Privacy Policy

Policy on personal data of clients/ contacts of the Occitanie LTRC

1.  Preamble

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in the handling of personal data and on the free movement of such data otherwise known as the General Data Protection Regulation (hereinafter referred to as the GDPR) sets the legal framework applicable to the processing of personal data. GDPR strengthens rights and obligations of Data Controllers, Processors, Data Subjects and Data Recipients. As part of our business, we process personal data.  To help understand this policy, please refer to the following points: 

  • the "Data Controller": Occitania LTRC;
  • the "Processor": refers to any natural or legal person who processes personal data on behalf of the Occitania LTRC;
  • "Data Subjects": refers to persons identifiable directly or indirectly as "Prospective Customers", "Contacts" or "Partners" of the Occitania LTRC;
  • "Recipients" : refers to natural or legal persons who receive personal data from the Occitania LTRC.  Data recipients may therefore include both Occitanie LTRC employees and external organisations (exhibiting partners, speakers, etc.).

Article 12 of the GDPR requires that data subjects be informed of their rights in a concise, transparent, comprehensible and easily accessible manner. 

 

2.  Purpose

To meet its operational requirements, the Occitania LTRC is required to implement and use personal data processing relating to Prospective Customers and contacts. The purpose of this policy is to comply with the obligation to inform imposed on Occitania LTRC in application of the GDPR (Article 12) and to formalise the rights and obligations of its prospects and contacts in relation to the processing of their personal data.

 

3.  Scope

This policy applies to all processing of personal data pertaining to Prospective Customers and Contacts of the Occitanie LTRC.  The Occitanie LTRC endeavours to ensure that data is processed within the framework of precise internal governance.  This being said, this policy only covers processing activities where the Occitanie LTRC acts as Data Controller and does not cover processing activities outside of the governance rules set by the Occitanie LTRC (known as shadow IT processing).  Personal data may be processed directly by the Occitanie LTRC or by a processor specifically designated by the Occitanie LTRC. This policy stands alone of any other document which may apply as part of the contractual relationship between the Occitanie LTRC and Prospective Customers.

 

4.  General Principles & Data Collection

No processing is carried out within the Occitanie LTRC relating to Prospective Customer and Contact data unless it relates to personal data collected through or in relation to our services and unless it meets the general principles of the GDPR.

For ease of understanding this policy, the following are instances of data use by the Occitanie LTRC:

Games & competitions

Any recreational activity whether or not intended to provide a prize to potential customers of the Occitanie LTRC. These competitions may be conducted online or offline directly by the Occitanie LTRC or indirectly by its partners. As a rule, only the data required to identify participants and to award prizes or awards will be collected.

Push media

All promotional and commercial activities and commercial follow-up.
Prospecting, usually by e-mail, SMS, telephone, etc.

Events

Physical events held by the Occitanie LTRC - either as a participant or as a sponsor of the LTRC.
Data is generally collected prior to the event itself (competition etc.) when registering for the event directly or via a partner, or during the event itself (questionnaire, business card, dedicated mobile applications, etc.).

Social Media

All social selling operations. These notably include the collection of data linked to registrations, posts, likes, replies and forwards, comments, opinions, etc. .

Cookies

We use various cookies on the site to improve the site's usability and our services A so-called "cookie" is a piece of information, usually small in size and identified by a name, that may be sent to your browser by a website you are visiting. Your web browser will store it for a period of time and send it back to the web server each time you log on again. Cookies serve several purposes: they can be used to store your customer ID on a merchant site, the current contents of your shopping cart, an ID that allows us to track your browsing behaviour for statistical or advertising purposes, etc.

See also the paragraph dedicated to cookies on the legal notice page.

Relations between the Occitanie LTRC and its partners

The contact directory of the Occitanie LTRC refers to all its legal partners and explicitly mentions one or more natural persons as contact persons.
This list is intended to be as complete as possible. Any new use case, modification or deletion of an existing processing operation shall be brought to the attention of Prospective Customers and Contacts through an amendment to this Policy.

5.  Types of Data Collected

Non-technical data (according to use cases)

  • Identity and identification (surname, first name, pseudonym)
  • Contact details (e-mail address, postal address, telephone number)
  • Photo upon granting us this right
  • Professional information when necessary (professional contact details, title of the post held)
  • Interests (leisure, nature, heritage, sport, etc.).

Technical data (depending on the use case)

  • Identification data (IP address)
  • Connection data (logs and token in particular)
  • Acceptance data (click)
  • Location data

6.  Data Sources

Data relating to our Prospective Customers and Contacts may be collected directly from them (direct collection).

It may also be collected indirectly via specialised companies or via the LTRC's partners and suppliers. In such cases, the Occitanie LTRC takes the greatest care to ensure the quality of the data communicated to it.

 

7.  Purposes and Legal Bases

Depending on the case, the Occitanie LTRC processes your data for the following purposes:

  • management of the relationship maintained with partners;
  • management of Prospective
  • Customer relations (GRP);
  • community management;
  • organisation of events and competitions;
  • directory of the various partners;
  • management of reports of behaviour contrary to the present;
  • management of opt-ins and newsletters;
  • improvement of services and satisfaction survey;
  • behavioural analysis and targeting;
  • advertising targeting and segmentation;
  • audience acquisition;
  • moderating social network comments;
  • retargeting of Internet users through the use of cookies;
  • statistics.

These purposes rest on the legitimate interest of the Occitanie LTRC to have data on its users and prospects.

Where necessary, the Occitanie LTRC obtains the consent of the Data Subjects (for example: newsletter).

 

 

8.  Data Recipients - Authorisation & Traceability

The Occitanie LTRC takes steps to ensure that data is only accessible to authorised internal or external recipients.

Internal recipients

  • Organisations, judicial and ministerial officers;
  • organisations in charge of managing the Do Not Contact List;
  • authorised staff of Processors.

Recipients of personal data of Prospective Customers and Contacts within the Occitanie LTRC are subject to an obligation of confidentiality.

The Occitania LTRC decides which recipient has access to which data in accordance with an authorisation policy.

All accesses concerning the processing of Prospective Customer and Contact personal data are subject to a traceability measure.

Furthermore, personal data may be disclosed to any public authority entitled by law to become acquainted therewith. In such cases, the Occitanie LTRC shall not be held liable for the terms under which the staff of such authorities access and use such data.

 

9.  Retention Period

The duration of data retention shall be determined by the Occitanie LTRC, taking into account the legal and contractual constraints and, failing that, according to its needs and, in particular, according to the following principles:

Data relating to contacts with partners

Throughout the duration of the contractual relationship between the Occitanie LTRC and its partner, data relating to a contact is deleted if the contact in question is no longer part of the partner's structure.

Data relating to Contacts and Prospective Customers

3 years from the date of their collection by the Occitanie LTRC or from the last contact from the prospect/contact which takes the form of the last click made by the prospect/contact or the opening of an email sent by the Occitanie LTRC.

Technical data

26 months from the date of collection

After the set time limits, the data is either deleted or kept after being anonymised, notably for statistical purposes.  They may be kept in the event of pre-litigation and litigation.

Prospective Customers and Contacts are reminded that deletion or anonymisation are irreversible operations and that the Occitanie LTRC is no longer able to restore them.

 

10. Right of Confirmation and Right of Access

Prospective Customers and Contacts have the right to ask the Occitanie LTRC for confirmation as to whether or not data concerning them are being processed.

Prospective Customers and Contacts also have a right of access, the latter being conditional on compliance with the following rules:

  • the request must be made by the person him/herself and accompanied by a copy of an up-to-date identity document;
  • the request must be made in writing to the following address CRTL OCCITANIE - 64 rue Alcyone - CS 79507 - 34960 Montpellier Cedex 2 or at the following e-mail address: rgpd@crtoccitanie.fr
    Prospective Customers and Contacts have the right to request a copy of their personal data being processed from the Occitanie LTRC.  However, in the event of a request for an additional copy, the Occitanie LTRC may require Prospective Customers to pay for this cost.

If Prospective Customers and Contacts submit their request for a copy of the data by electronic means, the information requested will be provided to them in a commonly used electronic form, unless otherwise requested.

Prospective Customers are informed that this right of access may not relate to confidential information or data, or to information which the law does not allow to be disclosed.

The right of access must not be exercised in an abusive manner, i.e. on a regular basis with the sole aim of destabilising the service concerned. 

 

11. Updating - Updating and Rectification

The Occitanie LTRC meets the requests  for updating:

  • automatically for online modifications to fields that technically or legally can be updated;
  • on written request from the person himself/herself who must prove his/her identity.

12. Right to Erasure

The right to erasure of Prospective Customers and Contacts shall not apply where the processing is undertaken pursuant to a statutory obligation.

Apart from this situation, Prospective Customers and Contacts may request the deletion of their data in the following:

  • limited cases personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • when the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
  • the data subject objects to processing necessary for the purposes of the legitimate interests pursued by the Occitanie LTRC and there is no compelling legitimate reason for the processing;
  • the data subject objects to the processing of his or her personal data for the purposes of prospecting, including profiling;
  • the personal data have been processed unlawfully.

In accordance with the legislation on the protection of personal data, Prospective Customers and Contacts are informed that this is an individual right that can only be exercised by the person concerned in relation to his/her own information: for security reasons, the department concerned must therefore verify your identity in order to avoid any communication of confidential information concerning you to anyone other than you.

13. Right to Restriction

Prospective Customers and Contacts are informed that this right is not intended to apply insofar as the processing carried out by the Occitanie LTRC is lawful and that all personal data collected is necessary for the performance of its services.

14. Right to Data Portability

The Occitanie LTRC confers the right to data portability in the particular case of data communicated by Prospective Customers and Contacts themselves on online services offered by the Occitanie LTRC itself and for purposes based solely on the consent of the individuals. In this case, the data will be communicated in a structured format commonly used and readable by a machine.

15. Automated Individual Decision

The Occitanie LTRC does not make automated individual decisions (decisions made in relation to an individual using algorithms applied to their personal data without human intervention in the process).

16. Post-mortem Rights

Prospective Customers and Contacts are informed that they have the right to formulate directives concerning the retention, deletion and communication of their post-mortem data.

The communication of specific post-mortem directives and the financial year to exercise their rights can be done by e-mail or by post to the following address CRTL OCCITANIE - 64 rue Alcyone - CS 79507 - 34960 Montpellier Cedex 2 accompanied by a copy of a signed identity document or at the address rgpd@crtoccitanie.fr 

 rgpd@crtoccitanie.fr

17. Voluntary or Compulsory Responses

Prospective Customers and Contact Persons will be notified by an asterisk on each personal data collection form as to whether their responses are mandatory or voluntary.

In the event that responses are mandatory, the Occitanie LTRC shall explain to Potential Clients and Contacts the consequences of not responding.

 

18. Right of Use

The Occitania LTRC is conferred by Prospective Customers and Contacts a right of use and processing of their personal data for the purposes set out above.

However, the enriched data which are the result of processing and analysis by the Occitanie LTRC, otherwise known as enriched data, remain the exclusive property of the Occitanie LTRC (statistical analysis of use etc.).

 

19. Processing

The Occitanie LTRC informs its Prospective Customers and Contacts that it may involve any Processor of its choice in the processing of their personal data.

In this case, the Occitanie LTRC ensures that the Processor respects its obligations under the GDPR.

The Occitanie LTRC undertakes to enter into a written contract with all its processors and imposes the same data protection obligations on the processors as it does on itself. Furthermore, the Occitanie LTRC reserves the right to audit its Processors to ensure compliance with the provisions of the GDPR.

 

20. Security

The Occitanie LTRC is solely responsible for defining and implementing such physical or logical technical security measures as it deems appropriate to protect against the destruction, loss, alteration or unauthorised disclosure of data by accidental or unlawful means.

These measures mainly include:

  • management of authorisations for access to data;
  • internal back-up measures;
  • identification processes;
  • conducting security audits;
  • adopting an information systems security policy;
  • adopting business continuity/disaster recovery plans;
  • using a security protocol or solutions.

21. Data Breach

In the event of a personal data breach, the Occitanie LTRC undertakes to notify the CNIL under the conditions prescribed by the GDPR.

If the said breach poses a high risk to Prospective Customers and Contacts and the data has not been protected, the Occitanie LTRC will:

  • notify the Prospective Customers and Contacts concerned;
  • communicate to the Prospective Customers and Contacts concerned the necessary information and recommendations

 

22. Data Protection Officer / GDPR Referent

In the event of new processing of personal data, the Occitanie LTRC will first refer to the Data Protection Officer.

If Prospective Customers and Contacts wish to obtain specific information or ask a specific question, they may refer the matter to the Data Protection Officer, who will give them an answer within a reasonable period of time with regard to the question asked or the information required.

In case of problems with the processing of personal data, Prospective Customers and Contacts may contact the designated Data Protection Officer.

 

23. Register of Processing

The Occitania LTRC, as Data Controller, undertakes to keep an up-to-date register of all processing activities carried out.

This register is a document or application allowing to list all the processing activities carried out by the Occitania LTRC as Data Controller.

The Occitanie LTRC undertakes to provide the supervisory authority, upon first request, with the information enabling the said authority to verify the conformity of the processing with the IT and freedom regulations in force.

 

24. Right to Lodge a Complaint with the CNIL

Prospective Customers and Contacts concerned by the processing of their personal data are informed of their right to lodge a claim with a supervisory authority, i.e. the CNIL in France, if they consider that the processing of their personal data does not comply with the European data protection regulations, at the following address:

CNIL – Service des plaintes
3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Tél : 01 53 73 22 22

25. Changes

This policy may be amended or modified at any time in the event of legal changes in CNIL decisions and recommendations or changes in usage.

Any new version of the present policy will be brought to the attention of Prospective Customers and Contacts by any means defined by the Occitanie LTRC, including electronic means (distribution by e-mail or online for example).

 

26. Further Information

For any other more general information on the protection of personal data, you can consult the Cnil website: www.cnil.fr/en