CONFIDENTIALITY POLICY & MANAGEMENT OF PERSONAL DATA

Version of July 1, 2023.

The SPC Group (hereinafter referred to as “SPC“) consists of the three companies:

• SPC CONSULTANTS, a public limited company with a board of directors under French law, having its registered office at Parc Inopolis, 204 route de Vourles, 69230 SAINT GENIS LAVAL (France) registered with the RCS of Lyon under number 343 762 308.

• SPC FORMATION, limited liability company under French law, having its registered office Parc Inopolis, 204 route de Vourles, 69230 SAINT GENIS LAVAL (France) registered with the RCS of Lyon under number 391 572 567

• SPC DEVELOPPEMENT, a simplified joint-stock company under French law, having its registered office at 36 rue Victor Basch – Immeuble Le Classéa, 91300 MASSY (France) registered with the RCS of EVRY under number 478 078 710.

These three companies have adopted a common policy for the management and protection of personal data aimed at ensuring a level of protection of the personal data of natural persons, in accordance with Law No. 78-17 of 6 January 1978 as amended, known as the Data Protection Act, and the General Data Protection Regulation No. 2016/679 of 25 May 2016,  says GDPR.

For any additional information on the protection of personal data, you can consult the website of the Commission Nationale de l’Informatique et des Libertés (CNIL) accessible at the following address: www.cnil.fr.

It is specified that this privacy policy concerns the personal data of the following natural persons:

• Employees, agents or representatives of SPC Co-contractors,
• SPC Training Participants
• And, generally, any natural person third party to SPC.

Accordingly, this Privacy Policy does not apply to personal data of SPC employees, which are subject to specific processing and provisions managed internally.

Definitions

For the purposes hereof, the words listed below shall have the following meaning when spelled with a capital letter.

• Candidate: means the natural person who applies for employment with SPC, either on the Site, directly by post or electronic means or through a third party mandated by SPC for this purpose (recruitment agencies, professional social networks, job websites, etc.).
• Co-contractor: means any legal person governed by private or public law or any natural person, acting in a professional capacity, who has concluded a contract with SPC, in particular customers, suppliers, service providers, subcontractors, trainees who are natural persons who conclude directly and in their own name a training agreement with SPC, etc.
• Personal Data: means any information pertaining to an identified or identifiable natural person (hereinafter referred to as “Data Subject”).
• Prospect: means any natural or legal person who is a potential client of SPC.
• Service(s): refers to all services provided by SPC.
• Site: refers to the website, published by SPC, accessible at the following address: https://groupe-spc.com/
• Trainee : means any natural person registered for an SPC training course.
• User: refers to any natural person who accesses and browses the Site.

Identity of controllers and joint controllers

Personal Data is collected and processed by SPC CONSULTANTS.

The processing of personal data relating to SPC’s Training activity is jointly implemented by SPC CONSULTANTS and SPC FORMATION.

The processing of personal data relating to SPC’s consulting, integration and project management assistance activities is jointly implemented by SPC CONSULTANTS and SPC DEVELOPPEMENT.

Personal Data collected and processed by SPC

1. Processing of Personal Data in the context of a request for information on the SPC Site

1.1. Request for information: When a natural person sends a request for information to SPC, SPC collects in particular his (her) name, first name, position, name of the employer, e-mail, and the subject of his (her) request.

Some Personal Data is mandatory and others optional as indicated in the collection forms.

The Personal Data collected is necessary to enable the communication and processing of the request addressed by the Data Subject to SPC.

This Personal Data is kept by SPC for a period of 30 days after the response is sent, and is subject to statistics relating to requests for information.

The collection of this data is based on SPC’s legitimate interest.

1.2. Subscription to the newsletter: When subscribing to the SPC newsletter, the email address of the registered Data Subject is collected and stored until unsubscribed. It is possible to unsubscribe from this newsletter at any time.

The legal basis for this processing is consent.

2. Processing of Personal Data collected through cookies.

A cookie is a small file stored by a server in a user’s terminal (computer, telephone, etc.) and associated with a website. This file is automatically returned in subsequent contacts with the same site.

Cookies have multiple uses: they can be used to memorize your customer ID with a merchant site, the current content of your shopping cart, the language of display of the web page, an identifier to track your navigation for statistical or advertising purposes, etc. Some of these uses are strictly necessary for the functionalities expressly requested by the user or for the establishment of the communication and therefore exempt from consent. Others, which do not meet these criteria, require user consent before reading or writing.

A banner on the SPC website allows you to read the various cookies used either by SPC or by third parties, and to accept them or not.

SPC does not collect any Personal Data from cookies.

3. Processing of Personal Data collected under a contract between SPC and its Co-contractors

SPC collects the surname, first name, professional position, name of the employer, email address or telephone number of natural persons employed by its Co-contractors and, where applicable, the bank details of the natural persons Contracting Parties (in particular trainers).

This Personal Data may be collected either directly from the Data Subject or through the Co-contractor concerned.

In the event of indirect collection of Personal Data, SPC shall inform the Data Subject at the time of the first communication and at the latest within one month of collection.

The Personal Data collected is necessary for the conclusion and execution of contracts between SPC and its Co-contractors through the Data Subject, the management and monitoring of the contractual relationship between SPC and its Co-Contractors, as well as the sending of information, in particular commercial information relating to SPC’s Services, to the Other Parties.

This Personal Data is kept by SPC for the duration of processing the request and, where applicable, the execution of the contract and the follow-up of the contractual relationship. They are then archived for the purposes and for the duration necessary to deal with any litigation involving a Co-contractor.

The legal basis for this processing is the legitimate interest of SPC and of the Co-contractor concerned.

4. Processing of Personal Data collected in the context of direct marketing

SPC collects the surname, first name, professional position, name of the employer, email address or telephone number of natural persons employed by its Prospects.

This Personal Data may be collected by SPC, either directly from the Data Subject, or indirectly through a third party (in particular the organisers of trade fairs and other professional events) or through a search within the data made public by the Data Subject (online directories, professional social networks, etc.).

In the event of indirect collection of Personal Data, SPC shall inform the Data Subject at the time of the first communication and at the latest within one month of collection.

The Personal Data collected is necessary for sending information and commercial solicitations relating to SPC’s Services to Prospects.

This Personal Data is kept by SPC for a period of five years from its collection by SPC or the last contact from the Prospect.

The legal basis for this processing is SPC’s legitimate interest.

5. Processing of Personal Data of Trainees participating in training courses

SPC collects the surname, first name, professional position, name of the employer, email address or telephone number and professional qualifications (prerequisites) of Trainees.

This Personal Data may be collected either directly from the Trainee or through the Co-contractor.

In the event of indirect collection of his Personal Data, SPC informs the Trainee at the time of the first communication and at the latest within one month of collection.

The Personal Data collected is necessary for the organization and execution of the training, the delivery of a training certificate and a satisfaction questionnaire to the Trainee. They may also be the subject of non-nominative statistics by SPC,

This Personal Data is kept by SPC for the duration necessary for the organization and management of the training and the duration of the contractual relationship with the Co-contractor, within the limit of 5 years. They are then archived for the purposes and for the duration necessary to deal with any litigation involving a Trainee or a Co-contractor.

The legal basis for this processing is the legitimate interest of SPC and the Co-contractor concerned.

The answers to the satisfaction survey are sent to the Co-contractor.

The Trainee’s contact information may also be used, on a consent basis, to send information related to SPC’s Services. The Trainee may unsubscribe at any time. His Data is kept for 5 years after the last contact with the Trainee.

E-learning courses on the TalentSoft platform: SPC collects the Trainee’s connection and navigation data for the purpose of validating that the Trainee has successfully completed the various training modules. These data are kept for 5 years.

6. Processing of Candidates’ Personal Data

When a Candidate applies for a job offer, SPC collects in particular his or her name, first name, title, personal contact details, CV, information relating to his/her current professional position, and mobility.

This Personal Data is collected either directly from the Candidate or through a third party mandated for this purpose by SPC (recruitment agencies, professional social networks, job offer websites, etc.).

In the event of indirect collection of Personal Data, SPC shall inform the Candidate at the time of the first communication and at the latest within one month of collection.

The legal basis for the processing is the taking of pre-contractual measures.

This Personal Data is kept by SPC for the duration of recruitment process and, in the event of a positive outcome of the recruitment, for the duration necessary for the employment relationship. In the event of a negative outcome, the Candidate may request the destruction of his Personal Data. Otherwise, his Personal Data is kept 2 years after the last contact with the Candidate, on the basis of SPC’s legitimate interest.

Recipients of Personal Data

The Personal Data collected is accessible to employees of the internal departments of the companies of SPC Group responsible for their processing.

Personal Data is also transmitted to external services providers involved in the processing concerned (training organizations, trainers, recruitment agencies, etc.).

The Personal Data collected may also be transmitted by SPC to duly authorized judicial or administrative authorities, pursuant to a legal or regulatory obligation or a decision of an administrative or judicial authority.

Personal Data is in no way transferred by SPC to a third party for commercial purposes.

Security of Personal Data

SPC Group implements appropriate physical, technical and organisational measures in order to restrict access to Personal Data and to guarantee an appropriate level of security for the needs, risks, costs and purposes of processing Personal Data, in particular:

• The means guaranteeing the confidentiality, integrity, availability and constant resistance of systems and services for processing Personal Data,
• The means to restore the availability of Personal Data and access to it within an appropriate time in the event of a physical or technical incident,
• The procedures to regularly test, analyse and evaluate the effectiveness of technical and organisational measures to ensure the security of the processing.

The data collected by the Groupe SPC is hosted within the EU.

Your rights

In accordance with the law, you have the right to access, rectify, delete and oppose for legitimate reasons. You can exercise them, by justifying your identity, by sending your request, either by post to SPC CONSULTANTS, Personal Data Management, Parc Inopolis, 204 route de Vourles, 69230 SAINT GENIS LAVAL, or by email to rgpd@groupe-spc.com. You also have the right to log a complaint with the CNIL.