Last updates: August 30, 2023
This Privacy Policy (the “Policy“) describes our practices for the collection and processing of your personal data when you access our website (at claranova.com) (the “Site“), and that you interact with any of the services, features or forms that we make available to you via the Site (the “Services“).
We invite you to read this Policy carefully to ensure that you understand it. Please do not hesitate to contact us if you have any doubts or questions, at dpo@claranova.com.
We have prepared two separate documents to inform you as fully as possible about how we collect, use and protect your personal data as part of our various services:
– this policy dedicated to data collected via our Website and Services;
– a document specific to the cookies we use on our Site (the cookie management policy).
WHO ARE WE ?
We are Claranova, located at Immeuble Adamas 2 rue Berthelot 92400 Courbevoie, France. You can contact us by mail at the above postal address, by email at ceo@claranova.com or by telephone on +33 1 41 27 19 74 .
Unless otherwise stated, we are responsible for the processing of personal data necessary for the execution of our Services.
CATEGORIES OF PERSONAL DATA PROCESSED
“Personal Data” means any information that identifies you as a natural person or that may be used, alone or in combination with others, to personally identify you as a natural person.
This information may include, for example, surname and first name, email address, telephone number, personal address or other physical address and other contact details. In addition, in certain jurisdictions (the European Union, for example), and given the specific use we make of information, an IP address, a device identifier and cookies may also be considered Personal Data.
With respect to the Services we offer, this data may include the following categories of personal data:
• Your identification data such as your first and last name(s), email address or telephone number;
• The content of the messages you send to us;
• Data concerning the use of the Site and the Services.
PURPOSES AND LEGAL BASIS OF PROCESSING
When you use the Services, your personal data may be collected and processed for the following purposes and on the following legal grounds:
1. Information You Provide to Us
a) Shareholder Club: We may offer you to join, subject to conditions, our Shareholders’ Club. In such a case, you will be asked to provide information such as your email address, full name and other Personal Data, via a dedicated form. We will process this information on the basis of the performance of a contract concluded at your request (club membership).
b) Registration for our newsletter (press releases, etc.): Where appropriate, we may offer you to sign up for our newsletters, by providing us with your email address, which we will process on the basis of your consent. You can unsubscribe at any time via the option provided for this purpose in the body of emails sent to you, or by contacting our data protection officer at dpo@claranova.com.
c) Contact/support. When you choose to contact us, we may need to process the details and content of your request, including your contact details, in order to respond to your request. If you contact us for assistance, feedback or other requests, whether via the online form, by sending us an e-mail, via a telephone call or message or by any other means of communication we make available to you, you will need to provide us with your name, e-mail or telephone address (and other contact details if necessary, depending on how you wish to be contacted) and the subject of your request. We will process this information on the basis of our legitimate interest in providing you with a response to your request.
d) Whistleblower Service : We offer a whistleblower service to enable confidential reporting of any unethical or illegal activities. This service is provided by an external software provider, ensuring the highest level of confidentiality and security for whistleblowers. The personal data collected through this service, including identification and contact information, as well as details of the report, will be processed strictly for the purpose of investigating and addressing the reported issues. This data may be shared with internal departments responsible for compliance and legal affairs and with external authorities if necessary. We ensure that our whistleblower software provider adheres to stringent data protection standards and complies with applicable data protection laws, including the use of standard contractual clauses approved by the European Commission for data transfers outside the European Economic Area (EEA). Your rights regarding access, rectification, and deletion of your data apply equally to the information provided through this service. For any questions or concerns about the whistleblower service, please contact us at dpo@claranova.com.
2. Information Collected About Your Use of the Services
a) Cookies: we may collect information about your use of our Services. This information includes your general activity on the Site and is often used for measurement, analysis and statistical purposes.
In addition, subject to your prior consent, certain services provided by our partners may be required to collect anonymous information about your interactions with the Site. These partners may use this information to provide and display advertisements and offers specific to the Site and/or content and services offered through the Site (“Advertisings”) when you browse other websites (“Retargeting”). You will have the option at any time to opt out of this type of advertising, directly from the ad when you meet it, from the ad setting of services provided by third parties or by following our opt-out instructions, available in our cookie policy.
This information is collected by cookies and we invite you to consult our dedicated policy to find out more (cookie management policy) which details all the useful information in this regard.
b) Log files: We collect information through server log files but also by deploying tracking technologies on the Site, for example invisible pixels. This enables us to analyse trends but also to monitor user engagement and their interactions with the Website and the Services concerned. The information collected may include IP addresses allocated to your devices by your Internet service provider. We retain these addresses for a limited period of time and for special purposes, including to better identify your geographical location (country, region and language) and therefore be able to provide the Services to you in your language and adapted to your home location. In addition, we use automated tools to analyse IP addresses and mark those that are fraudulent (“Fight against Fraud”). All of this processing is carried out on the legal basis of our legitimate interest.
RECIPIENTS OF INFORMATION
In some cases, we may share Personal Data, in the following situations and for the following purposes:
1. Internal Services
Internally, access to your personal data is reserved only to those persons whose duties require it. This access is restricted only to the data necessary for the objective pursued. This may include our commercial and marketing services, our technical department, our legal department or the departments responsible for control.
2. Subcontractors
We use services that enable the operation of our technical support (ticket creation, analytics services, etc.) or third party storage services (including cloud storage) to store and store information about you. This means that we send or disclose this information to third parties based in the UK and France, to store it for us or for other processing. These providers may be based (and their servers may be installed) anywhere in the world. In this case, be assured that they are bound by specific rules and measures to ensure the appropriate level of security for the protection of your personal data. This means that we will base our transfers on the basis of applicable regulations (standard contractual clauses approved by the European Commission in our contracts with third parties outside the EEA, transfer to protection countries recognised as adequate by the European Commission, etc.). We require each of our vendors to enforce strict privacy and data security policies and strict compliance with applicable data protection legislation.
3. Legal Action or Legal Requirement
We may share your personal data with a third party if we deem it useful or reasonably necessary to: a) comply with any applicable law, regulation, legal process or governmental request; (b) detect, prevent or manage fraud or security issues; and/or c) protect against any infringement of our rights, property or security, our affiliated entities, our users, yourself and/or the public.
4. Merger, Sale or Bankruptcy
In the event that our company or one of our affiliated entities is acquired by or merged with a third party entity, or sells all or part of its assets, we may transfer or assign the personal data and other information we have collected or received. In such a case, we will require the buyer to publish its data practices and allow you to exercise your rights, as provided by the jurisdiction of your place of residence.
RETENTION PERIOD
Your Personal Data will be kept for as long as necessary for the purposes described above, in accordance with the legislation in force.
Once the data is no longer used to achieve the purpose of its collection, it may need to be kept under legal or regulatory obligations or have an administrative interest (for example, to serve as evidence in a possible dispute). In these cases, the data is kept in “intermediate archiving”, i.e. it can only be consulted on an ad hoc basis and motivated by specifically authorised persons.
If you are registered with the Club of Shareholders, your identification data is stored until you request to unsubscribe. Once you have unsubscribed, we keep your data in intermediate archiving for a period of 5 years pursuant to the civil limitation period.
Regarding the sending of our newsletters, we will keep your email address for this purpose until your request to unsubscribe from the mailing list. It is then retained for 6 years in intermediate archiving in accordance with the criminal limitation period.
When you contact us for a request for information, we retain the information you have provided to us for as long as necessary to respond to your request. They are then archived according to the applicable limitation period, which may vary depending on the subject of your request.
For connection data (IP address, connection date and time, pages viewed), they are kept for a maximum period of one year.
YOUR RIGHTS
Providing us with information about you for the uses described in this Privacy Policy or via the Services is a personal choice. Please note, however, that we will not be able to provide you with most of the Services if you do not provide us with the information required to process it and validate your identity.
You may decide at any time to exercise your rights in relation to your personal data and under the jurisdiction of your place of residence. These rights are:
1. Your right to be informed: You can ask whether we have collected personal data about you and how we use it.
2. Your right to access information about you: You have the right to receive information related to the processing of your personal data. In particular, you may request a copy of the personal data we have about you, inform you about the use we make of this information, the source that has communicated it to us and its recipients.
3. Your right to rectification: You have the right to obtain the rectification of your personal data, if it is inaccurate or incomplete.
4. Your right to erasure: You have the right to have your personal data erased, if one of the conditions of Article 17 of the GDPR is met (for example: if your personal data is no longer necessary for the purposes for which it was collected, if you decide to withdraw your consent to the processing – if this constitutes the legal basis – and there is no other legal basis for the processing itself, if you dispute the processing and no other legitimate interest of the controller prevails, if your personal data is processed unlawfully)
5. Your right to restriction of processing: You have the right to obtain the limitation of the processing of personal data relating to you 1) for the time necessary to verify the accuracy of your personal data (if you have disputed it), or 2) if the processing of personal data is unlawful and you request the restriction of the processing of your personal data instead of their erasure, or 3) when we no longer need your personal data, but these are necessary for you to verify, exercise or defend legal claims, or, finally, 4) for the time necessary to assess whether the legitimate grounds of the data controller may override yours, if you have objected to the processing of your personal data.
6. Your right to portability: For processing based on your consent or on the performance of a contract to which you are a party, you may ask us to provide you with a copy of the information we have collected in a machine-readable format, so that you can communicate it to another service provider.
7. Withdrawal/Opposition: You may object, for legitimate reasons, to the processing of your personal data and in particular that it is no longer used for commercial prospecting purposes. In particular, any message we send to you by email (promotional, advertising, or website-related) will include a opt-out/unsubscribe option that you can exercise directly from the message received. Please note that you can also unsubscribe from email communications that you receive or simply send us an email about this. We may keep your account and customer information and contact you for updates.
8. Provide guidelines for the storage, erasure and disclosure of your personal data after your death.
To exercise your rights, you can:
– write to us at: Claranova SE, Immeuble Adamas 2 rue Berthelot 92400 Courbevoie, France;
– or contact us by email at dpo@claranova.com.
We may ask you for additional information, including proof of identity.
If you are not satisfied with our response, you may contact the Commission Nationale Informatique et Liberté (CNIL) directly at the following address https://www.cnil.fr/fr/vous-souhaitez-contacter-la-cnil.
INFORMATION SECURITY
Regarding data security, we implement systems and procedures to secure information transmitted, processed and stored on the Site, our servers and IT systems. We periodically review our information and data collection practices to ensure ongoing monitoring, we use third party provision and processing services that implement various information security standards and certifications and monitor and screen access to data when our organisation’s personnel are concerned. These systems and procedures reduce the risk of security breaches but do not ensure absolute security, which does not exist at the global network level. Therefore, we cannot guarantee that the Website and our servers are protected from unauthorized access to information stored on it and other risks to information security. If you have any questions about the security of the Website, you can contact us using the contact details set out above.
TRANSFER OF INFORMATION
We may transfer information about you (including your personal data) outside the country where it was collected or your country of residence (for example to the UK or the United States), including to a country that does not offer the same level of protection for Personal Data as your country of residence. In this case, be assured that they are bound by specific rules and measures to ensure the appropriate level of security for the protection of your personal data. This means that we will base our transfers on the basis of applicable regulations (standard contractual clauses approved by the European Commission in our contracts with third parties outside the European Economic Area (EEA), transfer to countries with protection recognised as adequate by the European Commission, etc.).
CHANGES TO THE PRIVACY POLICY
We may, from time to time, modify, add or delete provisions of this Privacy Policy.
In the event of a major change, we will make sure to notify you in a more visible manner, for example by posting a notice on the Site or by sending you an email. We strongly invite you to return to this webpage and check this Privacy Policy regularly.
ANY QUESTIONS?
If you have any questions about this Privacy Policy, please contact us at dpo@claranova.com.
USE OF COOKIES
We remind you that it is in our dedicated Cookie Management Policy that you will find details of your rights to your personal data and their management as part of the functionalities of our site and its operating method.