Personal Data Protection Policy
Introduction
EDF power solutions SA, whose registered office is situated at 43 Boulevard des Bouvets, CS 90310, 92741 Nanterre Cedex (hereinafter the ‘Company’ or ‘We’), acting as an independent Data Controller, kindly asks you to familiarise yourself with the terms and conditions governing the processing (i.e. the collection, use and sharing) of your personal data via this website (hereinafter the ‘Site’) and the use of the associated services (hereinafter the ‘Services’), in accordance with the applicable laws and regulations on the protection of personal data, in particular: (i) Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, and Law No. 2018-493 of 20 June 2018 on the protection of personal data; (ii) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, hereinafter ‘GDPR’), which came into force on 25 May 2018; and (iii) any other legislative act, decree, regulation or provision that may be enacted by a competent national or European data protection authority – hereinafter collectively referred to as ‘Applicable data protection legislation’.
Scope of this policy
The Company is the data controller for personal data (namely, any information relating to an identified or identifiable individual, referred to as a ‘Data Subject’) concerning you, processed via the Website and in connection with the use of the Services, in accordance with the terms set out in this Personal Data Protection Policy (‘Personal Data Protection’).
This Personal Data Protection Policy, together with the Cookie Policy, available here, applies to all users, including those who use the Website and the Services without being registered or subscribed to a specific service (hereinafter collectively referred to as ‘Users’).
What types of personal data do we collect?
The Company collects (1) registration data; (2) data that you have voluntarily shared with the Company; (3) browsing data relating to access to and use of the Website and the Services; and (4) other miscellaneous information. In particular, the Company collects the following information:
- Registration data: collected via the registration form.
- Data you voluntarily share with the Company: the Company may collect your personal data (e.g. first name, surname, email address, postal address, telephone number, etc.) when you submit a request via the online form on the Website.
- Browsing data: when you access and use the Website or the Services, the Company may collect information relating to these visits. For example, in order to establish your connection to the Website or the Services, our servers receive and record information about your computer, device and browser, which may include, amongst other things, your IP address, browser type and other information relating to software or hardware. If you access the Website or the Services from a mobile phone or other device, the Company may collect the device’s unique identifier, geolocation data and other identifying data relating to that device. Information may also be collected via cookies and other tracking technologies (such as browsing cookies, retargeting cookies, audience measurement tools, web beacons and Adobe Flash technologies, etc.). These technologies may also be used to collect and store information about your use of the Website or the Services, such as the pages you have visited, the online content you have viewed, the internet searches you have carried out and the adverts you have seen. For further information, please see our Cookies Policy.
We do not collect:
- Financial data from a secure payment service provider: in some cases, the company may use an unaffiliated payment service to enable you to purchase a product or make payments. Where this applies, the processing of the information you provide will be governed solely by the payment service provider’s data protection policy, and not by this Personal Data Protection Policy.
- Special categories of personal data: we ask that you do not disclose or provide to us any data classified as Special Categories of Personal Data or deemed equivalent by the CNIL (including, in particular, social security numbers, criminal records, ethnic origin, political opinions, religious or philosophical beliefs, health data or trade union membership) via our Website, our Services or by any other means.
Related Services. The Services may be linked to websites operated by third-party companies not affiliated with the Group, and may, in particular, include advertisements, offer online content, and provide features, games, newsletters, competitions or prize draws, or applications developed by third-party companies. The Company accepts no liability for the personal data protection practices implemented by these third-party companies. Once you leave the Services or click on an advertisement, it is your responsibility to check the personal data protection policy applicable to that other service
For what purposes do we collect your personal data?
We process data for:
a) Allowing you to use the Site and Services;
b) Evaluating and improving our Services and related features;
c) Enhancing your experience when using the Site and Services;
d) Providing customer support and responding to your inquiries;
e) Complying with legal obligations (including obligations related to the provision of Services) or responding to requests from public and governmental authorities;
f) Responding to the interests of the Company; in certain cases, the Company may disclose your personal data, particularly when it believes in good faith that such data processing is necessary to: (i) protect, exercise, or defend the rights, privacy, security, or property of the Company or its employees, agents, and contractors (including the execution of our contracts and terms of service); (ii) safeguard the safety, privacy, and security of users of the Site, Services, or the public; (iii) protect against fraud or for risk management purposes;
g) Subject to your prior consent, if necessary, to conduct commercial prospecting operations towards you, in accordance with your personal preferences and choices;
h) Subject to your consent, to share your personal data with our trusted business partners, including other entities within the Group, to enable them to send you commercial messages.
On what legal basis do we process your data?
The processing purposes outlined in sections 4(a) to 4(f) of this Personal Data Protection Policy are based on the legitimate interest of EDF Power Solutions SA as the Data Controller to ensure the proper functioning of the Site, optimise the user experience, respond effectively to user requests, and provide Services relevantly. This legitimate interest is founded on the need to enhance user satisfaction, maintain the security and integrity of data, and ensure the continuity of the services provided. Furthermore, the Company is committed to respecting the rights of Data Subjects by providing clear information and enabling them to exercise their data protection rights.
Regarding certain cookies that may be used, the processing is based on the consent of the Data Subjects.
The processing purpose outlined in section 4(e) of this Personal Data Protection Policy is based on applicable legal and regulatory obligations.
The processing purpose outlined in section 4(f) is based on the legitimate interest of the Company, which includes tracking visitor statistics to analyse the effectiveness of the Services and tailor our offerings to the needs of users, as well as on applicable legal and regulatory obligations.
The processing purposes outlined in sections 4(g) and 4(h) of this Personal Data Protection Policy are carried out based on your consent when required.
How long do we retain your data?
The Company retains your personal data for as long as is necessary to fulfil the purposes set out in section 4 above.
Your data is retained:
For the period strictly necessary for the use of the Website or the Services, or for the Company’s purposes, and for a maximum period of 5 years from the date of collection if no contract is concluded with the Company;
Where a contract is concluded or an order is placed, in connection with the Services or otherwise, for the entire duration of the contractual relationship, and then retained in interim archives for a period corresponding to any warranty period, plus the applicable statutory limitation period (5 years).
How do we process your data?
Data is processed both manually and electronically and is protected by appropriate security measures. In this regard, although the Company uses appropriate administrative, technical and organisational measures to protect personal data against theft, loss, unauthorised use, disclosure or alteration, it cannot guarantee that it is able to guard against all existing IT risks.
Who has access to your data?
In accordance with the purposes of processing set out in section 4 of this Personal Data Protection Policy, your data is shared internally within EDF Power Solutions SA and, where applicable, within the EDF RE Group, with the customer service department, the marketing/sales department and the communications department. The Company may also disclose your personal data to the following recipients:
Other entities within EDF power solutions, as applicable;
Third-party service providers and subcontractors (i.e. IT service providers, service providers related to the Services – by way of example, and without this list being exhaustive, experts, consultants and lawyers, companies involved in potential mergers, demergers or other corporate restructuring).
Competent national authorities: in order to comply with applicable law;
Trusted business partners: subject to your consent. The sectors in which these third parties may operate include, in particular: (i) energy, (ii) [industry]; etc.
Is your personal data transferred abroad?
Your personal data may be transferred to other EDF power solutions entities and to service providers acting on its behalf, located in France and/or within the European Union.
We will not transfer any personal data to countries outside the EEA.
Children under the age of 15
The Website is not intended for and does not offer Services to individuals under the age of 15, and the Company does not knowingly collect personal data from individuals under the age of 15.
Security measures
EDF power solutions SA implements all appropriate technical and organisational security measures to ensure a level of personal data security commensurate with the risk, and to protect data against accidental or unlawful destruction, loss, damage, disclosure or unauthorised access.
EDF power solutions SA contractually requires all its data processors to maintain the same level of protection. Any employee of EDF power solutions SA who, in the course of their duties, may have access to your personal data undertakes to treat it as strictly confidential.
What are your rights regarding personal data?
In accordance with the applicable regulations on the protection of personal data, you have the right to access, rectify, erase, restrict, transfer and object to the processing of your data, as well as the right to withdraw your consent at any time. You also have the option of providing us with your instructions regarding the handling of your personal data (retention, erasure, disclosure to a third party, etc.) in the event of your death. You may exercise these rights by writing to the following email address: privacy@edf-power.com.
However, in practice and depending on the circumstances, your objection may affect or prevent us from processing your request for information, registration or use of the Services offered on the Website.
You also have the right to lodge a complaint with a national supervisory authority, such as the Commission Nationale de l’Informatique et des Libertés, in the event of a breach of the applicable regulations on the protection of personal data, in particular the European General Data Protection Regulation (GDPR) No 2016-679, which has been in effect since 25 May 2018.
Amendments and Updates
The Personal Data Protection Policy shall take effect from the date specified in the introduction. The Company reserves the right to amend or supplement this document, in particular in the event of changes to the applicable regulations governing the protection of personal data.
You will be notified by the Company of any changes to this Personal Data Protection Policy before they come into force, and the amended version will in any event be available once published on our Website.
Contact details of the Data Protection Officer
EDF power solutions SA has appointed a Data Protection Officer (DPO) whom you may contact with any queries regarding the processing of your personal data, as well as to exercise your rights.
Contact details of the DPO: privacy@edf-power.com