Identity of the Data Controller

The company GWP S.A. (Luxembourg public limited company with a share capital of EUR 31,000 - 62 Avenue de la Liberté L-1930 Luxembourg - Registered in the Luxembourg Trade and Companies Register under number B207382 - business authorisation number 10071114/0, issued by the Ministry of Economy of the Grand Duchy of Luxembourg located at 19-21 Boulevard Royal, 2449 Luxembourg - VAT number LU28700569) (hereinafter "GWP"), acts as the Data Controller for the collection of personal data carried out on the website accessible at www.exclusivesandbenefits.co.uk (hereinafter the "Website").

The personal data collected by GWP on the Website is intended for GWP. It may be processed by technical service providers acting on behalf of GWP (in particular hosting providers, payment service providers, customer support and communication tools), bound by contractual confidentiality and security obligations. The data is hosted and processed within the European Union, particularly in France and Luxembourg.

Categories of personal data collected, purposes and retention periods

The personal data collected by GWP on the Website is described below, together with its purposes and retention periods.

Identification data

Nature. This data is collected when you register and use the service (for example: surname, first name, address, postcode, town, country, e-mail) and, where applicable, when you exercise a right (for example: withdrawal) or in the context of exchanges with customer service.

Purposes and legal basis. It is processed to enable the creation and management of the user account, the performance of the subscription, the management of the customer relationship, communication relating to the service (operation, follow-up, reminders relating to subscription payment), as well as the handling of requests and claims. Depending on the case, these processing activities are based on the performance of the contract, on GWP's legitimate interest in ensuring the operation and security of the service, or on compliance with legal obligations.

Retention period. Data linked to an active account is kept for the entire duration of the contractual relationship. Once this relationship has ended, certain strictly necessary data may be placed in intermediate archiving for evidential or dispute management purposes, for a period of up to five years, after which it is deleted or anonymised. Documents and information subject to a legal retention obligation (in particular accounting) are kept for the applicable legal period.

Payment data

Nature. Payments are processed by specialised and secure providers. GWP does not collect or store the full bank card number or the security code. Where necessary for the management of recurring payments, GWP only retains a technical payment identifier (token) provided by the payment service provider.

Purposes and legal basis. This data is used to enable the performance of the contract (subscription payment, management of recurring payments) and the securing of transactions, in particular for fraud prevention purposes. These processing activities are based on the performance of the contract and, where applicable, on GWP's legitimate interest in securing the service.

Retention period. Technical payment identifiers (tokens) are kept for the period necessary for the management of payments and, in any event, for a maximum period of thirteen months from the date of the last associated transaction, in particular to allow the management of any disputes or payment operations. After this period, the tokens are deleted, except where longer retention is strictly necessary to establish a right or to comply with a legal obligation. Information necessary for accounting and proof of transactions (for example transaction references, amounts, dates) may be kept for the applicable legal period.

Navigation data of Website visitors

Nature. Technical data may be collected through connection data (logs) generated by the Website's web server.

Purposes and legal basis. This data is processed for security, incident detection and unauthorised access prevention purposes, on the basis of GWP's legitimate interest in protecting the Website and its users.

Retention period. Connection data is kept for security purposes for a period of 24 hours and is intended for the IT services responsible for ensuring the security of the Website.

Data resulting from cookies and other trackers

Nature, purposes and retention period. Data may be collected and processed through cookies and other trackers, where applicable with your consent when required. The purposes, recipients and retention periods applicable to cookies are detailed in the Website's Cookie Policy.

Your rights

In accordance with the applicable regulations, you have the right to access, rectify and erase personal data concerning you, as well as the right to data portability. You also have the right to restrict processing, the right to object and, where processing is based on your consent, the right to withdraw it at any time.

You may exercise these rights by writing to contact@exclusivesandbenefits.co.uk or to the following address: GWP S.A., 62 Avenue de la Liberté L-1930 Luxembourg. A response will be provided within a maximum period of one month from the receipt of your request (this period may be extended under the conditions provided for by the regulations).

You also have the right to lodge a complaint with the competent supervisory authority, in particular the Information Commissioner's Office (ICO) in the United Kingdom or the CNPD in Luxembourg.

Policy updates

This policy may be amended at any time to ensure its compliance with legal and regulatory developments.