Policy on personal data of clients/ contacts of the Occitanie LTRC
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in the handling of personal data and on the free movement of such data otherwise known as the General Data Protection Regulation (hereinafter referred to as the GDPR) sets the legal framework applicable to the processing of personal data. GDPR strengthens rights and obligations of Data Controllers, Processors, Data Subjects and Data Recipients. As part of our business, we process personal data. To help understand this policy, please refer to the following points:
Article 12 of the GDPR requires that data subjects be informed of their rights in a concise, transparent, comprehensible and easily accessible manner.
To meet its operational requirements, the Occitania LTRC is required to implement and use personal data processing relating to Prospective Customers and contacts. The purpose of this policy is to comply with the obligation to inform imposed on Occitania LTRC in application of the GDPR (Article 12) and to formalise the rights and obligations of its prospects and contacts in relation to the processing of their personal data.
This policy applies to all processing of personal data pertaining to Prospective Customers and Contacts of the Occitanie LTRC. The Occitanie LTRC endeavours to ensure that data is processed within the framework of precise internal governance. This being said, this policy only covers processing activities where the Occitanie LTRC acts as Data Controller and does not cover processing activities outside of the governance rules set by the Occitanie LTRC (known as shadow IT processing). Personal data may be processed directly by the Occitanie LTRC or by a processor specifically designated by the Occitanie LTRC. This policy stands alone of any other document which may apply as part of the contractual relationship between the Occitanie LTRC and Prospective Customers.
No processing is carried out within the Occitanie LTRC relating to Prospective Customer and Contact data unless it relates to personal data collected through or in relation to our services and unless it meets the general principles of the GDPR.
For ease of understanding this policy, the following are instances of data use by the Occitanie LTRC:
Any recreational activity whether or not intended to provide a prize to potential customers of the Occitanie LTRC. These competitions may be conducted online or offline directly by the Occitanie LTRC or indirectly by its partners. As a rule, only the data required to identify participants and to award prizes or awards will be collected.
All promotional and commercial activities and commercial follow-up.
Prospecting, usually by e-mail, SMS, telephone, etc.
Physical events held by the Occitanie LTRC - either as a participant or as a sponsor of the LTRC.
Data is generally collected prior to the event itself (competition etc.) when registering for the event directly or via a partner, or during the event itself (questionnaire, business card, dedicated mobile applications, etc.).
All social selling operations. These notably include the collection of data linked to registrations, posts, likes, replies and forwards, comments, opinions, etc. .
We use various cookies on the site to improve the site's usability and our services A so-called "cookie" is a piece of information, usually small in size and identified by a name, that may be sent to your browser by a website you are visiting. Your web browser will store it for a period of time and send it back to the web server each time you log on again. Cookies serve several purposes: they can be used to store your customer ID on a merchant site, the current contents of your shopping cart, an ID that allows us to track your browsing behaviour for statistical or advertising purposes, etc.
See also the paragraph dedicated to cookies on the legal notice page.
The contact directory of the Occitanie LTRC refers to all its legal partners and explicitly mentions one or more natural persons as contact persons.
This list is intended to be as complete as possible. Any new use case, modification or deletion of an existing processing operation shall be brought to the attention of Prospective Customers and Contacts through an amendment to this Policy.
Data relating to our Prospective Customers and Contacts may be collected directly from them (direct collection).
It may also be collected indirectly via specialised companies or via the LTRC's partners and suppliers. In such cases, the Occitanie LTRC takes the greatest care to ensure the quality of the data communicated to it.
Depending on the case, the Occitanie LTRC processes your data for the following purposes:
These purposes rest on the legitimate interest of the Occitanie LTRC to have data on its users and prospects.
Where necessary, the Occitanie LTRC obtains the consent of the Data Subjects (for example: newsletter).
The Occitanie LTRC takes steps to ensure that data is only accessible to authorised internal or external recipients.
Recipients of personal data of Prospective Customers and Contacts within the Occitanie LTRC are subject to an obligation of confidentiality.
The Occitania LTRC decides which recipient has access to which data in accordance with an authorisation policy.
All accesses concerning the processing of Prospective Customer and Contact personal data are subject to a traceability measure.
Furthermore, personal data may be disclosed to any public authority entitled by law to become acquainted therewith. In such cases, the Occitanie LTRC shall not be held liable for the terms under which the staff of such authorities access and use such data.
The duration of data retention shall be determined by the Occitanie LTRC, taking into account the legal and contractual constraints and, failing that, according to its needs and, in particular, according to the following principles:
Throughout the duration of the contractual relationship between the Occitanie LTRC and its partner, data relating to a contact is deleted if the contact in question is no longer part of the partner's structure.
3 years from the date of their collection by the Occitanie LTRC or from the last contact from the prospect/contact which takes the form of the last click made by the prospect/contact or the opening of an email sent by the Occitanie LTRC.
26 months from the date of collection
After the set time limits, the data is either deleted or kept after being anonymised, notably for statistical purposes. They may be kept in the event of pre-litigation and litigation.
Prospective Customers and Contacts are reminded that deletion or anonymisation are irreversible operations and that the Occitanie LTRC is no longer able to restore them.
Prospective Customers and Contacts have the right to ask the Occitanie LTRC for confirmation as to whether or not data concerning them are being processed.
Prospective Customers and Contacts also have a right of access, the latter being conditional on compliance with the following rules:
If Prospective Customers and Contacts submit their request for a copy of the data by electronic means, the information requested will be provided to them in a commonly used electronic form, unless otherwise requested.
Prospective Customers are informed that this right of access may not relate to confidential information or data, or to information which the law does not allow to be disclosed.
The right of access must not be exercised in an abusive manner, i.e. on a regular basis with the sole aim of destabilising the service concerned.
The Occitanie LTRC meets the requests for updating:
The right to erasure of Prospective Customers and Contacts shall not apply where the processing is undertaken pursuant to a statutory obligation.
Apart from this situation, Prospective Customers and Contacts may request the deletion of their data in the following:
In accordance with the legislation on the protection of personal data, Prospective Customers and Contacts are informed that this is an individual right that can only be exercised by the person concerned in relation to his/her own information: for security reasons, the department concerned must therefore verify your identity in order to avoid any communication of confidential information concerning you to anyone other than you.
Prospective Customers and Contacts are informed that this right is not intended to apply insofar as the processing carried out by the Occitanie LTRC is lawful and that all personal data collected is necessary for the performance of its services.
The Occitanie LTRC confers the right to data portability in the particular case of data communicated by Prospective Customers and Contacts themselves on online services offered by the Occitanie LTRC itself and for purposes based solely on the consent of the individuals. In this case, the data will be communicated in a structured format commonly used and readable by a machine.
The Occitanie LTRC does not make automated individual decisions (decisions made in relation to an individual using algorithms applied to their personal data without human intervention in the process).
Prospective Customers and Contacts are informed that they have the right to formulate directives concerning the retention, deletion and communication of their post-mortem data.
The communication of specific post-mortem directives and the financial year to exercise their rights can be done by e-mail or by post to the following address CRTL OCCITANIE - 64 rue Alcyone - CS 79507 - 34960 Montpellier Cedex 2 accompanied by a copy of a signed identity document or at the address rgpd@crtoccitanie.fr
Prospective Customers and Contact Persons will be notified by an asterisk on each personal data collection form as to whether their responses are mandatory or voluntary.
In the event that responses are mandatory, the Occitanie LTRC shall explain to Potential Clients and Contacts the consequences of not responding.
The Occitania LTRC is conferred by Prospective Customers and Contacts a right of use and processing of their personal data for the purposes set out above.
However, the enriched data which are the result of processing and analysis by the Occitanie LTRC, otherwise known as enriched data, remain the exclusive property of the Occitanie LTRC (statistical analysis of use etc.).
The Occitanie LTRC informs its Prospective Customers and Contacts that it may involve any Processor of its choice in the processing of their personal data.
In this case, the Occitanie LTRC ensures that the Processor respects its obligations under the GDPR.
The Occitanie LTRC undertakes to enter into a written contract with all its processors and imposes the same data protection obligations on the processors as it does on itself. Furthermore, the Occitanie LTRC reserves the right to audit its Processors to ensure compliance with the provisions of the GDPR.
The Occitanie LTRC is solely responsible for defining and implementing such physical or logical technical security measures as it deems appropriate to protect against the destruction, loss, alteration or unauthorised disclosure of data by accidental or unlawful means.
These measures mainly include:
In the event of a personal data breach, the Occitanie LTRC undertakes to notify the CNIL under the conditions prescribed by the GDPR.
If the said breach poses a high risk to Prospective Customers and Contacts and the data has not been protected, the Occitanie LTRC will:
In the event of new processing of personal data, the Occitanie LTRC will first refer to the Data Protection Officer.
If Prospective Customers and Contacts wish to obtain specific information or ask a specific question, they may refer the matter to the Data Protection Officer, who will give them an answer within a reasonable period of time with regard to the question asked or the information required.
In case of problems with the processing of personal data, Prospective Customers and Contacts may contact the designated Data Protection Officer.
The Occitania LTRC, as Data Controller, undertakes to keep an up-to-date register of all processing activities carried out.
This register is a document or application allowing to list all the processing activities carried out by the Occitania LTRC as Data Controller.
The Occitanie LTRC undertakes to provide the supervisory authority, upon first request, with the information enabling the said authority to verify the conformity of the processing with the IT and freedom regulations in force.
Prospective Customers and Contacts concerned by the processing of their personal data are informed of their right to lodge a claim with a supervisory authority, i.e. the CNIL in France, if they consider that the processing of their personal data does not comply with the European data protection regulations, at the following address:
CNIL – Service des plaintes
3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Tél : 01 53 73 22 22
This policy may be amended or modified at any time in the event of legal changes in CNIL decisions and recommendations or changes in usage.
Any new version of the present policy will be brought to the attention of Prospective Customers and Contacts by any means defined by the Occitanie LTRC, including electronic means (distribution by e-mail or online for example).
For any other more general information on the protection of personal data, you can consult the Cnil website: www.cnil.fr/en
