Privacy Policy

For all other PII collected by any other means, the PII collection form will describe the rules that apply if they are different from the rules in the Privacy Policy.

DataGalaxy keeps the collected PII for the time strictly necessary to achieve the purpose of each processing, except for the exceptions provided for by the Law. These retention periods are indicated in the table below.

According to GDPR, your PII may be kept by us until the limitation periods for legal action have been reached. In this case, only the persons in charge of the litigation within the company have access to it. At the end of these periods, your PII are either deleted or irreversibly anonymised.

When we no longer have a legitimate business need to process your PII, we will delete it as soon as technically possible.

In view of the purpose of each processing, DataGalaxy implements the necessary means to ensure that PII are only accessible by its internal departments that need to know them, if this is strictly necessary for the proper execution of the processing.

PII are therefore transferred to the competent DataGalaxy departments, depending on the type of data and the purpose.

1. Service providers

In the course of its business and for the provision of its Services, DataGalaxy may share your PII with third party service providers.

These service providers act, according to article 4.8 of the GDPR, as personal data processors. In such a case, DataGalaxy undertakes to constantly ensure that :

• The service provider is contractually bound to respect the same obligations as ours regarding the protection of PII.
• The service provider presents sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the processing operations meet the requirements of the legislation on the protection of PII, and in particular of the GDPR.
• The service provider, in case of transfer of PII outside the European Union, contractually ensures their security and confidentiality.

2. Other third parties

Your PII may be shared with other types of third parties :

3. Special cases

We may also share your PII in the following specific cases:

• Where we are required or permitted to do so by law, applicable regulation, court order or regulation, or where such disclosure is necessary in connection with an investigation or proceeding at home or abroad.
• In case of an audit carried out in the context of investments, and/or in case of transfer of a DataGalaxy entity or its assets to any potential buyer.
• When we provide non-personal information to third parties, such as aggregated statistical PII.

All PII collected concerning Visitors, Prospects and Candidates are hosted in Europe, regardless of the hosting provider. For Customers, the location of storage depends on the subscription chosen:

• If the Customer is located in the European Union, all of the data contained in our Services (including PII) will always be hosted in Europe.
• If the Customer is located in the United States, all the data contained in our Services (including PII) will always be hosted in Europe.
• If the Customer is located in another country, our teams will make every effort to ensure that all the data contained in our Services (including PII) is hosted in the corresponding country.

Our hosting providers have numerous security certifications, a list of which is publicly accessible on their websites.

1. For customers located in the European Union

DataGalaxy does not currently transfer any PII outside the European Union. In the event that we make such transfers, they will only take place indirectly through our subcontractors.

DataGalaxy being subject to the GDPR, if it intends to engage any subcontractor for activities that imply a transfer of PII from the Customer to any country outside the European Union, then it undertakes to ensure that the security and confidentiality of said PII are preserved and this in particular through:

Data protection agreements in place between the EU and destination countries.
Standard contractual clauses issued by the European Commission or a Supervisory Authority in accordance with Article 46 of the GDPR.
Contracts for the outsourcing of Personal Data in accordance with Article 28 of the GDPR.
If a transfer of PII to countries not recognized by the European Commission as having an adequate level of protection is envisaged, DataGalaxy will systematically inform you.

2. For customers located in the United States

DataGalaxy makes its best efforts to limit the transfer of PII outside the United States. When such a transfer is envisaged, it must be linked to support and the improvement of the user experience.

In order to facilitate the management of support and the resulting user experience, we transfer certain PII (surname, first name, email address and message content) relating to users of the Solution at the Customer’s site from the United States to France. The PII are temporarily replicated in France while the issue that led to the support contact is resolved.

As such French support is subject to the RGPD, the security and confidentiality of PII is ensured by local legal provisions, which are very protective.

In order to ensure the security of the PII you send us, we have put in place a number of appropriate technical and organizational measures. In particular, the security of your PII is ensured by:

• The implementation of access control and management of authorisations for business software.
• Pseudonymisation and encryption of PII, where possible.
• Contracts for the outsourcing of Personal Data in accordance with Article 28 of the GDPR.
• The means to ensure the continued confidentiality, integrity, availability and resilience of processing systems and services.
• The means of restoring the availability of and access to PII within an appropriate timeframe in the event of a physical or technical incident.
• A procedure to regularly test, analyse and evaluate the effectiveness of technical and organisational measures to ensure the security of processing.

In order to reinforce the protection of your PII, we strongly recommend that you use a long password with several special characters, which you should change regularly and keep confidential.

1. Nature of your rights

In accordance with the GDPR, you have the following rights:

• Right to data portability : in accordance with Article 20 of the GDPR, the right to request a copy of your PII from us in a structured, commonly used and machine-readable format in order to provide them to another controller.
• Right of rectification : in accordance with Article 16 of the GDPR, the right to ask us to modify, complete or update your PII which has been found to be inaccurate, incomplete, equivocal or out of date.
• Right to erasure : in accordance with Article 17 of the GDPR, the right to ask us to permanently delete your PII, as soon as possible, in particular when you consider that it is no longer necessary for the purposes for which it was collected or that we are no longer legitimate to process it.
• Right to limit processing : the right to ask us to restrict the processing of all or part of your PII only in the cases listed in Article 18 of the GDPR, namely:
  – Check the accuracy of the PII you are disputing
  – Serve you for the establishment, exercise or defence of your legal rights, even if DataGalaxy no longer has any use for them
  – To verify whether the legitimate reasons pursued by DataGalaxy prevail over yours in case you object to the processing based on DataGalaxy legitimate interest
  – Fulfil your request to restrict the use of your PII , rather than erase them, if the processing of those PADs is unlawful
• Right of opposition : in accordance with Article 21 of the GDPR, the right to object at any time, on grounds relating to your situation, to the processing of PII for the purpose of commercial prospecting or, having as its legal basis the pursuit of a legitimate interest. Unless we demonstrate a compelling legitimate interest justifying such processing, we will only process PII not affected by your request.
• Post-mortem right : in accordance with article 85 of the French law 78-17 of January 6, 1978 on data processing, data files and individual liberties, the right to define particular directives concerning the conservation, deletion and communication of your post-mortem PII. These particular directives will only concern the processing carried out by DataGalaxy and will be limited to this perimeter.

2. Exercising your rights

To exercise your rights, we invite you to send us your request directly :

• By e-mail to dpo@datagalaxy.com, or
• By mail to DataGalaxy, Data Protection Officer, 47 rue Vivienne, 75002 Paris, France.

In accordance with the applicable legislation, we will ask you to prove your identity. Therefore, we thank you in advance for specifying when sending your request :

• Your name, first name, e-mail address
• The purpose of your request, the nature of the right you wish to exercise and the reasons for it.

DataGalaxy will have a maximum of one (1) month to respond to your request, which may be extended up to 2 (two) months depending on the complexity of the request. If we do not respond to your request, we will inform you of the reasons and of the possibility to lodge a complaint with a supervisory authority and to seek legal redress.