Privacy policy

The protection of personal data is governed in particular by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, also known as the General Data Protection Regulation (hereinafter the “GDPR”) and by Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended, known as the “Data Protection Law” (hereinafter the “Law No. 78-17”).

As part of its business activities, Réseau DEF, a simplified joint-stock company with a share capital of 20,976,137.80 euros, whose registered office is located at 7 rue du Saule Trapu, Parc d’Activités du Moulin de Massy – 91300 Massy, registered with the Evry Trade and Companies Register under number 340 087 576, and all its entities within the meaning of Article L. 233-1 of the French Commercial Code (hereinafter “DEF”), they collect and process, on their own behalf, personal data relating to their customers, prospects, subcontractors, job applicants, service providers or various partners (hereinafter collectively referred to as “Customers”).

DEF does, in fact, collect personal data when Customers use and interact with the products and services it offers and/or in the course of its business.
In addition to the GDPR and Law No. 78-17, DEF undertakes to comply with this privacy policy (hereinafter the “Privacy Policy”) in relation to all processing of personal data that it carries out.

Definitions

For the purposes of this Privacy Policy, each of the terms listed above and below that begins with a capital letter shall have the meaning set forth below, whether used in the singular or plural:

– “Recipient”: means the natural or legal person, public authority, agency, or any other body to which personal data is disclosed, whether or not it is a third party;
– “Personal data”: means personal data as defined in Article 4 of the GDPR, i.e., any information relating to an identified or identifiable individual, directly or indirectly, by one or more factors specific to that individual;
– “Data Subject”: means the natural person whose Personal Data is collected and processed;
– “Data controller”: means the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing;
– “Data Processor”: means the natural or legal person who processes personal data on behalf of the data controller;
– “Processing”: means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.”

Purpose

The purpose of this Privacy Policy is to clearly inform all Customers about the Personal Data that DEF collects and processes, how it uses that data, the categories of personal data collected, the reasons for collecting it, how long it is retained, the parties to whom it may be disclosed, the rights of Customers as Data Subjects, contact details in case of questions or complaints, and the protective measures it implements.
The Privacy Policy applies solely to the processing of personal data in respect of which DEF acts as the Data controller. In this context, the Processing of Personal Data may be carried out directly by DEF or through a Data Processor specifically appointed by it.

Compliance with the GDPR

DEF does not process any personal data unless it complies with the general principles of the GDPR.
Any new Processing activity, or any modification or deletion of an existing Processing activity, will be communicated to Customers through an amendment to this Privacy Policy.

Legal basis for the Processing carried out by DEF

In accordance with the applicable legislation on the protection of Personal Data, the processing of Personal Data carried out by DEF is based on one of the legal grounds set out below.

Performance of the contract

To access DEF’s products and services and/or in connection with its business, Customers may be required to enter into a contract related to such business.
This contract formalises a contractual relationship between each Customer and DEF.
The Personal Data collected and processed by DEF in this context is necessary for the performance of these contracts, the purposes of which are specified below.

Customer consent

When Customers browse a website published by Réseau DEF, Réseau DEF may read and/or write cookies to their device (e.g., computer, cell phone).
Before placing cookies on the Customer’s device, DEF obtains the Customer’s consent via a “cookie banner.”
DEF also processes the Customer’s Personal Data, provided that the Customer has completed an electronic data collection form in order to participate in an event organised by DEF and/or has registered for or subscribed to services made available online by DEF (e.g., website, social media, YouTube channel).
Customers are informed on each form used to collect personal data as to whether responses are mandatory or optional by the presence of an asterisk.
Where answers are mandatory, DEF explains to Customers the consequences of failing to provide a response.

Compliance with a legal obligation to which DEF is subject

DEF’s processing of the Customer’s Personal Data may be required by a legal obligation to which it is subject.

DEF’s legitimate interest

DEF may have a legitimate interest that entitles it to collect and process the Personal Data of Customers who visit a website published by the Réseau DEF (e.g., conducting marketing campaigns targeting its prospects).
In this context, DEF ensures that the processing carried out is necessary to pursue its legitimate interest and that it does not infringe upon the fundamental rights and interests of its Customers.

Categories of Personal Data processed by DEF

The Personal Data that DEF collects and processes in the course of its activities are as follows:

NON-TECHNICAL DATA (depending on use case):

(i) Identification: surname, first name, title, role, pseudonym, social media username;
(ii) Contact details: Telephone number, email address, postal address, fax number, etc.;
(iii) Photographs: where you grant us this right (usually taken during events or interviews at our events);
(iv) Professional background: occupation, degrees, work experience, the company the Customer works for, etc.;
(v) Bank details, if required;

DEF collects and processes the Customer’s personal data relating to their browsing and behaviour on a website published by Réseau DEF.
The personal data collected and processed in this context are as follows:

TECHNICAL DATA (depending on use case)

(i) Identifying information (IP addresses)
(ii) Connection data (including logs)
(iii) Consent data (click) primarily relating to access to DEF services (Sentinel, etc.)

DEF does not process sensitive data within the meaning of Article 9 of the GDPR (personal data revealing racial or ethnic origin, philosophical, political, trade union or religious views, or data concerning sex life or health).

Purposes of the Data Processing carried out by DEF

DEF’s processing of the Customer’s personal data is necessary to enable DEF to fulfil the following purposes:

Processing carried out for the purposes of DEF’s business activities:

(i) Case handling;
(ii) Customer relationship management;
(iii) Improving website navigation;
(iv) Answers to questions put to it (by telephone or online);
(v) Responses to public or private calls for tenders;
(vi) Personalised sales support;
(vii) Improving its services;
(viii) Creation of an account by Customers on the Sentinel platform;
(ix) Processing of payments for the Customers in question.

Data processing carried out for the purpose of sending the newsletter and marketing campaigns:

(i) Management of events organised by DEF (conferences, breakfast meetings, etc.);
(ii) Sending newsletters or news feeds; the Customer may unsubscribe at any time from any marketing communications by clicking on the unsubscribe link at the end of the text;
(iii) Compiling statistics and conducting marketing analyses;
(iv) Communication with a Customer who fills out a contact form on a website published by Réseau DEF;
(v) Creation of a database of customers and prospects;
(vi) Notifying Customers in the event of changes to the services offered by a website published by Réseau DEF.

Processing carried out for the purpose of managing applications:
The processing of Personal Data of Customers covered by DEF is necessary if the Customer accesses the job application service on a website published by Réseau DEF:

(i) Receipt of applications;
(ii) Hiring a candidate.

Processing carried out for the purpose of rights management:

(i) Preventing and combating fraud in connection with payments made by a concerned Customer;
(ii) Litigation management;
(iii) To comply with an administrative and/or legal obligation or in connection with legal proceedings or a dispute;
(iv) Handling requests from Data Subjects to exercise their rights, as listed below.

Recipients of Personal Data

All personal data collected and processed by DEF is strictly confidential.
DEF undertakes not to disclose its Customers’ Personal Data to any third party that might use it for its own purposes, without the Customers’ express consent.
DEF ensures that Personal Data is accessible only to authorised internal or external Recipients, when necessary to enable them to fulfil the aforementioned purposes exclusively.

Internal recipients:

(i) The team responsible for the website published by Réseau DEF and, where applicable, the team responsible for handling a Customer’s request, and the GDPR Committee.

Internal recipients at DEF are trained and authorised to process Personal Data. They are bound by a duty of confidentiality with respect to this data.

External recipients:
DEF may temporarily and securely transfer certain Customers’ Personal Data, when necessary, to the following Recipients:

(i) Service providers, partners, or support services with which DEF has entered into contracts (subcontractors, various service providers, service providers responsible for the operation and maintenance of a website published by Réseau DEF, partners with whom DEF has entered into contracts to enable the performance of the contracts it has concluded with Customers, partners with whom DEF has entered into contracts to enable the management of its relationships with customers and prospects, etc.);
(ii) Certain regulated professionals, such as: lawyers, experts, certified public accountants, auditors, agents, bailiffs, etc.;
(iii) Judicial bodies;
(iv) Administrative and judicial authorities.

Where the relevant Recipient is located outside the European Union, or in a country that does not have adequate safeguards within the meaning of the GDPR, DEF governs its contractual relationship with that third party by putting in place appropriate contractual arrangements.
It should be noted that DEF may be required to disclose its Customers’ Personal Data in order to comply with a legal order from the relevant authorities.

Retention period

The Customer’s Personal Data is retained for a period of three (3) years from the date of the last contact with and/or from the Customer.
Audience measurement statistics are not kept for longer than thirteen (13) months.
However, once the aforementioned periods have expired – including, where necessary, from the date of the Customer’s request for deletion – such Personal Data may be subject to interim archiving so that DEF can fulfil its statutory retention obligations:

(i) a contract entered into as part of a business relationship will be retained for five (5) years;
(ii) a contract entered into electronically with a consumer for an amount of 120 euros or more shall be retained for ten (10) years from the date of delivery or performance;
(iii) banking records will be retained for five (5) years;
(iv) documents relating to order management shall be retained for ten (10) years;
(v) documents relating to the management of invoicing shall be retained for ten (10) years.

Certain personal data may be retained beyond the specified retention periods (i) in the event of legal proceedings, in order to establish the facts of the case; and/or (ii) for the purposes of investigating, establishing and prosecuting criminal offences, solely to enable such data to be made available to the judicial authorities where necessary.
Archiving involves anonymising this personal data so that it can no longer be accessed online, but is instead extracted and stored on a separate, secure medium.
Once the periods set forth in this Privacy Policy have expired, Personal Data is deleted.

Rights of Data Subjects

Customers have the right to access, amend, object to, restrict, request the portability of, and rectify their data; to set out instructions regarding the handling of their data following their death; and to have their personal data erased, subject to compliance with the following rules:

(i) the request is made by the Data Subject and is accompanied by a copy of a valid identity document;
(ii) the request must be made in writing to the following address: rgpd@reseau-def.com

In accordance with the right to data portability, Customers are entitled to request a copy of their Personal Data that is being Processed. The information requested will be provided in electronic form, unless expressly requested otherwise.
Customers are informed that these rights may never relate to information or data that is confidential or for which communication is not authorised by law. Under no circumstances may these rights allow access to documents subject to the Military Secret.
The right to have Customers’ Personal Data erased shall not apply in cases where the Processing is carried out to comply with a legal obligation.
The Customer may, at any time, file a complaint with the competent supervisory authority, which in France is the Commission Nationale de l’Informatique et des Libertés (CNIL): cnil.fr.

Use of subcontractors

DEF hereby informs its Customers that it may engage data processors in connection with the processing of their personal data. A data processor means any natural or legal person who processes Personal Data on behalf of DEF.
In such cases, DEF ensures that the data processor complies with its obligations under the GDPR.
DEF undertakes to enter into a written contract with all its processors and to impose on them the same data protection obligations as those it itself adheres to. Furthermore, DEF reserves the right to carry out an audit of its data processors to ensure compliance with the provisions of the GDPR.

Safety

It is DEF’s responsibility to define and implement the technical and organisational measures it deems appropriate to prevent the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data.
The main measures include:

(i) Measures to secure its information systems—including networks, workstations, mobile devices, and data—such as implementing security measures for access to the premises (locking offices, access badges, etc.), secure access to computers and smartphones (passwords changed regularly), the implementation of usernames and passwords for all business applications, and the management of access permissions for personal data (with specific requirements for the finance, accounting, and communications departments), the use of VPNs for remote connections, and the use of a complex Wi-Fi password that is changed monthly;
(ii) Measures to ensure the confidentiality, integrity, availability, and resilience of processing systems and services, including by engaging processors that provide sufficient safeguards;
(iii) Measures to restore the availability of and access to Personal Data within a reasonable timeframe in the event of a physical or technical incident affecting any data in DEF’s possession;
(iv) Any procedure designed to regularly test, analyse, and assess the effectiveness of technical and organisational measures, in particular through monitoring and alert tools that directly contact the DEF development team in the event of a failure;
(v) Training and awareness-raising initiatives for its employees.

DEF has implemented and maintains technical and organisational measures that are state-of-the-art and appropriate to ensure the protection and security of the Processing and of Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, the purposes of the Processing, as well as the potential risks associated with failing to implement these technical and organisational measures.
To ensure the security of Personal Data and, in particular, to prevent any accidental or unlawful distortion, alteration, damage, destruction, loss, disclosure, and/or access by unauthorised third parties, DEF regularly monitors the compliance with and implementation of these technical and organisational measures.

DEF reserves the right to modify these technical and organisational measures, particularly in light of advances in the state of the art within its industry. Any such change will result in an update to this Privacy Policy. The new technical and organisational measures will maintain an increased or comparable level of security.
To assess the appropriate level of security, DEF takes into account the risks associated with the Processing, resulting in particular from the accidental or unlawful destruction, loss, alteration, disclosure, or unauthorised access to Personal Data that is transmitted, stored, or processed.

Cookies

DEF has a cookie policy, which can be accessed here:
[https://www.defonline.com/politique-de-cookies/]

Statistical use of anonymous data

As part of its business operations, DEF collects, processes, and stores statistical data regarding website usage and customer activities.
This usage data, which may be shared with third parties, is anonymous and does not allow Customers to be identified, even indirectly.

Record of processing activities

DEF maintains a register of personal data processing operations, which it makes available to the French Data Protection Authority (CNIL).

Data transfers outside the European Union

The company makes every effort to ensure that no transfer of personal data outside the European Union takes place.
However, when the company is required to disclose Customers’ Personal Data to third parties located outside the European Economic Area, in a country that does not have adequate safeguards within the meaning of the GDPR, the company governs its relationship with that third party by implementing appropriate contractual safeguards and ensures that such transfer complies with the level of protection required within the European Union.

Evolution

This Privacy Policy may be amended or modified at any time in the event of changes in the law, case law, or the decisions and recommendations of the European Commission, in particular.
DEF reserves the right to make any changes to the Privacy Policy at any time that it deems necessary and appropriate.
Any new version of this Privacy Policy will be brought to the attention of Customers by any means chosen by DEF, including electronic means (for example, by email or online).
The Privacy Policy will also be available to the Customer on the websites published by Réseau DEF.

Information

For any further information, please contact our GDPR Committee at the following email address: rgpd@reseau-def.com