Data protection

SAS Efalia, registered in the Lyon Trade and Companies Register under number 329 541 510 RCS Lyon, whose head office is located 210, avenue Jean Jaurès, 69007 Lyon, 69007 Lyon, ensures the protection of the personal data of all stakeholders, as Data Controller, implements the following principles:

From the design of the products and the services provided, the principles” Privacy by Design ” (taking into account respect for privacy by design) and the” Privacy by Default ” (default setting favorable to privacy) in order to ensure that the products and services offered integrate data protection principles as soon as they are implemented.
‍
When carrying out its activities, Efalia implements technical and organizational measures to ensure the protection of personal data as long as they are held by Efalia.

‍

1. DEFINITIONS

‍

The following terms, whether used in the singular or plural in this Privacy Policy, will have the following definition:

‍

Term	Definition
Intermediate Archiving	Refers to the transfer of personal data that still has administrative value for Efalia (for example, in the event of litigation) and/or is subject to a legal obligation, to a separate database, logically or physically segregated, and to which access is, in any case, restricted. This archive constitutes an intermediate stage before the deletion or anonymisation of the personal data concerned.
Client	Refers to any legal entity, public or private, that has entered into a contract with Efalia.
Personal Data	Refers to the personal data of the Data Subject, as defined by the Personal Data Regulations, collected and processed by Efalia.
Specific Rights	Refers to the rights granted by the Personal Data Regulations to Data Subjects concerning the processing of their personal data.
Efalia	Refers to the company acting as Data Controller, as indicated in the legal notices accessible from the Website.
Data Subject	Refers to the natural person whose personal data is processed by Efalia, corresponding to the definition of the term “Users” as referred to in this Privacy Policy.
Privacy Policy	Refers to this privacy and personal data protection policy implemented by Efalia on its Website.
Personal Data Regulations	Refers to French Law No. 78-17 of 6 January 1978 on information technology, files and civil liberties, as applied in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
Data Controller	Refers to the individual or legal entity that determines the purposes and means of processing.
Website	Refers to the website accessible at the following URL: https://www.efalia.com/, where this Privacy Policy is hosted.
Processing	Refers to any operation or set of operations carried out by Efalia, in its capacity as Data Controller, using personal data collected from the Website or directly from Efalia.
Users	Refers to all users and visitors of the Website, including applicants and prospects.

‍

2. PURPOSES OF THE TREATMENT

‍

Personal Data may be collected as part of several Processes, with the aim of:

‍

Respond to requests expressed via the forms or by using the available contact methods :This Treatment is based on Efalia's legitimate interest in identifying people who contact us. If you do not provide your Personal Data, we may not be able to process your message properly or at all. Personal Data only for the time necessary to respond to your message. At the end of this period, your Personal Data may be kept in Intermediate Archiving for evidentiary purposes during the legal limitation periods,
‍
‍Personalize the interaction with our Site, facilitate navigation and develop statistics on the use of our Site : this Treatment is based on the consent of Users browsing the Site, for which Personal Data is kept for the duration of navigation on the Site,
‍
‍Develop a partnership :this Processing is based on the pre-contractual measures necessary for the establishment of the partnership, for which Personal Data is kept until the signing of the relevant contract,
‍
‍Process transactions with the various partners within Efalia as part of a contract or a purchase : this Processing is based on the contractual execution of the General Terms and Conditions of Sale concluded with Customers, for which Personal Data is kept for the duration of the accounting year and then in Intermediate Archiving for a period of 10 years from the end of the accounting year,
‍
‍Gather the opinion of Users on all of Efalia's services : this Processing is based on Efalia's legitimate interest in improving its products and services, for which Personal Data is kept for the time necessary to achieve the objective of the satisfaction survey;
‍
‍Apply for a job at Efalia : this Processing is based on pre-contractual measures, for which Personal Data is kept during the recruitment process;
‍
‍Retention of applications : this Processing is based on the consent of the candidates for Efalia to keep their applications in order to contact them later; if necessary, the Personal Data is kept for a period of two (2) years;
‍
‍Analyze the use of the Site and Efalia services for trend monitoring, marketing and advertising purposes : this Treatment is based on the consent of Users for which Personal Data is stored in accordance with the cookie management policy.

3. COLLECTION AND USE OF PERSONAL DATA

‍

Efalia undertakes to collect only Personal Data that is strictly necessary for the performance of its activities, in this context:

‍

Personal Data is collected directly from Users and is only used for the explicit purposes that have been brought to their attention.
‍

In the event that optional Personal Data is requested, Efalia will clearly inform Users about the Personal Data necessary to carry out the subscribed service and those (optional) voluntarily provided by them.

‍

Personal Data may be used to offer other services to Users.
‍
Personal Data provided by Users:
- Are used by Efalia, only as part of these services as a Data Controller;
- Are not used for prospecting purposes including profiling;
- Are stored in France in secure Datacenters;
- May be transmitted to French or European service providers as part of subcontracted services.

4. RELEVANCE OF THE DATA

‍

Efalia collects and processes Personal Data fairly and lawfully. Personal Data collected by Efalia may include the following categories:

‍

Identity (names, first names, contact details)
Personal life (contact details, hobbies when indicated in a resume)
Professional life (function, position, company)
Login data (cookies)
Location data (deduced from the IP address used to connect to the Site)
‍

Efalia makes sure to update the data throughout the Treatments so that they are not obsolete.

‍

5. RESTRICTED ACCESS TO DATA

‍

Only duly authorized recipients can access, within the framework of an access management policy, the information necessary for their activity. Indeed, Efalia defines the access and confidentiality rules applicable to the personal data processed.

‍

As part of our business, we may use subcontractors whose mission is to provide certain services on our behalf. As a result, some of your Personal Data may be transmitted. However, our subcontractors cannot use your Personal Data for purposes other than those requested.

The information collected in this way is reserved for the exclusive use of Efalia and for the following subcontractors:

‍

in charge of providing the cookie banner,
in charge of hosting the Site,
in charge of the development and maintenance of the Site,
for the provision of the Customer database.
‍

As Data Controller, Efalia undertakes not to transfer Personal Data outside the European Union. In the event that the data is subject to such a transfer, Efalia undertakes to put in place appropriate guarantees, in accordance with the European General Data Protection Regulation (RGPD), and in particular to put in place standard contractual clauses adopted by the European Commission in their current version.

‍

Recipient of Personal Data	Nature of Data Transferred	Purpose of the Intended Transfer	Data Location	Level of Protection Offered by the Country or Exception Provided by Personal Data Regulations
Agilitation (Axeptio)	Personal data collected via cookies placed on the Website	Creation, storage and provision of a consent registry. Preparation of aggregated statistics relating to the use and performance of the widget by Website Users.	France and Ireland	Adequate
OVH	All personal data processed from the Website	Website hosting	France	Adequate
Salesforce	All customers’ personal data	Customer follow-up using a dedicated database	France	Adequate
Webflow	All personal data processed from the Website	Website development and maintenance	USA	Data Privacy Framework

‍

6. THE SECURITY

‍

Efalia determines and implements the means necessary to protect Personal Data Processing to avoid access by an unauthorized third party and to prevent any loss, alteration or disclosure of data.

‍

The Site is hosted by the company whose contact details are available by clicking hither.

‍

Every precaution has been taken to store the Personal Data of Data Subjects in a secure environment and to prevent them from being deformed, damaged or accessed by unauthorized third parties. The information transmitted by the Data Subject will never be transmitted to third parties for commercial purposes or sold or exchanged.

‍

7. THE DATA PROTECTION OFFICER (DPO)

‍

Efalia has appointed a Data Protection Officer (DPO), Timothée SAUMET. The DPO ensures compliance with the RGPD within Efalia, to support the teams during the implementation of Treatments, he also helps in the investigation of requests related to the protection of Personal Data, and informs and raises the awareness of employees. The DPO benefits from organizational measures and resources enabling him to manage Efalia's compliance.

‍

8. INFORMATION AND THE EXERCISE OF PEOPLE'S RIGHTS

‍

Prior to the implementation of its Treatments, Efalia informs the Persons Concerned and guarantees the exercise of its Specific Rights in relation to the RGPD. Users may at any time request to exercise the Specific Rights described in chapter 3 of the RGPD:

‍

Right of access : Data Subjects may obtain confirmation as to whether Personal Data concerning them is or is not being processed and, when they are, access to said Personal Data as well as information relating to the Treatments and their methods of implementation as set out below
‍
Right to rectification : Data Subjects may request that their Personal Data be updated.
‍
‍Right to object : Data Subjects may object to Processing based on legitimate interest.
‍
‍Right to erasure : Data Subjects may request the deletion of their Personal Data.
‍
‍Right to limitation : Data Subjects may request the suspension of the Processing of their Personal Data.
‍
‍Right to portability : Data Subjects may request to recover their Personal Data in order to dispose of it only within the framework of Treatments based on consent or a contract.
‍

The request for the exercise of rights can be made:

using the contact forms on the institutional site https://www.efalia.com
to the Efalia DPO, by sending a letter to: DPO Efalia 210, avenue Jean Jaurès 69007 LYON or by sending an email to the address: dpo@efalia.com.

With regard to the right of access, Users may also at any time ask to know:

‍

the identity and contact details of the data controller and, where applicable, of the representative of the data controller,
the contact details of the data protection officer,
the personal data held by Efalia and the method of collection,
the purposes of the processing for which the personal data are intended as well as the legal basis for the processing,
the recipients or categories of recipients of personal data, if they exist,
where applicable, the fact that the data controller intends to transfer personal data to a third country or to an international organization.

‍

In order to validate the legitimacy of the request, a signed message, accompanied by a photocopy of a valid identity document bearing your signature may be requested as well as the contact details of the requester for sending the response.

‍

A response will be sent to the Data Subject within a maximum of one (1) month following the date of receipt of the request.

‍

The Data Subject may also file a complaint before the competent supervisory authority (the CNIL).

‍