Personal Data & GDPR | Kroqi.

Personal data protection

1. Preamble

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, otherwise known as the General Data Protection Regulation (hereinafter GDPR), sets out the legal framework applicable to personal data processing within the European Union.

The GDPR strengthens the rights and obligations of data controllers, processors, and data subjects.

In operating the websites accessible at the addresses /****, KROQI (hereinafter “the company”) implements personal data processing of its clients and prospects.

For a proper understanding of this policy, it is specified that:

  • “clients and prospects”: refers to all natural or legal persons who have initiated a commercial contact with the company;

  • the “data controller”: refers to the natural or legal person who determines the purposes and means of personal data processing. Under this policy, the data controller is the company;

  • the “processor”: refers to any natural or legal person who processes personal data on behalf of the company. This refers in practice to the providers with whom the company works and who handle personal data of the company’s clients and prospects (CRM solutions, technical providers, freelancers, etc.);

  • “data subjects”: refers to persons who can be identified, directly or indirectly, in the context of the company’s commercial and marketing activity, i.e. all clients/prospects;

  • “recipients”: refers to natural or legal persons who receive personal data. Data recipients can therefore be both employees of the company and external entities (partners, banking institutions, agents, etc.).

The GDPR, in Article 12, requires that data subjects be informed of their rights in a concise, transparent, intelligible, and easily accessible manner.

The contact email address is “dpo-wimi@racine.eu”, and the DPO is specifically named as “Maître Eric Barbry, Cabinet Racine Avocats”.

2. Purpose

To ensure its proper operation, the company is required to implement and operate personal data processing relating to its clients and prospects.

This policy aims to satisfy the company’s information obligation and thus to formalize the rights and obligations of the company’s clients and prospects with regard to the processing of their personal data.

3. Scope

This personal data protection policy is intended to apply in the context of the personal data processing of the company’s clients and prospects.

This policy covers only the processing for which the company is the data controller and therefore does not cover processing that would not be created or operated by the company itself (so-called “wild” processing).

Personal data processing may be managed directly by the company or through a processor specifically designated by the company.

This policy is independent of any other document that may apply within the contractual relationship between the company and clients and prospects.

4. General principles

No processing is implemented in the company concerning client and prospect data if it does not relate to personal data collected by or for our services or processed in connection with our services, and if it does not meet the general principles of the GDPR.

5. Collection of personal data

5.2 Types of data

The company collects personal data necessary for operating these websites and these services (e.g. Kroqi) and for commercial prospecting.

5.3 Origin of data

Client and prospect data come notably from data collected by registration and contact forms via the website, as well as through commercial prospecting and the purchase of client databases.

5.4 Mandatory data

Mandatory data are indicated on forms by an asterisk. Without them, the service tied to that collection may not be provided.

6. Types of data collected

6.1 Non-technical data

The company notably collects the following data:

  • identification data (name, email address, phone);

  • banking data (only if the prospect becomes a client).

6.2 Technical data

The company collects connection data to the service (e.g. time, device type, browser language, etc.).

Depending on the case, the company processes your data for the following purposes:

  • managing registration and subscription to these services;

  • managing connection to the services;

  • managing the newsletter;

  • managing the user’s discovery of the services;

  • communicating with the support service;

  • communicating important information about the services;

  • managing unsubscription and account closure requests for the services;

  • managing requests relating to users’ rights over their data;

  • managing contact and support requests;

  • managing accounting and invoices;

  • managing data retention in accordance with legal security obligations;

  • managing unpaid bills and litigation;

  • improving the services provided through satisfaction surveys;

  • managing and monitoring the client, user, and prospect relationship, including segmentation and targeting operations to best meet user needs;

  • producing statistics to optimize the services.

The client is informed that the collection of their personal data is necessary for the execution of the contract concluded with the company.

8. Data recipients: authorization & traceability

The company ensures that data is accessible only to authorized internal or external recipients.

Internal recipients

External recipients

  • authorized personnel of the marketing service, sales service, services in charge of handling client relations and prospecting, administrative services, logistics and IT services, and their hierarchical managers;

  • authorized personnel of services in charge of audit (statutory auditor, services responsible for internal audit procedures, etc.).

  • partners, external companies, or affiliates of the same group of partner companies;

  • bodies, court agents, and ministerial officers in the context of their debt collection mission;

  • the company’s processors and, more particularly, the personnel of these processors authorized to use personal data.

Data recipients of clients’ and prospects’ personal data within the company are subject to a specific confidentiality obligation.

The company decides which recipient is authorized internally to receive data.

The authorization policy is regularly updated and takes into account the arrivals and departures of company employees with access to data.

The company is in no way responsible for damages of any kind that may result from unlawful access to personal data.

If an employee realizes they have access to data they should not have access to, they have an obligation to notify the relevant service immediately.

All access concerning processing relating to personal data of clients and prospects is subject to a traceability measure.

In addition, personal data may be communicated to any authority legally entitled to access them. In this case, the company is not responsible for the conditions under which the personnel of these authorities access and use the data.

9. Retention period

The data retention period is defined by the company in light of the legal and contractual constraints that apply to it and, failing that, according to its needs and notably the following principles:

Processing

Retention period

Data relating to clients

Client data is retained throughout the use of the KROQI service.

Data relating to clients in the context of commercial prospecting

Client data is retained for a maximum period of 3 years from the unsubscription from the company’s services.

Data relating to prospects

Prospect data is retained for a maximum period of 3 years from the last contact from the prospect.

Technical data

IP addresses and logs of clients/prospects are retained for a period of one year from the last connection or last use of the software.

Banking data

Banking data is in principle deleted as soon as the transaction is completed, unless the client expressly agrees otherwise.

However, for evidentiary purposes, banking data may be retained in archives for 13 months from the debit date.

Cookies

Cookies may be retained for a period of 13 months.

Data used to establish proof of a right or a contract, or retained in compliance with a legal obligation, is subject to an intermediate archiving policy for a duration not exceeding the duration necessary for the purposes for which it is retained, in accordance with current provisions.

Past the set deadlines, data is either deleted or kept after being anonymized, particularly for statistical purposes.

Clients and prospects are reminded that deletion or anonymization are irreversible operations and that the company is no longer subsequently able to restore them.

10. Right to confirmation and right of access

Clients and prospects have the right to ask the company for confirmation that data concerning them is or is not being processed.

Clients and prospects also have a right of access, subject to compliance with the following rules:

  • the request comes from the person themselves and is accompanied by a copy of a valid ID;

  • The access request can be sent to the postal address: 4 avenue du Recteur Poincaré, 75016, PARIS, France or by email to dpo-wimi@racine.eu.

Clients and prospects have the right to request a copy of their personal data being processed from the company. However, in the event of a request for an additional copy, the company may require the financial assumption of this cost by clients and prospects.

If clients and prospects present their request for a copy of the data electronically, the requested information will be provided to them in a commonly used electronic form, unless otherwise requested.

Clients and prospects are finally informed that this right of access cannot cover confidential information or data, or information for which the law does not authorize disclosure.

The right of access must not be exercised abusively, that is, performed regularly for the sole purpose of destabilizing the relevant service.

11. Right to rectification

To enable regular updating of personal data collected by the company, the company may solicit clients and prospects who will have an obligation to satisfy the company’s requests.

In the event of modification of clients’ and prospects’ information by the company, they will be spontaneously informed of it.

Clients and prospects are informed that the company will make no “convenience” modifications; only substantive modifications on the civil status, identity, and contact details of the data subject will be made.

12. Right to object

The right to erasure of clients and prospects will not apply in cases where processing is implemented to meet a legal obligation.

Outside this situation, clients and prospects may request the deletion of their data in the following limitative cases:

  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

  • when the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing;

  • the data subject objects to a processing necessary for the purposes of the legitimate interests pursued by the company and there is no compelling legitimate ground for the processing;

  • the data subject objects to a processing of their personal data for prospecting purposes, including profiling;

  • the personal data have been unlawfully processed.

In accordance with personal data protection legislation, clients and prospects are informed that this is an individual right that can only be exercised by the data subject in relation to their own information: for security reasons, the relevant service will therefore have to verify your identity to avoid any disclosure of confidential information about you to another person.

13. Right to erasure

Clients and prospects are informed that they do not have the right to restrict the processing of their personal data insofar as the processing carried out by the company is lawful and all personal data collected are necessary for the execution of the commercial contract.

14. Right to restriction of processing

Upon termination of the commercial relationship with the company, clients may, on request, exercise their right to portability over only the data they themselves provided to the company solely for the data collected through the online form. This data will be communicated to them in a structured, commonly used, and machine-readable format.

15. Right to data portability

The company performs profiling techniques for commercial prospecting purposes. As such, the data subject gives their explicit consent for data to be used for profiling purposes.

16. Automated individual decision

Clients and prospects are informed that they have the right to formulate directives regarding the retention, erasure, and communication of their data post-mortem. The communication of specific post-mortem directives and the exercise of their rights is carried out by email to wimi@racine.eu or by post to the following address 112 Rue Réaumur, 75002 Paris, France, accompanied by a copy of a signed ID.

17. Post-mortem right

Clients and prospects are informed on each personal data collection form whether responses are mandatory or optional by the presence of an asterisk.

In the case where responses are mandatory, the company explains to clients and prospects the consequences of a lack of response.

18. Exercise of rights

The company is granted by clients and prospects a right to use and process their personal data for the purposes set out above.

However, the enriched data, which is the fruit of processing and analysis work by the company (also called enriched data), remains the exclusive property of the company (usage analysis, statistics, etc.).

19. Subprocessing

The company informs its clients and prospects that it may involve any subprocessor of its choice in processing their personal data.

In this case, the company ensures the subprocessor’s compliance with its obligations under the GDPR, the company only using subprocessors that respect the rules in personal data protection matters and strictly comply with GDPR requirements.

20. Security measures

It is the company’s responsibility to define and implement the technical security measures, physical or logical, it deems appropriate to combat the destruction, loss, alteration, or unauthorized disclosure of data accidentally or unlawfully.

These measures mainly include:

  • authorization management for data access;

  • the use of an SSL-type encryption protocol for data transmission between user terminals and the company’s servers.

  • Hosting carried out on data centers located in France with maximum security.

  • All access to the infrastructure is via VPN: only certain predefined IPs are authorized to establish a tunnel (IP allowlist) using an RSA 4096 key.

  • Regular, systematic application of security patches on the infrastructure components.

To do this, the company can be assisted by any third party of its choice to carry out, at the frequencies it deems necessary, vulnerability audits or penetration tests.

Except in cases of urgency or imminent risk, employees will be informed in advance of these audits and will be required to take appropriate protective measures that will be notified to them in advance.

In any event, the company undertakes, in the event of a change of means aimed at ensuring the security and confidentiality of personal data, to replace them with means of higher performance. No development can lead to a regression in the level of security.

In the event of subprocessing of part or all of personal data processing, the company undertakes to contractually impose on its subprocessors security guarantees through technical data protection measures and appropriate human resources.

21. Data transfer outside the European Union

In the event of a personal data breach, the company undertakes to notify the CNIL under the conditions prescribed by the GDPR.

If the said breach poses a high risk to clients and prospects and the data has not been protected, the company:

  • will notify the clients and prospects concerned;

  • will communicate to the clients and prospects concerned the information and recommendations necessary.

22. Cookies policy

We have appointed a data protection officer who can be contacted at the following address for any question relating to data processing:

Name: Maître Eric Barbry, Cabinet Racine Avocats;
Email: dpo-wimi@racine.eu
Tel: 01 44 82 43 00

23. Evolution of this document

Clients and prospects concerned by the processing of their personal data are informed of their right to lodge a complaint with a supervisory authority, namely the CNIL, if they consider that the processing of personal data concerning them is not compliant with the European data protection regulation, at the following address:

CNIL, Complaints department

3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07

Tel: 01 53 73 22 22

24. Questions

This policy may be modified or adjusted at any time in the event of legal or jurisprudential evolution, decisions and recommendations of the CNIL, or usage.

Any new version of this policy will be brought to the attention of clients/prospects by any means defined by the company, including electronic (distribution by email or online, for example).

25. Credits

For any additional information, you can contact the following services: dpo-wimi@racine.eu

For any other more general information on personal data protection, you can consult the CNIL website at www.cnil.fr.

For any question on the security, compliance or sovereignty of your data, contact sales@kroqi.fr.