PRIVACY AND DATA PROTECTION POLICY

Following the entry into force of the European RGPD legislation, the VOLTAIRE group transparently informs about the use made of the personal data processed (under Articles 12, 13 and 14 of the RGPD legislation).

DATA FROM CREATING AN ACCOUNT ON ONLINE STORES INCLUDING VOLTAIRE-DESIGN, EQUITACK, FORESTIER, REBELLE SELLIER) AND INFORMATION REQUESTS FROM PROSPECTS.

Data processing controller	Voltaire group
Processing purposes	Management of registration and account creation Management of pre-contractual relationship Management of relationship with prospects
Processed data	Title, First Name, Last Name, Email, Password, Date of Birth, Optional Consent, Optional Information Requests.
Recipients and possible source personal data originate	Only the marketing team is authorized to access the communicated or recorded data.
Data retention and erasure	The maximum duration of data retention is set at 2 years after the account or prospect relationship becomes inactive.
Processing legal basis	The legal basis for the use and processing of personal data is based on the execution of pre-contractual measures or, failing that, the consent of the concerned interlocutors or, failing that, our legitimate interests of a commercial nature.

ORDER DATA, ESPECIALLY F VOLTAIRE-DESIGN, FORESTIER, EQUITACK, REBELLE SELLIER ONLINE STORES, BILLING AND CUSTOMER SERVICE DATA - DATA OF GAME CONTEST WINNERS

Data processing controller	Voltaire group. In case of orders from abroad, the concerned foreign subsidiary is a co-controller, namely: Ratina GMBH for Germany Equitack LTD for the United Kingdom
Processing purposes	Management of commercial relationship ; Management of orders ; Management of transactions and invoicing ; Management of customer service ; Management of delivery ; Management of deliveries for game winners ; Management of invoicing and customer support ; Management of associated statistics ; Management of discounts.
Processed data	Identities, contact details, ordered products, order status, summary of any transaction, delivery address, delivery status
Recipients and possible source personal data originate	Only the management in case of a problem, the customer service, the accounting department, the marketing department, and the shipping department are authorized to access the necessary data.
Data retention and erasure	6 years after an order (charged or free), only accounting documents are kept in the archive Accounting documents over 10 years old are not kept.
Processing legal basis	The legal basis for the use and processing of personal data is based on the execution of the commercial relationship or, failing that, our legitimate commercial interests.

DATA OF VOLTAIRE-DESIGN, FORESTIER, AND REBELLE SELLIER AMBASSADORS WHO CAN ORDER FOR FREE

Data processing controller	Voltaire Group
Processing purposes	Management of partner relationship Management of offered orders and discounts
Processed data	Identities, contact details, signed partnership contract, rider potential score, start and end date of the contract, “prestashop ID”, budget amount
Recipients and possible source personal data originate	Only the management in case of problems, the customer service, the accounting department, and the marketing department are authorized to access the necessary data.
Data retention and erasure	2 years after the end of the contractual activity
Processing legal basis	The legal basis for the use and processing of personal data is based on the execution of the contract or, failing that, our legitimate interests of a commercial nature.

DATA FROM NEWSLETTERS AND INVITATIONS TO EVENTS

Our clients, subscribers who consent, and our professional interlocutors (suppliers, institutional, partners, …) may receive our informative or commercial communications by email, phone, or mail. In this context, a newsletter system or guest listing may be set up by our company, which is the data controller. You can notify dpo@groupe-voltaire.com that you no longer wish to receive our communications or click on the dedicated buttons. The purpose of this registration, which contains personal data (name, first name, address, function, telephone, email, …), is the dissemination of news or commercial offers or the organizational and promotional management of events. Only the marketing team and management in case of problems are authorized to access the communicated or recorded data. We note that, in rare cases, we may enrich our invitation data with public information (for example, from the trade register) and transfer data to outsourced event organization companies. The maximum duration of personal data retention is set at 3 years after the end of the relationship with guests or subscribers (subject to technical possibility). The legal basis for the use and processing of personal data is based on the consent of the concerned interlocutors or our legitimate interest as a company or the legitimate interest of the person concerned.

POTENTIAL OR CURRENT SUPPLIER DATA

The identity of the interlocutors at our referenced or potential suppliers, all documents or data provided to become a supplier as well as the accounting documents of our suppliers are collected by GROUPE VOLTAIRE, which is the data controller, for the purpose of managing the supplier relationship and accounting. Only the management, personnel in charge of purchases and projects related to a supplier, as well as the accounting and quality departments are authorized to access the recorded or communicated data. The maximum duration of data retention is set at the end of operational need. The legal basis for the use and processing of your personal data is based on the consent of the concerned interlocutors or, failing that, our legitimate interest as a buyer or, failing that, the execution of a purchase contract. We note that, in rare cases, we may enrich our active or potential supplier data with public information.

DIRECTORY AND DIRECTORY OF PARTNER CONTACTS

A listing-partner system (potential or active) has been set up by GROUPE VOLTAIRE, which is the data controller. The purpose of this registration, which contains personal data (name, first name, function, telephone, email…), is to manage the partner relationship. Only the management and authorized personnel have access to the communicated or recorded data. We inform our partners that we may enrich our data with public information. The duration of personal data retention is set at the end of operational need. The legal basis for the use and processing of personal data is based on the consent of the concerned interlocutors or on our legitimate interest as a company.

JOB APPLICATION OR INTERNSHIP REQUEST

Data processing controller	Groupe Voltaire
Processing purposes	Evaluate the suitability of the candidate for a possible position to be filled; Feed our CV database; Organize interviews.
Processed data	CV, cover letter if applicable and all other documents or data provided (by yourself or your former employers) when applying for a job.
Recipients and possible source personal data originate	Only the management, recruitment department, and managers involved in recruitment can access the communicated or recorded data. We inform that we may transfer data to partner structures, including schools, institutions, and subsidiaries (sometimes outside the EU within the framework of specific consent) We inform you that we may enrich our candidate data with public information, from job boards or partners, especially from professional social networks.
Data retention and erasure	The maximum period for which the personal data will be stored is settled to 2 years after relationship inactivity.
Processing legal basis	The legal basis for the use and processing of your personal data is based on the consent of the data subjects or, failing that, our legitimate interest as a recruiter or, failing that, the legitimate interest of the candidate or, failing that, the performance of pre-contractual measures.

SECURE IT ARCHITECTURE

Our data is securely hosted in our premises or our certified ISO27001 outsourced datacenters located in the European Union, including Google Workplace, Google Cloud, OVH, and AWS. However, we do signal the possible use of American clouds, including Google Firebase, which can securely transfer data outside the EU under the framework of CTT (Contractual Clauses Types) or BCR as well as Privacy Framework.

YOUR RIGHTS

We inform that information about our interlocutors of any type (clients, suppliers, partners, …) may be transferred to dispute resolution or control partners: outsourced lawyers, accounting and HR firms, institutions, parent companies… According to the European GDPR legislation, you have at any time the right of access to, rectification, erasure, restriction, portability, consents changes for your personal data. You may also oppose, for legitimate grounds, the processing of your personal data. If you wish to exercise these rights, please write to dpo@groupe-voltaire.com or by postal mail addressed to Service DPO, Groupe Voltaire - SAS - Technopôle Izarbel, 231 allée Fauste d’Elhuyar, 64210 Bidart. You also have the right to withdraw your consent at any time and you may also initiate a claim to concerned the EU-GDPR supervisory authority - especially the CNIL for France.