Privacy Policy on Personal Data Protection

Privacy Policy on Personal Data Protection
Your privacy is important to us, and we pay special attention to it. We respect confidentiality and are committed to protecting the personal data collected about you. This Personal Data Protection Policy (hereinafter the “Policy”) describes the information that Hopscotch Groupe (hereinafter the “Agency”) and/or its subsidiaries collect about you, notably through or in part via:

its websites www.hopscotch.one (hereinafter the “Webite”);

or the website of one of its Business Units or subsidiaries, namely:www.hopscotchcongres.com ; www.hopscotchseason.com ; www.sagarmatha.fr ; www.hopscotchmoments.com ; www.heaven.paris

or pages of the Agency or one of its subsidiaries on social networks;

as well as within the context of your relations with the latter,

and how the Agency and/or its subsidiaries process such data (see information regarding the modalities for collecting, processing, and using your personal data).

This Policy also specifies the rights you hold over your personal data pursuant to the applicable legal and regulatory provisions.

If you have any questions or comments regarding this Policy, you may address them to the contact details provided below under the paragraph “What are your rights and how to exercise them?”.

The personal data processing set out and described in this Policy concerns those carried out by the Agency or one of its subsidiaries as data controllers, for their own account, or those executed jointly by the Agency with certain of its subsidiaries.
Regarding personal data processing carried out by other entities acting as data controllers for their own respective processing operations, such processing is not covered by this Policy. To learn more about such processing of your personal data by those entities, we invite you to contact them directly.
By way of illustration, concerning personal data processing affecting you carried out by clients of the Agency or one of its subsidiaries with whom you are in contact, you are invited to contact those clients for further information on such processing of your personal data.

In addition to terms defined elsewhere in this Policy, the following terms, whether used in singular or plural, have the following meanings:

• “Recipient”: means the natural or legal person, public authority, service, or any other body that receives disclosure of Data, whether or not a third party.
• “Data”: means any information relating to an identified or identifiable natural person (see “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more specific elements specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
• “Data controller”: means the natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the data controller determines jointly with others the purposes and means of processing, they are called “joint controllers”.
• “Processor”: means the natural or legal person, public authority, service or other body which processes Data on behalf of the data controller.
• “Processing”: means any operation or set of operations which is performed on Data or on sets of Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2.1  Hopscotch Groupe (also referred to as “the Agency” or “we” in this Policy) is a public limited company with a share capital of €2,252,791, registered with the Paris Trade and Companies Register under number 602 063 323, with its registered office located at 25 rue Notre-Dame des Victoires – 75002 Paris, VAT number FR26602063323, SIRET 602 063 323 00045, telephone: 01 41 34 20 00, email address: privacy@hopscotchgroupe.com.

The Agency is a communications group operating notably in the fields of public relations consultancy, public affairs consultancy, as well as organizing and managing major events for its clients.

For more information about the Agency, Click here.

2.2  This Policy also applies to the Agency’s subsidiaries whose legal information is listed below:

2.3  The Agency operates the publicly accessible website at the following URL:  www.hopscotch.one (the Website).

This Site aims to provide any internet user who visits or uses it information to discover the Agency’s activities and services, as well as its news (events, publications, etc.).

It also offers features and/or information enabling users to contact the Agency (e.g., contact requests, information requests, complaint submissions, unsolicited applications or responses to job or internship offers, etc.).

The Agency’s subsidiaries operate other publicly accessible websites at the following URLs:

www.hopscotchcongres.com ;
www.hopscotchseason.com ;
www.sagarmatha.fr ;
www.hopscotchmoments.com ;
www.heaven.paris ;

The Agency and/or its subsidiaries also manage pages presenting their activities and enabling them to publish content on social networks and interact with internet users via these networks (cf. LinkedIn ; X ; Instagram ; TikTok ; BlueSky ; YouTube ; Vimeo).

During your browsing and interactions on the Site, on other subsidiary websites, on pages managed by the Agency or its subsidiaries on social networks, or more generally during your interactions or exchanges with the Agency or its subsidiaries, the latter may collect and process Data about you, whether you are a client, prospect, contact, journalist, influencer, key opinion leader, public figure, internet user, job candidate, supplier, service provider, or partner, potential or current (also referred to as “you” or the “data subject(s)”), especially for managing their activities.

In this context, the Agency and/or the relevant subsidiary apply the principles defined by applicable legal and regulatory provisions on personal data protection, in particular Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and Law 78-17 of 6 January 1978 on data processing, files and freedoms (the “French Data Protection Act”) and related decrees.

3.1  Your Data is collected by the Agency and/or one of its subsidiaries and, where applicable, by its clients, either directly from you or indirectly from third parties.

3.1.1. Indeed, your Data is notably collected or processed wholly or partly during your navigation on the Site, your interactions with the Site, and the information you enter into data collection forms that may be present there, but also more generally as part of requests you may make to the Agency and/or the relevant subsidiary by any means you choose, through your relationship and exchanges with the Agency and/or the relevant subsidiary, as well as when you share site content via “share buttons” on social networks that may be offered on the Site, or during your navigation on one of the pages managed by the Agency and/or its subsidiaries on social networks.

Thus, your Data is collected by the Agency and/or one of its subsidiaries from you in the above-mentioned circumstances.

3.1.2. Furthermore, your Data is notably collected or processed in the context of requests you may make to the clients of the Agency and/or its subsidiaries by any means you choose, through your relationship and exchanges with these clients.

In such cases, your Data is collected directly from you by the clients of the Agency and/or its subsidiaries concerned.

3.1.3.  Your Data may also be collected via third parties.

Indeed, the Data we collect and process about you may be obtained or enriched by us, notably for commercial, communication, solicitation, prospecting, or marketing purposes, through other information sources (so-called “public” information, social networks, third-party or partner websites, professional directories, blogs, press articles, use of data rental/ data supply operations by third parties/partners, use of specialized databases offered by third parties, etc.).

Moreover, your Data may be collected by the Agency and/or one of its subsidiaries and then transmitted or made accessible to its clients or may be collected by the clients of the Agency and/or one of its subsidiaries and transmitted or made accessible to the Agency and/or its relevant subsidiary if applicable.

Similarly, your Data may be transmitted to the Agency and/or one of its subsidiaries by other staff members or contacts within your company or through third parties in certain situations.

Regarding especially Data processed during recruitment operations of the Agency and/or one of its subsidiaries, the Agency and/or the relevant subsidiary may use the information you provide (e.g., completed recruitment form or more generally information contained in your CV) that may, under certain conditions, be stored in a candidate database (CV library). However, the Agency and/or the relevant subsidiary may also contact third parties (for example recruitment agencies, previous employers, internship supervisors, or clients where you worked during prior assignments) or use other sources of information (notably professional social networks, recruitment agencies, or specialized recruitment websites) to collect information concerning you in order to review your application or profile. Furthermore, even in the absence of an application from you, the Agency and/or the relevant subsidiary may, particularly as part of monitoring and active searching for professional profiles that match available positions, collect Data from third parties (for example recruitment agencies or headhunters) or use other sources of information (notably professional social networks or specialized recruitment websites) to gather information about you with a view to inviting you to apply for one of their openings.

3.2 Furthermore, in general, you are informed that as a rule:

• if the processing of your Data is necessary to comply with legal or regulatory obligations of the Agency and/or its subsidiaries, the collection of such Data is mandatory;
• if the processing of your Data requires your consent, providing such Data is entirely optional (noting that failing to provide such Data could, however, prevent the Agency and/or one of its subsidiaries from carrying out the concerned processing at least in certain cases);
• if processing your Data is necessary to execute a contract or pre-contractual measures at your request, providing such Data is necessary to pursue this purpose and, in the absence of such data, the Agency and/or the relevant subsidiary may be prevented from fulfilling its contractual or pre-contractual obligations;
• if processing your Data is based on the legitimate interests pursued by the Agency and/or the relevant subsidiary, providing such Data is necessary for that purpose, and refusal to provide your Data could prevent or hamper the processing. For example, if you fail to provide information necessary to respond to your inquiry (information request, etc.), your request related to such Data collection may not be processed or may be delayed.

Specific case: if data collection forms (for example forms integrated on the Site or other subsidiary sites or on the pages of the Agency and/or its subsidiaries on social networks, or any data collection form regardless of the format the Agency and/or its subsidiaries may use to gather your information) require mandatory Data input for the associated processing, the relevant fields will be marked with an asterisk and you will be informed of the potential consequences of failure to provide such information. In the absence of an asterisk, the requested information is optional.

3.3 Except in specific cases or unless otherwise specified in this Policy, we do not collect so-called “sensitive” or “special” Data, i.e., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor genetic or biometric data for the purpose of uniquely identifying a natural person, nor data concerning health or a person’s sex life or sexual orientation. In this regard, you are informed that, as a rule, the Agency and/or its subsidiaries ask you not to provide such “sensitive” or “special” Data during your exchanges with them.

However, in certain situations, the Agency and/or one of its subsidiaries may process “sensitive” or “special” Data with your prior explicit consent or if such information has been made publicly available by you.

3.4 Data of minors or protected adults: generally, the use of the Site, other subsidiary websites, and the Agency’s and/or its subsidiaries’ social network pages is reserved for adults with legal capacity. The Agency and/or the relevant subsidiary cannot be held responsible for the use of the Site or social network pages by minors or persons lacking legal capacity, and for any consequences, particularly regarding the processing of their Data.

However, in certain specific cases, the Agency and/or the relevant subsidiary may process Data of minors at least fifteen years old when they contact us to apply for a job or internship. The Agency and/or the relevant subsidiary may also marginally process Data of minors, notably among influencers involved in certain specific topics, provided they are at least fifteen years old.

Your Data is processed for the following purposes:

4.1   Management and follow-up of information requests and exchanges with users

• Purpose of processing: The Agency and/or one of its subsidiaries may process your Data to ensure handling, management, and follow-up of any request (such as contact, information, or documentation requests) made by you, by any means including via the Site or interactions on the Agency’s and/or its subsidiaries’ social media pages (including, notably, the management, processing, follow-up, and possible moderation of your messages or comments) and responses thereto; management and follow-up of functionalities offered on or via the Site; and more generally for managing its relationships with its contacts broadly, including carrying out studies, surveys, or polls as applicable.
• Data controller: The Agency, or possibly jointly with one of its subsidiaries.
• Data processed: identity (title, last name, first name), username or pseudonym/alias, contact details (including postal address, telephone number, email address), contact/information/document request and exchanged correspondence, company affiliation and position if applicable.
• Legal basis for processing: the processing in this context is necessary for the legitimate interests pursued by the Agency and/or one of its subsidiaries to respond to your requests and more generally to ensure the management and follow-up of its relationships with its contacts.
• Data retention period: data is retained in an active database for the time necessary to respond to your request or manage the relationship; thereafter, it is archived for 5 years for administrative and/or evidential purposes, subject to other retention periods if your Data is processed for other purposes in accordance with the conditions and modalities described below in paragraph 4.

4.2  Management of the Agency’s and/or one of its subsidiaries’ relationships with current or potential clients

• Purpose of processing: To manage relationships with current or potential clients, the Agency and/or a subsidiary collects Data from its contacts at current or potential clients to manage and follow up pre-contractual, contractual, and post-contractual relations, including prospecting for new clients, contract conclusion and execution, services provided, payments and transactions, invoicing/accounting, and client/prospect/contact relations broadly, including client account management and follow-up of complaints if applicable.
• Data controller: The Agency, or possibly jointly with a subsidiary.
• Data processed: identity (title, first name, last name), contact details (email address, postal address, telephone number, etc.), professional life data, economic and financial information, details of transactions/services/contracts, data relating to transaction follow-up, and generally, relations between the Agency and clients, including complaint data.
• Legal basis for processing: such processing is generally necessary for the legitimate interests pursued by the Agency and/or one of its subsidiaries to ensure good management of relationships with current or potential clients and their contacts, including prospecting for new clients, contract execution monitoring, and organizing and managing missions or services entrusted. For invoice management and accounting, such processing may also arise from legal obligations.
• Data retention period:
  – For current clients (or contacts related to a current client): data is retained actively during the contractual or commercial relationship duration with the client ;
  – For potential clients (or contacts related to a potential client): data is retained actively during the pre-contractual relationship duration ;
• Afterward, data is archived for five years for administrative and/or evidentiary purposes, subject to other applicable retention periods as detailed in paragraph 4 below.

4.3 Management of the Agency’s or one of its subsidiaries’ relationships with partners (including providers and suppliers) current or potential

• Purpose of processing: The Agency and/or a subsidiary may process Data about current or potential partners and/or their contacts (for example, personnel members, consultants, or providers at the partner). Processing is for partner research, managing partnership requests, quotes, service proposals, partner management and relations management, contract execution follow-up, order tracking, invoicing, payments and transactions, and complaint follow-up.
• Data controller: The Agency, or possibly jointly with a subsidiary.
• Data processed: identity (title, first name, last name), contact details, company affiliation and function, education (studies, diplomas), professional experience and skills, CV contents where applicable, partnership requests or proposals, contract and order details, payment method data, transaction data, contract and relation monitoring data, invoices and complaint data.
• Legal basis for processing: such processing is generally necessary for the legitimate interests pursued by the Agency and/or one of its subsidiaries to ensure proper management of relations with current or potential partners and their contacts, including prospecting, execution monitoring, and organizational purposes. Accounting and invoicing data may respond to legal obligations.
• Data retention period: active retention during the pre-contractual (for potential partners) or contractual/commercial (for current partners) relationship, then archiving for 5 years for administrative and evidentiary purposes, subject to other retention conditions as outlined.

4.4  Management of relationships with journalists, influencers, key opinion leaders, political and public figures

• Purpose of processing: The Agency and/or one of its subsidiaries, and, where applicable, its clients, each within their respective scope, may process Data relating to their media/public affairs contacts broadly defined (notably journalists, influencers—including their close contacts where applicable—key opinion leaders, political figures, public personalities, and more generally the Agency’s contacts in the context of its activities). This processing aims to manage and monitor the consulting activities in public relations and/or public affairs, including notably:– The management and monitoring of media/public relations broadly defined (including segmentation/targeting, contact knowledge/briefing notes, communication actions, distribution of press releases, monitoring of media coverage, product placement operations, organization, management and follow-up of interviews/press conferences, crisis communication management, stakeholder mapping, media, digital, and social media monitoring operations, reports and summaries, etc.);
  – The management and monitoring of public affairs relations broadly defined (including segmentation/targeting, contact knowledge/briefing notes/biographies, communication actions, interest representation activities, lobbying operations, media, digital, social media, political and/or institutional monitoring, stakeholder mapping, design and implementation of engagement plans and contact programs where applicable, management and follow-up of interviews/meetings/press conferences, crisis communication management, reports and summaries, etc.).
• Data controller: The Agency, possibly jointly with a subsidiary or client.
• Data processed: identity (title, name, first name), alias/pseudonym, contact details (email, postal address, phone), social network profile information, company affiliation and function, education, experience, professional references, demographic data (age, gender), interests, expertise topics, service requests, contract details, payment data, invoices and complaints.
• Legal basis: Legitimate interest to manage and monitor the Agency’s, subsidiaries’, and clients’ public relations and public affairs activities. Processing of “sensitive” data (political opinions, religious or philosophical beliefs, union membership) may occur with explicit prior consent or if publicly disclosed.
• Retention: Active retention for 5 years, then archiving for 5 years for administrative and evidential purposes.

4.5  Organization, management and follow-up of trips (e.g., press or promotional visits/trips)

• Purpose of processing: The Agency and/or one of its subsidiaries and, where applicable, its clients, each within their respective scope, may process Data relating to their media/public contacts broadly defined (including notably journalists, influencers, key opinion leaders, political figures, and public personalities). This processing aims to organize, manage, and monitor their travel arrangements in the context of press or promotional visits or trips, including, in particular, accommodation, transportation, and catering (reservations, management of travel documents, etc.), as well as handle and follow up on any possible claims.
• Data controller: The Agency, possibly jointly with subsidiaries or clients.
• Data processed: Identity (title, last name, first name), contact details (email address, postal address, telephone number, etc.), company affiliation and position if applicable, details of travel (modes of transportation and accommodation, planned catering arrangements, dates, times, and details of the stay and organized activities, etc.), copy of identity document if applicable, dietary preferences if applicable, payment data and payment methods, transaction data, data relating to the monitoring of travel and the relationship, invoice data, and data relating to complaints.
• Legal basis for processing: Such processing is carried out on the basis of the legitimate interests pursued by the Agency and/or one of its subsidiaries and/or one of its clients to ensure the organization, management, and monitoring of travel in the broadest sense.
• Data retention period: Data is retained in an active database for 6 years, then archived for 6 years for administrative and/or evidentiary purposes, subject to other retention periods that may apply if your Data is processed for other purposes under the terms and conditions set forth below in this paragraph 4.

4.6  Execution of internal or external communication operations of the Agency and/or one of its subsidiaries

• Purpose of processing: The Agency and/or one of its subsidiaries may process Data relating to clients, prospects, contacts, journalists, influencers, key opinion leaders, political figures, public personalities, internet users, suppliers, service providers, or partners, whether potential or current, for the purpose of carrying out communication operations including, in particular, presenting the Agency and/or its relevant subsidiary as well as its/their activities (testimonials, distribution of presentation brochures, promotion and communication related to events, information on news, etc.) internally (e.g., intranet) and/or externally (e.g., on websites and/or social media pages of the Agency and/or one of its subsidiaries), and more generally on all communication media.
• Data controller: The Agency and/or possibly jointly with one of its subsidiaries.
• Data processed: Identity (title, last name, first name), photograph/video/voice, status (e.g., client, prospect, contact, journalist, influencer, key opinion leader, political figure, public personality, internet user, supplier, service provider or partner, and possibly details regarding such status), testimonial.
• Legal basis for processing: Such processing is based on your consent (to be obtained by the Agency via a dedicated document to be submitted to you), meaning you have the option not to consent or to withdraw your consent at any time without providing any reason or explanation.
• Data retention period: Data is actively retained for 3 years from the date your consent is obtained.

4.7  Conducting and preparing studies, analyses, reports, and statistics

• Purpose of processing: The Agency and/or one of its subsidiaries and, where applicable, its clients, each within their respective scope, may process Data relating to clients, prospects, contacts, journalists, influencers, key opinion leaders, political figures, public personalities, internet users, job candidates, suppliers, service providers, or partners, whether potential or current, for the purpose of conducting and preparing studies, analyses, reports, and statistics.
• Data controller: The Agency and/or one of its subsidiaries, possibly jointly with one of its clients.
• Data processed: Identity (title, last name, first name), username or pseudonym/alias, position and company affiliation if applicable, possibly professional life data, contact details (telephone number, email address or postal address), economic and financial data if applicable, details and data relating to the follow-up of transactions / services / contracts / ongoing disputes, etc., and more generally data relating to the relationships between the Agency and/or its relevant subsidiary (and, where applicable, its clients, each within their scope) and the data subjects.
• Legal basis for processing: Such processing is, as a general rule, necessary for the legitimate interests pursued by the Agency and/or one of its subsidiaries and/or one of its clients in order to ensure their development, assess the performance level of services provided, or operations carried out within the scope of their public relations and public affairs activities.
• Data retention period: Data is retained in an active database for 5 years, then archived for 5 years for administrative and/or evidential purposes, subject to other retention periods that may apply if your Data is processed for other purposes under the terms and conditions set out below in this paragraph 4.

4.8 Compliance with legal and regulatory obligations (including accounting, tax, and administrative obligations) related to the performance of contracts concluded by the Agency and/or its relevant subsidiary, and more generally to the activity of the Agency and/or one of its subsidiaries, and monitoring of the accounting and financial situation of the Agency and/or its subsidiaries

• Purpose of processing: In order to comply with the various legal or regulatory obligations incumbent upon the Agency and/or one of its subsidiaries (notably accounting, tax, or administrative obligations arising from the execution of commercial contracts for which the Agency and/or the relevant subsidiary is a party, and more generally from the Agency’s activity), the Agency and/or the relevant subsidiary processes the Data of its contacts (for example influencers, or contacts within its partners or clients, current or potential) for this purpose, as well as for the monitoring of its accounting and financial and budgetary situation (including general and analytical accounting, representation and monitoring of fluctuations in its assets, or the determination of its financial and budgetary situation, etc.).
• Data controllers: The Agency or jointly with one of its subsidiaries.
• Data processed: Identity (title, last name, first name), contact details (postal address, telephone number, email address, etc.), data relating to payments and payment methods, data relating to transactions, data relating to the monitoring of contracts and relationships with contacts, invoice data, accounting, financial, budgetary, and tax information.
• Legal basis for processing: Such processing is, as a general rule, necessary to comply with the legal or regulatory obligations incumbent upon the Agency and/or one of its subsidiaries (notably financial, tax, and accounting documents). Furthermore, the sub-purposes of this processing relating to the monitoring of the accounting and financial and budgetary situation of the Agency and/or one of its subsidiaries are necessary for the legitimate interests pursued by the latter in managing its accounting and financial situation properly.
• Data retention period: Data is actively retained for the duration of the current accounting or fiscal year, then archived until expiration of a 10-year period (except for data whose retention is solely for complying with the tax limitation period and which are therefore archived for a limited duration of 6 years).

4.9 Organization, management, and monitoring of events

• Purpose of processing: The Agency and/or one of its subsidiaries and, where applicable, its clients, each within their respective scope, may process Data concerning you as part of organizing and monitoring the events they offer, for instance, for promoting or communicating about their entity, a product, or a service (organization of interventions, management, processing and follow-up of registrations, responses to requests for information, etc.).
• Data controllers: The Agency or jointly with one of its subsidiaries, or possibly jointly with one of its clients.
• Data processed: Identity (title, last name, first name), contact details, position and company affiliation, information about event registrations and participation.
• Legal basis for processing: Generally, processing your Data in this context is necessary for organizing and managing events, based on executing pre-contractual measures at your request or performing a contract to which you are a party (e.g., event registration).
• Data retention period: Data is actively retained for the duration necessary to organize and follow up the event, then archived for 5 years for administrative and/or evidentiary purposes, subject to other retention periods that may apply if your Data is processed for other purposes under the terms and conditions set out below in this paragraph 4.

4.10 Prospecting / solicitation by postal mail or telephone

• Purpose of processing: The Agency and/or one of its subsidiaries and, where applicable, its clients, each within their respective scopes, may process Data of clients, prospects, journalists, influencers, key opinion leaders, political figures, public personalities, partners, and more generally contacts for carrying out commercial, communication, solicitation, prospecting, or marketing operations (including technical operations of segmentation, targeting, personalization of communications, etc.) by postal mail or telephone, notably to send information, such as product and service offerings or information on services that may interest them, information/releases (including dissemination, follow-ups, management of responses) on the news and/or activities of the Agency and/or its subsidiaries, and possibly clients of the Agency or its subsidiaries, other prospecting information or documents, as well as studies, surveys, promotions, or satisfaction polls, and also to send them products/gifts. Your Data may also be transmitted to partners to carry out their own postal mail or telephone prospecting operations.
• Data controllers: The Agency, or possibly jointly with one of its subsidiaries, or jointly with one of its clients.
• Data processed: Identity (title, first name, last name), contact details (postal address, telephone number), position and company affiliation if applicable, responses to studies/surveys/polls, profile/segment/email/types of services sought.
• Legal basis for processing: Such processing is carried out on the basis of the legitimate interests pursued by the Agency and/or one of its subsidiaries and/or one of its clients to promote themselves, ensure their commercial development, and/or carry out prospecting and solicitation operations broadly, with the clarification that recipients of such prospecting have in any case the right to object at any time without having to provide any reason or explanation.
• Data retention period: As a rule, active retention for three years from the collection of Data or the end of relations with the Agency and/or one of its subsidiaries and/or the client of the Agency and/or one of its subsidiaries where applicable, or the last contact from you to the attention of the Agency and/or one of its subsidiaries and/or the client of the Agency concerned (for example, for a client, from the end of a contract or last contact from the client; for a prospect, from the last contact from the latter such as online request, email, postal mail, phone call, etc.). Concerning data processed in satisfaction surveys, active retention during the time necessary to achieve the survey’s objective. In any event, after the active retention period, data is archived for 6 years for administrative and/or evidentiary purposes.

4.11 Prospecting / solicitation by electronic mail

• Purpose of processing: The Agency and/or one of its subsidiaries and, where applicable, its clients, each within their respective scopes, may process Data of clients, prospects, journalists, influencers, key opinion leaders, political figures, public personalities, partners, and more generally contacts for carrying out commercial, communication, solicitation, prospecting, or marketing operations (including technical operations of segmentation, targeting, personalization of communications, etc.) via electronic mail, including email, SMS, MMS, or private online messages. This includes sending product and service offers or information about services that may interest them, information/releases (including dissemination, follow-ups, management of responses) about news and/or activities (e.g., newsletters) of the Agency and/or its subsidiaries, and possibly clients of the Agency or its subsidiaries, other prospecting information or documents, as well as studies, surveys, promotions, or satisfaction polls. Your data may also be transmitted to partners for them to carry out their own electronic mail prospecting operations.
• Data controllers: The Agency, possibly jointly with one of its subsidiaries, or jointly with one of its clients.
• Data processed: Identity (title, first name, last name), contact details (postal address, telephone number, email), position and company affiliation if applicable, responses to studies/surveys/polls, profile/segment, types of services sought.
• Legal basis for processing:
  – Such operations do not require prior consent if messages are sent to professionals, to a professional email address, and relate to the recipient’s profession; in this case, processing pursues the legitimate interests of the Agency and/or its subsidiaries and/or clients to promote, develop commercially, and carry out broad prospecting and solicitation operations; recipients always have the right to object at any time without giving reasons;
  – In other cases, notably when you subscribe to the newsletter on the Site, such processing is based on your consent, which means you have the option not to consent or, if you do consent, to withdraw your consent at any time without providing any reason or explanation. Your prior consent is also required for the communication of your Data to partners for them to conduct their own electronic mail prospecting operations (it being specified that, in the absence of such consent, your Data will not be shared).
• Data retention period: Data is retained in an active database for three years from the collection of the Data or from the end of relations with the Agency and/or one of its subsidiaries and/or with the client of the Agency and/or its subsidiary concerned as applicable, or from the last contact made by you to the attention of the Agency and/or one of its subsidiaries and/or the client of the Agency and/or one of its subsidiaries concerned (for example, for a client, from the end of a contract or last contact from the client; for a prospect, from the last contact made by the latter, such as an online request, email, postal mail, telephone call, etc.). For data processed in satisfaction surveys in particular, Data is retained actively for the duration necessary to achieve the survey’s objective. In any event, after the active retention period, Data is archived for 6 years for administrative and/or evidentiary purposes.

4.12 Use of cookies or similar technologies for navigation tracking, including the conduct and preparation of studies, analyses, reports, and statistics, management and monitoring of site functioning, user experience improvement, provision of certain services or functionalities on the site, audience measurement, site performance monitoring, and display of advertisements, possibly targeted (excluding social networks or features related to social networks)

• Purpose of processing: In the context of your use of the Site and more generally the digital platforms of the Agency and/or one of its subsidiaries (excluding social networks or social network-related features), the Agency and/or its relevant subsidiary processes Data concerning you, notably for navigation tracking purposes, including the conduct and preparation of studies, analyses, reports, and statistics; management and monitoring of proper functioning and, in particular, site security; improvement of user experience; provision of certain services or functionalities on the Site; and audience measurement and performance monitoring of the Site. Data concerning you may also be collected and processed to enable the display on the Site or third-party websites of advertisements, possibly targeted (behavioral or programmatic ads) based on your profile, browsing, location (e.g., geolocated advertising), and your interactions with websites you visit. Such Data are collected through cookies or similar technologies.
• Data processed: Session data, internet connection and navigation data, including information about your browser or device and their configuration (e.g., device fingerprinting), unique device identifier, screen resolution, operating system, IP address, internet browser, device type, browsing history and more generally traffic and navigation data on the Site, data relating to actions and interactions tracking on the Site, number of visitors, users’ origin, pages visited, identifier-type data linked to your device, hardware, or operating system, scoring type data (e.g., bot score for user validation), information about your navigation and usage preferences on the Site and possibly on third-party websites, location data (e.g., IP address and geographic zone), network information, language, and non-personal data (age, gender, interests) linked to the user identifier.
• Data controller: The Agency, or possibly jointly with one of its subsidiaries.
• Legal basis for processing: When the processing of your Data exclusively aims to allow or facilitate electronic communication, or is strictly necessary to provide an online communication service at your explicit request, i.e., generally if this processing is strictly necessary to enable you to navigate the Site and benefit from the offered functionalities, it is based on the legitimate interests of the Agency and/or one of its subsidiaries to facilitate your navigation on the Site. In other cases, such processing is subject to your prior consent to the use of cookies and similar technologies for the aforementioned purposes, which means you have the option not to consent or to withdraw your consent at any time without having to provide reasons or explanations.
• Maximum lifespan of cookies and retention of Data collected by this means: Data is retained in active storage for the lifespan of the cookies and similar trackers through which the Data are collected, and for a maximum of six months.
• For more information on cookies, trackers, and similar technologies used by the Agency and/or its subsidiaries and its partners on the Site, on how to configure them, and on their lifespan, please refer to Hopscotch Groupe’s “cookie management policy.”

4.13 Use of cookies or similar technologies for navigation tracking, including the conduct and preparation of studies, analyses, reports, and statistics, provision and monitoring of interactive features with social networks, user experience improvement, audience measurement and performance monitoring of the Agency’s and/or its subsidiaries’ social media pages, and display of advertisements, possibly targeted (social networks and features related to social networks)

• Purpose of processing: For the purpose of providing interactive features between the site and social networks, and to monitor, understand, and study the usage of the Agency’s and/or one of its subsidiaries’ social media pages and interactions between the site and social networks, the Agency and/or one of its subsidiaries may offer you links on the site to its social media pages, configure said pages as administrators, or offer you tools created/provided by these social networks for use on their platforms. In such a case, the Agency and/or one of its subsidiaries processes Data concerning you notably to provide the aforementioned interactive features (for example, sharing buttons or access to social media pages), but also to improve your user experience, measure the audience and performance of the Agency’s and/or its subsidiaries’ social media pages and interactions between the site and said networks, and generate navigation statistics. Data concerning you may also be collected and processed to allow display on social networks of advertisements, possibly targeted (behavioral or programmatic advertising) based on your profile, browsing, location (e.g., geolocated advertising), and your interactions with the Agency’s and/or its subsidiaries’ social media pages as well as on the site or other websites you visit. These personal data are collected by means of cookies or similar technologies.
• Data controller: When the configuration of a social network tool performed by the Agency and/or its subsidiaries affects the nature of the personal data processed or characteristics of this processing, and more specifically when it can be considered that the Agency and/or its subsidiaries jointly determine the purposes and means of personal data processing, the Agency and/or its subsidiaries may be joint controllers of your personal data together with the concerned social network. In that case, the social network, which principally determines the purposes and means of processing as well as the nature and modalities of cookie deposits, is primarily responsible for the processing, and you are recommended to consult the privacy and cookie policies of these third parties for detailed information on their data collection and processing practices. The social networks concerned include Facebook, Instagram, YouTube, X (formerly Twitter), BlueSky, Vimeo, TikTok, and LinkedIn (see below).
• Data processed: Session, connection, and internet navigation data, including information about your browser or device and their configuration (e.g., device fingerprinting, unique device identifier, screen resolution, operating system, IP address, internet browser, device type, etc.), browsing history and more generally traffic and navigation information on the site and on our social media pages; data relating to traceability of actions and interactions with the site or the Agency’s and/or its subsidiaries’ social media pages or between the site and social networks; identifier-type information linked to your device, hardware, social networks or operating system; scoring-type data (e.g., bot score to ensure the user is not a robot); information on your browsing and usage preferences for the site, the Agency’s and/or its subsidiaries’ social media pages, and possibly third-party websites; location data (IP address and geographic zone, for example); information relating to the network, your language; and non-identifying personal data (age, gender, interests, demographics, family/marital status, professional activity/status, etc.) associated with the user identifier.
• Legal basis for processing: Such processing is subject to your prior consent to the use of cookies and similar technologies for the aforementioned purposes, meaning you may refuse to consent or withdraw your consent at any time without providing reasons or explanations.
• Maximum lifespan of cookies and retention of personal data collected by this means: Data is actively retained during the lifespan of the cookies and other similar trackers through which personal data are collected, and for a maximum of six months. Regarding the retention of personal data by LinkedIn, Instagram, X (formerly Twitter), BlueSky, TikTok, YouTube, Vimeo, and Facebook, see their respective Privacy Policies and Cookie Policies (see below).
• For more information about cookies, trackers, and similar technologies used by the Agency and/or its subsidiaries and partners on the Site, how to configure them, and their lifespan, please refer to the Agency’s “cookie management policy.“
• Regarding cookies, trackers, and similar technologies related to social networks:
  – Facebook and Instagram: Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour Dublin 2, Ireland. For more information on how Facebook processes your personal data when you use Facebook or Instagram, see Facebook Ireland Limited’s Data Policy and Instagram’s Data Policy, as well as their Cookie Policies, Instagram and Facebook.
  – YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For more information on how Google processes your personal data when you use YouTube, see Google Privacy Policies and Cookie usage.
  – X (formerly Twitter): X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, and for users in the European Economic Area, X International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. For more information on how X processes your personal data, see the Privacy and Cookie Policies of X.
  – TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland and TikTok Information Technologies UK Limited, 6th Floor, One London Wall, London EC2Y 5EB, UK. For more information on how these TikTok entities process your personal data, see TikTok’s Privacy Policy and Cookie Policy.
  – LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For more information on how LinkedIn processes your personal data, see LinkedIn’s Privacy and Cookie Policies.
  – Vimeo: Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, USA. For more information on how Vimeo processes your personal data when you view embedded video content on our site, see Vimeo’s Privacy and Cookie Policies.
  – BlueSky: Bluesky Social, PBC, 1800 M Street NW, Washington, D.C. 20036, USA. For more information on how BlueSky processes your personal data when you use their platform, see BlueSky’s Privacy Policy.

4.14 Management of applications and recruitment process

• Purpose of processing: The Agency and/or one of its subsidiaries may process your Data for the management and follow-up of job or internship applications submitted in response to offers or spontaneously, as well as the operations related to the recruitment process of the Agency and/or one of its subsidiaries. This includes, notably, monitoring and actively searching for professional profiles matching available positions, receiving and examining applications, evaluating and selecting applications and professional profiles, creating a candidate database (or CV library), using recruitment support methods and techniques (including psychometric or psychological tests, graphological analyses, or professional situational assessments), summoning candidates and conducting recruitment interviews, as well as the resulting decision-making (rejection or hiring of the candidate).
• Data controllers: The Agency, and/or jointly with its subsidiaries.
• Data processed: Identity (title, first name, last name), contact details (email address, telephone number, postal address, etc.), data relating to your professional life, information relating to your education (studies, diplomas, etc.), experience and career path, skills/professional references and current employment, economic and financial information, and all information contained in your CV (including interests, if applicable), and more generally within your application (cover letter, portfolio of creations/contents if applicable, etc.).
• Legal basis for processing: Such processing is necessary for the legitimate interests pursued by the Agency and/or one of its subsidiaries for the purpose of searching and recruiting new employees. However, retention of your data in the candidate database (or CV library) of the Agency and/or its subsidiaries after the position has been filled, to propose other potentially interesting positions to you, is subject to your prior consent.
• Data retention period: Your Data is retained for the duration necessary to process your application and, subject to your prior consent, may be kept for up to two years from receipt of your application, for example, to allow the Agency and/or its subsidiaries to contact you during this period if a position corresponding to your profile becomes available. After this period, your Data is archived for 6 years for administrative and/or evidentiary purposes.

4.15  Management of Data Subject Rights Requests

• Purpose of processing: To enable the Agency and/or one of its subsidiaries and, where applicable, its clients, each within their respective scope, to comply with their various legal and regulatory obligations regarding Data protection (e.g., responding to data subject rights requests, taking into account the resulting consequences including managing objections to prospecting, etc.), the Agency and/or one of its subsidiaries and its clients, each within their respective scope, may process Data concerning you in relation to this purpose.
• Data controllers: The Agency and/or jointly with its subsidiaries or possibly jointly with one of its clients.
• Data processed: Identity (title, first name, last name), contact details (email address, telephone number, postal address, etc. depending on the information provided by the requester), content and nature of the request, exchanges, and response, additional information or a copy of an identity document only when the situation requires it (e.g., in case of reasonable doubts as to the requester’s identity).
• Legal basis for processing: Such processing is, as a rule, necessary to comply with the aforementioned legal and regulatory obligations incumbent upon the Agency and/or its subsidiaries and, where applicable, its clients acting as data controllers (possibly joint controllers).
• Data retention period: Data is actively retained until the data controller(s) respond(s) to the request*, then archived for a maximum of 6 years from the time of response (depending on the type of request). However, when a copy of an identity document is collected hereunder:*
  – It is immediately deleted when it was provided by you but the request does not require transmission of such document;
  – It is deleted promptly after verifying the identity of the person making the request when the situation requires such verification or retained as archives for evidentiary purposes in exceptional cases where the data controller(s) identify(s) a strong litigation risk, for 6 years.

*In case you object to receiving prospecting communications, your identity and/or contact details may be retained actively by the data controller(s) for 3 years to take your request into account (e.g., maintenance of an objection list to prospecting).

4.16 Management and monitoring of pre-litigation and litigation

• Purpose of processing: Such processing of your Data is carried out by the Agency and/or one of its subsidiaries for the management and monitoring of pre-litigation and litigation (notably commercial litigation with clients, partners, providers, suppliers, and wider contacts), including preparation, conduct, and monitoring of litigation as well as enforcement of rendered decisions, and also the management and monitoring of actions aimed at establishing, exercising, or defending a right in court (including, where applicable, enforcement of the rendered decision). However, regarding the management and monitoring of litigation and pre-litigation involving journalists, influencers, key opinion leaders, or public/political figures, the Agency and/or one of its subsidiaries and the client of the Agency and/or one of its subsidiaries concerned by such pre-litigation/litigation may process Data jointly concerning the mentioned data subjects for this purpose.
• Data controllers: The Agency and/or one of its subsidiaries and/or jointly with its subsidiaries, and/or possibly jointly with one of its clients.
• Data processed: Identity (title, first name, last name), civil status, economic and financial information, history/information related to exchanges and relationships with the Agency and/or its subsidiaries and/or one of its clients, and generally all information necessary in view of the subject matter of the dispute, disputed facts giving rise to the procedure, information/documents/evidence gathered tending to establish or refute the facts alleged, characteristics and details of the pre-litigation/litigation/procedure, decision, information necessary for execution of the decision, including, where applicable, data relating to convictions (notably criminal), offenses or security measures, or special categories of data as defined previously.
• Legal basis for processing: Such processing is based on the legitimate interests pursued by the Agency and/or its subsidiaries and/or by the client of the Agency and/or its subsidiaries concerned, in order to preserve/enforce their interests and rights in court, notably in the performance of relationships with data subjects. Furthermore, special categories of Data may be processed if strictly necessary for these purposes and for establishing, exercising, or defending a legal right. Likewise, data relating to offenses, convictions, or security measures may be processed to enable the Agency and/or its subsidiaries and/or the client of the Agency and/or its subsidiaries concerned to prepare and, if applicable, conduct and monitor legal action as victim(s), defendant(s), or on behalf of a victim or defendant, and to enforce the decision rendered.
• Data retention period: As specified above, Data processed for the various purposes described are retained as archives for the legal limitation periods, notably for evidentiary purposes, in the event of litigation. For pre-litigation initiated before expiry of the limitation periods above and requiring Data retention to establish, exercise, or defend the rights of the Agency and/or its subsidiaries and/or the client of the Agency and/or its subsidiaries concerned, Data will be retained until amicable resolution of the dispute (including execution of such resolution if any), or otherwise deleted upon expiry of the corresponding limitation period. For litigation or legal proceedings, especially judicial, initiated before expiry of the periods above and necessitating Data retention for the same purposes, Data will be retained for the duration of such proceedings and until all ordinary and extraordinary legal remedies against the rendered decision are no longer possible. Decisions rendered may be retained by the Agency and/or its subsidiaries and/or by the client of the Agency and/or its subsidiaries concerned until full execution of the decision, or possibly as permanent archives.

Note: Regarding all active retention periods referenced above in paragraph 4, you are informed that these are “by principle” durations applied by the data controller(s), except if you exercise your right of erasure, objection, or withdrawal of consent, in the situations and according to the conditions set forth in paragraph 6 below. In such cases, your data will be retained only as archives for the duration specified above in 4.16 after exercise of these rights.

5.1 As a matter of principle, only duly authorised persons within the Agency and/or one of its subsidiaries may access your Data where such access is necessary for the performance of their duties and/or assignments, namely in particular the authorised personnel (including, in the broadest sense, employees, interns, temporary staff, etc.) of the Agency and/or one of its subsidiaries, notably those responsible for marketing, communication, public relations/public affairs, commercial management, recruitment and human resources, client and prospect relations, administrative, financial and legal matters, development, IT, projects, etc.

5.2  External recipients to the Agency and/or, where applicable, one of its subsidiaries may also receive your Data, namely:

• the departments or entities responsible for auditing or supervising the Agency and/or one of its subsidiaries and/or the clients of the Agency and/or one of its subsidiaries where applicable (statutory auditors, departments or entities responsible for internal or external control procedures, authorised supervisory bodies, etc.);
• the advisors of the Agency and/or one of its subsidiaries and/or the clients of the Agency and/or one of its subsidiaries where applicable (legal, financial, accounting advisors, etc.);
• the partners of the Agency and/or one of its subsidiaries and/or the clients of the Agency and/or one of its subsidiaries where applicable, including in particular their current or potential service providers and suppliers;
• social media platform operators, third-party website publishers, as well as cookie providers used on the website, and third-party companies involved, for example, in the implementation of prospecting or communication operations, in the management of our marketing activities, or more generally in the operation of the website (e.g. provision and proper functioning of the features offered on the website, performance, security, etc.). In this respect, it is also recalled that if you post content disclosing your Data on the internet, and in particular on the website or on the social media pages of the Agency and/or one of its subsidiaries, such content may of course be accessible to any internet user. Likewise, if you have consented to the use of your Data for internal and/or external communication purposes, such Data may be accessible to and/or viewed by the audiences to whom such communications are addressed, depending on the uses to which you have consented;
• technical service providers or other contractors involved in activities or assignments for which access to Data is necessary and/or justified. This category of recipients may also include any publisher of applications, software or tools used in the course of our activities, as well as any IT service provider or maintenance provider responsible for the applications, software and/or tools used by the Agency and/or one of its subsidiaries and/or by the clients of the Agency and/or one of its subsidiaries where applicable, in which your personal data may be processed;
• the clients and prospects of the Agency and/or one of its subsidiaries, with regard to certain personal data;
• potential third parties whose activity consists in creating and updating databases in connection with public relations and/or public affairs consulting activities;
• social security and tax authorities authorised to receive personal data in certain circumstances;
• organisations, legal officers and ministerial officers, particularly in the context of debt recovery activities;
• where applicable, the organisation responsible for managing the telephone marketing opt-out list;
• legal officers, ministerial officers and, where applicable, the competent courts or administrative or judicial authorities, in particular for the purpose of enabling the sale or transfer of all or part of the activities or assets of the Agency and/or one of its subsidiaries and/or the clients of the Agency and/or one of its subsidiaries where applicable, or in the context of the management and monitoring of pre-litigation and/or litigation matters;
• the insurers of the Agency and/or one of its subsidiaries and/or the clients of the Agency and/or one of its subsidiaries where applicable.

5.3 The data controller(s) may also be required to disclose your Data in response to legitimate requests from public authorities or authorised bodies, on the basis of applicable legal or regulatory provisions. Your Data may therefore be communicated to any authority legally entitled to receive such information, in particular in the event of a request issued by judicial, law enforcement or administrative authorities.

5.4 It is specified that the recipients referred to above are not necessarily recipients of all your personal data, but only of the data strictly necessary for the purpose requiring such disclosure.

6.1  In accordance with the conditions, procedures and limits defined by the applicable legal and regulatory provisions relating to data protection, you benefit from the following rights with regard to your Data:

• Right of access: you may obtain confirmation as to whether or not Data concerning you are being processed by the Agency and/or one of its subsidiaries and/or, where applicable, by the clients of the Agency and/or one of its subsidiaries and, where this is the case, access to such Data as well as certain information relating to the processing of your Data and the characteristics of such processing;
• Right to rectification: you may request the correction of your Data that you consider to be incomplete or inaccurate;
• Right to erasure: in certain circumstances provided for by the applicable provisions, you may request the erasure of your Data (except, for example, where such Data are necessary for the performance of your contractual relationship with the Agency and/or one of its subsidiaries and/or with the clients of the Agency and/or one of its subsidiaries where applicable, or where such Data are necessary for the Agency and/or one of its subsidiaries and/or the clients of the Agency and/or one of its subsidiaries where applicable to comply with their legal or regulatory obligations or to establish or exercise their rights);
• Right to restriction of processing: you may request the restriction of the processing of your Data, namely to request, in certain circumstances, the marking of your Data in order to limit their future processing;
• Right to data portability: in certain circumstances and under the conditions provided for by the applicable provisions, you have the right to request that the Data concerning you that you have provided to us be received by you or, where technically feasible, transferred to a third party in a machine-readable format (it being specified that this right to data portability only applies to processing based on the consent of the data subjects or on the performance of contractual relationships, provided that the processing of the Data is carried out by automated means);
• Right to withdraw your consent: you may withdraw your consent where the processing is based on your consent, without such withdrawal affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal;
• Right to define instructions regarding the retention, erasure or communication of your Data after your death: in this respect, in the event of death brought to the attention of the data controller(s), please note that your Data will be deleted (unless their retention is necessary for a specified period due to legal and regulatory obligations and/or statutory limitation periods and/or mandatory retention periods referred to above in paragraph 4 concerning the detailed characteristics of the processing), after having, where applicable, been communicated to a third party that you may have designated.

Furthermore, in certain circumstances and under the conditions provided for by the applicable provisions, you benefit from a right to object, allowing you to object to the processing of your Data for reasons relating to your particular situation. It is specified that, with regard to prospecting activities, including profiling operations related to such prospecting, you have an absolute right to object, which may be exercised at any time without having to provide any reason or justification. 

6.2  With regard to the processing of your Data carried out by the Agency in its capacity as data controller (whether jointly or not with its subsidiaries or with its clients), these rights may be exercised with the Agency:
(i) by email at the following address: privacy@hopscotchgroupe.com or 
(ii) by post at the following address: Comité de sécurité des données personnelles – 25, rue Notre-Dame des Victoires – 75002 Paris – France.

Upon receipt of such a request, a response will be provided as soon as possible and in any event within a maximum period of one month from the receipt of the request. Where necessary, this period may be extended by two additional months, taking into account the complexity and the number of requests received, in which case the requester will be informed accordingly.

Where there is reasonable doubt as to the identity of the person making a request to exercise the aforementioned rights, additional information necessary to confirm their identity may be requested and, where required by the circumstances, a photocopy of an identity document bearing their signature may be requested for this purpose. In such a case, the response periods mentioned above will be suspended pending receipt of the additional information required to identify the data subject.

The request may be submitted by the data subject or by a person specifically authorised by the data subject for this purpose, provided that such authorised person provides proof of their identity and that of the data subject, as well as proof of the mandate, including its duration and precise purpose. The mandate must also specify whether the authorised representative may receive the response.

Furthermore, where your Data are processed by another entity acting as data controller, jointly with the Agency and/or one of its subsidiaries or on its own behalf or on behalf of one of its subsidiaries, it is your responsibility to contact the relevant entity directly in order to exercise your rights with respect to such processing.

6.3  By way of illustration, with regard to the processing of Data carried out by a client of the Agency and/or one of its subsidiaries acting as data controller for its own account, and not jointly with the Agency and/or one of its subsidiaries, it is your responsibility to contact the relevant client directly in order to exercise your rights with respect to such processing.

6.4 Furthermore, and for the sake of clarity, the Agency and/or one of its subsidiaries may, in certain circumstances, be considered as jointly responsible for the processing of your Data together with the social media platforms on which the Agency and/or one of its subsidiaries maintains dedicated pages or with which the Agency and/or one of its subsidiaries offers interactions (see details of the purposes in paragraph 4 above). Depending on the social media platform concerned, the joint controller may be:

• with regard to Facebook and Instagram: : Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For more information on how Facebook processes your Data, please refer to the Facebook Irland Limited Data Policy as well as the Instagram Data Policy, and, where applicable, to the Facebook and Instagram Cookie Policy in order to configure the cookies used on the pages of these social media platforms (Facebook & Instagram)
• with regard to YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For more information on how Google processes your Data when you use the YouTube social media platform, please refer to the Google Privacy Policy as well as the information relating to Google’s use of cookies;
• with regard to X (formerly Twitter): X Corp., 1355 Market Street, Suite 900, San Francisco, CA 94103, United States, and, for users located in the European Economic Area, X International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. For more information on how X processes your personal data, please refer to the X Privacy Policy and, where applicable, the X Cookie Policy in order to configure the cookies used on the pages of this social media platform;
• with regard to TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, 6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom. For more information on how the aforementioned TikTok entities process your Data as joint controllers, please refer to the TikTok Privacy Policy and, where applicable, the TikTok Website Cookies Policy in order to configure the cookies used on the pages of this social media platform;
• with regard to LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For more information on how LinkedIn processes your Data, please refer to the LinkedIn Privacy Policy and, where applicable, the LinkedIn Cookie Policy in order to configure the cookies used on the pages of this social media platform;
• with regard to Vimeo: Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, United States. For more information on how Vimeo processes your personal data when you view video content embedded on our website, please refer to the Vimeo Privacy Policy and, where applicable, the Vimeo Cookie Policy in order to configure the cookies used on the pages of this social media platform;
• with regard to Bluesky: Bluesky Social, PBC, 1800 M Street NW, Washington, D.C. 20036, United States. For more information on how Bluesky processes your personal data when you use this social media platform, please refer to the Bluesky Privacy Policy and, where applicable, the cookie policy applicable to this social media platform in order to configure the cookies used on its pages.

In such cases, you may also, for the exercise of the aforementioned rights, consult your account settings on the above-mentioned social media platforms and/or contact:

• with regard to Facebook and Instagram: the Data Protection Officer of Facebook Ireland Limited by email, in particular by using the dedicated contact form;
• with regard to YouTube: the Data Protection Officer of Google Ireland Limited by email, in particular by using the dedicated contact form;
• with regard to X (formerly Twitter): the Data Protection Officer of X by email, in particular by using the dedicated contact form;
• with regard to TikTok: the Data Protection Officer of TikTok by email, in particular by using the dedicated contact form;
• with regard to LinkedIn: the Data Protection Officer of LinkedIn by email, in particular by using the dedicated contact form;
• with regard to Bluesky: the Data Protection Officer of Bluesky Social, PBC, appointed through Ametros Group Ltd, by email at dpo@ametrosgroup.com, or the European representative Ametros Ltd by email at gdpr@ametrosgroup.com;
• with regard to Vimeo: the Data Protection Officer of Vimeo, via the European representative EDPO, in particular by using the dedicated contact form or by post at the following address: EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium.

6.5  In any event, you have the right to lodge a complaint with the competent supervisory authority (in France, this is the Commission Nationale de l’Informatique et des Libertés, known as the “CNIL”: 3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 – France; Tel.: +33 (0)1 53 73 22 22) if you consider that the processing of your personal data is not carried out in accordance with the applicable legal and regulatory provisions relating to the protection of personal data.

To better understand your rights, you may also refer to the explanations provided by the CNIL here: https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles.

6.6  You are also informed that, pursuant to Articles L.223-1 et seq. of the French Consumer Code, if you are a consumer, you may at any time object to telephone marketing by registering free of charge on the website « www.bloctel.gouv.fr ».

7.1 The Agency implements appropriate organisational and technical security measures, taking into account in particular the categories of Data processed, the state of knowledge, implementation costs, the nature, scope, context and purposes of the processing, as well as the risks—whose likelihood and severity may vary—to the rights and freedoms of natural persons, in order to protect your personal data against any malicious intrusion, loss, alteration or disclosure to unauthorized third parties, and more generally to ensure the security and confidentiality of such Data and to guarantee a level of security appropriate to the risk.

However, due to the inherent difficulties of conducting activities on or via the internet and the risks associated with the electronic transmission of data, the Agency cannot be held to an obligation of result.

In the event of any difficulties, the Agency will make its best efforts to contain the risks and will take all appropriate measures in accordance with its legal and regulatory obligations (corrective actions, notification to the CNIL, and where applicable to the data subjects, etc.).

7.2 When developing, designing, selecting, and using our services offered on the website that involve the processing of personal data, the Agency takes into account the right to personal data protection by default and by design (see the principles known as “Privacy by Design and by Default”).

7.3 Access to personal data concerning you is limited to our employees or partners, and more generally to the recipients referred to above, who are authorised and need to know such data in the course of the performance of their duties and/or activities.

7.4 In the event of the outsourcing of part or all of the processing of personal data, the Agency contractually requires its processors to provide security guarantees, in particular regarding the confidentiality of the personal data to which they may have access (appropriate technical and organisational measures for the protection of such data).

Your Data are processed primarily within the European Union.

8.1 However, for the purposes mentioned above, some of your Data may be transferred to third-party entities established in countries located outside the European Union (e.g. processors involved in the processing activities mentioned above, etc.).

Some of these entities are considered to ensure an adequate level of protection of personal data because they are established in a country whose regulations on personal data protection have been recognised as providing an adequate level of protection for such data (see the European Commission’s adequacy decisions: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

Furthermore, if the country in which the relevant entity is established does not provide an adequate level of protection for such data, we ensure that appropriate security and confidentiality measures are implemented in order to guarantee the continued protection of your Data.

Accordingly, in such circumstances, you are informed that transfers of your Data to entities located outside the European Union are governed by the conclusion, with the recipients of such data, of contractual clauses in accordance with the recommendations of the European Commission, enabling us to ensure that appropriate safeguards are implemented with regard to the protection of such Data, where applicable supplemented by additional measures to ensure the protection of your Data.

You are further informed that transfers of Data outside the European Union are lawful where the transfer is necessary for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken at the request of the data subject; where the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the data controller and another natural or legal person; or where the data subject has given explicit consent to the proposed transfer after having been informed of the risks that such transfer may entail for them due to the absence of an adequacy decision and appropriate safeguards.

A copy of the reference documents referred to in this paragraph may be obtained (with all commercial information considered sensitive or confidential or covered by trade secrecy removed) from the contact mentioned in the paragraph above entitled “What are your rights and how can you exercise them?”.

9.1 Please note that the digital media of the Agency and/or one of its subsidiaries (in particular the website or the pages of the Agency and/or one of its subsidiaries on social media platforms) may provide or contain links to third-party websites, including social media websites. The Agency and/or one of its subsidiaries does not exercise any control over the activities of such websites or the policies they apply with regard to the protection of your personal data and your rights. You are therefore advised to review the safeguards offered by such websites before interacting with them. In this respect, your attention is drawn to the fact that the personal data protection policy of such websites may differ from the present data protection policy of the website, and it is your responsibility to review them.

9.2 If you post content disclosing your personal data on the internet, and in particular on social media platforms, including the social media pages of the Agency and/or one of its subsidiaries, such content may be accessible to any internet user and may be collected or used by third parties for purposes that are not the responsibility of the Agency. In any event, the liability of the Agency and/or the relevant subsidiary cannot be sought where the processing of personal data carried out through any of these third-party websites does not comply with the applicable legal and regulatory provisions.

10.1 This Policy may be amended at any time, and such amendments shall take effect on the date on which the corresponding update is published.

10.2 In the event of any modification, the new Policy will be made available on the website in the dedicated section. In addition, all Data collection forms that may appear on the website include a link to this Policy.

10.3 You are therefore invited to consult it regularly.

11.1 Cookies and other trackers or similar technologies may be placed and/or read on your browser or device when you visit the Website.

11.2 Click here to access the Agency’s “Cookie Management Policy”, which is also available via a link included in the footer of all pages of the Website.