Key facts at a glance

• An updated privacy and cookie policy explains how personal data is collected, used, stored, shared and protected.
• The policy is framed around the GDPR and identifies a data controller registered in France under company number 498 647 882, with its registered office at RCS Nanterre.
• The nominated representative for the Act is Ludovic Jacobs.
• Visitors are deemed to accept the practices described in the policy by visiting the website.
• Data collection falls into three broad categories: information supplied by users, information collected automatically during visits, and information received from other sources.
• Personal data may be used to perform contracts, provide requested products and services, send relevant marketing by email, phone or SMS, notify service changes, administer and improve the site, support interactive features, maintain security, measure advertising effectiveness and meet record-keeping obligations.
• Information may be shared with group members, business partners, suppliers, sub-contractors, advertisers, advertising networks, analytics providers and search engine providers.
• Personal data is stored on secure servers within the EEA for ten years, with safeguards including a secure firewall, anti-virus software, encryption and regular back-ups.
• Users have rights to be informed, access, rectification, erasure, restriction, portability, objection and protection from solely automated decisions with legal effects.
• The cookie policy covers analytical and performance cookies, functionality cookies and targeting cookies, and notes that third parties may also set cookies.
• Users can block cookies through browser settings, but doing so may affect access to all or parts of the website and its functionalities.

A revised framework for personal data

The updated policy begins with a commitment to protect and respect privacy. It states that the policy, together with any other documents referred to in it, sets out the basis on which personal data collected from users, or provided by users, will be processed. Visitors are asked to read the document carefully to understand the organisation's views and practices regarding personal data and how it will be managed. The policy adds that by visiting the website, a user accepts and consents to the practices described.

For the purposes of the GDPR, the data controller is identified as a company registered in France under company number 498 647 882, with its registered office at RCS Nanterre. The policy also names Ludovic Jacobs as the nominated representative for the Act. That detail places the document within a formal legal framework and gives users a point of reference for questions about how the policy is applied.

Three categories of information

The policy separates the information it collects and processes into three categories. The first is information users give directly. This includes details supplied when filling in forms on the websites, interacting with the site or corresponding by phone, email or another method. It also covers information provided when registering to use the site and when reporting an issue with the site. The policy states that this information will include a user's name, address, email address and phone number, as well as preliminary information about the user's business and its location.

The second category is information collected automatically about a visit. This generally covers technical information and is regularly collected through small data files known as cookies. According to the policy, this data allows the organisation to offer a good experience when browsing the site and to indicate where the site requires improvement. More information on how cookies work, which cookies are used and why can be found in the cookie policy.

The third category is information received from other sources. This includes information received if a user uses any of the other websites operated by the organisation. In that situation, the policy says users will be informed when the data is collected if it is intended to be shared internally, and the purpose of sharing will be explained. The category also includes information received from third parties such as business partners, sub-contractors in technical services, advertising networks, analytics providers and search information providers. The policy states that users will be notified when information about them is received from those parties and the purposes for which it is intended to be used.

How personal data may be used

The policy says all information collected or received about users, whether personal or technical in nature, may be used in a range of ways. It may be used to carry out obligations arising from contracts entered into between the user and the organisation and to provide information, products and services requested by the user. It may also be used to provide information about other goods and services offered by the organisation or its selected partners that are similar or relevant to those the user has already purchased or enquired about. Such contact will only be made by email, phone or SMS, and users can opt out at any time.

Other uses include notifying users about changes to services; administering the site and carrying out internal operations such as troubleshooting, data analysis, testing, research, statistical and survey purposes; improving the site so that content is presented in the most effective manner for the user and their computer; allowing users to participate in interactive features when they choose to do so; keeping the site safe and secure; measuring or understanding the effectiveness of advertising served to users and others; delivering relevant advertising; and complying with record-keeping and information storage obligations and policy. Where information is received from other sources, the policy says it will be combined with data provided by users and information collected about them, and used for the purposes set out above depending on the types of information received.

Sharing and disclosure practices

The policy sets out several circumstances in which information may be shared. It may be shared with any member of the group; business partners, suppliers and sub-contractors for the performance of any contract entered into with them or with the user; advertisers and advertising networks that require the data to select and serve relevant adverts to users and others; and analytics and search engine providers that assist in the improvement and optimisation of the site. In relation to advertisers, the policy says such information would not include anything that would make an individual identifiable to the advertisers, but aggregate information about users may be provided, such as the number of users living within a particular area, to help advertisers reach the kind of audience they want to target. Personal data may also be used to display advertisements to a selected target audience in line with advertisers' wishes.

The policy also states that personal information will be disclosed to third parties in specific circumstances. These include a sale or purchase of any business or assets, in which case personal data will be disclosed to the prospective seller or buyer; an acquisition of the organisation or substantially all of its assets by a third party, in which case personal data held about clients will be one of the transferred assets; a duty to disclose or share personal data to comply with a legal obligation, or to enforce or apply terms of use and other agreements; and the protection of rights, property or safety, whether of the organisation, its clients or others.

Storage, retention and security

On storage, the policy states that all information provided is stored on secure servers within the EEA, either by the organisation or by selected business partners, for a period of ten years. It says reasonable steps will be taken to protect information in accordance with the policy, including installing a secure firewall, using anti-virus protection software, encrypting data and carrying out regular back-ups. Where a password has been given to a user, or where a user has chosen one to access certain parts of the site, the user is responsible for keeping it confidential and is asked not to share it with anyone.

The policy also acknowledges that transmission of information via the internet is not completely secure. Although it says the organisation will do its best to protect personal data, it cannot guarantee the security of data transmitted to the site, and any such transmission is at the user's own risk. Once information has been received, strict procedures and security features will be used to try to prevent unauthorised access. The policy also notes that the site may contain links to and from the websites of partner networks, advertisers and affiliates. Users who follow a link to any of those websites are reminded that those websites have their own privacy policies, and the organisation does not accept responsibility or liability for those policies. Users are advised to check those policies before submitting personal data to those websites.

User rights under the policy

The policy lists a set of rights available under law in respect of personal information. These include the right to be informed about the collection and use of personal information; the right of access to information to verify the legality of its use; the right to request that inaccurate or incomplete information is rectified; the right to request deletion or removal of information where there is no further reason for use, such as withdrawal of consent; the right to restrict use; the right to obtain and reuse information for the user's own purposes; the right to object to certain uses such as marketing; and the right not to be subject to a decision that has a legal effect and is based on an automated decision.

Users who wish to exercise any of these rights may do so at any time by writing to the address given in the policy. In some cases, the policy says a small fee of no more than £10 may be charged in respect of administrative costs. Users who would like to request the information held about them are asked to send an email with a personal ID document to the address provided and to give specific details of the information they want, such as user account information.

Cookie policy and browser controls

The cookie policy explains that the website uses cookies to distinguish a user from other users and to provide an experience when browsing, as well as to help improve the website. By continuing to browse the website, a user is deemed to have agreed to the use of cookies as set out in the policy. The document describes analytical and performance cookies, which collect information used in aggregate form to help understand how websites are being used or how effective marketing campaigns are, or to help customise websites for users. It also describes functionality cookies, which are used to recognise a user when they return to the website, enabling personalised content, greeting by name and remembering preferences such as language or region. Targeting cookies record visits to the website, the pages visited and the links followed, and the policy says this information may be shared with third parties.

The policy notes that third parties, including advertising networks and providers of external services such as web traffic analysis services, may also use cookies over which the organisation has no control. These cookies are likely to be analytical and performance cookies or targeting cookies. On blocking, the policy states that users can block cookies by activating the setting on their browser that allows them to refuse the setting of all or some cookies. However, it warns that blocking cookies may affect the ability to use the website. In particular, users may not be able to access all or parts of the website or use the functionalities contained on it.

The policy also says any future changes to the privacy policy will be posted on the page, and users are encouraged to check back frequently for updates or changes. Questions, comments and requests regarding the privacy policy are welcomed and should be addressed to the nominated representative at the contact address provided. The cookie section ends by reiterating that users can manage cookies through browser settings, while noting the possible effect on access and functionality.

Source:Silicon UK News