Politique de protection des données personnelles

2 - Who is the data controller ?

The controller of the personal data processing carried out on the website https://www.gravitao.com is NOW-W, a simplified joint-stock company registered with the Bordeaux Trade and Companies Register under number 892 137 738, whose registered office is located at 26T Allée de Campes, 33470 GUJAN-MESTRAS.

3 – Definitions

The following terms shall have the meaning, in the plural or singular, set out below :

« NOW-W » or « we » : means the company NOW-W ;

« Personal Data » : means any personal data within the meaning of Article 4 of the GDPR ;

« CNIL » : désigne la Commission nationale de l’informatique et des libertés ;

« GDPR » : means the General Data Protection Regulation No. 2016/679 of 27 April 2016 ;

« French Data Protection Act » : means Act No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, in its latest version ;

« Website » : means the GRAVITAO website published by the company NOW-W, accessible at the URL address https://www.gravitao.com/.

4 – What Personal Data are processed and under what circumstances ?

NOW-W collects, through the Website, the following categories of data :

• Identification data that you provide to us via the contact form on the Website (title, last name, first name, email address, telephone number, country, city, etc.) ;

• Data relating to the personal contribution you wish to indicate in order to filter your searches on the Website ;

• Data relating to your contact requests (subject of the request, message) ;

• Browsing and traffic data automatically collected when you use the Website.

The personal data is obtained directly from you or results from your use of the website.

If your personal data is collected through a contact form, you are informed of the mandatory nature of the information by an asterisk (*). If you fail to provide this information, the processing cannot be carried out and your request cannot be completed.

Only the personal data that is strictly necessary with regard to the purposes described below is collected. Please note that this personal data protection policy applies solely to your personal data collected and processed through the website, and does not cover any subsequent processing carried out by NOW-W as part of the contractual or commercial relationship established with you.

5 – For what purposes and on what legal bases is your personal data processed ? How long are they retained ?

The processing of your personal data is based on the following legal grounds and retention periods :

MANAGEMENT OF THE RELATIONSHIP WITH THE WEBSITE USERS

Purposes / sub-purposes

Communication and exchange of information in order to respond to contact requests and to your messages.

Legal basis

NOW-W’s legitimate interest in responding to users’ requests submitted via the contact form.

Data retention periods

6 months from the date of the last exchange.

MANAGEMENT OF RIGHTS BY THE WEBSITE USERS

Purposes / sub-purposes

Management of users’ requests to exercise their rights regarding the processing of their personal data (right of access, right to object, right to restriction of processing, etc.).

Legal basis

Legal obligations.

Data retention periods

1 year for requests relating to the rights of access, rectification, erasure and restriction of processing.

6 years for the exercise of the right to object to processing.

6 – Who are the recipients of your personal data ?

Your personal data may be disclosed, according to their responsibilities and depending on the purposes pursued, to the recipients listed below :

Category of data recipients

Internal recipients within NOW-W : Staff members responsible in particular for NOW-W’s sales, communication, and IT departments.

External recipients of NOW-W : Subcontractors responsible for carrying out personal data processing operations, or providing consulting and support services. Parties involved in operations relating to the data controller’s corporate life (transfer, merger, acquisition, universal transfer of assets, etc.).

7 – Are your personal data transferred outside the European Economic Area (EEA) ?

Your personal data is not transferred outside the EEA. It is hosted in France and/or within the European Union.

In the event of a transfer of your personal data to a country outside the European Union, NOW-W will implement all appropriate measures to ensure a sufficient level of protection for your data, such as :

• Giving preference to so-called « safe countries » that is, those offering a high level of protection for your personal data ;

• Obtaining security and confidentiality guarantees by formalising the European Commission’s standard contractual clauses, while reserving the right to carry out regular checks.

8 – What are your rights regarding your personal data ?

You have the following rights regarding your personal data :

• Right of access : You may obtain a copy of your personal data at any time, along with information regarding the nature, origin, and use of that data, as well as the identity or categories of any potential recipients ;

• Right to rectification : You may request that any personal data concerning you that is inaccurate or incomplete be corrected or completed ;

• Right to erasure : You may request the deletion of your personal data, in particular if it is no longer necessary for the processing carried out, unless the data controller is subject to legal obligations requiring the retention of this data or if it is necessary for the establishment, exercise, or defence of legal claims ;

• Right to the restriction of one or more processing operations concerning your personal data : You may request that your personal data be temporarily made inaccessible in order to restrict its future processing in the following situations :

• When you contest the accuracy of your personal data, for a period enabling the data controller to verify its accuracy ;

• When you believe that the processing is unlawful and you object to the erasure of your personal data ;

• When your personal data no longer needs to be retained, but you wish it to be kept for the establishment, exercise, or defense of legal claims ;

When you have objected to the processing, for the period during which it is being verified whether the legitimate grounds pursued by the controller override your own.

• Right to data portability : You may request to receive the personal data concerning you that you have provided to the data controller and that is processed by automated means, in a structured and commonly used format. This right may be exercised only if the processing is based on your consent or on the performance of a contract or pre-contractual measures ;

• Right to object : you may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the data controller’s legitimate interests, unless there are compelling and legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims ;

• Right to define directives in the event of death : You may give instructions regarding the retention, deletion, and communication of your personal data. In the event of your death, your personal data will, in principle, be deleted, unless legal or regulatory obligations and/or statutory limitation periods require them to be retained ;

• Right to withdraw consent : you may withdraw your consent at any time regarding the processing of your personal data that is based solely on that consent.

9 – How to exercise your rights ? ?

You may submit any request relating to the exercise of your rights regarding your personal data to the following email address :

Proof of identity may be requested. The exercise of any of these rights may be refused if your request does not meet the conditions set out by the regulations. In such a case, you will be duly informed.

10 – How to lodge a complaint with the CNIL ?

If you believe that the processing of your personal data does not comply with legal and regulatory provisions, you may lodge a complaint with the CNIL at the following address : 3 place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, or directly online via the CNIL website https://www.cnil.fr/.

PERSONAL DATA PROTECTION POLICY

1 – What is the purpose of this document ?