General Personal Data Protection Policy

HORTIVAL DIFFUSION, SASU, with its registered office located at LES FONTAINES DE LAUNAY BEAUFORT EN VALLEE, 49250 BEAUFORT-EN-ANJOU France, registered under number RCS Angers B 071202071, a subsidiary of the TERRENA group (hereinafter ‘HORTIVAL DIFFUSION’) processes Personal Data (as defined below) in the course of its activities, acting both on its own behalf and on behalf of its subsidiaries.

• This personal data protection policy (the ‘Policy’) describes how HORTIVAL DIFFUSION collects, uses and processes your personal data in accordance with applicable regulations. HORTIVAL DIFFUSION attaches great importance to your privacy and is committed to protecting and preserving your data privacy rights. 

• This Policy applies to personal data that we collect from our customers, suppliers and service providers in connection with the performance of all types of commercial contracts. It also applies to the personal data of users of our various websites, individuals who wish to apply for our job vacancies and any other individuals whom we may legitimately contact in the course of HORTIVAL DIFFUSION's activities.

• Within the framework of the regulations applicable to the protection of personal data, and in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Law No. 78-17 of 6 January 1978 on information technology, files and freedoms, as amended (hereinafter collectively referred to as the ‘Personal Data Regulations’), the company responsible for your personal data is HORTIVAL DIFFUSION. 

• HORTIVAL DIFFUSION may modify this Policy. Please visit this page regularly to review any changes we may publish.

• If you disagree with certain aspects of our Policy, you have legal rights which are indicated where necessary.

• HORTIVAL DIFFUSION subsidiaries may also collect and process Personal Data. This Policy applies to HORTIVAL DIFFUSION subsidiaries.

   

1. Introduction

The personal data protection policy is based on the non-exhaustive principles listed below : 

• Comply with the optional standards and recommendations of the French Data Protection Authority (CNIL) and the French National Cybersecurity Agency (ANSSI), while meeting the operational needs of HORTIVAL DIFFUSION ; 

• Applying data protection rules from the design and implementation stage (‘Privacy-by-design’, ‘Privacy-by-default’) of new products intended to process personal data and reducing data collection to what is strictly necessary (‘minimisation’) ;

• Continuously monitor compliance with legal obligations and commitments made by HORTIVAL DIFFUSION throughout the entire life cycle of computerised data processing ;

• Ensure the utmost transparency in data processing, with the exception of information whose disclosure could compromise its security ;

• Strengthen individuals' rights and facilitate their exercise.
   

   

2. Definitions

‘Personal data’ or ‘Personal information’: Any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘Data subject’: Natural person whose personal data is processed as indicated in Article 4.

‘Data controller’: Natural or legal person who, alone or jointly with others, determines the purposes of the processing and the means used. The data controller is, as a general rule, the Terrena entity that collected the personal data. In the event that the Terrena cooperative, the parent company of the Terrena Group, is required to provide technical, administrative, marketing or commercial assistance to this entity, the Terrena cooperative may also be considered the data controller.

‘Data processing’: Operations carried out, with or without the aid of automated processes, on personal data, consisting in particular of collection, recording, use, transmission or communication. 

‘Processor’: Any natural or legal person, public authority, agency or any other body which processes Personal Data on behalf of the Data Controller.

‘Recipient’: Any natural or legal person, public authority, internal or external agency or any other body to whom Personal Data is disclosed.

‘TERRENA’: The Terrena cooperative and its subsidiaries.

‘HORTIVAL DIFFUSION’: The company HORTIVAL DIFFUSION and its subsidiaries (ALLIANCE SCP PARTENAIRES and PRIMAVERA).
 

3. Collection of Personal Data 

The Personal Data that HORTIVAL DIFFUSION may collect varies depending on the purpose of the processing. It is primarily intended to enable the identification of individuals in the context of their relations with HORTIVAL DIFFUSION. In any event, the Personal Data collected will be limited to the data necessary for the purposes set out in Article 5 below.

Data subjects 

The persons concerned by the processing carried out by HORTIVAL DIFFUSION are :

• Visitors, users and customers of its websites.

• Customers (members and non-members) of SCA Terrena and its subsidiaries.

• Customers in stores who identify themselves with their loyalty card.

• Participants in competitions, lotteries, special online or in-store promotions.

• Participants in surveys, polls or panels

• Recipients of promotional campaigns, online or commercial prospecting

• Suppliers and service providers

• Candidates and employees

Collection of personal data

Data may be collected directly from Data Subjects in various ways, including via :

• Contracts entered into with HORTIVAL DIFFUSION;

• Quotations in the context of pre-contractual relations;

• Appointments;

• Paper or online forms via websites;

• Cookies on the Data Subjects' web browsers.

In the event of indirect data collection from third parties (e.g. purchase of files, publicly available sources), HORTIVAL DIFFUSION shall inform the Data Subjects at the time of first contact and at the latest within one month, unless the Data Subjects already have this information.

Note to visitors and users of its websites : certain features and characteristics of its websites can only be used if certain Personal Data is provided. Users are free to provide all or part of the requested personal data. However, if users decide not to provide such data, this may prevent the objectives described in Article 5 below from being satisfactorily achieved, certain services and features of our websites may not function properly, and/or users may be denied access to certain pages of the websites.

Customer data (members and non-members): The data that HORTIVAL DIFFUSION collects about its customers is limited. As a general rule, HORTIVAL DIFFUSION requires the contact details of representatives within the customer or prospect company (in particular their name, telephone number, email address and postal address) in order to be able to perform the contracts entered into with its customers. As part of customer satisfaction surveys, HORTIVAL DIFFUSION also holds information relating to customers' needs or constraints, which HORTIVAL DIFFUSION may then use to ensure that marketing communications to them are relevant and timely. HORTIVAL DIFFUSION may also hold additional information that customer contacts have chosen to provide, particularly through loyalty programmes. In certain circumstances, when customers interact with certain HORTIVAL DIFFUSION departments or divisions, calls may be recorded in accordance with applicable local laws and requirements.

Data relating to suppliers and service providers: HORTIVAL DIFFUSION also collects data about its suppliers and service providers. In order to manage our commercial relationships effectively, HORTIVAL DIFFUSION collects information about its contacts within the supplier or service provider company, such as their name, telephone number, email address and postal address. HORTIVAL DIFFUSION may also hold additional information that contacts within the supplier or service provider company have chosen to provide.

Data relating to personnel management: For candidates applying for job vacancies at HORTIVAL DIFFUSION, various types of information are collected to enable applications to be analysed in relation to the positions offered, including identity, personal contact details, career history, qualifications and motivations. HORTIVAL DIFFUSION also collects all information useful for the proper management of its staff, including identity, civil status, personal contact details, career history, qualifications, bank details, social security details and administrative information, in accordance with legal and regulatory provisions.

Data relating to users of its various websites: HORTIVAL DIFFUSION collects personal data from users of its various websites, which is used to improve the use of its sites and manage the services provided by HORTIVAL DIFFUSION. This information includes, in particular, how its websites are used, how often users access them, the type of browser used, the location from which users visit HORTIVAL DIFFUSION's websites, the language used and the times at which the websites are most visited.
 

4. Protection of minors' personal data

HORTIVAL DIFFUSION products and services are reserved for adults and are not intended to be marketed to minors. HORTIVAL DIFFUSION does not voluntarily collect or store minors' personal data, except in the context of information relating to its personnel management. 

5. Purposes of personal data collection

Personal Data is collected for the purposes of HORTIVAL DIFFUSION's business activities, such as the performance of contracts concluded with its customers (members or non-members), its suppliers and other service providers or any third parties, for the purposes of its legitimate interests or compliance with reporting obligations provided for by law, as well as for the recruitment of employees and the management of HORTIVAL DIFFUSION employees.

HORTIVAL DIFFUSION collects and uses Personal Data for the purposes of its activities and in particular to enable the following activities to be carried out :

If HORTIVAL DIFFUSION is required to process the personal data of Users and/or Customers for purposes other than those listed in the tables above, HORTIVAL DIFFUSION will take any additional steps that may be necessary to ensure the legal compliance of all processing carried out.

6. Recipients of personal data

To achieve the purposes described above and only to the extent necessary to pursue these purposes, the personal data we collect may be transmitted to all or some of the following recipients :

Within the Terrena Group:

• To Terrena Group subsidiaries responsible for the award, management and execution of contracts and orders;

• To Terrena Group subsidiaries responsible for marketing, customer relations, complaints, prospecting, administrative services, IT services, online advertising or commercial prospecting;

• To Terrena Group subsidiaries responsible for the centralised management of our customer databases;

• Any other subsidiary of the Terrena Group whose involvement may be necessary for the processing carried out in accordance with this policy.

   

  Outside the Terrena group:

• To our service providers involved in all or part of the identified processing operations (in particular IT service providers responsible for maintaining the website, partners in the field of online advertising and personalised communications, and those responsible for the transport and delivery of products);

• To our partners who operate services available on our website or services accessible through the use of loyalty programmes;

• To our partners who sell products or services directly from our website;

• To our partners involved in the creation and distribution of commercial prospecting campaigns;

• To our partners involved in the process of distributing personalised online advertising or commercial prospecting;

• To suppliers of products and services of Terrena Group partner brands who may be recipients of your personal data is available here.
   

   

7. Transfer of personal data outside the European Union

HORTIVAL DIFFUSION is committed to ensuring that data is stored and transferred securely. Consequently, any data that may occasionally be transferred outside the European Economic Area or EEA (comprising the Member States of the European Union, plus Norway, Iceland and Liechtenstein) will only be transferred to countries that comply with data protection legislation and where the means of transfer ensure adequate protection of your data.

To ensure that personal information receives an adequate level of protection, appropriate procedures are in place with third parties with whom personal data is shared to ensure that personal information is processed by these third parties in a manner consistent with data protection legislation.
 

8.  Security of personal data

The ‘processing’ of Personal Data includes, in particular, the use, storage, recording, transfer, adaptation, analysis, modification, reporting, sharing and destruction of Personal Data as necessary in the circumstances or as required by law.

8.1  Data security by TERRENA

TERRENA attaches particular importance to the security of Personal Data. 

TERRENA implements technical and organisational measures, taking into account the sensitivity of personal data, in order to ensure the integrity and confidentiality of data and to protect it against malicious intrusion, loss, alteration or disclosure to unauthorised third parties.

Whenever possible and necessary, the following measures are taken :

• Encryption;

• Anonymisation;

• Pseudonymisation;

• Deployment of means to guarantee the confidentiality, integrity and availability of systems; 

• Deployment of means to restore the availability of and access to your personal data in the event of a technical incident.

As all Personal Data is confidential, access to it is limited to employees, subcontractors or business partners who need it in order

8.2  Data security by data recipients

In the event that applications, services or products provided by third parties are used, Terrena ensures that their publishers comply with legal requirements and guarantee the protection of the data processed therein.

In accordance with its commitments, Terrena carefully selects its subcontractors and service providers and requires them to :

• Provide a level of protection for personal data that is at least equivalent to its own;

• Use personal data solely for the purposes of managing the services they are required to provide;

• Strict compliance with applicable legislation and regulations on confidentiality, banking secrecy and personal data;

• The implementation of all appropriate measures to ensure the protection of the personal data they may be required to process;

• The definition of the technical and organisational measures necessary to ensure security.

If you suspect misuse, loss or unauthorised access to your personal information, please notify us immediately.
 

9. Data rights

Article 15 of the General Data Protection Regulation recognises the right of any natural person to obtain from the Data Controller confirmation as to whether or not Personal Data concerning them are being processed and, where they are being processed, access to said data.

HORTIVAL DIFFUSION has put in place appropriate Personal Data protection measures to ensure that Personal Data is used in accordance with the purposes indicated above and to ensure that it is accurate and up to date.

Right to object :

You may object to our processing of your personal data at any time. 

Your objection will be dealt with promptly and we will cease the activity to which you object. However, we reserve the right not to cease the activity in question if :

• We can demonstrate that we have legitimate and compelling reasons for processing your data that override your interests; or

• We process your data for the purpose of establishing, exercising or defending a legal claim. If your refusal relates to direct marketing, we must act in accordance with your objection by ceasing this activity in relation to you.

   

Right to withdraw consent : 

If we have obtained your consent to process your personal data for certain activities other than those for which no consent is required, you may withdraw that consent at any time and we will cease to carry out the particular activity to which you had consented, unless we consider that there is another reason justifying the continued processing of your data for that purpose, in which case we will inform you of this situation.

Access requests : 

You may ask us at any time to confirm the information we hold about you, and you may ask us to amend, update or delete it. We may ask you to verify your identity and request additional information about your request. If we provide you with access to the information we hold about you, we will not charge you for this access unless your request is ‘manifestly unfounded or excessive’. If you request further copies of this information, we may charge you a reasonable administrative fee where permitted by law. Where permitted by law, we may refuse your request. If we do so, we will always provide you with a reason for our refusal.

Right to erasure : 

You have the right to request that we erase your personal data in certain circumstances.

In principle, the information in question must meet one of the following criteria :

• The data is no longer necessary for the purposes for which we originally collected and/or processed it

• You have withdrawn your consent to the processing of your data and there is no other valid reason for us to continue processing it;

• The data has been processed unlawfully;

• The data must be erased in order for us to comply with our legal obligations as data controller; or where we process the data because we believe it is necessary for our legitimate interests, you object to this and we are unable to demonstrate a legitimate and compelling reason for continuing the processing.

We may refuse to comply with your request solely for one of the following reasons :

• To exercise the right to freedom of expression and information;

• To comply with legal obligations;

• For reasons of public health in the public interest;

• For archiving, research or statistical purposes; or

• To exercise or defend a legal right.

When we respond to a valid request for data erasure, we will take all appropriate practical steps to delete the data in question.

Right to restriction of processin : 

You have the right to request that we restrict the processing of your personal data in certain circumstances. This means that we will only be able to continue to store your data and will not be able to carry out any further processing activities except in one of the following cases: (i) resolution of one of the circumstances listed below; (ii) your consent; or (iii) further processing is necessary for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest of the European Union or a Member State.

The circumstances in which you have the right to request that we restrict the processing of your personal data are as follows :

• When you contest the accuracy of the personal data we process about you. In this case, our processing of your personal data will be restricted for the duration of the verification of the accuracy of the data;

• When you object to our processing of your personal data for our legitimate interests. You may request that the data be restricted while we verify our grounds for processing your personal data;

• When your data has been unlawfully processed by us, but you would prefer us to restrict its processing rather than erase it; and

• When we no longer need to process your personal data but you request it in order to establish, exercise or defend legal claims.

If we have disclosed your personal data to third parties, we will inform them of the restriction of processing unless this proves impossible or involves disproportionate effort. We will, of course, inform you before lifting any restriction on the processing of your personal data.

Right to rectification : 

You also have the right to request that we rectify any inaccurate or incomplete personal data we hold about you. If we have disclosed this personal data to third parties, we will inform them of the rectification unless this proves impossible or involves disproportionate effort. Where applicable, we will also inform you of the third parties to whom we have disclosed this inaccurate or incomplete personal data. If we believe it is reasonable not to comply with your request, we will give you the reasons for this decision.

Right to data portability : 

If you wish, you have the right to transfer your personal data from one data controller to another. In practical terms, this means that you can transfer the data to another online platform. To enable you to do this, we will provide you with your data in a readable format. This right to portability applies to the following data: (i) personal data that we process automatically (i.e. without human intervention); (ii) personal data that you provide; and (iii) personal data that we process on the basis of your consent or in the context of the performance of a contract.

Right to define general or specific guidelines regarding the storage, deletion or communication of your personal data after the death of a User and/or Customer : 

You have the option of defining general or specific guidelines regarding how you wish your rights under applicable regulations to be exercised after your death.

General guidelines concern all personal data relating to you, and you may revoke them at any time. They may be registered with a trusted third party certified by the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertés).

Specific guidelines concern the processing operations mentioned in these guidelines and are registered with Us: they are subject to your specific consent and you may revoke them at any time.

Right to lodge a complaint with a supervisory authority : 

If, after contacting us in this regard, you feel that your rights regarding your personal data have not been respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (3 place de Fontenoy - TSA 80715 - 75334 Paris cedex 07 - telephone: 01 53 73 22 22 or https://www.cnil.fr/fr/plaintes).

It is important that the personal information we hold about you is accurate and correct. Please inform us of any changes to your personal information during the period in which we hold your data.
 

10. Easy contact for exercising rights 

Although HORTIVAL DIFFUSION has taken reasonable measures to protect Personal Data, no transmission or storage technology is completely foolproof.

However, HORTIVAL DIFFUSION is committed to ensuring the protection of Personal Data. If you have reason to believe that the security of your Personal Data has been compromised or that it has been misused, please contact HORTIVAL DIFFUSION at dataprotection[@]hortival-diffusion.fr.

You may exercise your rights at any time and contact the Data Protection Officer at the following address:

• By post to the following address: HORTIVAL DIFFUSION (Terrena group), Data Protection/DPO, 7 avenue Jean Joxé, CS 20248, 49002 ANGERS, or

• By email to the following address: dataprotection[@]hortival-diffusion.fr

11. Policy updates 

This Policy may be updated according to the needs of HORTIVAL DIFFUSION and circumstances, or if required by law. We therefore invite you to check for updates on a regular basis.

HORTIVAL DIFFUSION undertakes to comply with legal or regulatory developments relating to personal data.

As such, HORTIVAL DIFFUSION reserves the right to modify its processing and security measures at any time and to adapt its data privacy policy accordingly.