Privacy Policy

1. Preamble

Lucky cart pays attention to the privacy of its Contacts, and in particular the protection, confidentiality and security of their Data which it collects, in accordance with General Data Protection Regulation 2016/679 and Data Processing and Freedoms Law no. 78-17 as amended (“Regulations”).

Through this privacy policy, Lucky cart wishes to make all of its Contacts aware of:

  1. the nature of the processing of Data which it is responsible for collecting and processing; 
  2. its commitments to respecting Data and enabling its Contacts to exercise their rights under the Regulations, where appropriate. 

2. Definitions

The terms and expressions identified by a capital letter in the privacy policy have the following meanings, whether used in the singular or plural:

  • Client”: contact within the mass-market retail corporation (a brand or retailer) which enters into a contract with Lucky cart in order to receive the services offered by the latter;
  • Cookie”: the practice of recording and/or reading information on digital terminals (computer, smartphone, tablet, etc.);
  • “Data”: personal data of Contacts, i.e. information that can identify them, directly or indirectly, which is collected and processed including when the Site is used for the contact request, and/or when participating in a promotional campaign organised by Lucky cart;
  • Prospect”: contact within the mass-market retail corporation (brands and retailers) identified as being potentially interested in the services of Lucky cart and not having, or no longer having, Client status;
  • Contact”: all Participants, Clients, Prospects, Internet Users and Applicants;
  • Data Controller”: the company Lucky cart, which decides, on its own or jointly, the purposes and means of the Data processing described in this privacy policy; 
  • Site”: the website www.luckycart.com published by Lucky cart;
  • Internet User”: any person who browses the Site;
  • Supplier”: the individual or corporation providing Lucky cart with goods or services;
  • Participant”: the adult individual residing in Metropolitan France with a valid personal email address who participates in a promotional campaign run by Lucky cart enabling them to win an instant prize draw.

3. Ways in which personal data is collected

Lucky cart may collect Data from its Contacts directly:

  • through the contact form posted online on its Site;
  • through the websites of Retailers where they are Participants. 

4. Nature of the processing

As Data Controller or joint Data Controller, Lucky cart collects and processes Data relating to its Contacts with the characteristics listed below. Where the processing is based on consent, Contacts have the right to withdraw it at any time.

N° 1
Purpose of processing: Organising and running the competition (participation in the competition, informing and dealing with winners, awarding and giving prizes, announcing results) 
Data subject(s): Participants
Legal basis: Implementation of the competition rules
Data retention period*: 3 years from the end of the competition held by Lucky cart
Data controller(s): Lucky cart and the Retailer concerned Details of this processing were given in the competition rules agreed to by the Participant

N° 2
Purpose of processing: Creating consumption profiles from the Participant’s purchase histories and promotion preferences in order to offer personalised promotions  
Data subject(s): Participants
Legal basis: Legitimate interest of Lucky cart and the Retailer, i.e. optimising the performance of promotional investments
Data retention period*: 3 years from the end of the competition held by Lucky cart
Data controller(s): Lucky cart and the Retailer concerned Details of this processing were given in the competition rules agreed to by the Participant

N° 3
Purpose of processing: Dealing with objections or complaints, investigating fraud, including calculating the risk of fraud, and complying with these rules, managing eliminations and managing entries on a special list so that promotions are no longer displayed to fraudsters
Data subject(s): Participants
Legal basis: Legitimate interest of Lucky cart and the Retailer, i.e. limiting fraud risks
Data retention period*: 3 years from being placed on the “banlist” when a known case of fraud is detected. Data processed for the purpose of calculating fraud risk in order to detect and manage abusive behaviour is kept for a period of fifteen (15) months.
Data controller(s): Lucky cart and the Retailer concerned Details of this processing were given in the competition rules agreed to by the Participant

N° 4
Purpose of processing: Producing analyses and statistics and carrying out reporting operations
Data subject(s): Participants
Legal basis: Legitimate interest of Lucky cart and the Retailer, i.e. analysing participation in the competition
Data retention period*: 3 years from the end of the competition held by Lucky cart
Data controller(s): Lucky cart and the Retailer concerned Details of this processing were given in the competition rules agreed to by the Participant

N° 5
Purpose of processing: Dealing with information requests sent by post and through the form on the Site 
Data subject(s): Contacts
Legal basis: Implementation of pre-contract steps taken at the data subject’s request
Data retention period*: For the period necessary to deal with requests
Data controller(s): Lucky cart

N° 6
Purpose of processing: Managing contracts entered into with Clients
Data subject(s): Clients
Legal basis: Legitimate interests of the data controller, i.e. performance of the contract entered into with the corporation
Data retention period*: Duration of the contractual relationship
Data controller(s): Lucky cart

N° 7
Purpose of processing: Commercial prospecting
Data subject(s): Clients
Legal basis: Legitimate interests of the data controller, i.e. promoting its services when messages are sent (i) by post or telephone or (ii) to Clients in accordance with Article L.34-5 of the Code of Civil Enforcement Proceedings
Data retention period*: For a period of 3 years from the last contact or the end of the contractual relationship
Data controller(s): Lucky cart

N° 8
Purpose of processing: Dealing with Suppliers 
Data subject(s): Supplier or individual contact within the Supplier
Legal basis: Legitimate interests of Lucky cart, i.e. monitoring its business relationship
Data retention period*: Duration of the contractual relationship
Data controller(s): Lucky cart

N° 9
Purpose of processing: Considering and processing applications
Data subject(s): Applicants
Legal basis: Legitimate interests of Lucky cart, i.e. managing recruitment
Data retention period*: Maximum of 2 years from the last contact from the Applicant
Data controller(s): Lucky cart

N° 10
Purpose of processing: Dealing with pre-litigation and litigation 
Data subject(s): Contacts
Legal basis: Legitimate interest of Lucky cart, i.e. defending its interests in legal proceedings
Data retention period*:
Pre-litigation: for the period necessary to settle the dispute amicably, or failing this, when the relevant action becomes time-barred.
Litigation: for the duration of the proceedings and until the end of the ordinary and extraordinary time limits for appeals.
Data controller(s): Lucky cart

(*) At the end of these retention periods, Data will be archived securely for the necessary storage and/or limitation periods specified in the applicable legislative or regulatory provisions. At the end of these periods, Data will be erased, in accordance with current regulations.

5. Processing carried out jointly by Lucky cart and Retailers

In accordance with Article 26 of the GDPR, the purpose of this clause is to make Participants aware of the essence of the agreement that Lucky cart has entered into with the Retailers concerned in relation to forms of processing 1 to 4, where they are carried out jointly.

Each Retailer is responsible for informing Participants and shall make them aware of the competition rules for the promotional campaign through their website before the Participant enters the competition.

Lucky cart is the contact point for Participants for the purpose of exercising their rights and handling complaints in relation to forms of processing 1 to 4. Requests in relation to rights which are made directly to the Retailer shall be passed on by the latter to Lucky cart.

If a request concerns processing for which the Retailer is solely responsible, Lucky cart shall send it to the latter as soon as possible.

This privacy policy does not apply to processing for which Retailers have sole responsibility.

6. Recipients of Data

Data is mainly intended for the relevant internal departments of Lucky cart and specially authorised technical staff, in accordance with the purposes listed in the “Nature of processing” article.

Lucky cart may also send some Data to its processors, particularly computer and accounting data. These processors must maintain the confidentiality, integrity and security of Data that is sent to them and must only use it for the purposes of fulfilling their role as service providers.

In special circumstances, Lucky cart may disclose Data where it is demanded by judicial and administrative authorities who demonstrate that they need to know it.

7. Data processing rights and freedoms

As “data subjects” concerned by the processing carried out by Lucky cart on its own or jointly, and in accordance with the Regulations, all Contacts have the rights listed below:

  • a right of access, i.e. to obtain confirmation that Data is or is not being processed and, where it is, access to this Data, and various pieces of information such as the purposes of the processing, the category of the Data, the recipient(s) of the Data, etc.
  • a right to rectify, as soon as possible, Data which is inaccurate, incomplete, out of date or ambiguous, or whose collection and processing are prohibited;
  • a right to object to processing or a transfer of Data, except where there are legitimate and compelling reasons which take precedence over the interests of Contacts;
  • a right to erasure of Data for the following reasons:
  1. Data is no longer needed for the purposes for which it was collected or processed;
  2. the consent on which the processing was based has been withdrawn, and there is no other legal reason for the Data processing;
  3. the Data processing has been objected to and no overriding interest justifies the processing;
  4. Data has been processed illegally;
  5. Data must be erased in fulfillment of a legal obligation to which Lucky cart may be subject;
  6. Data was collected when the data subject was a minor.
  • a right to restriction of Data processing for the following reasons:
  1. for a period enabling the data controller to verify the accuracy of Data, where it is challenged by the data subject
  2. the processing is illegal and the data subject objects to its erasure and demands instead that its use be restricted;
  3. the data controller no longer needs the Data for the purposes of the processing but it is still needed by the data subject in order to establish, exercise or defend rights in judicial proceedings;
  4. during checks as to whether the legitimate interests pursued by the data controller outweigh those of Contacts where they have objected to the processing;
  • a right to make arrangements in advance and while they are alive as to how Data will be stored and communicated after their death;
  • a right to portability and recovery of Data making it possible to receive Data sent in a format which is structured, widely used and machine-readable, and to send it to another data controller.

If one of these rights is exercised electronically, responses shall, where appropriate, be given electronically where possible, except where the Contact has specifically requested otherwise.

If responses given by Lucky cart are considered unsatisfactory or incomplete, all of its Contacts may make a complaint to CNIL (National Commission for Data Processing and Freedoms), the national supervisory authority with responsibility for the fulfilment of personal data protection obligations.

8. Contact details of Lucky cart

Lucky cart has its headquarters at 159 rue Montmartre 75002 Paris. Contacts’ requests to exercise rights may be sent to the following addresses:

  • by email to: contact@luckycart.com
  • by post to: Lucky cart, For the attention of the Data Protection Officer, 159 rue Montmartre 75002 Paris.

A request to exercise one of these rights may be refused if the Contact’s request does not meet the requirements of the Regulations. In this event, the Contact concerned shall be duly informed of this.

9. Cookies

  • Strictly necessary Cookies (“Technical cookies”)

Some Cookies are intended solely to enable or facilitate electronic communication or are strictly necessary to provide online communication services at the explicit request of each Internet User. According to Article 82 of the Data Protection and Freedoms Law, the Internet User’s consent is not requested for the use of these cookies which generate Data processing that is necessary to pursue our legitimate interest, i.e. the smooth technical running of the Site.

  • Cookies which are not strictly necessary (“Non-technical cookies”)

The Site uses Cookies that record information concerning Internet Users’ browsing, which can be used to optimise its Sites and tailor content to their interests. These Cookies include audience measurement Cookies which can be placed on the Internet User’s terminal when the latter browses the Site.

A notification banner appears upon every first visit. Its purpose is to inform Internet Users in advance of the precise reasons why Cookies are placed, to obtain their consent and, where appropriate, to enable them to object to all or some Cookies placed on digital terminals.

10. Access to social media networks

The Site makes it possible to access social media network pages by clicking on certain thumbnails on the Site.

When Internet Users click on these links, Data concerning them is automatically transferred to the social media networks concerned. Internet Users must therefore read their respective privacy policies in order to find out their characteristics and, where appropriate, exercise their rights by clicking on the links below:

  • Facebook privacy policy: https://www.facebook.com/privacy/explanation;
  • LinkedIn privacy policy: https://linkedin.com/legal/privacy-policy?

We also inform you that browsing Lucky cart’s Facebook pages results in Data processing for the purposes of creating statistics for which Lucky cart and Facebook Ireland Limited are jointly responsible, with the latter having primary responsibility for this processing in accordance with the addendum published by it which is available at the following address: https://facebook.com/legal/terms/page_controller_addendum.

11. Changes to the privacy policy

Lucky cart may make changes to this privacy policy so that it remains exhaustive at all times. All Contacts shall be informed of them through a special notice displayed on the Site.