My Network Personal Data Processing Agreement

Last updated: July 23, 2026

This personal data processing agreement (hereinafter the “DPA”) forms an integral part of the Terms of Use applicable to Brands (“ToU”): 📄 General Terms of Use (Brands).

1. DEFINITIONS

The terms “Personal Data,” “Controller,” “Processor,” “Data Subject,” “Personal Data Breach,” and “Process/Processing” have the same meaning as set forth in Regulation (EU) 2016/679, hereinafter the “GDPR,” and shall be interpreted accordingly.

“Sub-Processor”: means any legal entity designated by ANKORSTORE to Process the CRM Data on its behalf.

“CRM Data” means the Personal Data uploaded by the Brand, acting as Controller, into the MyNetwork tool, or collected on behalf of the Brand via MyNetwork features, in particular by means of a QR code, a link or a form generated from the Brand’s Account, a widget, a redirect link or any other tool made available by Ankorstore enabling a Data Subject to be redirected from a Brand environment to the Brand’s Ankorstore store, as well as any other Personal Data of Data Subjects arising from the use of the CRM. Ankorstore Processes the CRM Data in its capacity as Processor as well as any other Personal Data of Data Subjects arising from the use of the CRM. Ankorstore Processes the CRM Data in its capacity as Processor, without prejudice to the Processing that Ankorstore carries out in its capacity as independent Controller, in particular for the operation of the Platform, the management of Ankorstore Accounts, the linking of a Retailer to a Brand, and the making available of information derived from the Ankorstore Account in accordance with the ToU and Ankorstore’s privacy policy.

“Platform Data” means the Personal Data relating to a Retailer or a professional user derived from their Ankorstore Account or their use of the Platform, including in particular Account identification information, store name, professional contact details, professional or delivery address, information relating to Services subscribed to, subscriptions, interactions with the Brand’s Products, carts, wishlists, Orders or other activities carried out on the Platform, as well as source, attribution or interaction data identifying that a Data Subject accessed the Platform or the Brand’s Ankorstore store via a QR code, a link, a widget, the Brand’s website or any other redirect channel associated with the Brand. Platform Data are Processed by Ankorstore in its capacity as independent Controller, in accordance with its privacy policy, except where they are subsequently used by the Brand for its own purposes within MyNetwork.

For the purposes of the DPA, capitalized terms not defined herein shall have the meaning ascribed to them in the ToU: 📄 General Terms of Use (Brands).

2. PURPOSE

The purpose of the DPA is to define the conditions under which ANKORSTORE, in its capacity as Processor, undertakes to carry out, on behalf of the Brand acting as Controller, the Processing operations of the CRM Data as defined below.

In the context of their contractual relationship, the Parties undertake to comply with the applicable regulations, including the GDPR.

3. DESCRIPTION OF THE PROCESSING SUBJECT TO SUB-PROCESSING

Ankorstore makes the My Network CRM available to the Brand in accordance with the ToU. Use of the CRM entails the transmission by the Brand of CRM Data to Ankorstore, as well as, where applicable, the collection of CRM Data on behalf of the Brand by means of features made available by Ankorstore, such as the generation of a QR code, a link or a contact collection form. The CRM Data are Processed by the Brand in its capacity as Controller; Ankorstore Processes such data as a Processor in accordance with the Brand’s instructions. The CRM Data are Processed by the Brand in its capacity as Controller; Ankorstore Processes such data as a Processor in accordance with the Brand’s instructions.

The Brand determines the essential purposes and means of the Processing of CRM Data, including in particular the contacts it wishes to collect or import, the information it requests from Data Subjects, the commercial use it makes of such data, the communications campaigns it decides to send, and the applicable retention periods, subject to the technical parameters offered by MyNetwork..

4. OBLIGATIONS OF THE BRAND AS CONROLLER

The Brand acknowledges and agrees that it acts in its capacity as Controller with respect to CRM Data, including where such CRM Data are collected by means of a QR code, a link or a form generated from MyNetwork.

In this capacity, the Brand undertakes to:

have an appropriate legal basis for collecting, importing, using and retaining CRM Data in MyNetwork;
provide Data Subjects, prior to or at the time of collection of their CRM Data, with the information required by applicable regulations, including in particular the identity of the Controller, the purposes of the Processing, the applicable legal bases, the recipients or categories of recipients, retention periods, Data Subjects’ rights, and the means of exercising those rights;
clearly inform Data Subjects that their CRM Data may be added to the Brand’s MyNetwork network and used by the Brand to manage its commercial relationship with them;
ensure that the CRM Data collected are adequate, relevant and limited to what is necessary in relation to the purposes pursued;
comply with the rules applicable to commercial prospecting, including electronic prospecting, and, where required, obtain valid consent from Data Subjects prior to sending promotional communications;
where the Brand integrates on its website or any other environment it controls a widget, a redirect link or any other technical tool enabling a Data Subject to be redirected to Ankorstore or to identify their source, provide the required information to Data Subjects and, where necessary, obtain their prior consent in accordance with applicable regulations, including with respect to cookies, trackers and electronic communications;
not use MyNetwork to send unlawful, misleading, unsolicited or otherwise objectionable communications contrary to Data Subjects’ rights;
handle requests by Data Subjects to exercise their rights in relation to CRM Data, without prejudice to the assistance that may be provided by Ankorstore pursuant to this DPA;
define and comply with the retention periods applicable to CRM Data, subject to the features and technical constraints of MyNetwork;
warrant to Ankorstore that the CRM Data transmitted, imported or collected via MyNetwork have been obtained in accordance with applicable regulations.

5. CONTACT COLLECTION AND REDIRECTION VIA QR CODE, LINK, FORM, WIDGET OR MYNETWORK REDIRECT TOOL

Where the Brand uses a feature enabling the generation of a QR code, a link or a contact collection form, or where it integrates on its own website or any other environment it controls a widget, a redirect link or any other tool made available by Ankorstore enabling a Data Subject to be redirected to the Brand’s Ankorstore store, the Personal Data entered by Data Subjects are collected on behalf of the Brand and integrated into MyNetwork as CRM Data. Where the feature does not result in the direct entry of Personal Data but enables identification of the source of a Data Subject or the subsequent linking of that Data Subject to the Brand in MyNetwork, the corresponding Processing operations are carried out under the conditions described in Article 6 below.

The Brand remains the Controller of such CRM Data and their use in MyNetwork, in particular for managing its commercial relationship with Data Subjects and the possible sending of communications via MyNetwork. Ankorstore acts as Processor for the technical provision of the feature, hosting, integration into MyNetwork and, where applicable, the technical sending of communications on behalf of the Brand.

The Brand is responsible for the context in which the QR code, link, form, widget, redirect link or similar tool is presented to Data Subjects, including at trade fairs, events or commercial operations, as well as the context in which such a tool is integrated or presented on its own website or any other environment it controls. It undertakes not to present this feature in a manner likely to mislead Data Subjects as to the identity of the Controller, the purposes of the collection, the subsequent use of their CRM Data or the role of Ankorstore.

No Ankorstore Account is automatically created where a Data Subject does not already have an Ankorstore Account. In such case, the CRM Data are integrated into the Brand’s MyNetwork as a contact or prospect of the Brand, solely where the feature used involves the collection or transmission of CRM Data to MyNetwork. Where the Data Subject merely accesses the Brand’s Ankorstore store via a widget, a redirect link or a similar tool without having an Ankorstore Account and without entering any Personal Data, no MyNetwork contact record is created solely as a result of that click. Ankorstore shall not contact that Data Subject solely as a result of their addition to the Brand’s MyNetwork, unless they subsequently decide to create an Ankorstore Account or to interact directly with Ankorstore.

6. TRANSFER OUTSIDE THE EUROPEAN UNION

Where a Data Subject listed in the Brand’s MyNetwork already has an Ankorstore Account, or subsequently creates an Ankorstore Account using information enabling them to be identified or linked to the contact listed in MyNetwork, or where a Data Subject who has or subsequently creates an Ankorstore Account can be identified as coming from a QR code, a link, a widget, the Brand’s website or any other redirect channel associated with the Brand, Ankorstore may match that contact or Data Subject with the corresponding Ankorstore Account and/or the Brand’s MyNetwork network. This matching may enable the Brand to access, within MyNetwork, certain Platform Data associated with the Retailer, in accordance with the ToU and Ankorstore’s privacy policy.

Such matching may be carried out in particular by means of information entered by the Data Subject, technical redirect parameters, source identifiers, cookies or other trackers, or any other mechanism enabling it to be established that the Data Subject accessed the Platform or the Brand’s Ankorstore store from a channel associated with the Brand, in compliance with applicable regulations. Where cookies or other trackers are used on the Brand’s website or any other environment it controls, the Brand remains responsible for providing the required information and obtaining, where necessary, Data Subjects’ consent prior to the placement or reading of such cookies or trackers.

The Platform Data likely to be made visible to the Brand may include, depending on the information available and the features activated, the store name, corporate name or trade name, professional or delivery address, professional contact details registered in the Account, contact points associated with the Account, information relating to the Retailer’s status or eligibility for certain Ankorstore Services, subscriptions taken out, as well as certain interactions by the Retailer with the Brand’s Products on the Platform, including in particular cart additions, additions to a wishlist or similar feature, and Orders placed with the Brand.

The telephone number associated with the Retailer’s Ankorstore Account shall not be made visible to the Brand in MyNetwork prior to a first Order being placed with that Brand, unless the Retailer has been informed otherwise or has taken a specific action to that effect.

The Processing operations consisting of Ankorstore managing the Ankorstore Account, carrying out the matching between a MyNetwork contact and an Ankorstore Account, and determining the Platform Data made visible to the Brand are the responsibility of Ankorstore in its capacity as independent Controller. The Brand acts as independent Controller for the Processing it subsequently carries out on the Platform Data it accesses within MyNetwork, including in particular its consultation, its use for commercial management, segmentation or communications purposes.

The Brand undertakes to use the Platform Data made visible in MyNetwork solely for purposes compatible with the commercial relationship with the Retailer, the ToU, Ankorstore’s privacy policy and applicable regulations. It shall not attempt to obtain, infer or reconstruct information that is not made accessible to it by Ankorstore, including in particular the Retailer’s telephone number prior to a first Order where it is not visible in MyNetwork.

7. COMMUNICATIONS SENT VIA MYNEWTORK

Where the Brand uses MyNetwork to send communications to Data Subjects, including contacts imported or collected via a QR code, a link or a form, it remains the Controller of the sending of such communications, the choice of recipients, the content of the messages, the applicable legal basis and compliance with the rules applicable to commercial prospecting, including electronic prospecting.

The Brand acknowledges that certain communications may technically be sent via an address or domain operated by Ankorstore. This technical modality does not alter the Brand’s status as Controller in respect of those communications. The Brand undertakes to ensure that such communications enable Data Subjects to clearly identify the Brand as the sender or advertiser of the communication, and to understand that Ankorstore acts as a technical service provider via MyNetwork.

The Brand undertakes to comply with and ensure compliance with unsubscribe requests, objections or any preferences expressed by Data Subjects regarding communications sent via MyNetwork.

8. OBLIGATIONS OF THE PROCESSOR TOWARDS THE CONTROLLER

In its capacity as Processor, ANKORSTORE undertakes to:

Process the CRM Data exclusively for the purposes set out in this DPA and in accordance with the Brand’s instructions;
Inform the Brand without undue delay if ANKORSTORE considers that an instruction constitutes a breach of the GDPR;
Ensure the confidentiality of the CRM Data Processed on behalf of the Brand under the DPA;
Ensure that persons authorized to Process the CRM Data, whether ANKORSTORE employees or agents, are bound by confidentiality obligations and receive necessary training;
Take into account, with respect to the Platform, data protection by design and by default, considering the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing of CRM Data, as well as the potential risks that the Processing poses to Data Subjects;
Notify the Brand of any Personal Data Breach without undue delay after becoming aware of it. Such notification shall be accompanied by any relevant documentation available to Ankorstore, to enable the Brand, where applicable, to notify the Personal Data Breach to the competent supervisory authority and to the Data Subjects;
Implement measures designed to ensure the confidentiality and security of the CRM Data.

9. SUB-PROCESSING

The Brand gives general authorization for ANKORSTORE to sub-process all or part of the CRM Data to Sub-Processors. ANKORSTORE shall ensure that Sub-Processors provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures.

10. TRANSFERS OUTSIDE THE EUROPEAN UNION

If the CRM Data are transferred outside the EEA, ANKORSTORE undertakes to first ensure that such transfer meets all requirements mandated by applicable regulations.

11. RIGHT TO INFORMATION OF DATA SUBJECTS

It is the Brand’s responsibility to provide all information to Data Subjects regarding the conditions of sub-processing of CRM Data in accordance with applicable regulations. In particular, where CRM Data are collected by means of a QR code, a link or a form generated from MyNetwork, or where a Data Subject is redirected to the Platform or the Brand’s Ankorstore store via a widget, a redirect link or any other tool integrated on the Brand’s website or an environment it controls, the Brand undertakes to provide Data Subjects, at the time of collection or redirection, with clear, comprehensive and easily accessible information on the Processing of their CRM Data, including in particular on the use of MyNetwork, the possible sending of communications via MyNetwork, the identity of the Brand as Controller, the role of Ankorstore as technical service provider, the means of exercising their rights, and, where applicable, the mechanisms enabling identification of the Data Subject’s source and their linking to the Brand’s MyNetwork network.

Where the collection or addition of a Data Subject to the Brand’s network may lead to a matching with an existing or subsequently created Ankorstore Account, the Brand undertakes to relay the information made available by Ankorstore regarding such matching and the possibility that certain Platform Data may be made visible to the Brand in MyNetwork, under the conditions set out in the ToU and Ankorstore’s privacy policy.

Ankorstore may make available to the Brand template information notices or information relating to the technical operation of MyNetwork. However, the Brand remains solely responsible for the accuracy, completeness and adaptation of such information to its own Processing operations.

12. EXCERCISE OF DATA SUBJECTS’ RIGHTS

When Data Subjects submit to ANKORSTORE any requests to exercise their rights (right of access, rectification, erasure and objection, right to restriction of Processing, right to data portability, right not to be subject to a decision based solely on automated processing, including profiling), the Brand expressly authorizes Ankorstore to handle such requests in its name and on its behalf for aspects relating to the MyNetwork CRM tool (e.g., deletion of Data, informing Data Subjects, etc.). Ankorstore shall inform the Brand of the requests received and the responses provided without undue delay. Where the request also concerns an existing Ankorstore Account or Processing carried out by Ankorstore in its capacity as Controller, Ankorstore may handle that part of the request in its own name and in accordance with its privacy policy. Where the request concerns the origin of the collection of CRM Data, the legal basis relied upon by the Brand, the sending of promotional communications by the Brand, the deletion of CRM Data from the Brand’s network, or the Brand’s use of the Platform Data made visible in MyNetwork, the Brand remains responsible for handling such request; Ankorstore shall provide only technical assistance under this DPA.

ANKORSTORE shall, where applicable, provide any reasonable assistance required by the Brand and necessary in connection with the exercise of Data Subjects’ rights.

13. ASSISTANCE TO THE BRAND

ANKORSTORE may provide the Brand with any assistance enabling it to comply with its obligations as Controller, in particular in the context of conducting data protection impact assessments relating to the protection of Data or as part of impact assessments. The Brand remains responsible for defining and complying with the retention periods applicable to CRM Data during the period of use of MyNetwork. It undertakes to delete or cause the deletion of CRM Data that are no longer necessary for the purposes pursued or whose retention is no longer lawful. The deletion of CRM Data in MyNetwork does not affect any Personal Data that may be Processed by Ankorstore in its capacity as Controller in connection with an existing Ankorstore Account, which remain governed by Ankorstore’s privacy policy.

14. DISPOSITION OF THE CRM DATA

Upon termination of the ToU for any reason, ANKORSTORE shall delete and destroy all existing copies of the CRM Data, subject to any statutory retention obligations applicable to ANKORSTORE.

15. AMENDMENT OF THE DPA

ANKORSTORE reserves the right to amend the DPA at any time. The applicable version is the one published on the Platform.

ANNEX 1: DESCRIPTION OF THE PROCESSING OF PERSONAL DATA

ANKORSTORE is authorized to Process the CRM Data on behalf of the Distributor, in its capacity as Processor, in order to provide the “My Network” CRM tool under the conditions defined by the ToU:.

The nature of the Processing operations carried out on the CRM Data is:

Collection;
Recording;
Retention;
Consultation;
Use;
Storage.
Import, integration and linking of CRM Data to the Brand’s network;
Technical sending of communications on behalf of the Brand;
Management of unsubscribes, preferences or requests relating to communications sent via MyNetwork, subject to available features;
Collection and processing of source, attribution or redirect data;
Matching between a redirect from a channel associated with the Brand and an existing or newly created Ankorstore Account.

The purpose(s) of the Processing are:

Provision of the “My Network” CRM tool under the conditions defined by the ToU;
Enable the Brand to collect professional contacts via MyNetwork, in particular by means of a QR code, a link or a form generated from its Account;
Automatically integrate the CRM Data thus collected into the Brand’s MyNetwork;
Enable the Brand to send, via MyNetwork, communications to the contacts in its network, under its own responsibility;
Enable the Brand to redirect Data Subjects to its Ankorstore store via a widget, a redirect link or any other tool integrated on its own website or an environment it controls;
Enable, where the conditions are met, the linking of a Data Subject to the Brand’s MyNetwork network following a redirect from a channel associated with that Brand.
Use of the functionalities enabled by the CRM, namely, in particular, the sending of promotional communications by the Brand to Data Subjects while ensuring targeting and the tracking of such communications;
Determination of the Retailer’s status (Historical or Brought by Ankorstore);
Tracking of Data Subjects’ interactions with communications sent via MyNetwork, where such feature is available.

The types of Personal Data Processed are (depending on the information provided by the Brand for each Data Subject):

First name
Last name
Professional email address
Professional phone number

Other data that may not constitute Personal Data will also be Processed by ANKORSTORE (e.g., company/store name and address, SIRET/SIREN number) Personal Data will also be Processed by ANKORSTORE (e.g., company/store name and address, SIRET/SIREN number)

Data relating to the Data Subject’s membership of the Brand’s network, their status in MyNetwork and their interactions with communications sent via MyNetwork;
Source, attribution or redirect data, such as the source of the redirect, the campaign or link identifier, the date and time of redirect, and, where applicable, the technical information required for linking to the relevant Brand.

Where the Data Subject already has an Ankorstore Account or subsequently creates one, certain Platform Data may be made visible to the Brand in MyNetwork in accordance with the ToU and Ankorstore’s privacy policy. Such Platform Data may include, depending on the information available and the features activated, the store name, corporate name or trade name, professional or delivery address, professional contact details registered in the Account, contact points associated with the Account, information relating to the Retailer’s status or eligibility for certain Ankorstore Services, subscriptions taken out, as well as certain interactions by the Retailer with the Brand’s Products on the Platform, including in particular cart additions, additions to a wishlist or similar feature, and Orders placed with the Brand. The telephone number associated with the Retailer’s Ankorstore Account shall not be made visible to the Brand in MyNetwork prior to a first Order being placed with that Brand, unless the Retailer has been informed otherwise or has taken a specific action to that effect.

The categories of Data Subjects are:

Retailers (professionals) who are customers or prospects of the Brand;

Representatives, employees, agents or professional contacts of such Retailers;
Professional visitors to trade fairs, events or commercial operations who have communicated their contact details to the Brand via MyNetwork;
Professional visitors to the Brand’s website or a Brand-controlled environment who were redirected to the Platform or the Brand’s Ankorstore store.

The duration of the Processing corresponds to the term of the ToU, subject to the retention periods defined by the Brand in its capacity as Controller and the deletion or unsubscribe features available in MyNetwork.

ANNEX 2: TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

ANKORSTORE undertakes to implement the following security measures:

Internal security measures:
Access to premises secured by badge
Access to IT equipment secured by biometric readers
Access to information systems secured by password manager (SSO 2FA)
Access rights policy and password policy
Internal team fully dedicated to information security protection
Mandatory ongoing security and data protection awareness and training for all employees
Regular audits of information systems and security policies
Vulnerability testing of information systems and regular updates
Business continuity plan
Backup servers (redundancy)
100% HTTPS
Encryption of data in transit (256-bit)
Payment flows via a PSP compliant with PSD2

Additional security measures implemented by Sub-Processors: