Datenschutzrichtlinie

1. Introduction

This Privacy Policy (hereinafter the "Policy") of the Cleeven Group (hereinafter "We" or "Cleeven"), as well as any document referred to herein, details how Cleeven collects and processes Personal Data relating to (i) employees and candidates, (ii) users of the website www.cleeven.com (hereinafter the "Site"), (iii) suppliers and other external service providers, and (iv) clients (collectively hereinafter "You"). This Policy also includes information on the type of Personal Data collected, how Cleeven processes them, and the purposes of these processing activities.

We process your Personal Data as the Data Controller and in compliance with the principles set out by the applicable regulations on Personal Data protection, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR"), and Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended (collectively hereinafter the "Personal Data Regulations").

These processing activities are carried out in accordance with the legislation and the following principles:

  • Lawfulness of processing: your Personal Data are collected for specified, explicit, and legitimate purposes, and based on an appropriate legal basis. Our Policy is regularly updated;
  • Data minimization: We commit to collecting and processing only the Personal Data strictly necessary for the purpose we pursue;
  • Retention period of Personal Data: if the retention of your Personal Data is not mandatory and they are no longer useful for the processing carried out, We commit to destroying them under the conditions provided in Article 3 of this Policy;
  • Transparency of processing: We inform you of each processing activity we implement on your Personal Data through an information notice. No processing of your Personal Data is carried out without your knowledge, and We refrain from selling your Personal Data.

This Policy may evolve depending on the applicable legal and regulatory context or the evolution of our activity, including the products and services We offer.

2. Definitions

For the purposes of this Policy, the following terms shall have the meanings set forth below:

  • "Personal Data": any information relating to an identified or identifiable natural person, i.e., "a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural, or social identity";
  • "Processing": any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
  • "Data Controller": Cleeven;
  • "Recipient": a natural or legal person, public authority, service, or any other body to whom Personal Data are disclosed, whether or not a third party.

For all practical purposes, it is specified that when Personal Data have not been collected directly from you, the collection is limited to the identification data of the data subjects concerned.

3. Data Controller

The Data Controller is Cleeven.

The person representing the Data Controller in matters of human resources is Mrs. Marie-Claire VALENTINI GUICHARD in her capacity as Human Resources Director, whose contact details are as follows: mcgv@cleeven.com.

4. Processing of Your Personal Data

In accordance with Article 6 of the GDPR, each Processing of Personal Data carried out by the Data Controller is based on a legal basis.

We implement various Processing activities of your Personal Data to pursue the purposes described in Annex 1, whose legal bases are as follows: your consent, the performance of a contract concluded with You, our legitimate interest, or our legal and regulatory obligations.

In accordance with the Personal Data Regulations, the Personal Data We collect will be retained only for the duration necessary to achieve the purposes and for the period detailed in Annex 1 of this Policy. At the end of the retention periods, your Personal Data will be deleted or, for those we are legally required to keep, archived and retained for an additional period corresponding to the legal prescription period. At the end of this period, your Personal Data will be deleted.

Types of Personal Data Collected

Depending on your mode of interaction and communication with Us (online, offline, by phone, etc.), We may collect from You different types of information, which differ according to the purposes We pursue, under the following conditions:

  • Contact details and personal information that You have provided to us in the context of recruitment (name, first name, date of birth, postal address, email address, phone number, education and degrees, bank account details, health insurance, social security certificate, personal situation, residence permit, driving license, proof of address, medical certificates, your image if applicable);
  • In the context of prospecting or applications, personal and geographical contact details including: name, first name, email address, country of residence;
  • In the context of the relationship with clients and suppliers/external service providers, company contact details (company name, SIRET number, name and first name of the person in charge, email address, phone number, bank account details, VAT number, accounting information);
  • Technical information on the devices You use to access our Site, such as the operating system and Internet Protocol (IP) address;
  • In the context of your use of our Site: last site visited, pages viewed, advertisements you have clicked on.

Recipients of Your Personal Data

The Data Controller may transmit some of your Personal Data, notably to the following Recipients:

  • The tax administration;
  • Social security organizations;
  • Pôle Emploi (French employment agency);
  • Pension and supplementary retirement organizations;
  • Occupational medicine;
  • Professional training organizations;
  • Generally, any public or private body entitled to request the communication of all or part of the Personal Data by virtue of law or a court decision (e.g., government websites, bailiffs, public accountants, etc.);
  • Potential buyers in the context of a sale of the company or a transfer of all or part of the staff under the application of Article L.1224-1 of the French Labor Code or otherwise;
  • Possible subcontractors;
  • The administrative services of Cleeven (general services, finance, IT, etc.);
  • Entities of the Cleeven group in charge of centralized management of our clients' databases or whose intervention would be necessary for the execution of the Processing implemented in accordance with this Policy;
  • Our service providers involved in all or part of the identified Processing activities (notably IT service providers responsible for maintaining the Site, technical intermediaries in the field of advertising and personalized communications).

Also, it is possible that your Personal Data may be transmitted if required by law and government authorities. In the event of a transfer of one of our activities or our company to another company, the legal successor will have access to the Personal Data held by the transferring entity and therefore probably to some of your Personal Data.

5. Transfer of Personal Data Outside the European Union

We do not transfer your Personal Data outside the European Union.

We may transfer your Personal Data within the different entities of the Cleeven group (Cleeven Ac, Cleeven Ge, Cleeven Li, Cleeven Nd, Cleeven Se, Cleeven Mo, Cleeven Sc, Cleeven Sg, Cleeven He, Cleeven Am, Cleeven Ac IT, Cleeven Sr, Cleeven Ba, HundredsLabs, and Umanite Expansion). We commit to complying with the applicable Personal Data regulations, and in particular to respecting the contractual framework established within the group regarding the management of intra-group transfers.

6. Your Rights

Right of Access

You may request access to your Personal Data that We collect and process.

If You make an access request, We will provide You with a copy of all Personal Data concerning You that we possess, along with the legally required information about the processing conditions:

  • the purposes of the Processing;
  • the categories of Personal Data concerned;
  • the Recipients to whom your Personal Data have been or will be disclosed;
  • the retention period of your Personal Data (or, failing that, the criteria used to determine this period);
  • any additional information about your rights concerning your Personal Data;
  • the procedures relating to the right to lodge a complaint with a supervisory authority;
  • any available information regarding the sources of your Personal Data when they have not been collected directly from You;
  • the existence of automated decision-making, including profiling, and, at least in such cases, useful information about the underlying logic as well as the significance and consequences of this Processing for You.

Right to Rectification

You have the right to obtain from the data protection officer, without undue delay, the rectification of your Personal Data that are inaccurate or incomplete.

Right to Erasure (“Right to be Forgotten”)

You have the right to obtain from the data protection officer the erasure, without undue delay, of your Personal Data, and the data protection officer has the obligation to erase such Personal Data without undue delay, in the following cases:

  • the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • You exercise your right to object to the Processing of your Personal Data;
  • You have withdrawn your consent to the Processing and there is no other legal basis for the Processing;
  • the Personal Data have been unlawfully processed;
  • the Personal Data must be erased to comply with a legal obligation under Union or national law to which the Data Controller is subject;

However, the right to erasure shall not apply in the following cases:

  • the Processing is necessary for compliance with a legal obligation which requires Processing by Union or national law to which the Data Controller is subject;
  • the Processing is necessary for the establishment, exercise, or defense of legal claims.

Right to Restriction of Processing

You have the right to obtain from the data protection officer the restriction of Processing in the following cases:

  • when You contest the accuracy of the Personal Data, for a period enabling the data protection officer to verify the accuracy of the Personal Data;
  • when the Processing is unlawful and You oppose the erasure of your Personal Data and request the restriction of their use instead;
  • when the Data Controller no longer needs the Personal Data for the purposes of the Processing but they are required by You for the establishment, exercise, or defense of legal claims;
  • when You have objected to the Processing of your Personal Data, You may request the restriction of this Processing while We examine your complaint.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the Processing of your Personal Data based on legitimate interests pursued by the Data Controller.

The Data Controller will no longer process your Personal Data unless it demonstrates compelling legitimate grounds for the Processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.

You may also, at any time, object to the Processing of your Personal Data by us when this Processing is carried out for direct marketing purposes by electronic or postal means.

Right to Data Portability

You have the right to data portability of your Personal Data, provided that the exercise of this right does not infringe upon our rights and freedoms or those of third parties. This right differs from your right of access because it concerns only the Personal Data that you have provided to us (for example, automatically collected data are not included).

Provided that the Processing in question has been carried out by automated means, You have the right to receive the Personal Data concerning You that have been provided to the Data Controller, in a structured, commonly used, and machine-readable format, and the right to transmit those Personal Data to another data controller without hindrance from the Data Controller.

You also have the right to have your Personal Data transmitted directly from the Data Controller to another, where technically feasible.

Right to Lodge a Complaint with Cleeven or a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, any person who considers that the Processing of their Personal Data infringes the Personal Data Regulations and the principles set out in this Policy has the right to lodge a complaint.

To exercise your rights, you must send an email to Cleeven's data protection officer at dpo@cleeven.com or by postal mail addressed to the Data Protection Officer [Umanite Expansion company, 94 Quai Charles de Gaulle, Cité Internationale, 69006 Lyon].

To ensure that your request is processed as quickly as possible, please:

  • indicate your last name, first name, postal address, and email address;
  • specify the information to which you wish to have access;
  • provide the service(s) for which you are making your request;
  • prove your identity by any appropriate means.

Please note that any information provided to us will be processed only in accordance with, and to the extent permitted by, applicable laws. However, if You believe, after contacting us in this regard, that your rights relating to your Personal Data are not respected, You may file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) (3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 – Phone: 01.53.73.22.22 or at https://www.cnil.fr/fr/plaintes).

To assert your rights, You may also mandate a non-profit body, organization, or association that has been validly and legally constituted, whose statutory objectives are in the public interest and is active in the field of protection of the rights and freedoms of data subjects regarding the protection of your Personal Data, to lodge a complaint on your behalf with the CNIL or to exercise on your behalf your right to an effective judicial remedy against the Data Controller or a processor.

7. Cookies

Definition and Purpose

Cookies may be installed on the Site, either by the publisher, by third-party partner or provider websites or applications, or through links with social networks.

Through this information, we wish to:

  • Help you better understand how cookies work and how to configure them;
  • Inform you of the presence of cookies on the Site, their purposes, and their retention period on your computer.

Our Site includes a banner allowing you to indicate your choices prior to the placement of the cookies described below.

Cookies are stored on the user's computer hard drive or memory. A cookie is a small file sent by a web server (which is the computer on which the visited website is running) to the user's browser (Internet Explorer, Mozilla Firefox, Google Chrome, etc.). Cookies allow the Site to function efficiently and improve its performance; they also provide information to the owner for statistical or advertising purposes, mainly to personalize the browsing experience by remembering preferences and navigation methods.

Cookies have different functions and are used to allow us to:

  • Establish statistics of traffic and use of our Site;
  • Adapt the presentation of our Site to your device's display preferences (display resolution, language, etc.);
  • Remember the information entered in the forms completed on our Site (e.g., contact form);
  • Implement appropriate security measures, notably against fraud, and prevent cyber-attacks.

Cookies do not collect information that directly identifies the user. Indeed, Cleeven cannot, through cookies, trace back to any personal information directly identifying a person (e.g., name, first name) if the information is not directly provided by the user. Furthermore, another website cannot use a cookie issued by Cleeven to access other information contained in the user's computer. Once stored on the computer, the cookie can only be read by the website that created it (and therefore, in our case, by https://cleeven.com).

Cookies can be "session" cookies (when they are stored exclusively for the duration of the browsing session on the Site and are erased when the browser is closed), or "persistent" cookies (they are stored for a longer period, until their expiration or deletion by the user).

Different Types of Cookies Used on Our Site

Cleeven uses various types of cookies and similar technologies, each of which has a specific function.

To optimize the use of the Site and personalized features, the computer, tablet, or mobile device must accept cookies. Our information regarding the use of cookies provides instructions on the types of cookies used and how to manage, control, and delete them.

We wish to clarify that cookies do not damage your device.

Browsing Cookies

This type of cookies allows the Site to function properly and display content on your computing device by recognizing the language and currency of the country from which you have decided to connect. If you are a registered user, they will allow us to recognize you and provide access to services offered in the dedicated areas. Browsing cookies are technical cookies and are necessary for the operation of the Site.

These session cookies are issued by the Site on the user's computer during navigation, but they are stored exclusively for the duration of that browsing session. This means that when the user closes their browser, the cookies are automatically deleted and disappear without remaining in the computer's memory. They consist of random numbers generated by the server and ensure a safe and efficient exploration of the Site.

Cookie Name Cookie Provider Cookie Function (Description) First-party or Third-party Cookie Cookie Duration
cle_lang Cleeven Display the site in the chosen language / allows keeping the version of the site used (language) for the next visit First-party 1 year

Functional Cookies

These cookies allow, based on the express request of the user, to facilitate navigation within the Site, for example by recognizing login data to a user account so that they do not have to enter their data at each visit (e.g., "Remember me").

Functional cookies are not essential for the operation of the Site, but they improve the quality and experience of navigation.

Cookie Name Cookie Provider Cookie Function (Description) First-party or Third-party Cookie Cookie Duration
Not applicable

Analytical Cookies

These cookies are used to develop statistical analyses on how users navigate our Site. We use certain third-party services that independently install their own cookies.

Cookie Name Cookie Provider Cookie Function (Description) First-party or Third-party Cookie Cookie Duration
Not applicable

Marketing and Profiling Cookies

These cookies aim to create user profiles to send commercial messages that align with the preferences expressed during the visit or to improve your browsing experience: when You browse our Site, these cookies are useful to show You products of your interest or similar to those You have viewed. These persistent cookies are issued by the Site on the user's computer during navigation and are stored beyond the duration of the browsing session, until their expiration or deletion by the user.

The use of these cookies requires the user's express and informed consent.

Cookie Name Cookie Provider Cookie Function (Description) First-party or Third-party Cookie Cookie Duration
Not applicable

Social Media Cookies

These cookies allow your social networks to interact with our Site. They serve, for example, to let you express yourself and share our Site with your online friends. Social media cookies are not necessary for navigation.

On certain websites, some applications allow the user to make known or share the content of the Site with other people, notably on social networks such as Facebook, Twitter, Instagram via a dedicated sharing button (hereinafter "plugins"). They are issued and managed by the publisher of the concerned social network.

We do not control the processing process, volume, purposes, or retention periods of Personal Data collected by each of these providers. Even if the user has not used plugins, it is possible that social networks track the navigation of the latter if his or her account or session is activated on his or her computer at the time of navigation.

Cookie Name Cookie Provider Cookie Function (Description) First-party or Third-party Cookie Cookie Duration
Not applicable

The placement of these cookies requires your consent. You can accept or refuse them.

Disabling/Deleting Cookies Through the Web Browser

It is possible to disable/enable or delete cookies at any time through the configuration of your Internet browser. You can configure your own browser to be alerted to the presence of a cookie and decide whether to accept it or not. It is also possible to automatically refuse all cookies by activating the option provided for this purpose in the browser. Finally, it is possible to eliminate specific cookies that have already been stored within the browser, or block the storage of cookies on the computer by specific websites, or block third-party cookies.

Each browser has its own way of managing cookies, so it is possible to modify/manage settings and proceed to deletion on the administration panel or preferences.

To disable the use of all or just some cookies, it is necessary to modify the browser configurations (Firefox, Chrome, Explorer, Safari, Opera, etc.).

To do this, you can consult the information provided in the browser's instruction booklet (called the Help Page) or click on the links below:

For more information on cookies and to manage your preferences on third-party profiling cookies, we invite you to visit http://www.youronlinechoices.com.

To disable analytical cookies and prevent Google Analytics from collecting data on your browsing, you can download the Browser Add-on for disabling Google Analytics: https://tools.google.com/dlpage/gaoptout.

Acceptance of Cookies

By continuing to browse this Site and closing the informational banner relating to cookies or clicking on any part of the page or navigating to another page of the Site, the user declares to have read the Policy and gives their specific consent for the use of cookies.

We inform you that your consent will be required only upon the first access to the Site and then every six (6) months following the date of your last consent. Through the use of a technical cookie, we will remember your consent to allow you to directly access the pages of the Site on subsequent visits (without prejudice to the right to disable/enable cookies at any time or to delete them). In this case, or after this period of six (6) months, the Site will ask for your consent again. Moreover, if the user registers on the Site and gives their specific consent during registration for tracking their navigation, the data relating to navigation within the Site may be associated with their Personal Data.

In case of non-acceptance of cookies by abandoning the navigation, any cookies already locally stored on the browser will remain stored but will no longer be read or used by Cleeven until a subsequent and possible acceptance of the Policy. There will always be the possibility to remove these cookies at any time by following the indications referred to on the sites in the paragraph "Disabling/Deleting Cookies Through the Web Browser".

8. Security of Personal Data

We have implemented appropriate technical and organizational measures based on the sensitivity level of the Personal Data collected, in order to ensure the integrity and confidentiality of your Personal Data and to protect them against any malicious intrusion, loss, alteration, or disclosure to unauthorized third parties. In particular, we use encryption and/or pseudonymization techniques for your Personal Data whenever possible, useful, or necessary.

We carefully select our subcontractors, providers, and partners and require them to:

  1. ensure a level of protection for your Personal Data equivalent to ours;
  2. use your Personal Data only to the extent necessary to provide the services we have entrusted to them;
  3. strictly comply with the Personal Data Regulations.

9. Changes to Our Policy

In the event of changes in how we manage and process your Personal Data, we will update this Policy. We reserve the right to modify our practices and this Policy at any time. Please check regularly for updates or changes to our Policy.