PRIVACY STATEMENT LE PAIN QUOTIDIEN
Last modified on September 16th 2021.
First of all, we are excited that you are interested in the products and services of Le Pain Quotidien.
This privacy statement describes how we use the Personal Data you provide us with.
We may ask you to share certain Personal Data with us, including but not limited to your first name, last name and e-mail address (identification data). For certain specific obligations you may be required to provide us with additional data, such as billing or payment data.
We only collect Personal Data that is necessary to inform you about our products (and services), to execute an agreement with you and to contact you.
For this purpose, we base ourselves on the processing grounds of the agreement, the legal obligation, our legitimate interest and, in some cases, your consent (see also Clause 2).
The processing of your Personal Data is subject to this privacy statement. For questions and/or comments, please contact [e-mail address].
By providing your Personal Data, you are deemed to have acknowledged the use of your Personal Data in accordance with this privacy statement.
Clause 1 – Definitions
“Affiliated Company” means any company that is affiliated to Le Pain Quotidien insofar as it meets the conditions for an “affilitated company” as set out in the French Commercial Code.
“Controller” has the meaning as defined in the General Data Protection Regulation 2016/679. Le Pain Quotidien will be qualified as the Controller which determines the purposes and means of the processing of Personal Data.
“Le Pain Quotidien” means Le Pain Quotidien, opérant sous la dénomination « Le Pain Quotidien », SAS au capital de 8 262 998,64 €, ayant son siège social au 42 rue de Cléry, 75002 Paris (France) et immatriculé au RCS Paris B 417 706 298..
“Personal Data” has the meaning as defined in the General Data Protection Regulation 2016/679, which is any information relating to an identified or identifiable natural person (also referred to as “data subject”).
“Processor” has the meaning as defined in the General Data Protection Regulation 2016/679, which processes Personal Data on behalf of the Controller.
“Website” means the website of Le Pain Quotidien: france@lepainquotidien.com.
Clause 2 – Purposes and legal grounds
Customer data
In relation to providing our services and our activities we collect and process the identification and contact data of our customers, their employees, associates, appointees and other useful contacts. The data may be processed for the purposes of execution of the agreement with our customers, customer management, accounting and direct marketing activities such as sending promotional or commercial information. The legal grounds for this processing are the agreement, compliance with a legal obligation to which we are subject, our legitimate interest and, in some cases, your consent.
Data of suppliers and subcontractors
We collect and process the identification and contact data of our suppliers and subcontractors, as well as any (sub)contractor(s), their employees, associates, appointees and other useful contacts. The data may be processed for the purposes of execution of the agreement, supplier/subcontractor management and accounting. The legal grounds for this processing are the agreement, compliance with a legal obligation to which we are subject and/or our legitimate interest.
Data of employees
The data of our employees may be processed for the purposes of staff management and payroll administration.
Data of applicants
We process the identification and contact data, as well as the work history and other data that is usually indicated on a curriculum vitae of applicants when they provide us with this information. The Personal Data is processed to determine whether you qualify for a job with us on the ground of our legitimate interest.
If we wish to retain your Personal Data for a longer period of time after the relevant vacancy has been filled, we will inform you and request your permission to do so.
Other data
In addition to the data of customers, suppliers/subcontractors, employees and applicants, we also process Personal Data of others, such as possible new customers/prospects, useful contacts within our sector, network contacts, etc. This is done via our Website or other channels. The purposes of this processing are in the interest of our activities, direct marketing and public relations. The legal grounds for this processing are our legitimate interest, the execution of an agreement and, in some cases, your explicit consent.
Specifically, we may use the Personal Data we collect for the following purposes:
- to provide you with our newsletter, when you subscribe to this;
- to find stores near you, when you enter your location;
- to provide you with information about our products and services;
- to provide you with our products and services and execute any agreements;
- to process and respond to any complaints or requests;
- to help us in evaluating, correcting and improving the Website and any related products or services;
- for direct marketing purposes;
- for internal reasons, including business administration and filing purposes.
Clause 3 – The confidentiality of your Personal Data
Every time you submit Personal Data, we shall handle this information in accordance with the stipulations of this privacy statement and the legal obligations within the scope of the processing of Personal Data, including the General Data Protection Regulation (GDPR) 2016/679.
We establish reasonable measures and procedures to secure and protect the Personal Data we collect through the Website or via electronic correspondence. This way, we undertake, as far as can reasonably be expected, to prevent illegal processing of Personal Data and unintentional loss or removal of your Personal Data.
Despite these precautions, we cannot guarantee that your Personal Data is protected when it gets displayed or reported in another way than the Website via unsecured means.
We seek to optimize the security of your Personal Data by limiting the access to your Personal Data to persons on a “need-to-know” basis (for example: only those employees, associates, Affiliated Companies or subcontractors who need your Personal Data for the purposes as described in Clause 2 shall receive permission to access the data).
Clause 4 – How does Le Pain Quotidien collect your Personal Data and for how long is it kept?
Collection of data
We collect your Personal Data – without being exhaustive – in the following cases:
- when you subscribe to receive our newsletter;
- when you enter your location via the Website to find stores near you;
- when you enter into an (employment) agreement with us;
- when you call, email or correspond with us in another way than via the Website.
We avoid the collection of Personal Data which are not relevant for the purposes as set out in Clause 2.
We can combine the Personal Data we collect with information which third parties deliver to us.
Retention of data
Personal Data will be stored and processed by us for the duration that is required in relation to the purposes of the processing.
Customer data and supplier or subcontractor data will be removed from our systems 7 years after the termination of the agreement involved, except for the Personal Data that we have to store for a longer duration based on specific legal obligations or in case of pending litigation(s).
Personal Data of our employees will be removed 5 years after the termination of the employment agreement.
Personal Data of applicants will be removed after the relevant vacancy has been filled or 2 years after obtaining the permission to inform applicants about future job opportunities.
Other data will not be stored longer than 2 years after the last useful contact with you, except in the case of your explicit consent to retain this data for a longer period of time.
Clause 5 – Transfer of Personal Data
Whenever possible, we will store and process the Personal Data we collect within the European Economic Area.
We shall, in any case, only transfer your Personal Data to third parties outside the European Economic Area who retain the Personal Data in accordance with the European Commission’s Standard Contractual Clauses and thereby provide an adequate level of security for the processing of Personal Data.
Furthermore, we will not transfer Personal Data to third parties inside the European Economic Area without your permission, except:
- when such transfer is necessary to permit Affiliated Companies, associates, agents or subcontractors to provide a service or accomplish a task in our name (including but not limited to providing marketing support, accomplish market research or providing customer services);
- if it is required by applicable laws and regulations.
Any transfer of Personal Data to one of the third parties mentioned in the list above, is in accordance with the stipulations of the General Data Protection Regulation 2016/679.
We ensure that measures are taken to make sure that third parties cannot use your Personal Data for other purposes than the purposes mentioned in Clause 2, and that these third parties have undertaken the necessary technical and organizational measures to protect the data involved.
We will have data processing agreements in place with the aforementioned third parties and, if applicable, Standard Contractual Clauses as provided by the European Commission, in order to ensure the security of the Personal Data.
Finally, we shall take all necessary precautionary measures to assure that our employees and associates who have access to Personal Data will process these Personal Data exclusively in accordance with this privacy statement and the obligations under the General Data Protection Regulation 2016/679.
Clause 6 – Rights of the data subject
By virtue of both French and European legislation concerning data protection, you have the rights as mentioned below. If you want to exercise these rights, you have to send a written request and a copy of (the front side of) your ID card to france@lepainquotidien.com.
We will provide you with information within 1 month of receipt of the request on the action that will be taken. We can extend this one-month period to a maximum of 3 months, in which case you will be informed about the reasons for such delay within 1 month of the original request.
The right of access to Personal Data
You have the right to instruct us to provide you with any Personal Data we hold about you, providing the rights of other data subjects are not affected.
The right to rectification of Personal Data
We kindly ask you to help to make sure that the Personal Data in our records are as accurate and up-to-date as possible. If you believe that the Personal Data submitted to us are incorrect or incomplete, please notify us as described above. We will correct or adapt your Personal Data as soon as possible.
The right to erasure of Personal Data
In some circumstances you have the right to the erasure of your Personal Data without undue delay.
Those circumstances include:
- the unnecessity to hold the Personal Data any longer in relation to the purposes for which they were collected or otherwise processed;
- the withdrawing of the consent to consent-based processing;
- the processing that is for direct marketing purposes; and
- in case the Personal Data have been unlawfully processed.
However, there are certain general exclusions of the right to erasure. Those general exclusions include where processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation; or
- for the establishment, exercise or defense of legal claims.
The right to restrict the processing of Personal Data
In the following circumstances you have the right to restrict the processing of your Personal Data:
- for contesting the accuracy of the Personal Data;
- when the processing is unlawful but you don’t want the Personal Data to be erased; or
- when you objected to processing, pending the verification of that objection.
Where processing has been restricted on this basis, we may continue to store your Personal Data. However, we will only process it with your explicit consent, for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.
The right to object
You have the right to object to our processing of your Personal Data.
The right to data portability
If you wish to exercise your right to data portability, we will send the Personal Data in a structured, commonly used and machine-readable format to a controller of your choice.
The right to withdraw consent
To the extent that the legal basis for our processing of your Personal Data is consent, you have the right to withdraw that consent at any time. However, withdrawal will not affect the lawfulness of processing before the withdrawal.
The right to complain to a supervisory authority
Without prejudice to any other administrative or judicial remedy, you can file a complaint with the CNIL if you consider that the processing of your Personal Data constitutes a violation of the applicable regulations. The contact details of the CNIL are available at the following address: https://www.cnil.fr.
The right to organize the fate of your Personal Data in the event of death
You have the right to define general or specific directives relating to the storage, erasure and communication of your Personal Data after your death (law 78-17 of 6 January 1978 amended, art. 40, II) .
Clause 7 – Third party links
The Website may contain links to other websites which are not controlled by us. Although we will do our utmost to make sure that the links lead exclusively to websites that have corresponding security and confidentiality standards, we are not responsible for the protection and confidentiality of data, among Personal Data which you submit on other websites, after you have left the Website.
We emphasize to proceed carefully and consult the privacy statement which applies on the website concerned before submitting Personal Data on other websites.
Clause 8 – Amendments
We have the right to change this privacy statement at any time by publishing a new version on our Website.We recommend to consult the Website on a regular basis in order to verify that you agree to any changes made to this privacy statement.
In any event, you will be informed of any changes to this privacy statement by e-mail.
Clause 9 – Cookies
Le Pain Quotidien uses “cookies” each time you visit the Website. A “cookie” is a piece of information sent to your device via the server and stored on the device’s hard drive. Cookies help Le Pain Quotidien to recognize your device when you visit the Website. This allows Le Pain Quotidien to make processing more user-friendly and to provide you with a personalized service.
For more information, we refer to our cookie statement which can be found on our Website.