Privacy policy

This policy explains what personal data CHANGE MIRAMAR collects on the website www.change-or-argent.com, why, how long it is kept and how to exercise your rights. It applies in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (“Informatique et Libertés”) of 6 January 1978 as amended.

1. Data controller

CHANGE MIRAMAR SARL, 57 Bd de La Croisette, 06400 Cannes, registered with the RCS de Cannes under number 404 706 095, authorised bureau de change. For any question regarding your data: contact@change-or-argent.com, or by post to the address above.

2. Data collected

• Online order: surname, first name, email address, telephone number, collection branch or delivery address, contents and amount of the order, bank transfer reference, prices and rates applied, history of the order’s statuses.
• Supporting documents: a copy of your identity document and of a proof of address (see Article 6).
• Communications: the messages you send us by email, telephone or SMS, and our replies.
• Technical data: as with any website, our hosting provider records the IP address, the date and the page requested in technical logs kept for the security of the service.

The website has no password-protected customer account, no comment form, no audience measurement tool and no targeted advertising.

3. Purposes and legal bases

• Processing your order (preparation, payment by bank transfer, handover at a branch or delivery, follow-up, confirmation and information messages by email and SMS): performance of the contract.
• Verifying your identity and complying with our obligations to combat money laundering and terrorist financing: legal obligation (Articles L561-1 et seq. of the French Monetary and Financial Code).
• Keeping our accounts and retaining supporting documents: legal obligation.
• Ensuring the security of the website, preventing fraud and keeping a record of the operations carried out on orders: legitimate interest of CHANGE MIRAMAR.
• Responding to your requests: legitimate interest, or pre-contractual measures if your request precedes an order.

Your contact details are never used for marketing purposes without your consent, and are neither sold nor rented.

4. Recipients

Your data is accessible only to authorised CHANGE MIRAMAR staff, according to their duties. It is also processed, on our behalf and on our instructions, by the following technical service providers:

• Vercel Inc. (United States): website hosting;
• Supabase Inc.: hosting of the order database and of the storage space for supporting documents, located in the European Union;
• Brevo (Sendinblue SAS, France): sending of the emails and SMS relating to your order;
• Microsoft (Microsoft 365): the company’s email system.

Finally, it may be disclosed to the competent authorities where required by law (in particular Tracfin, the Prudential Supervision and Resolution Authority (ACPR), the tax authorities or the judicial authorities).

5. Transfers outside the European Union

Some of our service providers are companies established in the United States or belonging to American groups. Where data is transferred or accessible outside the European Union, the transfer is governed by the EU–US Data Privacy Framework where the provider participates in it, or by the standard contractual clauses adopted by the European Commission.

6. Proof of identity and address

For every online order, whatever its amount, we ask for a copy of your identity document (identity card, front and back, or passport) and proof of address dated within the last three months. These documents enable us to verify your identity, as the law requires of bureaux de change (changeurs manuels) for the purposes of combating money laundering and terrorist financing (Articles L561-5 et seq. of the Monetary and Financial Code (Code monétaire et financier)). They are not used for any other purpose.

In accordance with Article L561-12 of the Monetary and Financial Code, these documents are kept for five years from the closure of your order, then deleted automatically. During this period, your right to erasure cannot be exercised over these documents, as the law requires us to keep them; your other rights (access, rectification, restriction) remain applicable.

The documents are stored in a private, encrypted space hosted in the European Union, accessible only to authorised CHANGE MIRAMAR staff. Every upload and every consultation is recorded in a log. They are not passed on to any commercial third party and may only be disclosed to the authorised authorities, in the cases provided for by law.

7. Retention periods

• Order and billing data: ten years from the end of the financial year, under accounting obligations (Article L123-22 of the French Commercial Code).
• Identity documents and proofs of address: five years from the closing of the order, then automatic deletion (Article 6).
• Exchanges by email, telephone or SMS with no order: three years from the last contact.
• Hosting provider’s technical logs: a few weeks at most, depending on the hosting provider’s configuration.

8. Cookies

The website uses only cookies that are strictly necessary for its operation, which do not require your consent:

• a “basket” cookie, which remembers the products or currency chosen for seven days;
• a session cookie, reserved for the CHANGE MIRAMAR staff management area.

No advertising or audience measurement cookies are set. To display fonts and currency flags, your browser contacts the servers of Google Fonts and flagcdn.com, which receive your IP address in the process; these services do not set cookies.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing and objection and, for the data you have provided to us, the right to data portability. You may also set out instructions regarding what happens to your data after your death. These rights are exercised within the limits provided by law: in particular, data that we must keep under our legal obligations (accounting, combating money laundering) cannot be erased before the end of its retention period.

To exercise your rights, write to contact@change-or-argent.com or to CHANGE MIRAMAR, 57 Bd de La Croisette, 06400 Cannes. We may ask you to prove your identity. We reply within one month, which may be extended by two months if the request is complex.

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

10. Security

Exchanges with the website are encrypted (HTTPS). Order data and supporting documents are stored in private areas, accessible only to authorised persons after authentication; every viewing of a supporting document and every change to an order is recorded in a log.

11. Third-party websites

The website may contain links to other websites (social networks, consumer mediator, information websites). These websites have their own privacy policies, over which CHANGE MIRAMAR has no control; a link to a social network does not transmit any data to that network unless you click on it.

12. Changes to this policy

This policy may be amended, in particular to take account of changes to the website or to regulations. The date of the last update appears at the top of the page.