1. Preamble
This Privacy Policy is intended for internet users (hereinafter referred to as the “Users”) who may provide their personal data on the various websites and domains (hereinafter the “Sites”) of the APRC GROUP and its subsidiaries (hereinafter the “APRC GROUP”).
The use of the Sites implies full and complete acceptance of this Privacy Policy by the User.
The Privacy Policy is accessible from every page of the Sites and is also incorporated by reference into the General Terms of Use.
2. Definitions
The terms and expressions identified in capital letters in the Privacy Policy have the meaning given below, whether used in the singular or plural:
“Privacy Policy”: refers to this privacy policy intended to inform the User, whether professional or consumer (or non-professional), of the commitments made by the Company, in its capacity as Data Controller, to respect the User’s Data when using the Sites and to enable the User, where applicable, to exercise the rights granted by the amended French Data Protection Act.
“Data”: refers to the personal data of the User collected and processed when using the Sites, in particular contact requests and application submissions.
• “Data Controller”: refers to the Company that determines the purposes and means of the Data processing implemented through the Sites.
• “User”: refers to any person who uses the Sites.
3. Purpose
The purpose of the Privacy Policy is to define the Company’s commitments as Data Controller, with regard to respect for User Data collected and processed during the management of contact requests, the submission of an application and commercial prospecting.
4. Data collected
As Data Controller, the Company collects and processes three (3) categories of Data:
4.1 Identification data
To send a contact request, the Company requires the provision of identification data.
In the contact form, only the fields marked with an asterisk (*) are mandatory in order to allow the Company to contact the User again.
If no response is received in these fields, the User’s request cannot be processed.
The User’s answers in fields not marked with an asterisk (*) are optional.
4.2 Professional Data
To send a contact request and submit an application, the Company requires the provision of identification data.
In the application form, only the fields marked with an asterisk (*) are mandatory in order to allow the submission of the application to the Company and thus, if necessary, to be contacted again by the Company.
If no response is received in these fields, the User will not be able to submit his or her application.
The User’s answers in fields not marked with an asterisk (*) are optional.
4.3 Login data
The Company also collects IP address, login credentials and cookies, specifically addressed in Article 9 of the Privacy Policy when visiting one of the Sites.
The User is (1) informed in advance of the collection and processing of his/her Data and (2) must consent to it, by means of a checkbox, as part of the information and consent notice, at the time of collection of his/her Data via the contact form.
5. Purposes of the processing
By sending a contact request or an application, the User is informed that his or her Data is collected, used and processed to:
• Receiving, managing and processing contact requests;
• Recruitment management;
• Commercial prospecting;
• The implementation of personalized preference criteria.
6. Recipients of the processing
The Data is strictly intended for the Company, its employee staff and its specifically authorised technical staff, in compliance with the purposes listed in Article 5.
The Company may be required to communicate some of the Data to its subcontractors in order to process requests from Users, including the professionals that the Company mandates to market its real estate programs, subject to the User’s consent when collecting their Data via the contact form. Subcontractors are required to respect the confidentiality and security of the Data that may be communicated to them and to use it only in the context of the performance of their subcontracting mission or the provision of services.
The Company guarantees that the User’s Data will not be disclosed to any unauthorized third party, without the User’s consent.
In special circumstances, the Company may be required to disclose Data if requested by judicial or administrative authorities.
7. Data retention
The Data is kept by the Company for a period that does not exceed the period strictly necessary to achieve the purposes for which it was collected and referred to above, and in any event, may not be retained:
• more than sixty (60) days from the User’s request for deletion or transfer of Data made to the Company;
• more than two (2) years from the last contact with the User who applied to the Company;
• beyond the commercial relationship with the User for Data relating to customer prospects and more than three (3) years from their collection or the last contact from the User for Data relating to non-customer prospects;
• beyond the contractual relationship concerning the Company’s Partner Data.
At the end of the retention period provided for in Article 7, the Data will be archived in a secure manner for the necessary retention and/or limitation periods resulting from the applicable legislative or regulatory provisions.
8. User Rights
The User has the rights listed below:
• a right of access, i.e. to obtain confirmation from the Data Controller as to whether or not the Data concerning him or her is being processed and, where it is, access to said Data, as well as various information including the purposes of the processing, the category of the Data concerning him/her, the recipient(s) of the Data, etc.
• a right to rectify, as soon as possible, Data concerning him or her that is inaccurate, incomplete, outdated or ambiguous, or whose collection and processing is prohibited;
• a right to object to the processing of the Data by the Data Controller or to a transfer of Data, unless there are legitimate and compelling reasons that override the interests of the User.
• a right to erasure of Data concerning him for the following reasons:
• the Data is no longer necessary in relation to the purposes for which it was collected or processed by the Company;
• the User has withdrawn the consent on which the processing was based, and there is no other legal ground for the processing of the Data;
• the User objects to the processing of the Data and there is no overriding interest in carrying out the processing;
• the Data has been unlawfully processed;
• the Data must be erased in order to comply with the legal obligation to which the Company may be subject;
• the Data was collected when the data subject was a minor.
• the right to organise in advance and during his or her lifetime the conditions under which the User wishes the Data that the Company has collected and processed to be kept and communicated after his or her death;
• a right to data portability and retrieval allowing the User to receive the Data that he or she has transmitted to the Company in a structured, commonly used and machine-readable format, and to transmit it to another Data Controller, without the Company to whom the Data was initially communicated, cannot stand in the way.
If the User wishes to exercise any of the aforementioned rights, he/she may send his/her request:
• by post to the following address:
APRC Group – Attn: Data Protection Officer (DPO) – 63 quai Charles de Gaulle – CS50112 – 69463 Lyon Cedex 06.
The User must mention in his letter the company of the APRC GROUP with which he intends to exercise one of these aforementioned rights.
In the event that the User exercises any of his rights electronically, the Data will be provided, where applicable, electronically by the Company when possible, unless the User has specifically requested otherwise.
9. Data Security
The Company adopts sufficient, adequate and relevant security measures to preserve the security of the Data and, in particular, to prevent it from being distorted, damaged, or accessed by unauthorized third parties.
When the Company becomes aware of a security flaw, vulnerability or breach or is informed, it is required to inform the supervisory authority of:
• the nature of the security flaw, vulnerability, or breach, including, if possible, the categories and approximate number of individuals affected by the breach, vulnerability, or breach and the categories and approximate number of Data records affected;
• the likely consequences of the personal data breach;
• the actions taken or proposed to be taken by the Company to address the security flaw, vulnerability or breach, including, where applicable, measures to mitigate any adverse consequences.
• If it is not possible to provide all of this information at once, it can be provided in stages within a reasonable period of time.
The Company will not inform the supervisory authority of flaws, vulnerabilities and security breaches that are not likely to create a risk to the User’s rights and freedoms.
10. Cookies
Cookies are small files that are sent to the browser and saved on the hard drive of the computer, smartphone, tablet, etc., when the User connects to the Sites.
Cookies only store the identification code in memory with the exception of any other personal information concerning the User. Thus, the deposit of cookies carried out in the context of the use of one of the Sites does not allow the User to be personally identified, but it records information relating to the browsing of his terminal that the Company will be able to read during the User’s subsequent visits.
The storage period of cookies will not exceed thirteen (13) months from their first deposit in the User’s terminal.
There are several types of cookies that can be implemented in the User’s browser:
• record any information relating to their browsing on the Sites, such as any information relating to the pages consulted and the dates and times of consultation;
• to improve the User’s navigation;
• to establish statistics and volumes of traffic and use of the various elements of the Sites (sections and content visited, date and time of consultation, etc.), in order to improve the interest and ergonomics of the Sites;
• to recognize the browser of any User as a former registered visitor, to remember any preferences that may be sent when using the Site by his browser.
• adapt the presentation of the Sites to the display preferences of the Client’s terminal or of any Internet user (language used, display resolution, operating system used, etc.) during their visits, according to the viewing or reading hardware and software that their terminal has.
As such, and for cookies whose sole purpose is not to enable or facilitate browsing, an information banner is displayed during the User’s first visit, in order to inform him/her, prior to the deposit of these cookies, (1) of their presence and their precise purposes and (2) to allow them, where applicable, to oppose their deposit on their device and to change the settings by clicking on a link in the banner and (3) and the fact that continuing to browse it constitutes consent to the deposit of cookies on their device.
In addition, the User may withdraw their consent at any time by configuring the preferences of the browser of their terminal or other tools used to browse the Sites.
However, this will result in the deletion of all cookies used by the Internet browser, including those used by other websites, and thus make Internet browsing more complex or even impossible.
The User can configure his browser software so that cookies are saved on his terminal or, on the contrary, that they are rejected, either systematically or according to their issuer.
The User can also configure his browser software so that the acceptance or refusal of cookies is offered to him on an ad hoc basis, before a cookie is likely to be saved on his terminal.
For the management of cookies and its choices, the configuration of each browser is different. It is described in the help menu of the User’s browser, which will allow them to know how to modify their cookie wishes.
Finally, the Company uses the services of third-party partners to know the use of these sites, in order to optimize the User’s experience and to display personalized advertising. These partners use cookies that we do not control. To object to the deposit and reading of these cookies and trackers, the User must configure their browser as explained above, or go directly to the partner’s website by clicking on the links listed below:
| Cookie category | Means of deactivation |
| Analytical and performance cookies | Google Analytics |
11. Commercial prospecting
The Company may be required to collect and process Data for commercial prospecting purposes by sending its electronic communications, outgoing calls or postal mail.
Commercial prospecting may be carried out directly by the Company, or by Partners.
In such a case, the User is (1) informed in advance of the carrying out of the commercial prospecting operations and (2) must consent to it in the context of the information and consent notice, when collecting his or her Data via the contact form.
Prior consent is not required in the context of the provision of a good or service to the User for the purpose of commercial prospecting for similar products and services, insofar as the User has the possibility to object to the use of the Data free of charge.
Finally, the User is informed that he or she may register at any time, and free of charge, on a list of opposition to telephone canvassing in order not to receive calls from the Company.
12. Changes to the Privacy Policy
The Company reserves the right to modify the Privacy Policy and will inform the User in advance by means of a special notice posted on the Sites.
13. Applicable law
The Privacy Policy is written in French and is governed by French law.
Any dispute will be brought before the competent French courts.