1 / PREAMBLE
The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, otherwise known as the General Data Protection Regulation (hereinafter “GDPR”) lays down the legal framework applicable to the processing of personal data.
The GDPR strengthens the rights and obligations of the controllers, processors, data subjects and recipients of data.
As far as our activity is concerned, we are required to process personal data.
For a good understanding of this Policy, the parties acknowledge that :
- the “controller” is France Cargo Handling ;
- “Processor” means any natural or legal person who processes personal data under the instructions and authority and on behalf of France Cargo Handling;
- “Data subjects” refers to the clients and / or contacts of France Cargo Handling;
- “Recipients” refers to natural or legal persons who receive personal data from France Cargo Handling. Recipients of data can therefore be employees of France Cargo Handling as well as external organizations (partners, exhibitors, banks, stakeholders, etc.).
Article 12 of the GDPR requires that data subjects be informed of their rights in a concise, transparent, understandable and easily accessible way.
2 / SUBJECT MATTER
The purpose of this Policy is to comply with the obligation of information that France Cargo Handling shall implement pursuant to Article 12 of the GDPR and to formalize the rights and obligations of its clients and contacts with regard to the processing of their personal data.
3 / SCOPE
This Policy applies when implementing any processing of personal data relating to clients and contacts of France Cargo Handling.
France Cargo Handling shall ensure that data is processed in the context of a specific internal governance. However, this Policy only deals with the processing for which France Cargo Handling is a controller and therefore does not apply to processing that is not created or operated beyond the governance rules set by France Cargo Handling (“wild treatment” or “shadow IT”).
Processing of personal data may be handled directly by France Cargo Handling or through a processor specifically designated by France Cargo Handling.
This Policy remains independent from any other document that may apply in the contractual relationship between France Cargo Handling and its clients or contacts.
4 / PURPOSES
We are processing your data for the following purposes :
| Customer Relationship Management |
- Communication campaigns for clients and prospects
- Organization of commercial prospecting actions (solicitation by email or visit of the premises)
- Organization and participation in various events
- Accounts receivable transactions
|
| Supplier Relationship Management |
- Performance of supplier contracts
- Following-up of the commercial relationship with suppliers
- Accounts payable transactions
|
| Security System & Access Control |
- Site access tracking
- Identity and authorization checking for persons wishing to access the site
- CCTV for the purpose of removing any doubt in case of trespassing, handling of potential theft of goods and potential disputes
- Assignment of access badges for site access authorization purposes
|
This list is intended to be as exhaustive as possible, any new use, modification or deletion of an existing processing will be reported to the clients and contacts by a modification of this Policy.
5 / LEGAL BASIS
Any processing implemented by our company under this Policy is based on the performance of the contract which legally binds our company to the client or supplier concerned, the compliance with a legal obligation or the legitimate interest.
6 / DATA ORIGIN
Data relating to our clients and contacts is usually collected directly from them (direct collection).
Collection can also be indirect via specialized companies or partners and suppliers of France Cargo Handling. In this case, France Cargo Handling takes the greatest care to ensure quality of the data received.
7 / DATA RECIPIENTS – AUTHORIZATION & TRACKING
France Cargo Handling ensures that the data is accessible to authorized internal or external recipients only.
| Internal Recipients |
External Recipients |
| Authorized staff of the departments concerned, namely the Directorate-General, the Purchasing, Security, Sales and Finance/Accounting Department |
- Accountants, auditors, banking institutions, tax departments responsible for any accounting operation;
- Airlines if they request us to communicate a contact;
- Competent authorities for any data relating to the access control and identity of persons likely to access the site (except for CCTV data, which are not communicated to them);
- Processors’ authorized personnel.
|
Recipients of clients and contacts’ personal data within France Cargo Handling are subject to a confidentiality obligation.
France Cargo Handling decides which recipient will have access to any data according to an authorization policy.
Any access relating to the processing of personal data of clients and prospects are subject to a tracking measure.
In addition, personal data may be communicated to any competent authority. In this case, France Cargo Handling is not responsible for the conditions under which the personnel of these authorities has access to and use data.
8 / RETENTION PERIOD
The data retention period is defined by France Cargo Handling with regard to the legally and contractually binding constraints and, failing that, to its needs and especially according to the following principles :
| Processing |
Retention Period |
| Client Data |
For the duration of the contractual relationship with France Cargo Handling, increased by 3 years for purposes of animation and prospecting, without prejudice to retention obligations or limitation periods |
| Supplier Data |
For the duration of the contractual relationship with France Cargo Handling and generally for the time during which the natural person contact with the supplier works in this entity |
| Contacts and Prospects Data |
3 years from their collection by France Cargo Handling or from the last contact from the prospect/contact |
| CCTV Data |
30 days |
| Accounting Data |
10 years for invoices and duration of the performance of the contract entered into with the client or supplier for client and supplier records |
Upon termination of the set deadlines, data is either deleted or stored after being anonymized, e.g. for statistical purposes. Data can be stored in case of pre-litigation and litigation.
Clients and contacts are reminded that deletion or anonymization are irreversible operations and that France Cargo Handling is no longer able to restore them thereafter.
9 / RIGHT TO OBTAIN CONFIRMATION & RIGHT OF ACCESS
Clients and contacts shall have the right to ask France Cargo Handling for confirmation that data relating to them is or is not being processed.
Clients and contacts shall also have a right of access, subject to compliance with the following
rules :
- the request shall be issued by the person itself, together with a copy of an up-to-date identity document ;
- the request shall be made to the following address : 26-28 rue des Voyelles, bâtiment 3520, CS 80028 – Tremblay en France, 95722 ROISSY CDG CEDEX ;
Clients and contacts have the right to request a copy of their personal data processed by France Cargo Handling. However, in the event of a request for an additional copy, France Cargo Handling may require the payment of this cost by the clients and contacts.
If the clients and contacts submit electronically their request for a copy of their data, the requested information will be provided in an electronic form commonly used, unless otherwise requested.
Clients and contacts are informed that this right of access cannot relate to confidential data or information, or data for which communication is not authorized by law.
The right of access shall not be overused, i.e. carried out regularly for the sole purpose of destabilizing the service concerned.
10 / UPDATE – ACTUALIZATION & RECTIFICATION
France Cargo Handling satisfies update requests :
- automatically for online changes concerning fields that technically or legally can be updated;
- upon written request from the person itself who shall prove its identity.
11 / RIGHT TO ERASURE
The right to be forgotten for clients and contacts shall not apply in cases where the processing is implemented to meet a legal obligation.
Apart from this situation, clients and contacts may request the removal of their data in the following limiting cases :
- personal data is no longer necessary for the purposes for which it has been collected or otherwise processed;
- where the data subject withdraws the consent on which the processing is based and there is no other legal basis for processing;
- the data subject objects to the processing necessary for the legitimate interests pursued by France Cargo Handling and that there is no compelling legitimate reason for the processing;
- the data subject objects to the processing of its personal data for the purposes of prospecting, including profiling;
- personal data has been subject to unlawful processing.
In accordance with the legislation on the protection of personal data, clients and contacts are informed that it is an individual right which can only be exercised by the data subject with regard to its own information: for security purposes, the service concerned shall therefore verify the identity of clients and prospects to avoid any disclosure of confidential information about them to another person.
12 / RIGHT TO RESTRICTION
Clients and contacts are informed that this right is not intended to apply insofar as the processing operated by France Cargo Handling is lawful and all the personal data collected is necessary for the performance of its services.
13 / RIGHT TO PORTABILITY
France Cargo Handling allows data portability in the specific case concerning data communicated by clients and contacts themselves, for online services offered by France Cargo Handling itself and for the purposes based on the sole consent of the persons. In this case data will be communicated in a commonly used, structured and machine-readable format.
14 / AUTOMATED INDIVIDUAL DECISION
France Cargo Handling does not make automated individual decisions.
15 / POST-MORTEM RIGHT
Clients and contacts acknowledge that they have a right to provide guidelines regarding the retention, deletion and communication of their post-mortem data. Communication of specific post-mortem instructions and the exercise of their rights shall be provided by post to the following address : 26-28 rue des Voyelles, bâtiment 3520, CS 80028 – Tremblay en France, 95722 ROISSY CDG CEDEX, along with a copy of a signed identity document.
16 / OPTIONAL OR MANDATORY ANSWERS
Clients and contacts are informed that an asterisk specifies on each collection of personal data form the mandatory or optional nature of the answers.
In the case where answers are mandatory, France Cargo Handling shall explain to clients and contacts the consequences of an absence of answer.
17 / RIGHT TO USE
Clients and contacts grant France Cargo Handling the right to use and process their personal data for the purposes set out hereinabove.
However, enriched data arising from a processing and analysis work performed by France Cargo Handling, otherwise known as enriched data, remains the exclusive property of France Cargo Handling (usage analysis, statistics, etc.).
18 / PROCESSORS
France Cargo Handling informs its clients and contacts that it can involve any processor of its choice in the processing of their personal data.
In this case, France Cargo Handling shall ensure compliance by the processor with its obligations under the GDPR.
France Cargo Handling undertakes to enter into a written agreement with all its processors and imposes on the processors the same data protection obligations as itself. Furthermore, France Cargo Handling reserves the right to audit its processors to ensure compliance with the provisions of the GDPR.
19 / SECURITY
France Cargo Handling shall define and implement technical security measures, physical or logical, that it considers appropriate against the destruction, loss, alteration or unauthorized disclosure of data in an accidental or unlawful manner.
These measures include mainly :
- management of authorizations for data access;
- internal safeguard measures;
- identification process;
- conducting security audits;
- use of a protocol or security solutions.
20 / DATA BREACH
In case of personal data breach, France Cargo Handling undertakes to notify the CNIL in the conditions provided by the GDPR.
If this breach constitutes a high risk for clients and contacts and that data has not been protected, France Cargo Handling shall :
- notify the relevant clients and contacts;
- communicate the necessary information and recommendations to the clients and contacts concerned.
21 / DATA PROTECTION OFFICER
France Cargo Handling has not appointed a Data Protection Officer at this moment.
22 / RECORD OF PROCESSING ACTIVITIES
France Cargo Handling, as a controller, undertakes to maintain a record of all processing activities performed.
This record is a document or application to identify all the processing implemented by France Cargo Handling, as a controller.
France Cargo Handling undertakes to provide the supervisory authority, on first request, with the information enabling this authority to ensure that the processing complies with data protection laws in force.
23 / RIGHT TO LODGE A COMPLAINT WITH THE CNIL
Clients and contacts concerned by the processing of their personal data are informed of their right to lodge a complaint with a supervisory authority, namely the CNIL in France, if they consider that the processing of personal data does not comply with the European Data Protection Regulation, to the following address :
CNIL – Service des plaintes
3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07
Tel : +33 1 53 73 22 22
24 / EVOLUTION
This Policy may be modified or amended at any time in the event of legal or case law developments, of the decisions and recommendations of the CNIL or uses.
Clients and contacts will be informed of any new version of this Policy by any means defined by France Cargo Handling, including the electronic way (broadcasting by email or online for example).
25 / MORE INFORMATION
For any further information, please contact the following service : 26-28 rue des Voyelles, bâtiment 3520, CS 80028 – Tremblay en France, 95722 ROISSY CDG CEDEX.
For any other more general information on personal data protection, please visit the CNIL website at the following address : www.cnil.fr
