PERSONAL DATA PROTECTION POLICY

DANAE GROUP, a simplified joint-stock company with a capital of 500,00 euros, headquartered at 49 RUE DE PONTHIEU 75008 PARIS, registered with the Paris Trade and Companies Registry under number 982 425 696, is a company specializing in media and communication strategy.
DANAE GROUP operates a website, www.danae-group.fr, whose main functions are to present the “DANAE GROUP” brand and to facilitate contact between users of the website and the DEVA GROUP teams (the “Website“).
In the course of its activities, DANAE GROUP processes Personal Data of users of the Website, its clients, and prospects.
DANAE GROUP is committed to protecting Personal Data and makes every effort to ensure the highest level of protection in compliance with applicable regulations.
The purpose of this policy is to:

Present the technical and organizational measures implemented by DANAE GROUP to ensure a high level of protection for the processed Personal Data, in compliance with applicable regulations;
Document its compliance with applicable regulations; and
Inform individuals about how they can stay informed and control the processing of their Personal Data.

For the purposes of this policy, in accordance with Regulation (EU) 2016/679 of the European Parliament and Council on the protection of individuals with regard to the processing of personal data and the free movement of such data (the “GDPR“) and Law No. 2018-493 of June 20, 2018, on personal data protection:

“Personal Data” means any information relating to an identified or identifiable natural person (hereinafter the “Data Subject”); an identified or identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity;
“Sensitive Data” means any information concerning racial or ethnic origin, political, philosophical, or religious opinions, trade union membership, health, or sexual life of the Data Subject;
“Processing” is defined as any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
“Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the Processing; and
“Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller.

PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

Before any Processing, DANAE GROUP ensures that the Processing:

Is based on a specific, explicit, and legitimate purpose for which the Personal Data is processed;
Is strictly limited to the pursued purpose;
Is lawful, justified by (i) the necessary execution of a contract between DANAE GROUP and the Data Subject or pre-contractual measures, (ii) a legal obligation, (iii) the prior consent of the Data Subject, or (iv) a legitimate interest pursued by DANAE GROUP, provided that it does not infringe upon the fundamental rights of the Data Subjects.

DANAE GROUP ensures the accuracy and updating of the processed Personal Data.
DANAE GROUP REGULARLY ANALYZES ITS DATA PROCESSING AND DATA PROTECTION PROCEDURES TO ADJUST AND COMPLETE THEM, ENSURING THE HIGHEST POSSIBLE LEVEL OF PROTECTION FOR ITS CLIENTS, PROSPECTS, AND WEBSITE USERS IN ACCORDANCE WITH APPLICABLE REGULATIONS.

CATEGORIES OF PROCESSED PERSONAL DATA

Personal Data is primarily collected during (i) browsing the Website, (ii) contact via the contact form available on the Website, and (iii) placing an order on the Website.
Through the Website, Personal Data is collected when the user directly completes the contact form or places an order for “DANAE GROUP” brand products on the Website. The mandatory or optional nature of the Personal Data collected is indicated at the time of collection by an asterisk (*).
The Personal Data that may be collected by DANAE GROUP includes:

Name, first name, and company of the Website user; and
Email address and other personal communication details of the aforementioned individuals.

Furthermore, the use of the Website by any user results in the collection of navigation data through the use of cookies and IP addresses. DANAE GROUP also collects statistical data on the use of the search engine. The statistics also include commercial data.
No Sensitive Data, as defined by applicable regulations, is processed by DANAE GROUP.

PURPOSES OF PROCESSING PERSONAL DATA

The Processing of Personal Data carried out by DANAE GROUP aims to:

Execute a pre-contractual or contractual relationship with the Data Subject:
– Manage, process, and follow up orders for any client; and
– Billing and its follow-up;
Pursue the legitimate interest of DANAE GROUP when pursuing the following purposes:
– Prospection and promotion in its communication activity on the “DANAE GROUP” brand;
– Managing the client and prospect relationship of DANAE GROUP;
– Organizing, registering, and inviting to DANAE GROUP events and sending newsletters and information, as appropriate;
– Understanding users;
– Website performance; and
– Website security;
Comply with legal and regulatory obligations when implementing Processing aimed at:
– Preventing money laundering and terrorism financing and combating corruption;
– Billing; and
– Accounting;
Obtain Data Subject’s consent:
– Personalized solicitation.

DURATION OF STORAGE OF PERSONAL DATA

DANAE GROUP retains Personal Data only for the duration necessary for the operations for which they were collected and in compliance with applicable regulations.
Personal Data of DANAE GROUP clients is kept for a period of five (5) years from the placement of an order.
For accounting purposes, they are kept for ten (10) years from the closing of the fiscal year during which the last order was placed by the Data Subject.
Personal Data of prospects and/or users of the Website is kept for a duration of three (3) years if no contractual relationship has been established between the Data Subject and DANAE GROUP.

SECURITY MEASURES FOR PERSONAL DATA

To ensure the security, confidentiality, integrity, availability, and to protect the Personal Data Processed by DANAE GROUP against any destruction, loss, alteration, or unauthorized disclosure of this Data, DANAE GROUP implements the following protection measures:

Training DANAE GROUP staff on applicable regulations regarding Processing and protection of Personal Data;
Limited access of DANAE GROUP staff to Personal Data;
Verification of compliance of Processors with applicable regulations, as appropriate;
Securing DANAE GROUP’s premises, equipment, and computer software;
Updating personalized and secure profiles, including the use of passwords meeting higher security standards and changed regularly;
Using regularly updated antivirus and computer security systems;
Using various internal and external backup modes; and
Implementing an internal procedure to manage any incident, breach, or violation of any Personal Data.

PERSONAL DATA BREACH

In the event of a Personal Data breach, DANAE GROUP will notify the breach to the competent supervisory authority as soon as possible, and no later than seventy-two (72) hours after becoming aware of it.
Furthermore, if the breach is likely to pose a high risk to the rights and freedoms of a natural person, DANAE GROUP will inform the Data Subject of the breach of their Personal Data as soon as possible, unless:

DANAE GROUP has implemented appropriate technical and organizational protection measures, and those measures have been applied to the Personal Data affected by the breach, especially measures that render the Personal Data unintelligible to anyone not authorized to access it, such as encryption;
DANAE GROUP has taken subsequent measures that ensure that the high risk to the rights and freedoms of the Data Subjects is no longer likely to materialize; and
Communication would require disproportionate efforts.

PROCESSING BY THIRD PARTIES AND TRANSFER OF PERSONAL DATA

Processed Personal Data is intended for DANAE GROUP, and where applicable, its Processors. Processed Personal Data may also be shared to comply with any legal or regulatory obligation.
NO TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION WILL BE CARRIED OUT BY DEVA GROUP. FURTHERMORE, DANAE GROUP DOES NOT SELL PROCESSED PERSONAL DATA TO THIRD PARTIES.

RIGHTS OF DATA SUBJECTS

Under the conditions defined by applicable regulations, Data Subjects have the following rights, subject to certain conditions:

Access their Data; DANAE GROUP must, upon request, provide a copy of the Personal Data concerning them;
Obtain from DANAE GROUP, as soon as possible, the rectification of Personal Data concerning them that is inaccurate or incomplete;
Obtain from DANAE GROUP the erasure of Personal Data concerning them as soon as possible;
Obtain from DANAE GROUP the limitation of Processing; and
Receive the Personal Data concerning them that they have provided in a structured, commonly used, and machine-readable format, and transmit this Data to another Data Controller (right to the portability of Personal Data).

WHEN PROCESSING IS BASED ON THE CONSENT OF THE DATA SUBJECT, THEY MAY WITHDRAW THEIR CONSENT AT ANY TIME. ANY DATA SUBJECT MAY ALSO OBJECT TO A PROCESSING BASED ON THE LEGITIMATE INTEREST OF DEVA GROUP BY NOTIFYING THE LATTER.
For any information or to exercise rights regarding the Processing of Personal Data, it is possible to contact the Data Controller within DANAE GROUP:

By email at the following address: [email protected]; or
Under the conditions defined by the applicable regulations, Data Subjects have the following rights, under certain conditions:

DANAE GROUP commits to process all requests for information and exercise of rights relating to Personal Data as soon as possible from the receipt of any request, and at the latest within a period of one (1) month.
Any Data Subject can at any time lodge a complaint with the National Commission on Informatics and Liberty (the “CNIL”) (Regulatory authority in France).

PERSONAL DATA PROCESSING RECORD

DANAE GROUP commits to maintaining a record of Processing activities under its responsibility, listing all the information provided by the provisions of Article 30 of the GDPR.

COOPERATION WITH THE CONTROL AUTHORITY

DANAE GROUP commits to cooperate with the CNIL, upon its request, in the execution of its missions.

USE OF COOKIES

When consulting the Website, cookies may be placed on the hard disk of the user’s terminal. A cookie is a text file intended to collect information relating to navigation and user identification.
The maximum retention period of cookies set by DANAE GROUP is twelve (12) months. The Website user has the possibility at any time to oppose the use of these cookies by appropriately configuring their browser software.

DATA CONTROLLER WITHIN THE COMPANY

The Data Controller of Personal Data within DANAE GROUP is Emeline Santerre, president and legal representative of the company DANAE GROUP SAS.
THIS PRIVACY POLICY MAY BE MODIFIED AT ANY TIME BY DANAE GROUP, WITHOUT PRIOR INFORMATION TO USERS. IT IS THEREFORE RECOMMENDED TO REGULARLY CONSULT THIS POLICY ON THE WEBSITE.
FOR ANY OTHER INFORMATION ON THE PROTECTION OF PERSONAL DATA, ANYONE CAN CONSULT THE CNIL WEBSITE: www.cnil.fr.

Last update: Mai 2024