Table of contents
- Introduction
- Definitions
- Collection of personal data
- Protection of the personal data of minors
- Purposes of collecting personal data
- Recipients of personal data
- Transfer of personal data outside the European Union
- Security of personal data
- Data rights
- Easier contact for exercising rights
- Policy update
1. Introduction
The personal data protection policy is based on the following non-exhaustive principles:
- To comply with the optional application standards and recommendations of the Commission Nationale de l'Informatique et des Libertés (CNIL) and the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI), while meeting HORTIVAL DIFFUSION's operational requirements;
- Apply data protection rules from the design and implementation stage ("Privacy-by-design", "Privacy-by-default") of new products designed to process personal data, and reduce data collection to the strict minimum ("minimisation").
- Continuously monitor compliance with legal obligations and commitments made by HORTIVAL DIFFUSION throughout the life of computerised data processing;
- To ensure the greatest possible transparency in data processing, with the exception of information whose disclosure could compromise security;
- Strengthening people's rights and making it easier for them to exercise them.
2. Définitions
- "Personal data": any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.
- "Data subject": natural person whose personal data is processed as indicated in Article 4.
- "Data Controller": Natural or legal person who, alone or jointly with other entities, determines the purposes of the processing and the means it uses. The Data Controller is, as a general rule, the Terrena entity that collected the Personal Data. In the event that the Terrena cooperative, the parent company of the Terrena Group, provides this entity with technical, administrative, marketing or commercial assistance, the Terrena cooperative may also be considered as the Data Controller.
- "Data processing": Operations carried out on personal data, whether or not by automatic means, which consist in particular in the collection, recording, use, transmission or communication.
- "Sub-processor": natural or legal person, public authority, department or any other body that processes Personal Data on behalf of the Controller.
- "Recipient": the natural or legal person, public authority, internal or external department or any other body that receives communication of Personal Data.
- "TERRENA": The cooperative company Terrena and its subsidiaries.
- "HORTIVAL DIFFUSION": HORTIVAL DIFFUSION and its subsidiaries (ALLIANCE SCP PARTENAIRES et PRIMAVERA).
3. Collection of personal data
The Personal Data that HORTIVAL DIFFUSION is likely to collect varies according to the purpose of the processing. Its main purpose is to identify individuals in the context of their relations with HORTIVAL DIFFUSION.
In any event, the Personal Data collected will be limited to that which is necessary for the purposes set out in Article 5 below.
People concerned
The persons concerned by the processing carried out by HORTIVAL DIFFUSION are :
- Visitors, users and customers of its website
- Customers (members and non-members) of SCA Terrena and its subsidiaries
- In-store customers who identify themselves with their loyalty card
- Participants in competitions, lotteries, special operations online or in-store
- Participants in surveys, polls or panels
- Recipient of a promotion, online canvassing or commercial operation
- Suppliers and service providers
- Candidates and employees
Collection of personal data
Data may be collected directly from Data Subjects in various ways, including via :
- Contracts signed with HORTIVAL DIFFUSION
- Quotations as part of pre-contractual relations ;
- Events;
- Paper or web forms on websites;
- Cookies present on the Internet browser of the persons concerned.
In the event of indirect collection of data from third parties (e.g.: purchase of files, sources accessible to the public), HORTIVAL DIFFUSION undertakes to inform the Data Subjects at the time of first contact and at the latest within 1 month, unless the Data Subjects already have this information.
Note to visitors and users of its websites:
Certain functions and features of its websites can only be used if certain personal data is provided. Users are free to choose whether or not to provide all or part of the Personal Data requested. However, if the user decides not to provide them, such a decision may prevent the satisfactory achievement of the objectives described in Article 5 below, certain services and features of our websites may not function correctly and/or the user may be denied access to certain pages of the sites.
Customer data (members and non-members) :
The data that HORTIVAL DIFFUSION collects about its customers is limited. As a general rule, HORTIVAL DIFFUSION needs the contact details of people within the client or prospective client (in particular their name, telephone number, e-mail address and postal address) in order to be able to execute contracts concluded with its clients. In the context of customer satisfaction surveys, HORTIVAL DIFFUSION also holds information relating to customers' needs or constraints, which HORTIVAL DIFFUSION may then use to ensure that marketing communications to them are relevant and timely. HORTIVAL DIFFUSION may also hold additional information that customer contacts have chosen to communicate, such as through loyalty programmes. In some circumstances, when customers interact with certain HORTIVAL DIFFUSION departments or services, calls may be recorded, depending on applicable local laws and requirements.
Data relating to suppliers and service providers :
HORTIVAL DIFFUSION also collects data about its suppliers and service providers. In order to manage our commercial relations, HORTIVAL DIFFUSION collects information from its contacts within the supplier or service provider company, such as their name, telephone number and e-mail and postal addresses. HORTIVAL DIFFUSION may also hold additional information that contacts within the supplier or service provider company have chosen to communicate.
Data relating to personnel management :
For candidates applying for HORTIVAL DIFFUSION job offers, various types of information are collected to enable analysis of applications in relation to the positions offered, in particular identity, personal details, professional background, qualifications and motivations.
HORTIVAL DIFFUSION also collects all information useful for the proper management of its personnel, in particular identity, civil status, personal details, professional background, diplomas, bank details, social security and administrative information in accordance with legal and regulatory provisions.
Data relating to users of its various websites:
HORTIVAL DIFFUSION collects personal data from users of its various websites, which is used to enable it to improve the use made of its sites and to manage the services that HORTIVAL DIFFUSION provides. This information includes how its sites are used, the frequency with which the user accesses them, the type of browser, the place from which users visit HORTIVAL DIFFUSION's sites, the language used and the times when the sites are most visited.
4. Protection of the personal data of minors
HORTIVAL DIFFUSION's products and services are reserved for adults and are not intended to be marketed to minors. HORTIVAL DIFFUSION does not voluntarily collect or store Personal Data from minors, except in the context of information relating to the management of its personnel.
5. Purposes of collecting personal data
Personal Data is collected for the needs of HORTIVAL DIFFUSION's business, such as the performance of contracts concluded with its customers (members or non-members), its suppliers and other service providers or any third party, for the purposes of its legitimate interests or the fulfilment of reporting obligations provided for by law, as well as for the recruitment of employees and the management of HORTIVAL DIFFUSION employees.
HORTIVAL DIFFUSION collects and uses Personal Data for the purposes of its activities and in particular to carry out the following activities:
Goals | Legal basis | Duration of storage |
Concerning use of the websites | ||
Make available the websites and the products and services offered on the websites | Execution of pre-contractual measures taken at the request of Users and/or Customers and/or performance of the contract | Duration necessary to achieve the purpose of the processing and for a further period of five (5) years |
Respond to requests made via forms or using the contact facilities available on the websites | Execution of pre-contractual measures taken at the request of Users and/or Customers and/or performance of the contract | Duration necessary to achieve the purpose of the processing and for a further period of five (5) years |
Concerning all customers for customer relationship management | ||
Create and manage current business accounts to enable quotations to be issued, orders to be managed, reservations to be made, deliveries to be made and invoices to be issued for products, services and solutions | Execution of pre-contractual measures taken at the request of Users and/or Customers and/or performance of the contract | Five (5) years from the date of the Customer's last activity, then transferred to the archive for a further five (5) years. |
Managing requests, questions and complaints | Execution of pre-contractual measures taken at the request of Users and/or Customers and/or performance of the contract | Five (5) years from the date of each request, question or complaint. |
Find out about and characterise customers, monitor the relationship, improve and personalise communications, offers and advice, and carry out statistical studies. | Legitimate interest | Five (5) years from the date of the last Customer activity, followed by a further five (5) years in the archives. |
To use personal data as a customer in order to be recognised as such by other services offered by other companies in the Terrena Group. | Legitimate interest | Five (5) years from the date of the last Customer activity, followed by a further five (5) years in the archives. |
Provide digital tools, financial activity management services and regulatory data, and maintain the security of these tools | Legitimate interest | Five (5) years from the date of the last Customer activity, followed by a further five (5) years in the archives. |
Manage commercial canvassing by post and telephone or electronic canvassing for similar products and services | Legitimate interest | Five (5) years from your last activity, then destruction |
For all suppliers | ||
Managing purchasing and supplies: * Order management * Monitoring and management of purchases and stocks * Performance management and management of the operating account * Store supply management * Invoice generation | Legitimate interest | Five (5) years from the date of the last Supplier activity, then transferred to the archives for a further five (5) years. |
Marketing and prospecting | ||
To send promotions and offers, personalised or otherwise, by electronic means. | Consent | Five (5) years from the last activity. |
Participation in competitions, lotteries and prize draws. | Execution of pre-contractual measures taken at your request and/or performance of the contract | Three (3) years from the end of the competition concerned. |
Carrying out profiling for the purpose of improving customer knowledge (establishing your profile, combining purchasing and informational data collected online and offline, segmentation, carrying out studies and analyses to better understand people's expectations in terms of services, products or offers). | Legitimate interest | Personal data from online and offline purchases used for this purpose is stored for 24 months from the date of your purchase. The other personal data used for this purpose is stored for as long as you have a customer or loyalty account, and for no longer than 5 years from the date of your last activity. |
For all candidates | ||
Analysis of applications in relation to positions offered | Legitimate interest | 1 month if candidate not selected but possibility of inserting CV library for a maximum of 2 years |
With regard to compliance with legal and regulatory obligations, defending its rights, safeguarding its interests and combating fraud | ||
Accounting and tax: Storage of invoices and other documents required for general accounting and tax purposes . | Compliance with legal and regulatory obligations | Personal data processed as part of the management of accounting and tax obligations is stored for a period corresponding to the duration of the current financial year plus one (1) year, then transferred to the archives for a period of ten (10) years. |
Exercising the rights of Users and/or Customers: Management of requests to exercise rights (communications, extracts of information required) | Compliance with legal and regulatory obligations | Personal data relating to requests to exercise rights are stored for three (3) or six (6) years from the date of the request, depending on the right exercised. Where proof of identity is required, it is deleted as soon as it has been verified. |
Defence of HORTIVAL DIFFUSION's rights and the fight against fraud: Establishment and storage of the means of proof necessary for the defence of rights in the context of actions and complaints brought against HORTIVAL DIFFUSION by Users and/or Customers and the fight against fraud. | Legitimate interest | The personal data required to establish and store the evidence needed to defend rights is stored for the duration of the applicable legal provisions, or for the duration of the dispute or litigation, should one arise, and until a final and binding decision has been handed down. |
Public and judicial authorities: Management of requests from public or judicial authorities and communications with the authorities | Legitimate interest | Personal data relating to the management of requests from authorities is stored for the duration of the proceedings before the authority concerned, and until a final and binding decision has been handed down. |
If HORTIVAL DIFFUSION is required to process the personal data of Users and/or Customers for purposes other than those listed in the tables above, HORTIVAL DIFFUSION will take any additional steps that may be necessary to ensure the legal compliance of all such processing.
6. Recipients of personal data
In order to achieve the purposes described above and only to the extent necessary for the pursuit of those purposes, the personal data we collect may be transmitted to some or all of the following recipients:
Within the Terrena group :
- Terrena Group subsidiaries in charge of placing, managing and executing contracts and orders;
- Terrena Group subsidiaries in charge of marketing, customer relations, complaints, canvassing, administrative services, IT services, online advertising or commercial canvassing;
- Terrena Group subsidiaries responsible for the centralised management of our customers' databases.
- To any other subsidiary of the Terrena Group whose intervention may be necessary to carry out the processing implemented in accordance with this policy.
Outside the Terrena group :
- Our service providers involved in all or part of the identified processing operations (in particular IT service providers responsible for maintaining the site, partners in the field of online advertising and personalised communications, and those responsible for the routing and delivery of products);
- To our partners who operate services available on our site or services accessible through the use of loyalty programmes;
- Our partners who sell products or services directly from our site;
- Our partners involved in producing and sending commercial prospecting campaigns;
- Our partners involved in the process of distributing personalised online advertising or commercial prospecting;
- To the suppliers of products and services of the Terrena Group's partners who may receive your personal data is available here.
