PRIVACY POLICY

(22 December 2020)
This Privacy Policy (the “Privacy Policy”) clarifies how the company CREADS processes personal data, as well as the different rights of the data subject. This Privacy Policy may be amended and will enter into force on the date of publication of its update on the CREADS websites (the “websites”) notwithstanding the rights acquired prior to such amendment.

ARTICLE 1 - CONTROLLER

The data controller is the person who determines the purposes and means of processing personal data, in other words, the person who defines the objectives for which the data is processed.

The company CREADS, a simplified French joint-stock company with a share capital of 691,096 Euros, registered at the Company Register of Paris under number 504 019 662, with registered office at 112 rue Réaumur – 75002, Paris (France) (hereinafter, the “Company”), edits the CREADS websites and acts as the data controller.

If you have any questions or requests concerning personal data, please contact us via our postal address at CREADS, Département Juridique, 112 rue Réaumur, 75002, Paris or via our email address.

ARTICLE 2 - NATURE OF PERSONAL DATA

Personal data is any information that refers to an identified or indirectly identifiable natural person (in particular, referring to an identifier, such as a name, identification number, data about location, online username, or one or more specific aspects about their physical, philosophical, genetic, psychological, economic, cultural or social identity).

ARTICLE 3 - COLLECTION OF PERSONAL DATA

Within the framework of the provision of our services, we collect personal data directly from you when you fill out personal data collection forms and you use the features that are available on our websites.

We may also collect personal data from third parties acting in connection with the provision of our services (in particular, for the payment of our services).

In addition to this, we may collect and obtain, directly or indirectly, personal data based on an analysis of your behaviour when you use our website, in accordance with cookies regulations.

The personal data we collect may include, in particular,

your surname, first name, pseudonym, sex, email address, signature, photo, postal address, information in regard to your professional life, exchanges and comments on our website and applications, your IP address, and the type and language of your browser.

We do not collect personal data that is related to your racial or ethnic origin, political opinions, religious or philosophical beliefs, or union memberships, nor do we process genetic or biometric data that can be used to identify a natural person, data relating to your health, sexual health, or sexual orientation.

Our website is not intended for children under fifteen (15) years-old; therefore, we do not intentionally collect such data and we reserve the right to delete it in the event that we become aware of the transfer of this data.

If you provide us with personal data relating to a third party, you shall be responsible for ensuring that such data has been collected in a lawful, fair and transparent manner and that this third party did not object to this transfer.

ARTICLE 4 - PURPOSES OF PROCESSING

In addition to the personal data processed within the framework of the request to exercise your rights, in relation to our websites, we process your data for the following purposes:

4.1 Managing requests for information

To manage our responses to your requests for information, we process personal data you provide within this framework.
Data: identity, personal data related to requests for information.
Duration: requests and responses shall be kept for two years from the last contact.
Legal basis: consent (willingness, on your part, to provide us with this data to be processed to provide you with a response).

4.2 Managing job applications

To manage job applications available at CREADS, we process relevant personal data to assess and select applicants.
Data: identity (surname, first name, address, photograph), professional data contained in your CV, cover letters and correspondence, application interviews and notes about these interviews, wishes expressed by applicants in terms of employment, assessment of professional skills based on objective criteria and in direct and necessary relation to the job being applied for.
Duration: data shall be destroyed once the application has been rejected or stored for two years with the applicant’s consent.
Legal basis: this processing is required for our legitimate interests in incorporating potential new collaborators.

4.3 Managing our creative community

We collect and process relevant personal data to monitoring relationships and contracts with our creative community, internal and external communication, and the generation of statistics.
Data: identity, contact information, projects undertaken, exchanges related to the implementation of projects, and statistics.
Duration: creative collaborators’ data shall be stored throughout the contractual relationship and for five years following its termination (prescription).
Legal basis: such processing is necessary to execute a contract or pre-contractual measures.

4.4 Managing relationships with our clients and prospects

In order to manage our relationships with clients and prospects, we collect relevant personal data for client management, non-payments management, trade statistics, market research actions and information related to market research, and management of access, rectification and opposition rights. Data: identity, address, email address, telephone number, fax number, internal processing code, data related to the monitoring of business relationships (orders, contracts, exchanges and client comments), data relating to loyalty actions, market research, selecting prospects, customer notices and comments about services, data related to transactions, payment methods, invoices and transaction data.
Duration: client data shall be stored throughout the contractual relationship and for five years following its termination (prescription). Prospect data shall be stored for a period of three years from the end of the business relationship or the end of the last contact with the prospect.
Legal basis (clients): such processing is necessary to execute a contract or pre-contractual measures.
Legal basis (market research): such processing is necessary for our legitimate interests to show our products and services on the market.

4.5 Managing our websites

We collect and process relevant personal data for the management of our websites and protecting its cybersecurity.
Data: identity, functions, contact information, data related to browsing (IP address, time stamp, cookies) and on digital platforms via share buttons and media communications, user contact management data, data related to managing technical suppliers, and data related to our audience and the use of the online service provided by CREADS.
Duration: login data (logs) shall be stored for six months, the data needed to generate statistics about the audience and the use of online services shall be stored for thirteen months and data related to exchanges with suppliers shall be stored for five years following the termination of the contract in question.
Legal basis: such processing is necessary for our legitimate interests to implement actions for monitoring the operation and use of our website.

Legal basis for non-technical cookies: consent.

4.6 Managing disputes

We collect and process relevant personal data for the preparation, exercise, and monitoring of disciplinary actions and judicial appeals and for executing the judgment issued, where appropriate.
Data: identification data related to the case, victims, witnesses, and judicial assistants (surname, first name, sex, date and place of birth, nationality, address, telephone number and email address), data related to the offences, convictions, or preventative measure (controversial facts, information, documents or elements collected that tend to establish the facts that may be susceptible to be reproached), features of the dispute (statements, testimonies, attestations, procedural acts, procedural documents), features of the dispute, conviction and monitoring of the proceedings.
Duration: during the dispute and after the termination of the appeal. Afterwards, archiving in a differentiated and secure medium if it is of historical interest.
Legal basis: such processing is necessary to execute a contract or pre-contractual measures in the event of a dispute relating to a contract.

4.7 Managing collaborators

We collect and process relevant personal data for the monitoring of collaboration contracts, joint projects implementation, internal and external communications, and the generation of statistics.
Data: identity, contact information, projects undertaken, exchanges related to the implementation of projects, and statistics.
Duration: creative collaborators’ data shall be stored throughout the contractual relationship and for five years following its termination (prescription).
Legal basis: such processing is necessary to execute a contract or pre-contractual measures.

4.8 Managing communication and events

We collect and process relevant personal data for the management of our marketing and communications events (registration, logistics organisation, assessment and statistics), and for submitting our sale communications.
Data: identity, contact information, exchanges related to project implementation and statistics.
Duration: data required to send newsletters shall be stored for as long as the interested party does not unsubscribe, press relations data shall be stored for five years, event-related data shall be stored for five years after the event in question has been held, and data from social media pages shall be stored for as long as the social media account in question is active (except for exercising the right to deletion or opposition).
Legal basis: such processing is necessary for our legitimate interests to implement communication actions and present our creative services.
Legal basis: your consent (which may be withdrawn at any time) to receive newsletters.

ARTICLE 5 - MANDATORY OR OPTIONAL NAUTRE FOR THE TRANSMISSION OF PERSONAL DATA

In our forms that collect personal data, we indicate which information is mandatory for the processing purpose in question. If these fields are not completed, CREADS shall not be able to implement the necessary actions for the processing purposes considered (for example, creating an identity-free account that it can be linked to).

ARTICLE 6 - TRANSMISSION OF PERSONAL DATA

In general, we do not transfer your personal data to third parties, however, we must transfer your personal data to our subcontractors, who process this data on our behalf (as our host), to our collaborators, who participate in the correct execution of our services, to our partners who are responsible for CREADS’ business activities (auditor, services responsible for internal control procedures, lawyers and legal agents) and to bodies, judicial assistants and ministerial officials within the framework of their debt collection or dispute management activities.

In addition to this, CREADS may be obliged to share personal data at the request of the public authorities, in particular, in order to meet the requirements in terms of respect for the personal data rights, national security or, more generally, law enforcement.

CREADS has implemented organisational and technical security measures adapted to the level of sensitivity of your personal data in order to protect them from any harmful infringement, loss, alteration, or disclosure to unauthorised third parties.

Your personal data is stored and processed within the European Union. However, CREADS may use certain service providers who are located abroad or who use subcontractors located abroad, including outside of the European Economic Area (EEA). In such cases, the transfer of your personal data outside of the EEA shall be carried out through the implementation of appropriate safeguards, applying the applicable legislation about the protection of personal data, in particular, via the signature, in each case, of the contractual clauses based on the European Commission’s form or any other mechanism under the GDPR (General Data Protection Regulation).

ARTICLE 7 – YOUR PERSONAL DATA RIGHTS

You may exercise the following rights, within the limits defined by law:

• Right to access: you may obtain information regarding the processing of your personal data and a copy of this data. ;


• Right to rectify: you may request the correction of your personal data that you believe to be incomplete or inaccurate. ;


• Right to erasure: you may request the deletion of your personal data. ;


• Right to restriction of processing: you may request a restriction of processing of your personal data. ;


• Right to data portability: you may exercise the right to have the personal data you provided returned to you or transferred to a third party, where technically possible, in a machine-readable format. ;


• Right to withdraw your consent at any time if the processing is done according to the legal basis of your consent (for example, receiving newsletters or non-technical cookies). ;


• Right to file any possible complaint with the French National Commission on Informatics and Liberty (CNIL). ;


• Right to establish instructions in relation to the storage, erasure, or communication of your personal data after your death. ;


• Right to object: right to object to the processing of personal data for reasons related to your particular situation.

ARTICLE 8 - EXERCISING YOUR RIGHTS

If you have any question or comments in regard to the content or execution of our Privacy Policy, please contact us (contact@creads.fr) for further information or details.

In order to exercise your rights, you may contact us with a copy of your proof of identity at one of the following addresses: via our postal address at CREADS, département juridique, 112 rue Réaumur, 75002 Paris, or via our email address.

We shall respond to you within one (1) month of receiving your request. However, this period may be extended to two (2) months, depending on the complexity and/or number of requests.

ARTICLE 9 – COOKIES

A “cookie” is a set of information, in general, small in size and identified by a name, that is transferred to your browser through a website that you are connected to. Your browser will store it for a certain period of time and forward it to the web server each time you reconnect.

When a cookie is fully functional (memorising information entered into forms, managing and securing access to reserved areas), its use does not require your prior consent. If it is not fully functional, its use requires your prior consent.

When you first browse the CREADS’ website, CREADS will ask for your consent to install non-fully functional cookies via a banner that explains the purposes of these cookies and a system for managing your preferences. You may set your potential consent or withdrawal of consent for the installation of non-fully functional cookies on your device at any time.

The personal data resulting from the installation of cookies shall be stored on your device for a maximum of 13 months.