Personal Data Protection Policy
Customer contacts and contacts

The data is mainly collected directly from our interlocutors, customers and prospects of our company.

As a result, we only collect and use the data that is necessary to conclude or perform contracts with our company, namely:

• identity of the contact(s) in charge of a file or contacted for prospecting purposes (e.g. title, surname, first name);
• professional contact details of the contact(s) in charge of a file or contacted for prospecting purposes (e.g. professional email, professional postal address, professional landline or mobile telephone number, fax number);
• professional information of the contact(s) in charge of a file or contacted for prospecting purposes (e.g. position, grade, function);
• technical data depending on the use case (identification or connection data such as IP address or logs);
• Images of the contact(s) in charge of a file or contacted for prospecting purposes (e.g. in the case of access to our premises).

Pre-contractual exchanges
We process data of people who interact with us when we have approached the structure to which they belong for prospecting purposes or when they have contacted us to contract with us.

Contract & Contract Follow-up
We process the data of our contact persons attached to our customers as part of the follow-up of the contractual relationship between us and our customers.

Invoicing, Payment & Accounting
We process the data of our contact persons with our customers and prospects in the context of invoicing and payment for orders placed.

Customer/prospect relationship management
We process the data of our contact persons with our customers and prospects in order to communicate with them in the context of questions that they may ask us in connection with the current or future performance of a contract with our company.

Management of the directory of our customers and prospects
We keep an up-to-date directory of our customers and one of our prospects, which implies that the latter mention our main contacts with the latter.

Organization of events by our company
We process the data of our interlocutors with our customers and prospects when we invite them to events that we organise or co-organise.

Third-party staff access management
We process the data of our interlocutors accessing our premises in order to secure access to them (e.g. keeping a register, access badges, etc.).

Third-party staff video surveillance
Certain specific areas of our premises, such as barriers and fences, are subject to video surveillance, which results in the processing of third-party data that may be filmed.

Compilation of statistics
We may compile statistics on the data of our customers and prospects.

We define the retention period of our interlocutors' data with our customers and prospects with regard to the legal and contractual constraints that weigh on us and, failing that, according to our needs.

As a matter of principle, data relating to our customers and prospects must be kept for the time strictly necessary for the management of the commercial relationship. More specifically, we are committed to the following retention periods: 

Contracts with our customers
5 years from the date of conclusion
10 years for electronically concluded contracts of more than €120

Business correspondence (purchase orders, delivery orders, invoices, etc.)
10 years from the end of the financial year

CCTV footage
For a maximum of one month

Access to buildings
For a maximum of one month

Technical Data
1 year from collection

Cookies
See the Cookie Policy

The periods indicated in the previous table are necessarily extended for the legal limitation period as evidence in the event of a dispute. In the latter case, the retention period is extended for the duration of the dispute.

After the set deadlines, the data is either deleted or kept after having been anonymised, in particular for reasons of statistical use. They can be kept in the event of pre-litigation and litigation.

It is reminded that deletion or anonymization are irreversible operations and that SENEF is no longer able to restore them.

The processing of our contact persons' data with our customers and prospects as presented above is based on the following conditions of lawfulness, which differ depending on whether the processing concerns customers or prospects:

Customers
Pre-contractual or contractual performance

Leads
Pre-contractual performance or legitimate interest of SENEF

The recipients of the data are the natural or legal persons who receive the personal data. The recipients of the data can therefore be SENEF employees as well as external bodies.

We ensure that the data collected and processed in the context of our relationships with our customers and prospects is only accessible to authorised internal and external recipients, and in particular, to the following recipients:

• the staff of the competent departments authorised to manage the relationship with our interlocutors with our customers and prospects and their line managers;
• support services staff, i.e. administrative, logistics and IT services and their line managers;
• our service providers or support services (e.g. IT service provider);
• the competent authorities in case we are required to share certain data with court officers, services in charge of internal control procedures, etc. ;
• In the event of a visit to our premises, the reception staff, who collect the data of any visitor in a register.

In the case of internal recipients, we decide which recipient will have access to which data according to an enabling policy and we ensure that they are subject to an obligation of confidentiality.

With regard to external recipients, we inform you that the personal data of our contacts with our customers and prospects may thus be communicated to some of our service providers or to any authority legally entitled to know them (tax and social security authorities in particular). In this case, SENEF is not responsible for the conditions under which the staff of these authorities have access to and use the data.

We may involve any subcontractor of our choice in the context of the processing of the personal data of our interlocutors with our customers and prospects.

For the purposes of the GDPR, processor means any natural or legal person who processes personal data on behalf of the controller. In practice, these are the service providers with whom SENEF works and who work on SENEF's personal data.

In this case, we ensure that the processor complies with its obligations under the GDPR.

We are committed to signing a written contract with all our subcontractors and impose the same data protection obligations on them as we impose on ourselves. In addition, we reserve the right to audit our subcontractors to ensure that they comply with the provisions of the GDPR.

We undertake, as the data controller, to keep an up-to-date record of all processing activities carried out where required by law to do so.

This register is a document or application that makes it possible to identify all the processing carried out by SENEF as data controller.

We undertake to provide the CNIL, at first request, with the information enabling it to verify the compliance of the processing with the data protection regulations in force.

We implement such technical physical or logical security measures as we deem appropriate to prevent accidental or unlawful destruction, loss, alteration or unauthorized disclosure of data.

These measures mainly include:

• management of authorisations for access to data;
• internal safeguards;
• identification process;
• conducting security audits and penetration testing;
• the adoption of an information systems security policy;
• the adoption of business continuity/recovery plans;
• the use of a security protocol or solutions.

In any case, we undertake, in the event of a change in the means to ensure the security and confidentiality of personal data, to replace them with means of superior performance. No change can lead to a regression in the level of security.

We undertake to notify the CNIL of any data breach that we may suffer under the conditions prescribed by the regulations on personal data.

Our contacts with our customers and prospects are informed of any data breach that could pose a high risk to their privacy.