This section explains the rules for implementing personal data processing carried out by CHOREOGRAPH as a part of its business in France and in the United Kingdom.
Concerned about the respect of data protection rules, CHOREOGRAPH undertakes to comply with the provisions of the General Data Protection Regulation EU n°679/2016 of 27 April 2016, entered into force on 25 May 2018, and :
- For its French business, the French Act n°78-17 of 6 January 1978 on Information Technology and Civil Liberties, and
- For its UK Business, the Data Protection Act 2018.
1 WHAT IS PERSONAL DATA?
Personal data is defined as any information relating to an identified or identifiable data subject either in a direct or indirect manner by reference to an identifier, such as a name, an identification number, a location data, an online identifier or to one or more specific elements to his physical, physiological, genetic, mental, economic, cultural or social identity.
2 WHAT IS DATA PROCESSING?
Data Processing is defined as any operation or set of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
3. WHAT ARE CHOREOGRAPH’S STATUS?
- As part of the management of the requests for contact from prospects or professional clients (in particular through the "Contact" form on its website), and more broadly, as a part of its business relationships (initial contact, quoting, contract negotiation and provision of services…) CHOREOGRAPH collects and process personal data as data controller. As such, CHOREOGRAPH undertakes to collect and process data in a lawful, fair and transparent manner. CHOREOGRAPH also undertakes to take the necessary measures to ensure the security and confidentiality of the personal data collected.
- As part of its provider activities in the field of marketing, CHOREOGRAPH processes personal data as a data processor. As such, CHOREOGRAPH processes personal data of data subjects only when instructed to do so and on behalf of its clients, and undertakes to take the necessary measures to ensure the security and confidentiality of the personal data entrusted to it by its clients.
4. CHOREOGRAPH AS A DATA CONTROLLER
4.1 How Does CHOREOGRAPH obtains personal data?
CHOREOGRAPH directly collects personal data:
- When people use the “Contact” form on CHOREOGRAPH’s website (which is dedicated to professional clients),
- During professional exchanges through a business framework (fair, exhibition…)
- By receiving emails from business contacts sent to the following address : CHOREOGRAPH - 27bis, rue du Vieux Faubourg - 59000 Lille FRANCE
This data is necessary to achieve the following purpose: processing the contact request.
4.2 What is the processing purpose and its legal basis?
The legal basis for the processing is CHOREOGRAPH’s legitimate interest. Indeed, it is in CHOREOGRAPH’s interests to collect data from professionals to be able to contact them easily to answer their information requests.
4.3 For How long does CHOREOGRAPH store data?
In accordance with Article 5 of Regulation 2016/679 of 27 April 2016, personal data are only stored in a form which enables identification for a period not to exceed the duration necessary for the purposes for which they are collected and processed.
The data collected through the business contact will be kept for a reasonable period following the last contact with CHOREOGRAPH.
4.4 What are the categories of data recipients?
The personal data collected through the contact form or a mail is transmitted to the CHOREOGRAPH FRANCE customer relation teams.
5. CHOREOGRAPH AS A DATA PROCESSOR
5.1 How does CHOREOGRAPH obtain personal data?
CHOREOGRAPH, as a service provider, is involved in sectoral marketing programmes gathering professionals.
These programmes (“The Programme”) have a marketing purpose (Alliance/IBehavior Programme, Conex Data, Conex + /IBehavior + Programme…) which is more precisely defined in section 5.3.
As such, each member of the Programme (“Member”), as data controller, collects personal data from individuals and submits its database to CHOREOGRAPH in accordance with the applicable regulation governing personal data protection.
CHOREOGRAPH does not collect personal data directly from data subjects but processes, as data processor, incoming data submitted by data controllers, following their instructions and in accordance with the processing purpose that they have defined.
The Members of the Programme, as data controllers, relate to the following business sectors:
In France :
- Personal Goods
- Home Goods
- Automobile
- Press / Publishing
- Services
- Food
- Wellness-services
- Associations
In the UK :
- Apparel
- Home and Garden
- Collectables
- Food and wine
- Gadgets and gifts
- Entertainment
- Health and beauty
- Travel and leisure
5.2 Which category of personal data is concerned?
CHOREOGRAPH receives from any Member of the Programme the following data, gathered in the Member’s client/prospect database:
- Nominative and contact data
- Data relating to personal life
- Hobbies/interests
- Order/purchase history
CHOREOGRAPH completes this data with:
- CHOREOGRAPH, as a Data Processor, centralizes data transmitted by Members of the Programme, as Data Controllers, in a secure database to which the Members of the Programme do not have access.
- This allows CHOREOGRAPH to carry out on these consolidated data a certain number of technical operations (data standardisation, deletion of duplicates, correlation with non-personal and public data and/or using algorithm to carry out segmentation...) in order to assist the Members of the Programme to:
5.3 What is the purpose of personal data Controllers?
CHOREOGRAPH, as a Data Processor, centralizes data transmitted by Members of the Programme, as Data Controllers, in a secure database to which the Members of the Programme do not have access.
This allows CHOREOGRAPH to carry out on these consolidated data a certain number of technical operations (data standardisation, deletion of duplicates, correlation with non-personal and public data and/or using algorithm to carry out segmentation...) in order to assist the Members of the Programme to:
(i) Optimise their marketing campaigns :
- Targeting the prospects or customers of the Members of the Programme who are most likely to be interested in a product or service advertising campaign,
- Identifying people in their customer database who are likely to make repeated purchases or donations,
- Enriching a Member’s database with additional data.
Marketing campaigns may be carried out by post, by email, by SMS at client’s choice.
Any Member of the French Programme may also access to specific services on a SaaS platform provided by CHOREOGRAPH.
(ii) Allow others business clients which are not part of the Programme to use such data for identical marketing purposes (commercial prospection/solicitation, database enrichment)
To operate these processing, CHOREOGRAPH acts exclusively on the request of Programme Members’ and on their behalf, the said Members being responsible for informing the persons concerned and obtaining their consent or allowing them to oppose this use of their personal data according to the legal basis chosen and according to the use that will be made of these data..
CHOREOGRAPH may be required to contribute as a processor for one business client acting as a Data Controller, in the following situations:
- Processing data provided by the client for targeting purpose ;
- Processing data provided by its client for analyses and improvement of customer knowledge purpose ;
- Performing a prospection or communication operation on behalf of its client.
CHOREOGRAPH never has any contact with the individuals except, if necessary, if an individual requests to exercise one of its rights (for example, if CHOREOGRAPH is recipient of such demand).
CHOREOGRAPH may commercialize data or turn to external service providers for this task.
Once CHOEREOGRAPH, or the external service provider acting on behalf of CHOREOGRAPH, has made a selection of individuals, their contact information is forwarded to intermediaries specialised in technical operations required for the marketing operations (prospection, solicitation or enrichment of the database) appointed by the client or the client itself particularly in operations of enrichment.
Lastly, CHOREOGRAPH may use data in the database in order to improve its services, test new features or new services in relation to services already provided. This operation is made in accordance with rules contractually fixed by the Members of the Programme, in accordance with the quality of service level they have defined, ensuring that these processes has no impact on individual’s privacy.
5.4 How long does CHOREOGRAPH retain the data?
In accordance with Article 5e of Regulation 2016/679 of 27 April 2016, personal data are only stored in a form which enables identification for a period which cannot exceed the duration necessary for the purposes for which they are collected and processed.
As a data processor, the data are only stored by CHOREOGRAPH for the period indicated by the Members of the Programme acting as data controller. In the absence of specific instructions from the client, CHOREOGRAPH has established strict rules to respect the rights and privacy of individuals and, consequently, any individual whose last transaction with a client dates to over 36 months shall not be retained by CHOREOGRAPH for its analyses.
5.5 Who are CHOREOGRAPH subprocessors?
The subprocessors are:
For French Programmes:
ATE : 21, avenue de la Créativité, 59650 Villeneuve d’Ascq – Hosting provider of the database located in France
MICROSOFT AZURE : Microsoft Amsterdam Data Center, Agriport 601, Middenmeer, Netherlands Hosting provider of the database located in the European Union.
LIVEDATA SOLUTIONS : Calle Equador 75, 08029 Barcelona, Espagne – Service provider located in the European Union and email supplier used to carry out email routing services.
MEDIAPOST : 19, rue de la Villette, 69425 Lyon Cedex 03 – Service provider located in France and CHOREOGRAPH Marketing partner.
ARSENAL : 7c rue du Houblon, ZI Pilaterie, 59700 Marcq en Baroeul - Service provider located in France, and partner in the marketing of CHOREOGRAPHE offers to its customers.
For UK Programmes:
ATE : 21, avenue de la Créativité, 59650 Villeneuve d’Ascq – Hosting provider of the database located in France
MICROSOFT AZURE : Microsoft Amsterdam Data Center, Agriport 601, Middenmeer, Netherlands Hosting provider of the database located in the European Union.
CHOREOGRAPH’s subprocessor or any company of its group may transfer data or make it available for one of the purposes previously mentioned to a company located outside the European Union. In such situations CHOREOGRAPH takes all the guarantees necessary to ensure a secure transfer of the data.
5.6 Who are the data recipients?
CHOREOGRAPH transfers data to the subprocessors referenced in section 5.5 and to its business partners. CHOREOGRAPH’s clients work in several business sectors, including:
Clients of French Programmes :
- Publishing and Media
- Automobile
- Wellness services
- Associations
- Energy
- Mail order
- Polls and surveys
- Personal goods
- Home goods
- Recreation
- Clothing
- Services
- Banking, Insurances
- Food
- Telephony
- Internet
Clients of UK Programmes :
- Apparel
- Home and Garden
- Collectables
- Food and Wine
- Gadgets and Gifts
- Entertainment
- Health and Beauty
- Travel and leisure
6. HOW DOES CHOREOGRAPH SECURE THE DATA?
In accordance with Article 32 of Regulation 2016/679 of 27 April 2016, CHOREOGRAPH undertakes to maintain data security and confidentiality.
To do this, CHOREOGRAPH has defined a strict security policy for personal data. This policy makes it possible to:
- Implement data encryption procedures to protect any database containing personal data which enters or exists in the CHOREOGRAPH information system.
- Secure work stations with unique user ids and strong passwords
- Limit the number of employees who have access to databases containing personal data
- Ensure that its own subcontractors comply with personal data regulations
- Regularly test the information system to check that it has a high level of security.
7. HOW DOES DATA SUBJECTS MAY EXERCISE THEIR RIGHTS?
7.1 General rules
Any person whose personal data is subject to processing has the ability to exercise his/her rights to access, correct, operate portability of, erase his/her personal data, and object to the processing of his/her data or limit the processing of his/her data, in accordance with Articles 15 and seq of Regulation 2016/679 of 27 April 2016. Any individual can also transmit post-mortem instructions.
These rights may be exercised directly by contacting:
- The Member of the Programme which collected data
- The Programme’s Client, Member or not, who uses the personal data for an advertising campaign or enrichment of its client database.
Such request can also be addressed to CHOREOGRAPH, it being specified that CHOREOGRAPH shall forward this request to the Data Controller:
- In writing at the following address: CHOREOGRAPH, 27bis, rue du Vieux Faubourg 59000 Lille
- By email at : data-privacy@choreograph.com
Such request will be answered within one (1) month, except in the conditions of Article 12.3 of Regulation 2016/679 of 27 April 2016.
In order to comply with the aforementioned regulation, CHOREOGRAPH has established a pushback list which makes it possible not to contact the data subject who do not wish it.
If you do not wish to be contacted by a client of CHOREOGRAPH, you may contact us at the address provided and tell us which contact details you wish to register in this pushback list.
7.2 CHOREOGRAPH’s Data Protection Officer’s contact info
The Data Protection Officer designated by CHOREOGRAPH is the law firm TGS France Avocats and is reachable:
- By writing at the following address: DPO CHOREOGRAPH - 27bis, rue du Vieux Faubourg - 59000 Lille
- By email at : data-privacy@choreograph.com
Last update: 02/23/23