PERSONAL DATA PROTECTION POLICY

Eurailtest may be led to collect your personal data, in particular in the context of professional meetings, folders, partnerships, candidacies, of your presence on our premises, as well as of your visits to our website.

Declarative personal data are those data that you provide on forms, whether virtualized on our website, in paper format, or in response to questions posed to you.

Eurailtest implements principles of data minimization, of data protection by design and of data protection by default. Consequently, the information collected is pertinent, adequate and limited to what is requisite for the purposes for which it is processed.

Eurailtest processes your personal data in compliance with the applicable regulations and, in particular, in the following circumstances:

• when you have given your free, specific, clear and univocal consent to the processing of your personal data (for example: by subscribing to thematic information, registering for an event, etc);
• when required in order to implement a contract or pre-contractual measures taken at your request (for example: candidature, management of a folder, etc);
• in order to meet Eurailtest’s legal or regulatory obligations (for example: fraud-fighting).

Your personal data are collected for specific, explicit and legitimate purposes. Depending on the case, your personal data may be used with the aim of:

• communicating with you in relation to folders, assignments, partnerships, etc;
• conducting satisfaction surveys, analyses and statistics in order to improve our products and services, as well as our acquaintance with our clients and prospects;
• requesting, obtaining or receiving information about Eurailtest or about the products and services offered by Eurailtest or its partners;
• subscribing to and receiving thematic information (documentation, invitations, activity reports, etc);
• processing your job application;
• improving your client-experience.

Eurailtest may likewise use your personal data for administrative purposes or for any other end determined by applicable law.

Since your personal data are confidential, only persons duly authorized by Eurailtest can access them, including their possible transmission to organs performing a monitoring or inspection function in compliance with the applicable law.

All persons having access to your personal data are bound by a commitment to confidentiality.

These persons include Eurailtest’s internal, authorized staff. Our service providers may also be required to process personal data strictly necessary for the performance of the services with which we entrust them.

In the case of recourse to service providers located outside the European Union, Eurailtest undertakes to ascertain that appropriate measures are in place in order to ensure that your personal data receive an adequate level of protection.

Eurailtest is very careful about the protection and safety of your personal data in order to assure their confidentiality and to prevent their being distorted, damaged, destroyed or divulged to unauthorized third parties.

When divulging data to third parties is necessary and authorized, Eurailtest ascertains that these third parties ensure the data in question the same level of protection as that extended by Eurailtest, and exacts contractual guarantees so that, above all, the data are processed exclusively for the purposes you agreed to in advance, with the requisite confidentiality and safety.

Eurailtest implements technical and organizational measures to ensure that your personal data are retained safely, for the period of time necessary to implement the intended purposes in compliance with applicable law.

In spite of the fact that Eurailtest takes all reasonable measures to protect your personal data, no transmission or storage technology is totally infallible.

In compliance with the applicable European regulations, in case of a proven violation of personal data that is liable to engender a heightened risk to the rights and liberty of the persons concerned, Eurailtest undertakes to communicate this violation to the competent supervisory authority and, when required by the said regulations, to the persons concerned (individually or generally, as the case be).

Without prejudice to the aforesaid, it is incumbent on you to take every caution necessary to prevent any unauthorized access to your personal data and to your terminal devices (computer, smartphone, etc).

Moreover, Eurailtest’s websites may offer links to third-party websites likely to interest you. Eurailtest has no control over the content of these third-party sites or over the practices of these third parties with regard to the protection of personal data they may collect. Consequently, Eurailtest assumes no liability for the processing of your personal data by these third parties, who are not subject to the present Policy. It is your responsibility to keep yourself informed about the personal data protection policies of these third parties.

Eurailtest retains your personal data for the duration required for fulfilling their intended purposes, subject to legal possibilities of archiving, data-retention obligations, and/or anonymization.

Specifically, we apply the retention periods specified below for the following few large personal data categories:

• Personal data of clients / prospects / business partners: As long as the user is active and, at most, for 3 years after the last contact;
• Online personal data (data rooms): 1 year after the last logon;
• Personal data of candidates (recruiting): For the duration required for processing the candidacy and, in the case of a negative outcome, 3 years after the last contact (excepting cases where the candidate agrees to a longer duration).

1. Your rights

Subject to the limits set by the applicable laws, you have the following rights over your personal data:

The right to information regarding the processing of your personal data

Eurailtext endeavors to provide you with concise, transparent, comprehensible and easily accessible information, in clear simple terms, regarding your personal data processing conditions.

The right to access your personal data, correct them and delete them (or “right to be forgotten”)

The right of access allows you to obtain from Eurailtext a confirmation that your personal data are or are not being processed, and the conditions of this processing, as well as to receive an electronic copy of this confirmation (for every additional copy, Eurailtext has the right to exact any payment required to cover reasonable expenses based on the administrative costs involved).

Likewise, you have the right to demand that Eurailtext correct your personal data promptly (by default, within 30 days).

Finally, with the exception of specific cases provided for by the applicable law (for example: retention requisite in order to meet a legal obligation), you have the right to demand of Eurailtext to delete your personal data promptly when one of the following grounds apply:

• Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You want to retract your consent on which the processing of your personal data was based, and no other grounds exist justifying this processing;
• You deem, and can establish, that your personal data have been illicitly processed;
• Your personal data must be deleted due to a legal requirement.

The right to restrict the processing of your personal data

The applicable regulations determine that this law may be invoked in certain cases, in particular under the following circumstances:

• When you contest the accuracy of your personal data;
• When you deem that the processing of your personal data is illicit and can establish this, but you object to the deletion of your personal data and, in lieu of this, demand to restrict this processing;
• When Eurailtest no longer needs your personal data, but you still need them for statements, rights or advocacy in court;
• When you object to data processing that is based on the legitimate interest of the person responsible for data processing, during the assessment of the question whether the legitimate motives pursued by the person responsible for data processing prevail over those of the person concerned.

The right to data portability

When data processing is based on your consent or a contract, this right to data portability allows you to receive the personal data provided by you to Eurailtest in a structured, commonly used format, and to transmit these personal data to another person responsible for data processing without Eurailtest impeding this.

The right to retract consent to the processing of personal data

When Eurailtest processes your personal data on the basis of your consent, the latter can be retracted at any moment by availing yourself of the means at your disposal to this end (the relevant procedure is described below, in Subclause 7.2 of this Policy). On the other hand, and in compliance with the applicable law, retraction of your consent is only valid with regard to the future and, consequently, you shall not be able to challenge the lawfulness of data processing carried out prior to this retraction.

The right to file a complaint with an inspecting authority

If you believe, despite the efforts of Eurailtest to maintain the confidentiality of your personal data, that your rights are not being respected, you are entitled to file a complaint with an inspecting authority. A list of inspecting authorities is available on the website of the European Commission.

The right to decide the fate of your personal data after your death

Finally, you have the right to organize the fate of your personal data post-mortem by deciding on general or specific instructions. Eurailtest undertakes to respect these instructions. In the absence of instructions, Eurailtest will acquaint the heirs with the possibility of exercising certain rights, in particular the right of access, if required for the settlement of the deceased person’s estate; and the right of objection in order to proceed to closing the deceased person’s user accounts and to object to the processing of their personal data.

2. Means of exercising your rights

If you have any question regarding the present Policy and/or the exercise of your rights as described above, you can contact Eurailtest, via email or post, by sending a letter accompanied by a copy of any identity document to contact@eurailtest.com

Eurailtest undertakes to send a response to your request promptly and, in any event, within one month of its receipt.

If necessary, this deadline can be extended by two months, taking into consideration the complexity and number of requests addressed to Eurailtest. In this case, you will be notified of this extension and of the reasons for it.

If your request is presented electronically, you will likewise receive the information electronically wherever possible, unless you specifically request to receive it in a different manner.

Should Eurotest fail to grant your request, it will notify you of the reasons for its inaction and you will be entitled to file a complaint with an inspecting authority and/or to institute court proceedings.

The present Policy is subject to French law. In the event of a dispute, wherever an amicable settlement failed to be reached, the Paris Commercial Court shall be the sole competent authority, notwithstanding a plurality of respondents or a guaranteed appeal.