Privacy Policy
Introduction
This privacy policy (“Policy”) describes how Descartes & Mauss processes your personal data. It applies to website visitors, job applicants, clients or prospects, and service providers or prospective service providers.
1. Data Controller
The data controller responsible for collecting and processing your personal data is:
DESCARTES & MAUSS,
SAS Company reg. (RCS, Paris)
n. 897 469 086
3, rue du Colonel Moll, 75017 Paris France
E-mail: privacy@descartesmauss.ai
2. Processing Activities: Purpose, types of data collected, legal basis and storage.
We collect different categories of information based on the type of person and nature and purpose of the data processing. The below table describes how, why and for how long we process your personal data, depending on whether you are a website visitor, job applicant, client or prospect, or a service provider or prospective service provider.
| Person | Purpose | Data collected | Legal basis | Duration of Storage |
|---|---|---|---|---|
| Website Visitors | Using our website: We automatically collect personal data from you through your web browser or device and through cookies. See our Cookies Policy , for additional information. This collection is done: to deliver the website, optimize your experience, obtain statistics. | IP-address, device type, browser type, referring site, pages accessed during your visit, cookies, the date, and time of each visit. | GDPR, Article 6(1)(a) (consent). GDPR, Article 6(1)(f) (our legitimate interest in providing the website, to improve user experience, and develop and improve our website). | Data relating to statistics and audience measurement are kept for up to 12 months from the date of your visit. (Specific storage periods depend on the individual cookie. See our Cookies policy). |
| Website Communications: We collect personal data directly from you to communicate with you and to respond to your queries (i.e., through our “Contact us” page). | Name and email address. | GDPR, Article 6(1)(f) (our legitimate interest in being able to respond to your enquiry and communicate with you). | Up to two years from the date on which you contacted us. | |
| Job Applicants | Applying for a Job: The purpose of our processing of your personal data is to evaluate your qualification in relation to the position you are applying for; to communicate with you during the recruitment process; to keep records related to hiring; and to comply with our legal requirements. We collect data from: you, your named referees (if applicable), from whom we collect: your full name, periods of previous employment, performance during previous employment. third party recruitment services (Welcome to the Jungle, LinkedIn) | The data provided in your CV and covering letter. Data you provide to us during interviews. Data you provide to third party recruitment services. Any personal data provided to us by your referees (if applicable). | GDPR, Article 6(1)(f) (our legitimate interest in assessing your qualifications in relation to the position for which you have applied). | If you are employed by us, your personal data will be transferred to your personnel file. If your application is rejected, your information will be stored for up to two years after the recruitment process ends so as to be considered for future employment opportunities with us. |
| Clients and Prospects | Administration of business relationships and lead generation: We process your personal data when you are a contact person or representative of a company that is a client or prospect of Descartes & Mauss, including for administration of the business relationship and lead generation. We process your personal data for the purpose of proposing, planning, performing, and managing the business relationship. We collect data from the following sources: directly from you, your employer. | Contact information, including name of the contact person, job title, work email address, work address and work phone number. Financial data of the legal entity and data related to invoice payments. Data related to business administration (requests for information, contract management, correspondence, and after-sales services). Data related to canvassing and promotional activities. | GDPR Article 6(1)(b) (necessary for the performance of a contract, or in view of concluding a contract, between the company you represent or your company and Descartes & Mauss). GDPR Article 6(1)(c) (legal obligation, such as record keeping obligations) GDPR Article 6(1)(f) (our legitimate interest in managing our business relationships). | For the duration of the commercial relationship with your company, or as otherwise required by applicable regulations. Regarding prospecting of former clients, personal data may be kept for up to three years from the end of the commercial relationship. Thereafter, we may contact you to enquire whether you wish to continue receiving commercial solicitations. If you decline, we will register your refusal for a minimum of three years. |
| Service Providers and Prospective Service Providers | We process your personal data if you provide us with services or have expressed an interest in providing us with services. This includes for the purposes of contacting you or your company in relation to potential business opportunities. We collect personal data from: you, your employer, Public websites (e.g., your company website, LinkedIn). | Contact information, including name of the contact person at the service provider, job title, work email address, and work phone number. If you are a sole trader, we also process information about your company name, company registration number, city, country, postal code, and business location Data relating to contract administration and financial data of supplier. | GDPR Article 6(1)(b) (necessary for the performance of a contract, or in view of concluding a contract, between the company you represent or your company and Descartes & Mauss). GDPR Article 6(1)(c) (legal obligation, such as record keeping obligations) GDPR Article 6(1)(f) (our legitimate interest in (i) managing business relationships with our suppliers and (ii) developing and improving our network of suppliers.) | For the duration of the commercial relationship with your company, or as otherwise required by applicable regulations 3 years from the last contact with the supplier or prospective supplier. |
3. Personal data about other parties that you provide
If you provide us with personal data about other people (such as, the contact information of colleagues within your company), you must ensure that you have their permission to do so and refer them to this Policy.
4. Recipients of personal data
Depending on the circumstances, we may share your data with:
- Service Providers, as part of our business operations and to perform certain services and functions, such as payment processing, marketing, web analytics, hosting, email communication and customer support services, and recruiting services. Pursuant to our instructions, and to provide services to us, these service providers may access, process, or store your personal data.
- Descartes & Mauss, Limited, our UK subsidiary, as part of providing our services.
- A third company and their advisers, as part of a business transfer, if we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of our company assets, or transition to another provider. In this case, your personal data may be transferred to a successor or affiliate as part of that transaction along with other assets.
- Public Authorities, if required to (i) comply with a legal obligation or lawful request by public authorities, (ii) protect and defend our legal rights or property, or (iii) protect against legal liability.
5. Transfer of personal data to third countries
In certain situations, we will transfer personal data outside EU/EEA. Transfers to third countries are made on the following legal basis:
- the country has been deemed by the European Commission as having an adequate level of protection with respect to personal data; or
- where the country does not have an adequacy decision from the European Commission, the Commission’s standard contractual clauses (“SCCs”) for the transfer of personal data to third countries will be put in place. To obtain a copy of our SCCs contact: privacy@descartesmauss.ai.
6. Your rights
When we process your data, you have the following rights:
- to access, rectify, or erase your personal data.
- to object to or restrict the processing of your personal data.
- to object to the processing of your personal data for direct marketing purposes.
- if the processing of your personal data is based on your consent, to withdraw your consent at any time.
- to receive a copy of your personal data in a structured, commonly used, and machine-readable format (data portability).
- to determine the retention, deletion, and communication of your personal data after your death.
- to file a complaint with a supervisory authority (in France, the Commission nationale de l’informatique et des libertés (CNIL)).
You can exercise your rights by contacting us; see Section 7.
7. Contact Descartes & Mauss regarding your privacy
If you have questions about our processing of your personal data, or if you wish to exercise your rights, please write to privacy@descartesmauss.ai. We will respond to your request within one month. If your request is not sufficiently precise or does not contain all the elements required to answer your request, we may ask you to provide additional details.
You may also file a complaint with your local data protection authority. In France, this authority is:
Commission nationale de l’informatique et des libertés (CNIL)
3 place de Fontenoy
TSA 80715
75334 PARIS CEDEX 07
Telephone: +33 (0)1 53 73 22 22
If you wish to file a complaint with the CNIL, you can complete the online form available at: www.cnil.fr/fr/plaintes
Website: https://www.cnil.fr
8. Amendments to our privacy policy
We will take all reasonable steps to communicate any changes to this Policy and will post any updated Policy on our website.
Updated: 1 October 2022.