CONFIDENTIALITY POLICY & MANAGEMENT OF PERSONAL DATA

Version of January 2, 2019.

The SPC group (hereinafter « SPC ») is composed of three companies:

• SPC CONSULTANTS, SA (limited liability company) with a Board of Directors according to French law, with its Head Office in the Inopolis Business Park, 204 route de Vourles, 69230 SAINT GENIS LAVAL (France) registered with the RCS of Lyon under the number 343 762 308.
• SPC FORMATION, limited liability company according to French law, with its Head Office in the Inopolis Business Park, 204 route de Vourles, 69230 SAINT GENIS LAVAL (France) registered with the RCS of Lyon under the number 391 572 567
• SPC DEVELOPPEMENT, limited liability company according to French law, with its Head Office 36 rue Victor Basch – Immeuble Le Classéa, 91300 MASSY (France) registered with the RCS of EVRY (France) under the number 478 078 710.

These three companies have adopted a common management and protection policy of personal data aiming to ensure a level of data protection of the Person Concerned that conforms to the law n°78-17 of 6 January 1978 modified, known as the “Law of Information Technology and Civil Liberties act”, and “General Data Protection Regulation (GDPR)” n°2016/679 of 25 May 2016.

For all additional information of personal data protection, consult the site of the French Commission for Data Protection and Liberties (CNIL) accessible via the following link: www.cnil.fr.

We specify that this confidentiality policy concerns the personal data of Persons Concerned including:

• SPC contacts within their Contractual Partners
• Participants in SPC training courses, and
• In general, all third-party individuals.

Consequently, this confidentiality policy does not apply to the personal data of SPC employees, which are subject to specific treatment and provision within SPC.

Definitions

In the present context, the words listed below will have the following definition when they are written with a capital letter.

• Candidate: designates a natural person who applies for a job in SPC either directly via the Site / postal system / electronically, or indirectly, via a third party mandated by SPC for this purpose (recruitment firms, professional social networks, job offer Internet sites, etc.).
• Contractual Partner: designates any legal person/entity obeying private or public law or any natural person acting in a professional capacity, who have concluded a contract with SPC, notably clients, suppliers, services, sub-contractors, interns/trainees natural persons who directly and on their own behalf enter into a training agreement , etc.
• Personal Data: designates all information pertaining to an identified or identifiable natural person (hereinafter referred to as the « Person Concerned »).
• Prospect: designates any natural or legal person who is a potential client of SPC.
• Service(s): designates all the services provided by SPC
• Site: designates the internet site, edited by SPC, accessible at the following address:  https://groupe-spc.com/fr/
• Participant: designates any Person Concerned enrolled in an SPC training course.
• User: designates any Person Concerned who accesses and browses the Site.

Identity of the people responsible and co-responsible for the data processing

The Personal Data are collected and processed by the company SPC CONSULTANTS.

The processing of the Personal Data related to the training activity of SPC is jointly implemented by SPC CONSULTANTS and SPC FORMATION.

The processing of the Personal Data related to the activities of SPC other than training such as consulting, integration, maintenance, etc… is jointly implemented by SPC CONSULTANTS and SPC DEVELOPPEMENT.

Personal Data collected and processed by SPC

1. Collected Personal Data

1.1. When the Person Concerned sends a request for information or a quote to SPC, SPC notably collects the family name, first name, profession, name of the employer, and e-mail address. Certain Personal Data are obligatory and others are optional as indicated on the data collection forms.

The Personal Data collected are necessary in order to: 1) use the functionalities of the Site, 2) communicate and process the request sent by the Person Concerned to SPC, 3) close the contracts between SPC and its Contractual Partners via the Person Concerned, and 4) manage the contractual relationship between SPC and its Contractual Partners.

These Personal Data are kept by SPC for the period required to process the request, and if appropriate, until the contract is executed and for the follow-up of the contractual relationship with the Contractual Partner. They are then archived during a period of time deemed necessary so as to deal with any eventual dispute/litigation involving a Contractual Partner or Prospect.

Therefore, the collection and storage of Personal Data is based on the legitimate interests of SPC, and if appropriate, of the Contractual Partner concerned.

1.2. SPC uses cookies to record the browsing of the User on its Site for statistical analysis. Under no circumstances can SPC Consultants identify a User via a cookie. The User can at any moment decide to disable these cookies (see Terms and Conditions & Management of Cookies).

All information relative to cookies as well as the procedure to follow to disable them is accessible here.

1.3. When subscribing to any SPC newsletter, the email address of the Person who subscribes is collected and stored until the Person unsubscribes. It is possible to do this at any time. After unsubscribing, the email address is deleted, unless it is kept for other purposes, especially if it is the email address of a contact within a Contractual Partner of SPC.

The legal basis of this process is consent.

2. Personal Data of the Persons Concerned within a Contractual Partner

SPC collects the family name, first name, profession, name of the employer, and e-mail address or telephone number of the Persons Concerned employed by their Contractual Partners and, if appropriate, the bank details of these Persons Concerned (notably, the trainers).

The Personal Data can be collected either directly from the Person Concerned or via the Contractual Partner concerned.

For indirect collection of Personal Data, SPC informs the Person Concerned in the first correspondence and at the latest, within one month starting from the moment the data was collected.

The Personal Data collected are necessary: 1) to conclude and execute the contracts between SPC and their Contractual Partners via the intermediary of the Person Concerned, 2) for the management and follow-up of the contractual relationship between SPC and their Contractual Partners, and 3) to send information to the Contractual Partners which is notably commercial and related to SPC Services.

These Personal Data are kept by SPC for the time necessary to process the request and, if appropriate, to execute the contract and for the follow-up of the contractual relationship. They are then archived during a period of time deemed necessary so as to deal with any eventual dispute/litigation involving a Contractual Partner.

The legal basis of this process is the legitimate interest of SPC and the Contractual Partner concerned.

3. Personal Data of the Persons Concerned employed by Prospects

SPC collects the family name, first name, profession, name of the employer, and e-mail address or telephone number of the Persons Concerned employed by the Prospects.

These Personal Data can be collected by SPC, either directly from the Person Concerned, or indirectly via a third party (notably, organizers of fairs and other professional events) or by an Internet search (online directories, professional social networks, etc.).

The Personal Data collected are necessary: 1) to address the information requests of the Prospect and 2) the sending of information and commercial canvassing related to SPC Services designed for the Prospect.

These Personal Data are kept by SPC for a period of three years beginning from the collection date by SPC or from the last/latest contact from the Prospect.

The legal basis of this process is the legitimate interest of SPC.

4. Personal Data of the Participants taking part in training sessions

SPC collects the family name, first name, profession, name of the employer, e-mail address or telephone number and professional qualifications (prerequisites) of the Participants.

These Personal Data can be collected either directly from the Participant, or indirectly via a Contractual Partner.

For indirect collection of Personal Data, SPC informs the Participant in their first correspondence and at the latest, within one month starting from the moment the data was collected.

These Personal Data are necessary for: 1) the organization and execution of the training courses, 2) the delivery of the certificate of training and the satisfaction questionnaire to the trainee, and 3) for sending commercial information notably that related to SPC Services to the Contractual Partners.

These Personal Data are kept by SPC for the duration of the training session and, if appropriate, for the follow-up of the contractual relationship with the Contractual Partner. They are then archived during a period of time deemed necessary so as to deal with any eventual dispute/litigation involving a Participant or a Contractual Partner.

The legal basis of this process is the legitimate interest of SPC and the Contractual Partner concerned.

5. Personal Data of the Candidate

When a Candidate replies to a job offer, SPC collects the family name, first name, title, personal contact details, CV, information relative to their present professional position, and their mobility.

These Personal Data can be collected either directly from the Candidate, or indirectly via a third party mandated by SPC for this purpose (recruitment firms, professional social networks, job offer Internet sites, etc.)

For indirect collection of Personal Data, SPC informs the Candidate in their first correspondence and at the latest, within one month starting from the moment the data was collected.

These Personal Data are kept by SPC for the duration of the job application procedure and, if the job application is successful, then these data are kept for the period of employment. If the job application is unsuccessful, the Candidate can ask for their Personal Data to be destroyed. Failing that, the Personal Data will be destroyed 2 years after the last contact with the Candidate.

The legal basis of this process is the Candidate’s consent.

6. Recipients of the Personal Data

The collected Personal Data are accessible to the employees in the internal services in the SPC companies who are in charge of this data processing.

The Personal Data are also transmitted to external services involved in this data processing (training organizations, trainers, and recruitment firms, etc.).

The Personal Data can also be transmitted by SPC to duly accredited judiciary or administrative authorities, under legal or regulatory obligation or by the decision of a judiciary or administrative authority.

The Personal Data are never given by SPC to a third party for commercial ends.

7. Personal Data security

SPC implements adapted physical, technical and organizational means in order to restrict access to Personal Data and guarantee an appropriate level of security for the needs, risk, cost and purpose of the processing of the Personal Data, notably:

• The means guaranteeing the confidentiality, integrity, availability and constant resistance of the Personal Data processing systems and services,
• In case of a physical or technical incident, the means enabling the availability of the Personal Data to be reestablished and thus access to them within an appropriate delay,
• The procedures in order to regularly test, analyze and evaluate the efficacy of the technical and organizational measures to ensure continued security of the processing.

8. Personal Data transfer outside the European Union

It is possible that the Personal Data processed by SPC is communicated to external providers, in particular Microsoft, likely to transfer the Personal Data outside the European Union (EU), to countries which could have less rigid Personal Data protection legislation than that in effect in the country where you reside. In this regard, SPC  refers to the Personal Data protection conditions, notably those for Data transfer outside the EU, provided in Microsoft’s general conditions which are regulated by European Commission type Contractual Clauses. Furthermore, Microsoft is certified in accordance with the Privacy Shield agreed between the EU and the USA.

9. Your rights

In accordance with the law and for a legitimate reason, you have the right of access, rectification, suppression and opposition regarding your Personal Data. You can exercise this right, subject to delivery of a document proving your identity, by addressing your request either by posting to the following address SPC CONSULTANTS, Gestion des Personal Data, Parc Inopolis, 204 route de Vourles, 69230 SAINT GENIS LAVAL, or by electronic mail to rgpd@groupe-spc.com.  You also have the right to log  a complaint with the CNIL.