PRIVACY NOTICEFOR ORANGE BUSINESS CORPORATE CUSTOMERS AND PROSPECTS*

Introduction
Orange Business provides a range of solutions tailored to its customers’ needs. In doing so, Orange
Business processes certain Customer Personal Data (as defined in section 1).
Orange Business is committed to protect Customer Personal Data in accordance with applicable
personal data protection and information security laws, including but not limited to the EU General Data
Protection Regulation 2016/679 (the “GDPR”), the EU ePrivacy legislation, and other applicable national
personal data protection laws.
Orange Business is made up of different legal entities in different countries. This privacy notice is issued
on behalf of all the Orange Business entities.
This privacy notice explains how the Orange Business entities (“Orange Business”, “we”, “us” or “our”)
use and protect Customer Personal Data and provides information about the rights individuals have inrespect of their Customer Personal Data.
Please click through to any of the areas listed below.
1. Definitions
2. The scope of this privacy notice
3. Who we are and our contact information?
4. What Customer Personal Data may we collect?
5. How do we use Customer Personal Data as Controller and Processor?
6. To whom may we disclose Customer Personal Data?
7. International Transfers of Customer Personal Data
8. Our data security practices
9. Our data retention policy
10. Data subjects’ rights* (formerly known as Privacy Policy for Orange Business Services Corporate Customers and Prospects)
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

1

1.

2.

Definitions
Controller

has the meaning set out in the GDPR (or of the nearest equivalentterm in the applicable data protection legislation); in short, it is thecompany that (alone or jointly with others) determines the purposes
and means of the processing of Personal Data

Customera customer or potential customer of Orange Business who is abusiness, enterprise or other organization, to the exclusion of natural
persons and SOHOs

Customer Personal Data(a) Personal Data that we collect from Customer representatives
during our relationship with Customers, such as when Customers
approach us to ask about our services, or when we communicate
with Customers during the provision of our services (“Customer
Representative Personal Data”); and (b) Personal Data that relates
to End Users provided to us by Customers or generated by us inconnection with the services that we provide to Customers (“EndUser Personal Data”)

Customer Representativea natural person authorized to represent a Customer

End Userthe natural persons who are the users of the solutions that we
implement for Customers, such as for example Customer
employees or clients

Personal Data

any information relating to an identified or identifiable natural person

Processor

has the meaning set out in the GDPR (or of the nearest equivalentterm in the applicable data protection legislation); in short, it is thecompany that processes Personal Data on behalf of the Controller

The scope of this privacy notice
What information does this privacy notice relate to?
This privacy notice applies to Customer Personal Data that Orange Business processes inconnection with its relationship with its Customers. This privacy notice describes our general
Personal Data protection framework and does not change the content of any individual contract
signed with our Customers.
This privacy notice does not apply to the Personal Data of natural persons who are contracting
directly with Orange Business for the provision of a service such as natural persons who subscribe
directly a mobile internet access service from Orange Business. The privacy notice of Orange
Business in respect of the Personal Data of customers who are natural persons is provided together
with the terms of use pursuant to which Orange Business provide the service.
Our services are not intended for use by children, and we do not knowingly collect Personal Data
relating to children.

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

2

The importance of reading this privacy notice, and keeping us updated
It is important that you read this privacy notice together with any other privacy notice or related
information we may provide on specific occasions, so that you are fully aware of how and why we
use Customer Personal Data. This privacy notice supplements other notices and privacy policies
and is not intended to override them.
It is important that all Customer Personal Data that we hold is accurate and current. Please keep
us informed if you become aware that any Customer Personal Data has changed during yourrelationship with us.
Third-party links
Our website www.orange-business.com may include links to third-party websites, plug-ins andapplications. Clicking on those links or enabling those connections may allow third parties to collector share Personal Data about you. We do not control these third-party websites and are notresponsible for their privacy statements. When you leave our website, please read the privacy noticeof the other websites that you visit.
Changes to this privacy notice
Our privacy notice is regularly reviewed. This version was last updated in August 2023.

3.

Who we are and our contact information?
Controller
An Orange Business entity acts as a Controller in respect of all Customer Personal Data collected
or generated by Orange Business for its own purposes, independently of its Customers’
requirements and for which the Orange Business entity solely determines the means of theprocessing outside of the contractual documentation agreed with the Customer.
Any Orange Business entity operating as an electronic communications service or network provider
and each third-party electronic communications service or network provider interconnected withan Orange Business entity may act as a Controller in respect of:•

End Users electronic communications metadata we process in order to build, operate andsecure the Orange Business network;•

End Users electronic communications metadata we process in order to transmit theirelectronic communications and, as regards voice communications, the Call Detail Records(CDRs) we process to produce the traffic details required for the invoice;•

End User Personal Data we process to perform activities that applicable law requires electronic
communications providers to undertake, such as monitoring for intrusion / fraud detection /security weaknesses and dealing with requests from law enforcement, security or regulatory
authorities.

The Orange Business entity engaging with you may act as a Controller in respect of Customer
Representative Personal Data, in relation to any Orange Business sales or marketing activities,
surveys, customer satisfaction or service improvement programs, events invitation andmanagement activities that involve such Customer Representative Personal Data.
Orange S.A. (Orange Business division) is the Controller in respect of the Personal Data ofCustomers Representatives processed through our website www.orange-business.com. The
Controller of any other public website is the Orange Business entity identified as the editor on therelevant website.
Orange Business may act as Controller in respect of Customer Personal Data for data analysis for
its own purposes.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

3

For further details on our processing activities as Controller and the type of Personal Data
processed, please see section 5.
Processor
The Orange Business entity you contract with as a Customer acts as a Processor in respect of all
Customer Personal Data collected or generated by Orange Business in order to provide its services
to the Customer, on its instructions, and not for any other purpose.
Each Customer defines the purpose of the processing of the Customer Personal Data by specifying
the services it procures from Orange Business entities and its end-users to which the service must
be provided. The means of the processing are described in the contractual documentation agreed
by Customer and the Orange Business entity.
For further details on our processing activities and the type of Personal Data processed, please see
section 5.
Data protection officer
We have appointed a global data protection officer (DPO) who is responsible for overseeing
questions in relation to this privacy notice. We also have appointed local data protection officers
where required. For requests to exercise your rights, please refer to section 10.
Contact details

For enquiries to the Chief Data Protection Officer or to any local data protection officer:
Email: obs.dpo@orange.com

Or; for enquiries relating to France only:
Email: obs.francedpo@orange.com

4.

What Customer Personal Data may we collect?
We may collect, use, store and transfer different types of Customer Personal Data which we havecategorised in the table below.

Category

Personal Data in category

Billing Datathe consumption data that Orange Business collects from services that itprovides to its Customers in order to calculate charging as well as billinginformation, to the extent related to natural persons.

Contact Data

first name, last name, email address, postal address and telephone numbers, jobrole within the Customer.

Support Data

Customer Representatives’ or End Users’ service ticket information, Customer
Representatives’ or End Users’ telephone recordings for incident.

Identity Data

first name, last name, honorific (e.g. Ms, Mr. Dr.,…), username or similar identifier,password, ID document / number.

Location Data

geographic location, device location, SIM card location for mobile services.

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

4Marketing andCommunications
Data

preferences in receiving marketing from us and/or third parties andcommunication preferences.

Profile Datainterests, preferences, comments, questions, feedback and survey responses.

Technical Datainternet protocol (IP) address, login data, browser type and version, time zone
setting and location, browser plug-in types and versions, operating system andplatform, as well as other technology on the devices natural persons use toaccess areas of our website or other technical data generated through the use of
the service.

Traffic / Connection
Data

data revealing a communication’s origin, destination, route, format, size, time
duration, IP address, time zone setting, MAC address.

Hosted Data

any categories of Customer Personal Data that may be recorded or stored (suchas voicemails, call recordings, files) by Customer and which is hosted on theinfrastructure provided by Orange Business.

Usage Data

information about how End Users use our products and services and how natural
persons use our website.

Visual Data

photographs and other visual records we take during Orange Business’ or third
parties’ events or that we process based on your consent.

We collect Personal Data from the following categories of sources: our customers, suppliers,
partners or directly from you.
When the processing of Customer Personal Data is subject to Swiss law, it is clarified that theCustomer Personal Data shall not be considered as secret data.
Aggregated/anonymised data
We also collect, use and share aggregated and anonymised information such as statistical or
demographic information. Aggregated or anonymised data could be based on Customer Personal
Data but is not legally considered to be Personal Data. For example, we may aggregate oranonymise Usage Data to calculate the percentage of users accessing a specific function on our
website. If we combine or link aggregated or anonymised data with any Customer Personal Dataso that it can identify an individual, we treat the combined data as Personal Data which will be usedin accordance with this privacy notice.
Special categories of Personal Data
We may process, as Processor, “special” or “sensitive” categories of Personal Data (information
revealing race or ethnicity, political opinions, religious or philosophical beliefs, trade union
membership, genetic data, biometric data, health data or data concerning sex life or sexual
orientation) relating to Customers or End Users, only if it is contained in Hosted Data. However, we
do not collect it for our own purposes and we are not aware of when we are processing such
Personal Data (except in the framework of hosting services in the health sector pursuant to specificaccreditations) and, as such, we don’t use such Personal Data outside of a data subject’s
reasonable expectations.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

5

5.

How do we use Customer Personal Data as Controller and Processor?

The tables below show how we use Customer Personal Data for which we are Controller and our legal
basis for doing so (including a description of our legitimate interests), as well as how we use Customer
Personal Data for which we are Processor.
The contract between a Customer and an Orange Business entity will include further information on
Customer Personal Data which we process as Processor and the respective obligations of the parties
regarding the processing of Customer Personal Data.
Customer Personal Data for which we are Controller

Our Activity
To manage the sales andcontractual relationships with ourCustomers

Categories of Personal
Data processed

Our lawful bases for processing•

Necessary for our legitimate interests todevelop and manage our sales activities andthe relationship with our Customers, includingordering, billing and collection of payments•

Consent where requiredMarketing Data andCommunications Data•

Necessary to comply with legal obligations wemay have under applicable laws (for example,
electronic communications regulations and eprivacy regulation, tax laws etc…)

Traffic / Connection Data•

Necessary for our legitimate interests toassess the amount of data moving across our
network at a given point in time, to manage
such data•

Necessary to comply with legal obligations (toprevent or detect fraud)

To assist national law enforcement All/ security agencies, to respond torequests from public, governmental
and regulatory authorities, tocomply with court orders, litigation
procedures and other legal
processes•

Necessary to comply with legal obligations wemay have under applicable laws (for example
to provide lawful intercept and/or dataretention by national law enforcement /security agencies)

To complete a survey, provide
customer satisfaction feedback,take part in service improvement
programs, and attend any events
that we organise•

Necessary for our legitimate interests to study
how Customers use our products/services, totry to increase and improve interaction with
Customers, to find out how we can improve
our services, and to develop and grow ourbusiness, to communicate about our eventsContact Data
Identity Data
Profile Data
Billing data
Traffic/Connection Data

To build, operate and secure our
network

Identity Data
Contact Data
Profile Data
Usage Data
Marketing andCommunications Data
Visual Data

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

6

Customer Personal Data for which we are Controller

Our Activity
To make suggestions andrecommendations to you about
goods or services that may interestyou

Categories of Personal
Data processed
Identity Data

To provide access to you, as anindividual, to on-line portals foryour own individual usage
management

To use data analytics to improve:
our website, products/services,marketing or Customer
relationships and experiences•

Necessary for our legitimate interests todevelop our products/services, grow ourbusiness and maintain our Customer
relationships•

Consent where required•

Necessary for our legitimate interests to run
our business, provision of administration andIT services, network security, to prevent fraud
and in the context of a business reorganisation
or group restructuring exercise•

Necessary to comply with a legal obligation•

Necessary for the legitimate interests of yourorganisation, our Customer, to provide youwith this feature to improve and facilitate youruse of the service;•

Necessary for our legitimate interests to study
how you use our service, to try to improve
interaction with you, to find out how we can
improve our services, and to develop andgrow our business•

Necessary for our legitimate interests tomanage or improve/develop our products,
services, offers, marketing strategy, keep our
websites updated and relevantContact Data
Profile Data
Usage Data
Marketing andCommunications Data

To administer and protect ourbusiness and our websites

Our lawful bases for processing

Contact Data
Technical Data

Identity Data
Contact Data
Technical Data
Profile Data

Depending on the activity,
certain:Contact Data
Support Data
Profile Data
Marketing andCommunications Data
Technical Data
Usage Data

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

7

Customer Personal Data for which we are Processor
Our Activity

Categories of Personal Data processed

Delivering, activating and implementing services and Identity Datachanges to services requested by Customer
Contact Data
(including intrusion detection and monitoring services
Support Data
ordered by Customer)
Profile Data
Hosted Data
Incident management (troubleshooting, resolution
and reporting) related to a specific Customer

Identity Data
Contact Data
Support Data
Technical Data
Profile Data
Hosted Data

Providing reports to Customer on billing, usage,
quality of service and other reports required by the
Customer

Identity Data
Contact Data
Billing Data
Support Data
Traffic/Connection Data
Profile Data
Location Data
Hosted Data

Providing access to Customer portals, on-line tools
and other applications managed by Orange Businessfor the provision of services to its Customers(including troubleshooting, data analysis, testing,system maintenance, support, reporting and hostingof data)

Identity Data

Hosting Customer data and infrastructure

Hosted Data

Contact Data
Technical Data
Profile Data

Marketing
We provide Customers with choice regarding the use of Customer Personal Data around marketing
and advertising. You can always ask us to stop sending you marketing messages by contacting us
at any time.
You will receive marketing communications from us if you have provided your consent to receive
those communications (unless we are exempted to obtain consent under applicable laws).
Cookies
We use necessary cookies to make our website work and we may also use optional cookies to help
us improve our website. For more information about the cookies we use and how to disable them,
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

8

please see our cookie policy here. Our online tracking is not of the nature such that it qualifies as“selling” or “sharing” under California law and we do not have actual knowledge that we have soldor shared the Personal Data of anyone under 16 years old.

6.

To whom may we disclose Customer Personal Data?
As a Processor of the Customer Personal Data
We disclose Customer Personal Data to other Processors, whether other entities within Orange
Business or external providers, that we engage in our capacity as Processor for carrying out specificprocessing activities on behalf of our Customer, the Controller.
We inform our Customers of all the Processors (other entities within Orange Business and external
providers or partners) we engage under a general written authorization (or specific authorization).
We may share some Customer Personal Data with third parties acting as Controllers in their own
rights. For example, to deliver you a parcel we share your Contact Data with courier companies.
As a Controller of the Customer Personal Data
We may share Customer Personal Data as Controller of such data with the parties set out below
for the purposes set out in the table in section 5 above.
Orange Business entities
The Orange Business entity which is the Controller of your Personal Data may share such Data withother Orange Business entities acting as Processors. The list of countries where Orange Business
entities are located can be found on Orange Business’ website (about us/where we are).
External parties
Service providers acting as Controllers in their own rights, in which case the processing ofCustomer Personal Data will be subject to these service providers’ privacy policies. For example,
to provide transmission to carry traffic on our network we share Traffic/Connection Data with otherregulated providers of electronic communications or to distribute third parties’
applications/software, which are used directly by the End-Users in accordance with the privacy
notice of those third parties.
Service providers acting as Processors, such as providers of IT and system administration services,maintenance, expert technical support or hosting.
National authorities (such as tax authorities), agencies and regulators acting as Processors or
Controllers who have the legal authority to require reporting of processing activities or disclosureof Customer Personal Data in certain circumstances.

7.

International Transfers of Customer Personal Data
We may transfer and process Customer Personal Data to/in countries other than the country inwhich the Customer Personal Data is initially collected. Please see Annex 1 to this document for
the list of countries where Orange Business may transfer Customer Personal Data.
International transfers to Orange Business entities
We may transfer Customer Personal Data amongst Orange Business entities as Controller orProcessor, inside or outside of the European Union (“EU”).
All Orange Business entities have signed an intra-group agreement for processing and transferring
personal data, which includes the EU Commission standard contractual clauses. This intra-groupagreement defines the adequate safeguards all Orange Business entities must put in place toOrange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

9

protect Personal Data and its transfer. For more information about the transfer of Customer
Personal Data to Orange Business entities for a specific processing activity, please contact us.
International transfers to external suppliers
When we transfer Customer Personal Data to an external supplier in another country, we make surethat a similar degree of protection is afforded to the Customer Personal Data. For transfers outsideof the EU or to a country which the EU Commission has not assessed as providing an adequatelevel of protection (for further details, see the relevant page of the European Commission websitehere), we use the EU Commission standard contractual clauses or another appropriate safeguard.
International transfers from Switzerland
When an Orange Business entity located in Switzerland transfers Personal Data to an Orange
Business entity or an external supplier in a country not recognised by Switzerland as providing anadequate level of protection, Orange Business signs the EU Commission standard contractual
clauses adapted to Swiss law, as appropriate safeguards.

8.

Our data security practices
We have put in place appropriate security measures to prevent Customer Personal Data from being
accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we
limit access to Customer Personal Data to those employees, agents, contractors and other third
parties who have a business need to access it. They will only process Customer Personal Data on
our instructions and they are subject to a duty of confidentiality.
We require all third parties to respect the security of Customer Personal Data and to treat it inaccordance with applicable data protection laws.
We have put in place procedures to deal with any suspected Personal Data breach and will notify
Customers and any applicable regulator of a breach where we are legally or contractually required
to do so.

9.

Our data retention policy
How long will we retain Customer Personal Data?
We retain Customer Personal Data in respect of which we are Processor for the period agreed with
our Customer, the Controller, unless applicable law requires us to retain it for a longer period (e.g.
regulatory, tax or accounting obligations). We may also retain Customer Personal Data for a longer
period in the event of a complaint or if we reasonably believe there is a prospect of litigation in
respect to our relationship with our Customers. Our contractual documentation agreed with ourCustomer describes the retention periods for the processing activities we perform as Processor for
our Customer, the Controller. We retain Customer Personal Data in respect of which we areController only for as long as reasonably necessary to fulfil the purposes we collected it for,including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting
requirements. To determine the appropriate retention period for Customer Personal Data in respectof which we are Controller, we consider:•

the amount, nature and sensitivity of the Customer Personal Data;•the potential risk of harm from unauthorised use or disclosure of Customer Personal Data;•the purposes for which we process Customer Personal Data and whether we can achieve
those purposes through other means; and•the applicable legal, regulatory, tax, accounting or other requirements.

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

10

10. Data subjects’ rights
Which are the data subjects’ rights?
Under certain circumstances, individual Customer Representatives or End Users may have thefollowing rights under data protection laws in relation to their Personal Data:• request access to, correction of, or erasure of Personal Data, including the right to know thefollowing about your Personal Data: the categories of Personal Data collected, the categories ofsources from which the Personal Data has been collected, our purposes for doing so, with whom
we have shared that Personal Data, and the specific pieces of Personal Data that we havecollected;• object to processing of Personal Data;• request restriction of processing of Personal Data (except that we do not sell or share Personal
Data and do not use sensitive Personal Data in a manner that provides an opt out right under
California law);• request transfer of Personal Data to another organisation;• withdraw consent to processing of Personal Data;• make a complaint to the relevant national data protection regulator (such as the Information
Commissioner’s Office (ICO) in the UK – www.ico.org.uk, or the Commission Nationale de
L’Informatique et des Libertés (CNIL) in France – www.cnil.fr/fr).
We will not discriminate or retaliate against you for exercising your Personal Data protection rights.
Whom should you contact?
-

If you want to exercise your rights in respect of your Personal Data of which Orange Businessis a Controller:o

For Traffic/Connection Data: we do not identify the individual to which
Traffic/Connection Data relates. We only identify the Customer to which
Traffic/Connection Data relates. Traffic/Connection Data is also subject to confidentiality
obligations under our agreements with our Customers. Therefore, in order to exercise
your rights in respect of your Personal Data that is Traffic/Connection Data, you should
contact your employer, or the organisation through which you have been using Orange
Business’ services. The person(s) authorised by your organisation to ask our assistancein respect of your request will contact us.

o

For other Personal Data of which Orange Business Service is a Controller, you cancontact us by using the online contact form or emailing us at obs.dpo@orange.com.
Alternatively, you can fill and print the form and send it by post to:If you are based in France:
Orange BusinessAgences Entreprises
Gestion des données personnelles
TSA 70007 - 82008 Montauban - France.
If you are based outside of France:
Orange Business
DPO Office,
3 Avenue du Bourget, 1140 Brussels, Belgium

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

11-

If you want to exercise your rights in respect of your Personal Data of which Orange Businessis a Processor for a Customer: you should contact your employer, or the organisation throughwhich you have been using Orange Business’ services in the first instance, to obtain
information about, or exercise, the rights you may have in respect of your Personal Data. The
person(s) authorised by your organisation to ask our assistance in respect of your request
will contact us.

-

If you are authorised by our Customer to ask Orange Business’ help in answering a data
subject request, you can contact us through your “My Service Space” portal or your “Espace
Entreprise Client” portal.

How will Orange Business deal with my request?

Usually no fee
You will not have to pay a fee to access your Personal Data (or to exercise any of your other rights).
However, we may charge a reasonable fee if your request is clearly unfounded, repetitive orexcessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we require
We may need to request specific information from you to help us confirm your identity and ensure
your right to access your Personal Data (or to exercise any of your other rights). This is a security
measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.
We may also contact you to ask you for further information in relation to your request to speed up
our response. You may also ask for an authorized agent to submit a request on your behalf and (ifyou do so) your agent should submit evidence of their authority.

When we will respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer
than a month if your request is particularly complex or you have made several requests. In this case,we will notify you and keep you updated.

Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

12

Annex 1 – Countries where Customer Personal Data may beprocessed/transferred

Argentina

Australia

Austria

BelgiumBrazilBulgaria

Canada

Chile

China

Colombia

Croatia

Czech Republic

Denmark

Egypt

FinlandFranceGermany

Ghana

GreeceHong Kong

Hungary

India

IrelandIsrael

Italy

Ivory CoastJapan

Kazakhstan

LebanonLuxembourg

Madagascar

Malaysia

Mauritius

MexicoMoroccoNetherlands

New ZealandNigeria

NorwayPakistan

Peru

PolandPortugal

Qatar

Romania

RussiaSaudi Arabia

SenegalSingapore

Slovakia

South Korea

Spain

SwedenSwitzerland

ThailandTaiwanThailandTurkeyUkraineUnited Arab Emirates

United Kingdom

United States

VietnamOrange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.6_August 2023

13