PERSONAL DATA PROTECTION POLICY

Within Thermador Groupe, respect of people’s privacy is a major priority and we constantly strive to protect it. Through this policy, Thermador Groupe undertakes to comply with EU regulation n°2016/679 of the European Parliament and the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter referred to as ‘GDPR’) and also with French law on personal data protection.

I. IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

In your dealings with Thermador Groupe, the ‘controller’ of your personal data is the company which decides ‘why’ and ‘how’ these data are processed, i.e. Thermador Groupe company, located at 60, rue de Luzais - Parc d’Activités de Chesnes - 38070 Saint-Quentin-Fallavier, SIRET n°: 339 159 402 00017, hereafter referred to as Thermador Groupe or "us".

II. CONTACT DETAILS OF THE DATA PROTECTION OFFICER

Thermador Groupe’s DPO (Data Protection Officer) is Adeline Porcher. She can be contacted via email at privacy@thermador-groupe.fr or by post at the following address: Thermador Groupe, Data Protection Officer, 60, rue de Luzais, Parc d’Activités de Chesnes, 38070 Saint-Quentin-Fallavier.

III. SOURCES

We may collect or obtain personal data concerning you in the following ways:

• Directly from you, for example when you contact us or give us your business card.
• During our commercial dealings, for example when we provide a product or service to you or to your employer.
• When you make your personal data public, for example on your website or that of your group, or on the social media.
• When you browse to our website, for example when you fill in personal information in our contact forms or you authorise the use of cookies.

IV. CATEGORIES OF PERSONAL DATA CONCERNED

‘Personal data’ refers to any information which could identify you directly (for example, by your name) or indirectly (for example, via pseudoanonymised information such as a unique ID). We may collect data:

• Concerning your identity: for example your name, first name, email address, telephone number.
• Concerning your professional life: for example your profession, work phone number, work address, delivery address, or information about your employer.
• Concerning your orders: for example your purchasing history or the contact details of the person delivered to.
• Concerning your financial information: for example bank details required for payment.

We do not collect your so-called ‘sensitive’ personal data. If we need to do and have legitimate reasons to do so, we would do it with your consent and according to applicable laws.

V. PROCESSING OF YOUR DATA

Category of processing	Purpose	Legal basis	Those concerned	Personal data category	Distribution
Management of customer database	Deliver products and services Create a direct contact Personalise our product range Check the accuracy of customer information Analyse sales activity	Consent Legal obligation	Customers	Identity Working life	IT service providers
Order management and customer service	Answer your requests Follow your orders, deliveries, invoicing and payment Manage claims	Legal obligation Execution of contract	Customers	Working life Economic and financial information	Sub-contractors specialised in transport IT service providers
Management of online orders	Create customer access online	Legal obligation Execution of contract	Customers	Identity Working life Connection data Financial data	IT service providers
IT service providers	Make it easier to navigate the site Run the forum Perform audience and statistical analyses	Consent	Customers and prospects	Identity Working life	IT service providers
External communication and prospecting	Inform you about our news and events Draw up a list of those interested by our products and services, depending on the case	Your consent or legitimate commercial reasons	Customers and prospects	Identity Working life	Communications agency Routing service provider IT service provider
Recruitment management	Select candidates and contact them	Consent	Candidates	Identity Working life	Sub-contractors specialising in recruitment IT service providers

 

VI. TRANSFER OF PERSONAL DATA OUTSIDE THE EU

In general, your personal data are kept secured in digital format on our servers and in physical format in our buildings in the European Union. However, for certain specific services, we may need to transfer some data to sub-contractors outside the EU. In this case, in compliance with prevailing regulations, we require those sub-contractors to provide the necessary guarantees for the management and securing of those transfers, and in particular a suitability ruling from the European Commission concerning certain countries, the ‘Privacy Shield’ for the US or European Commission’s standard contract terms (SCT).

VII. PERIOD OF TIME DURING WHICH PERSONAL DATA IS KEPT

We take all reasonable measures to guarantee that your personal data are kept for a period which does not exceed that necessary for the purposes described in point V.
We keep your personal data for the whole of our commercial relationship with you on the basis of our legal and contractual obligations and according to legitimate commercial interests.
At the end of the commercial relationship, we keep your data throughout the limitation period in compliance with applicable law, i.e. the legal period during which a person can bring charges concerning your personal data or during which your personal data can be pertinent to a case. If a court case is brought, we can continue to process your personal data for an additional period as required for the judicial process to be completed.
At the end of these periods, we will delete or physically destroy your personal data or anonymise them.

VIII. YOUR RIGHTS CONCERNING DATA

This personal data protection policy contains all the information on the personal data we collect, what we do with it and who has access to them.

RIGHT OF ACCESS AND RECTIFICATION
You can question us as to whether we possess personal data concerning you, and ask for a copy thereof. You may also secure the rectification of data about you which may be inaccurate. Given the purposes of our data processing, you have the right to see incomplete data supplemented accordingly.

RIGHT TO OBLIVION
You may also exercise your right for your data to be deleted and ask us to delete all personal data concerning you as soon as you withdraw your consent, or if the data are no longer necessary for the execution of the legal or contractual obligation.

RIGHT TO LIMITED PROCESSING
GDPR also allows you to ask for the processing of your data to be limited if you challenge the accuracy of data or the legality of its processing, even though you do not want your data to be deleted, in order to be able to follow a judicial procedure.

DATA PORTABILITY RIGHTS
You also have the right to receive your personal data in a structured format currently used and readable by machines for the purpose of being able to transfer them to another controller.

OPPOSITION RIGHTS
The right of opposition allows you to oppose the processing of your data at any time, as long as they are not necessary for a legal or contractual obligation to be executed. This right of opposition concerns in particular processing of data linked to prospecting.

RIGHT TO WITHDRAW YOUR CONSENT
When we process your personal data with your consent, you have the right to withdraw your consent at any time. This withdrawal does not affect the legality of any processing undertaken before the date upon which we receive notification of your withdrawal. Withdrawal of consent does not prevent processing being performed if it based on other secure legal foundations.

EXERCISING YOUR RIGHTS AND CLAIMS TO THE CONTROL BODY
PIn order to ask us a question in relation to these rights or any other clause of the policy, or to question us as to the processing of your personal data, you can contact our DPO whose contact details appear in point II.

We can ask for proof of your identity before responding to your requests.

In compliance with GDPR, we reserve the right to:

• Request payment of reasonable costs which take into account administrative costs incurred to provide the information, communicate the information or take the measures requested.
• Refuse to comply with these requests by demonstrating the manifestly unfounded or excessive nature of them.

We also inform you that you can at any time bring a claim before the competent control body. In France, that control body is the CNIL (Commission nationale de l’Informatique et des Libertés) www.cnil.fr

IX. EVOLUTION OF THIS POLICY

This policy may evolve periodically and you will be able to consult this page to keep up with the most recent version on our website.