CHARTER FOR THE PROTECTION OF PRIVACY AND CONFIDENTIALITY
ARTICLE 1- Subject
The use of this Website requires acceptance by the User or future User of the GT&C.
The GT&C formally set down the contractual relationship between the User and IRFTS and set the legal basis for the collection and processing of the User’s Personal Data by IRFTS in the conditions of this Charter For The Protection Of Privacy And Confidentiality (hereinafter referred to as the “Charter”). The Charter is an integral part of the GT&C.
The User may contact IRFTS at any time about the protection of his/her Personal Data at the address: firstname.lastname@example.org
IRFTS takes protecting the User’s privacy and Personal Data very seriously. IRFTS gathers, stores and uses Personal Data only in compliance with the content of this Charter and Personal Data Protection Regulations.
ARTICLE 2 – Definitions
The meaning of the terms in this Charter starting with an upper-case letter have the meaning given to them in the GT&C unless indicated otherwise.
Furthermore, the terms in this Charter that are not defined in the GT&C have the meaning given in the following definitions:
||Refers to the Commission Nationale de l’Informatique et des Libertés (French personal data protection supervisory authority)
||A cookie is a file placed on the User’s hard drive enabling the entity who placed this file to identify and store information about the User’s web browsing activities (keywords used, sites visited, pages visited and actions performed on these sites, time spent, geolocation, language used, etc.)
|“Loi Informatique et Libertés”
||Refers to the French Act No. 78-17 of 6 January 1978 as amended on Information Technology, Data Files And Civil Liberties (in French the “Loi Informatique et Libertés”)
||Refers to the General Data Protection Regulation No. 2016/679 of 27 April 2016 applicable from 25 May 2018
|“Personal Data Protection Regulations”
||Refers to the French Act No. 78-17 of 6 January 1978 as amended on Information Technology, Data Files And Civil Liberties (in French the “Loi Informatique et Libertés”) and the General Data Protection Regulation No. 2016/679 of 27 April 2016 applicable from 25 May 2018.
||Refers to the material device (PC, tablet, smartphone, etc.) used by the User to consult the Website
ARTICLE 3 – Personal Data Protection
All the information provided by the User to IRFTS when visiting the Website are strictly confidential.
3.1 Legal basis for the processing carried out
In compliance with the Personal Data Protection Regulations, the processing referred to in this Charter is underpinned by a specific legal basis.
3.1.1 User consent
In particular, the legal basis for the processing conducted is the consent from the User (e.g. to process his/her requests).
IRFTS has thus asked for the User’s specific consent by means of the double “opt-in” process in order to use his/her Personal Data to send him/her the IRFTS Newsletter.
The User may go back on this consent at any time with future effect by using the unsubscribe link in each IRFTS Newsletter or by sending a message to the address: email@example.com.
3.1.2 Processing required for the User’s contractual relationship with IRFTS
In order to use the Website and the Services, the User has accepted the GT&C. This document formally establishes a contractual relationship between the User and IRFTS and forms the legal basis for the collection and processing of the User’s Personal Data by IRFTS.
These Personal Data are required to carry out a certain number of processing operations related to the contractual relationship between IRFTS and the User the purposes of which are detailed in article 3.3 of this document.
3.1.3 Processing required to comply with a statutory obligation binding on IRFTS
The processing that IRFTS performs may also result from a statutory obligation incumbent on it.
3.1.4 IRFTS’s legitimate interest
The processing carried out by IRFTS may be justified on the grounds of IRFTS’s legitimate interest, the protection of its Website for example.
3.2 Nature and storage duration of Personal Data collected
The Website may be consulted by the User without prior registration or identification.
However, IRFTS may collect the Personal Data that the User willingly provides in a collection form on the Website, in particular when:
- Signing up for training workshops organised by IRFTS;
- Reporting the installation of an “EASY ROOF EVOLUTION” system;
- Signing up for the IRFTS Newsletter;
- Asking to enter into contact with IRFTS;
- Searching for a distributor or applying to become a distributor of IRFTS products;
- Inquiring as to compatibility with IRFTS products; and
- Any other commercial and/or technical inquiries.
These Personal Data include in particular such data as: the User’s surname, forename, address, telephone number, email, the name of the User’s company, the date and time of the request made by the User on the Website.
Unless indicated otherwise on the Website, these data may be stored by IRFTS for a maximum duration of three (3) years from the date of the last activity by the User on the Website.
The email address of Users subscribed to the IRFTS Newsletter will be stored by IRFTS until the User concerned unsubscribes (using the unsubscribe link in the IRFTS Newsletter).
Furthermore, and subject to agreement from the User, which can also be expressed through the User’s Terminal settings, IRFTS may also collect and process all or part of the following Personal Data:
- Information on the User’s browsing and his/her behaviour on the Website, such as the duration of the User’s visit to the Website, how often the pages viewed are consulted, the terms searched, or information on the User’s Terminal and on his/her operating system;
- Information about the User’s behaviour when sent the IRFTS Newsletter, in particular, the time when the User reads the IRFTS Newsletter, the links in the IRFTS Newsletter the User clicks on and/or Users who unsubscribe. These Personal Data are associated to the User’s actions on the Website.
Statistics on the User’s behaviour on the Website and with respect to the IRFTS Newsletter are not stored for more than thirteen (13) months by IRFTS.
3.3 Purpose of Personal Data collected
The collection of Personal Data by IRFTS is required to enable:
- Access to the Services offered by the Website to the User, the use and improvement of these Services;
- Compiling of commercial statistics by IRFTS.
More specifically, the Personal Data collected from the Cookies that may be placed on the Website and the IRFTS Newsletter under the conditions of article 5 [About Cookies] below, enable IRFTS to compile statistics and data on visit and use frequency of the various elements making up the Website and the IRFTS Newsletter enabling the interest and ergonomics of its Services to be improved.
3.4 Disclosure of Personal Data to third parties
The User’s Personal Data are treated with the strictest confidentiality. They will never be forwarded to any third party who might use them for their own purposes and especially for commercial and/or direct advertising purposes without the specific consent of the User, or at least that this disclosure be necessary for the performance of a contract between IRFTS and the User.
However, they may be shared with the legally empowered administrative and judicial authorities.
IRFTS may also be required to publish, disclose and use aggregate information (information on Users or specific groups or categories of Users combined in such a way that an individual User can no longer be identified or mentioned) and non-personal information for sector and market analysis purposes, demographic profiling, promotional and advertising purposes and for other commercial purposes.
ARTICLE 4 – User rights
In accordance with Personal Data Regulations, the User has the following rights:
- Right to access (1)
- Right to rectification (2)
- Right to erasure (3)
- Right to restriction of processing (4)
- Right to Personal Data portability (5)
- Right to object (6)
- The right to decide how Personal Data will be treated after death (7).
To exercise the rights mentioned above, the User can sent a request along these lines to IRFTS:
- By email to the address: firstname.lastname@example.org
- By post to the following address (with a copy of his/her identity papers if the User wishes to exercise his/her rights):
26 rue du 35 ème Régiment d’Aviation 69500 Bron
For the attention of: Julien AUBENAS
IRFTS will reply to the User within a period of one (1) month from the time the User’s request is received. This period may be extended by two (2) months by IRFTS who will inform the User due to the complexity and the number of requests being addressed.
4.1 Right to access
In accordance with the provisions of article 15 of the GDPR, the User has the right to obtain confirmation from IRFTS as to whether or not Personal Data concerning him or her are being processed, and, where that is the case, access to the Personal Data and the following information:
- a) the purposes of the processing;
- b) the categories of Personal Data concerned;
- d) the recipients or categories of recipient to whom the Personal Data have been or will be disclosed, in particular recipients in third countries or international organisations;
- d) where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
- e) the existence of the right to request from IRFTS rectification or erasure of Personal Data or restriction of processing of Personal Data concerning the User or to object to such processing;
- f) the right to lodge a complaint with the CNIL (French data protection supervisory authority);
- g) where the Personal Data are not collected from the User, any available information as to their source;
- h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the User.
4.2 Right to rectification
In accordance with the provisions of article 16 of the GDPR, the User shall have the right to obtain from IRFTS without undue delay the rectification of inaccurate Personal Data concerning him or her. Taking into account the purposes of the processing, the User shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
4.3 Right to erasure (right to be forgotten)
In accordance with the provisions of article 17 of the GDPR, the User shall have the right to obtain from IRFTS the erasure of Personal Data concerning him or her without undue delay and IRFTS shall have the obligation to erase Personal Data without undue delay where one of the following grounds applies:
- a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
- b) the User withdraws consent on which the processing is based and where there is no other legal ground for the processing;
- c) the User objects to the processing and there are no overriding legitimate grounds for the processing;
- d) the Personal Data have been unlawfully processed;
- e) the Personal Data have to be erased for compliance with a legal obligation in Union or Member State law to which IRFTS is subject;
4.4 Right to restriction of processing
4.4.1 In accordance with the provisions of article 18 of the GDPR, the User shall have the right to obtain from IRFTS restriction of processing where one of the following applies:
- a) the accuracy of the Personal Data is contested by the User, for a period enabling IRFTS to verify the accuracy of the Personal Data;
- b) the processing is unlawful and the User opposes the erasure of the Personal Data and requests the restriction of their use instead;
- c) IRFTS no longer needs the Personal Data for the purposes of the processing, but they are required by the User for the establishment, exercise or defence of legal claims;
- d) the User has objected to processing pursuant to Article 21(1) of the GDPR (right to object), pending the verification whether the legitimate grounds of IRFTS override those of the User.
4.4.2 Where processing has been restricted under article 4.4.1 herein, such Personal Data shall, with the exception of storage, only be processed with the User’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
4.4.3 The User who has obtained restriction of processing pursuant to article 4.4.1 of the Charter shall be informed by IRFTS before the restriction of processing is lifted.
4.5 Right to Personal Data portability
4.5.1 In accordance with the provisions of article 20 of the GDPR, the User shall have the right to receive the Personal Data concerning him or her, which he or she has provided to IRFTS, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the Personal Data have been provided, where:
- a) the processing is based on consent or on a contract,
- b) the processing is carried out by automated means.
4.5.2 In exercising his or her right to data portability pursuant to article 4.5.1 herein, the User shall have the right to have the Personal Data transmitted directly by IRFTS to another controller, where technically feasible.
4.5.3 The exercise of the right, referred to in article 4.5.1 herein, is without prejudice to Article 17 of the GDPR (right to be forgotten). That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
4.6 Right to object
4.6.1 In accordance with the provisions of article 21 of the GDPR, The User shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of Personal Data concerning him or her which is based on IRFTS’s legitimate interest, including profiling based on those provisions. IRFTS shall no longer process the Personal Data unless IRFTS demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User or for the establishment, exercise or defence of legal claims.
4.6.2 Where Personal Data are processed for direct marketing purposes, the User shall have the right to object at any time to processing of Personal Data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
4.6.3 Where the User objects to processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.
4.7 The right to decide how Personal Data will be treated after death
In accordance with the provisions of article 40-1 of the French Act on Information Technology, Data Files And Civil Liberties, the User can give instructions on the storage, erasure and disclosure of his/her Personal Data after his/her death. These instructions may be general or specific.
General instructions concern all Personal Data relating to the User and may be registered with a digital trusted third party certified by the CNIL.
Specific instructions concern the processing of Personal Data identified in these instructions. These instructions are registered with the controllers concerned. They are the subject of specific consent from the User and cannot result from the sole approval by the User of the GT&C.
In the absence of instructions given during his/her lifetime by the User, the User’s heirs may exercise the rights mentioned in this section to the extent necessary:
- The right of access, if it is necessary to settle the estate of the deceased User;
- The right to object to processing of the User’s Personal Data.
ARTICLE 5 – About Cookies
IRFTS uses different types of Cookies to improve the quality of its Website Content and its Services as described below.
By using the Website, after accepting the notice about Cookies that is displayed via a ‘cookie banner’ on the first visit, the User accepts that Cookies be installed on his/her Terminal in accordance with the terms and conditions of this Charter.
The consent of the User will therefore have to be renewed at the end of this period.
5.1 Cookies likely to be placed on the User’s Terminal
5.1.1 Analytic Cookies
The Website features Cookies used to analyse the User’s behaviour and which are called ‘Analytic Cookies‘. These Analytic Cookies are used to collect and store the following data:
- Consultation frequency for pages viewed,
- Search terms
- Use of Website features,
- Website visit duration.
Analytic Cookies are used to improve and optimise the quality of the Website content and to check and improve the Service scope and access. To analyse the behaviour of the User for the above-mentioned purposes, IRFTS uses the Google Analytics software.
At IRFTS’s request, Google will use this information to assess how the Website is used, to compile reports on the Website’s activity and provide other services relating to the use of the Website to IRFTS. The IP address forwarded by the User’s browser for the purposes of Google Analytics will not be merged with other Google data.
Furthermore, the User has the possibility of preventing this Cookie from being placed and used on his/her terminal by going to: http://tools.google.com/dlpage/gaoptout?hl=fr
More information on Google Analytics and the protection of Personal Data is available at: http://tools.google.com/dlpage/gaoptout?hl=fr and https://support.google.com/analytics/answer/6004245?hl=fr
5.1.2 Cookies linked to the IRFTS Newsletter
IRFTS assesses the behaviour of Users who have subscribed to the IRFTS Newsletter.
The IRFTS Newsletters are sent using the MailChimp tool. Mail Chimp is an emailing software from The Rocket Science Group LLC 675 Ponce de Leon Avenue NE Suite 5000 Atlanta, GA 30308.
The IRFTS Newsletters may contain “Web beacon pixels” enabling MailChimp to identify when the User opened the email and check on which links or ads he/she accessed in the email. IRFTS uses this information to determine which parts of the IRFTS Newsletter are most relevant to the User.
Personal data may therefore be processed in the United States to enable the IRFTS Newsletter to be sent to subscribers.
The User can delete the pixel by deleting the IRFTS Newsletter email.
If the User does not wish to download the pixel onto his/her PC or other device, he/she can avoid it by receiving the Newsletter in plain text form rather than HTML.
The User may also go back on his/her consent with future effect by using the unsubscribe link in each IRFTS Newsletter or by sending a message to the following address: email@example.com
5.1.3 Other Cookies
||Collects and analyses information in order to see how the User interacts with the Website
||Enables use of the WordPress fonts stored on: fonts.googleapis.com
|| Is used to track visits to the Website from the Google AdSense and DoubleClick services
||Is used to propose geolocation to the User to provide him/her with more relevant replies
||Used in order to take advantage of the features of the Youtube service
||Used by Youtube to store Flash Player information.
5.2 Managing and disabling Cookies
The User has the ability to configure his/her browser by changing the settings so as to reject Cookies. However, total rejection of Cookies may prevent the User from taking full advantage of certain features on the Website.
IRFTS waives any liability for the consequences of any Website malfunctioning resulting from IRFTS being unable to record or view the Cookies necessary for its Services to operate and that the User has refused or deleted.
The User can change his/her browser settings to disable the placing of Cookies as follows:
ARTICLE 6 – Security and information
IRFTS is committed to implementing all appropriate technical and organisational measures to ensure a level of security appropriate to the risks of accidental, unauthorised or unlawful access, disclosure, alteration, loss or destruction of Personal Data concerning the User.
The computers and servers used by IRFTS to store Personal Data are kept in a secure environment.
In the event of IRFTS becoming aware of unlawful access to a User’s Personal Data stored on its servers or unauthorised access resulting in the risks identified above being materialised, IRFTS undertakes to:
- Notify the User of the incident without delay;
- Investigate the causes of the incident and inform the User accordingly;
Take all necessary and reasonable measures to mitigate the negative effects and damage that may result from the incident
Last Charter update on 26/11/18