Source: http://www.circeo.today/en/privacy-policy/
Timestamp: 2019-04-18 10:19:02+00:00

Document:
Circeo is committed to ensuring the security and protection of the personal information that we process, and to provide a compliant and consistent approach to data protection in accordance with the EU General Data Protection Regulation (“GDPR”). The privacy of our website visitors is very important to us, and we are committed to safeguarding it. This policy explains what we will do with your personal information.
If you have any questions or suggestions regarding data protection, please do not hesitate to contact us by email at dataprivacy@circeo.today.
– any other personal information that you send to us.
We may disclose your personal information to any member company of the Circeo group as reasonably necessary for the purposes set out in this policy.
Information that we collect may be transferred to the following countries which do not have data protection laws equivalent to those in force in the European Economic Area: the United States of America and Russia.
Personal information that you publish on our website or submit for publication on our website may be available, via the internet, around the world. We cannot prevent the use or misuse of such information by others. You expressly agree to the transfers of personal information described in this Section 5.
This Section 6 sets out our data retention policies and procedure, which are designed to help ensure that we comply with our legal obligations regarding the retention and deletion of personal information.
Personal information that Circeo processes for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes (usually 7 days).
– in order to establish, exercise, or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).
In case your personal data is processed, you are the data subject within the meaning of the GDPR and you have the rights outlined hereafter.
Each data subject shall have the right granted by the European legislator to obtain from Circeo the confirmation as to whether or not personal data concerning him or her are being processed.
– the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
Furthermore, the data subject shall have a right to obtain information as to whether personal data are transferred to a third country or to an international organization. Where this is the case, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer in accordance with Art. 46 of the GDPR.
You have the right that Circeo has to immediately correct or complete any personal data concerning you if it is inaccurate or incomplete. We as controller would have to execute your request without undue delay.
– The accuracy of the personal data is contested by the data subject, for a period enabling Circeo to verify the accuracy of the personal data.
– The processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use.
– Circeo no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims.
– The data subject has objected to processing pursuant to Art. 21 (1) of the GDPR pending the verification whether the legitimate interests of Circeo override those of the data subject.
In case the processing of your personal data was subject to restriction, and notwithstanding their storage, such data shall only be processed with your consent or for the establishment, exercise, or defense of claims or for the procurement of the protection of rights of a natural or legal person or for purposes of an important public interest of the European Union or a member state.
In case the restriction of processing has been executed in accordance with the above, you shall be informed by Circeo prior to the cancellation of such restriction.
– the personal data have been collected in relation to the offer of information society services referred to in Art. 8 (1) of the GDPR.
Where Circeo has made personal data public and is obliged pursuant to Art. 17 (1) of the GDPR to erase the personal data, Circeo, taking into account available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested erasure of any links to, or copy or replication of, those personal data, from these controllers.
– for establishing, exercising or defending legal claims.
In case you have claimed the right of rectification, erasure or restriction of the processing towards Circeo, Circeo is obliged to inform all recipients of personal data belonging to you such rectification, erasure or restriction accordingly, unless such information seems to be impossible or only possible by needing inappropriate efforts.
You are entitled to claim to be informed by Circeo about such recipients.
Furthermore, in exercising your right to data portability, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.
The right to data portability only applies as long as the processing is not necessary for the performance of a task carried out in the public interest.
Each data subject shall have the right to object, based on his or her particular situation, at any time, to processing of personal data concerning him or her, which is based of Art. 6 (1) it. e), or f) of the GDPR. This also applies to profiling based on these provisions.
Circeo shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate reasons for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.
If Circeo processes personal data for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing. This applies to profiling to the extent that it is related to such direct marketing.
If the data subject objects to Circeo to the processing for direct marketing purposes, Circeo will no longer process the personal data for these purposes.
In order to exercise the right to object, the data subject is free in the context of the use of information society services, and notwithstanding Directive 2002/58/EC, to use his or her right to object by automated means using technical specifications.
You as data subject shall have the right to withdraw your consent to processing of your personal data at any time. Irrespective of such withdrawal of the consent, the legitimation of the processing of personal data until the withdrawal shall remain unaffected.
iii) is not based on the data subject’s explicit consent.
Notwithstanding the aforementioned, such decisions shall not be based on specific categories of personal data pursuant to Art. 9 (1) of the GDPR, insofar Art. 9 (2) it. a) or it. g) do not apply and in case that suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests were procured.
In view of the cases i) to iii) above, Circeo shall procure suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests. This means that Circeo is at least required to ensure the right to express his or her point of view and contest the decision.
Notwithstanding any other administrative and judicial procedures, you shall have the right to file a complaint with a competent regulatory authority, in particular in the member state where you are situated, you have your place of work or where the alleged breach has occurred if you believe that the processing of your personal data is a breach of the regulations set forth in the GDPR.
The regulatory authority, that has been approached by you, shall inform you about the status of the results of an investigation on an ongoing basis as well as about the possibility of a judicial procedure according to Art. 78 of the GDPR.
Circeo takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorized access, alteration, disclosure or destruction and have several layers of security measures.
Circeo has designated Matthieu Job as our Data Protection Officer (DPO) and have appointed a data privacy team to develop and implement our roadmap for constantly complying with the GDPR. The team are responsible for promoting awareness of the GDPR across the organization, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures and measures.

References: Art. 22
 Art. 46
 Art. 21
 Art. 8
 Art. 17
 Art. 6
 Art. 9
 Art. 9
 Art. 78