge and agree that we cannot guarantee the security of personal data you transmit to us over the internet and that such transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to prevent unauthorized access.

If we have given you (or if you have chosen) a password which enables you to access your account, you are responsible for keeping this password confidential. We ask that you never share a password with anyone.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable supervisory authority of a suspected breach where we are legally required to do so.

Cookies

What are cookies?

“ Cookies ” are small text files, often including unique identifiers, that are sent by web servers to web browsers, and which may then be sent back to the server each time the browser requests a page from the server.

Cookies are very useful and allow a website to recognize you, log in when you visit a particular page, provide a secure connection to a website and improve your user experience by improving your browsing comfort and/or adapting the content of a page to your interests.

How are cookies used?

When prior consent is required for their use, the validity period of consent to the deposit of cookies is 6 months. At the end of this period, we will ask for your consent again.

The cookies we place as operators of our Site are called "first-party cookies." Cookies that third parties have placed on our Site and/or our application are called "third-party cookies." Third-party cookies enable third-party features or functionality to be provided on or through a website (for example, advertising, interactive content, and analytics). The people who set these third-party cookies may collect some of your personal information and recognize your computer both when you visit the website in question and when you visit other websites.

The lifespan of an audience measurement cookie that does not require consent is 13 months. In addition, the information collected through these cookies is retained by us for a maximum period of 25 months, in accordance with applicable regulations.

The types of cookies that are used on our Site are as follows:

Technical cookies:

These cookies will allow you to move around our Site and use its features more efficiently. These cookies also allow our Site to remember your previous action during the same browsing session.

Functionality cookies:

These cookies allow our Site to remember choices you make when you visit our Site in order to provide you with enhanced and more personalized features.

Social media cookies:

These cookies allow you to display or share our content with other people, particularly on social networks such as Facebook, Twitter, YouTube, LinkedIn, etc. Even if you do not use these sharing buttons or applications, it is possible that social networks will track your navigation on the Site if your account or session is activated on your computer at that time.

Analytical cookies:

These cookies are used by us or by third-party service providers to analyze the use and performance of our Site. In particular, we use Google Analytics cookies to obtain web analytics data. Google Analytics collects information about your interaction with our Site, including information about the pages you visit and the length of your stay on our Site.

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the collected data to track and monitor the use of our service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

You can opt out of having your activity on the Service made available to Google Analytics by installing the Google Analytics Opt-out Browser Add-on. This add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity.

For more information on the privacy practices of Google, please visit the Google Privacy Policy web page: https://policies.google.com/privacy?hl=en .

Statistical cookies :

These cookies allow us to establish statistics and volumes of visits and use of the different elements making up our site and our application (sections and content visited, paths, visit time), which allows us to improve the interest and ergonomics of our services.

How to block the use of cookies?

There are two ways to refuse the use of cookies.

When you first visit our Site, your consent to the use of your data by cookies will be requested via an information banner which will be displayed visibly at the bottom of the page.

Using the "Accept cookies" and "Reject cookies" buttons, you can accept or reject cookies globally so that we can place cookies on your computer or device (certain audience measurement cookies, social network cookies generated in particular by their sharing buttons when they collect personal data). However, a third "Customize" button on this banner will allow you to obtain details of the categories of cookies used and thus choose whether or not to consent by objective.

However, if you wish to refuse the use of any type of cookies on a website, you can do so by changing your browser settings to block the use of cookies. Please note that if you block the use of cookies through this browser setting, you may not be able to use or view all or parts of the relevant website, including our Site.

Each web browser offers different ways to configure cookie management. These are generally described in each browser's help menu.

• Firefox : https://support.mozilla.org/fr/kb/cookies-information-sites-register

Click the menu button and select "Options Preferences".

Select the "Privacy and Security" panel.

Set the "Retention Rules" menu to "Use custom settings for history".

Uncheck the "Accept cookies" box.

The changes you made will be automatically saved.

• Internet Explorer : https://support.microsoft.com/en-us/products/windows?os=windows-7

Click the "Tools" button, then click "Internet Options."

Click the "Privacy" tab, then under "Settings," move the slider up to block all cookies or down to allow all cookies, then click OK.

• Google Chrome : https://support.google.com/chrome/answer/95647?hl=fr

Select the Chrome menu icon.

Select “Settings”.

At the bottom of the page, select "Show advanced settings."

In the "Privacy" section, select "Content settings".

Select "Block all sites from storing data."

Select OK.

• Safari : https://www.apple.com/legal/privacy/fr-ww/cookies/

Click on "Settings" > "Safari" > "Privacy" > "Cookies and website data".

Then select “always block”.

Please note that if you block the use of cookies through this browser setting, you may not be able to use or view all or parts of the website, including our Site.

Additionally, if you wish to block the use of analytical cookies, please access the following URL to suspend the use of these cookies:

Google Analytics: Opt-out for cookies

Description of cookies and their purpose:

Google Analytics _ga ;

Google Analytics _gid. These cookies are used to distinguish users. [https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage];

Google Analytics _gat. These cookies are used to reduce the number of requests. However, if Google Analytics is deployed via Google Tag Manager, these cookies will be named: _dc_gtm_<property-id>. [https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage].

Google Analytics is a web analytics service provided by Google LLC (“Google”). The information generated by the cookie about your use of the Site is usually transmitted to a Google server in the United States and stored there.

Google will use this information on our behalf to analyze your use of the Site, compile reports on Site activity and provide us with additional services related to Site use and Internet usage in general. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

You can refuse the use of data created by these cookies in relation to the use of our Site (in particular your IP address) as well as the processing of this data by Google, by downloading and installing the plug-in available on your browser under the following link: https://tools.google.com/dlpage/gaoptout?hl=en-GB

 

 Third-party websites

The Site may contain links to other websites operated by third parties. Please note that this Privacy Policy applies only to personal data collected by us (or third parties on our behalf), and we are not responsible for any personal data collected and stored by third parties. Third-party websites have their own terms and conditions and privacy policies, and you should read these carefully before submitting any personal data to these sites. We do not assume or accept any responsibility for the content of these third-party websites or third-party terms and conditions or policies.

Changes to this Privacy Policy

This Privacy Policy was updated on 12/21/2022.

We reserve the right to update this Privacy Policy at any time. Please check this Privacy Policy regularly to be informed of any changes. We may also notify you from time to time of any changes in the processing of your personal data.

Applicable law

This privacy policy is subject to French law.