PRIVACY POLICY
1. Preamble
The purpose of this Privacy Policy is to inform website users about how their Personal Data is collected through the Website, how it is processed by the Publisher, and the rights available to website users in connection with such processing, as defined below.
2. Definitions
The following terms, whether used in the singular or plural in this Privacy Policy, shall have the meanings set out below:
Intermediate Archiving: means the transfer of Personal Data that remains of administrative interest to the Publisher—such as in the event of litigation and/or where required by law—to a separate database, logically or physically segregated, access to which is restricted in all circumstances. This archive constitutes an intermediate stage before the relevant Personal Data is deleted or anonymised.
Privacy Policy: means this privacy and Personal Data protection policy implemented by the Publisher in respect of website users.
Personal Data: means the personal data of website users collected and processed by the Publisher, as defined in this Privacy Policy.
Specific Rights: means the rights granted to website users under the Personal Data Regulations in relation to the processing of their Personal Data.
Personal Data Regulations: means French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended by Law No. 2018-493 of 20 June 2018 on the protection of personal data, implementing Regulation (EU) 2016/679 of 27 April 2016, published in the Official Journal of the European Union on 4 May 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data—commonly referred to as the “GDPR” (General Data Protection Regulation).
Device(s): means the hardware equipment—computer, tablet, smartphone, telephone or other device—used by a website user to access or display the Website and/or any other digital medium published by a third party.
Website User: means any internet user or visitor to the Website.
3. Legal Bases for Processing Operations Carried Out by the Publisher
In accordance with the Personal Data Regulations, each processing operation described in this Privacy Policy is based on a specific legal basis.
Use of the Website necessarily gives rise to a contractual relationship between the Website User and the Publisher. This relationship serves, in particular, as the legal basis for the collection and processing of the Website User’s Personal Data by the Publisher for the proper functioning of the Website and the provision of the related services.
The processing of Personal Data may also be necessary for compliance with a legal obligation to which the Publisher is subject.
The processing of the Website User’s Personal Data may also be necessary for the purposes of the legitimate interests pursued by the Publisher or by a third party, unless those interests are overridden by the interests or fundamental rights and freedoms of the Website User which require the protection of Personal Data, particularly where the Website User is a child.
The processing of the Website User’s Personal Data that is strictly necessary for the prevention of fraud constitutes, for example, a legitimate interest of the Publisher.
Where processing is based on the legitimate interest of the Publisher or a third party, the Publisher ensures that the processing is necessary to achieve that legitimate interest and assesses the consequences of such processing for the Website User, taking into account, in particular, the nature of the Personal Data processed and the manner in which it is processed.
In all circumstances, the Publisher ensures that the interests or fundamental rights and freedoms of the Website User are not adversely affected by allowing the Website User, at any time, to object to all or part of the processing operations described in this Privacy Policy and to exercise their Specific Rights, in accordance with the conditions set out in Section 9 below.
4. Purposes of the Processing Operations Carried Out by the Publisher
The Website User’s Personal Data is necessary to enable access to and use of the Website, to improve the Website, and to enable the Publisher to provide any services described on the Website.
The operations described below are not intended to create profiles that could reveal so-called sensitive Personal Data, such as racial or ethnic origin, philosophical, political, trade-union or religious opinions, sex life or health data. Nor are they intended to result in automated decision-making by the Publisher.
5. Storage of Personal Data
The Website is hosted by AWS. Its contact details are available by clicking here: Legal Notice.
All necessary precautions have been taken to store Website Users’ Personal Data in a secure environment and to prevent it from being altered, damaged or accessed by unauthorised third parties.
Information provided by Website Users will never be disclosed to third parties for commercial purposes, sold or exchanged.
6. Collection of Personal Data on the Website
The Publisher collects the Personal Data that Website Users voluntarily provide on the Website.
This Personal Data is retained by the Publisher in an active database for a period of two (2) years from the date on which it is submitted through the Website.
The relevant Personal Data is subsequently retained in Intermediate Archiving for an additional period of three (3) years, in accordance with the general limitation period.
Where applicable, the Publisher may decide to retain this Personal Data for a longer period in legal Intermediate Archiving in order to comply with a legal obligation—for example, Article L.123-22 of the French Commercial Code, which provides that “accounting records and supporting documents must be retained for ten years”—or to enable the Publisher to establish evidence of a right or contract.
Only the Personal Data identified as mandatory on the Website is essential in order to benefit from the services provided through the Website.
7. Recipients or Categories of Recipients of Personal Data
The Website User’s Personal Data is disclosed to the Publisher’s data processors, namely:
AYS (Klixi)
AYS (Klixi), a simplified joint-stock company (société par actions simplifiée) with share capital of €50,000, whose registered office is located at 18 Rue de Londres, 75009 Paris, France, registered with the Paris Trade and Companies Register under number 535 351 472:
https://www.klixi.io/fr/mentions-legales
Function: Website development and website management and administration tools used by the Publisher.
Transfers of data outside the EU and specific safeguards: No.
Amazon Web Services LLC (AWS)
P.O. Box 81226
Seattle, WA 98108-1226
United States
https://aws.amazon.com
Function: Website hosting.
Transfers of data outside the EU and specific safeguards: Yes – the Data Privacy Framework (DPF), an active self-certification mechanism, and, as a fallback, the European Commission’s Standard Contractual Clauses (SCCs).
8. Website Users’ Rights
In accordance with the Personal Data Regulations, Website Users may exercise the following Specific Rights at any time:
*the right of access, under Article 39 of French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties;
*the right to rectification, under Article 40 of the same law;
*the right to erasure, under Article 40 of the same law;
*the right to restriction of processing, under Article 40 of the same law;
*the right to data portability, under Article 20 of the GDPR;
*the right to object, under Article 38 of the same law;
*the right to issue post-mortem directives, under Article 40-1 of the same law.
8.1 Right of Access
The Website User may obtain from the Publisher confirmation as to whether or not Personal Data concerning them is being processed and, where it is, access to that Personal Data and to the following information:
*the purposes of the processing;
*the categories of Personal Data concerned;
*the recipients or categories of recipients to whom the Personal Data has been or will be disclosed;
*where possible, the envisaged period for which the Personal Data will be stored or, where this is not possible, the criteria used to determine that period;
*the existence of the right to request from the Publisher the rectification or erasure of Personal Data, restriction of processing, or to object to such processing;
*the right to lodge a complaint with the French data protection authority, the CNIL;
where the Personal Data has not been collected from the Website User, any available information as to its source;
*the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the Website User.
Where Personal Data is transferred to a third country or an international organisation, the Website User has the right to be informed of the appropriate safeguards relating to such transfer.
The Publisher shall provide a copy of the Personal Data undergoing processing.
The Publisher may charge a reasonable fee based on administrative costs for any additional copy requested by the Website User.
Where the Website User submits their request electronically, the information shall be provided in a commonly used electronic format, unless the Website User requests otherwise.
The Website User’s right to obtain a copy of their Personal Data shall not adversely affect the rights and freedoms of others.
8.2 Right to Rectification
The Website User may obtain from the Publisher, without undue delay, the rectification of inaccurate Personal Data concerning them. They may also request that incomplete Personal Data be completed, including by providing a supplementary statement.
8.3 Right to Erasure
The Website User may obtain from the Publisher the erasure, without undue delay, of Personal Data concerning them where one of the following grounds applies:
*the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed by the Publisher;
*the Website User has withdrawn their consent to the processing of the Personal Data and there is no other legal basis for the processing;
*the Website User exercises their right to object under the conditions set out below and there are no overriding legitimate grounds for the processing;
*the Personal Data has been unlawfully processed;
*the Personal Data must be erased to comply with a legal obligation;
*the Personal Data was collected in relation to the provision of information society services directly to a child.
8.4 Right to Restriction of Processing
The Website User may obtain from the Publisher restriction of the processing of their Personal Data where one of the following grounds applies:
*the accuracy of the Personal Data is contested by the Website User, for a period enabling the Publisher to verify its accuracy;
*the processing is unlawful and the Website User opposes the erasure of the Personal Data and requests the restriction of its use instead;
*the Publisher no longer needs the Personal Data for the purposes of processing, but it is required by the Website User for the establishment, exercise or defence of legal claims;
*the Website User has objected to the processing under the conditions set out below, pending verification of whether the legitimate grounds pursued by the Publisher override those of the Website User.
8.5 Right to Data Portability
The Website User may receive the Personal Data concerning them from the Publisher in a structured, commonly used and machine-readable format where:
*the processing of the Personal Data is based on consent or on a contract; and
the processing is carried out by automated means.
When exercising their right to data portability, the Website User has the right to have their Personal Data transmitted directly by the Publisher to another data controller designated by them, where technically feasible.
The Website User’s right to data portability shall not adversely affect the rights and freedoms of others.
8.6 Right to Object
The Website User may object at any time, on grounds relating to their particular situation, to the processing of their Personal Data where such processing is based on the legitimate interest of the Publisher.
The Publisher shall then no longer process the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Website User, or unless the Personal Data is required for the establishment, exercise or defence of legal claims.
8.7 Post-Mortem Directives
The Website User may provide the Publisher with instructions concerning the retention, erasure and disclosure of their Personal Data after their death. These instructions may also be registered with a certified digital trusted third party.
These instructions, sometimes referred to as a “digital will”, may designate a person responsible for carrying them out. If no such person is designated, the Website User’s heirs shall be responsible for their implementation.
In the absence of any instructions, the Website User’s heirs may contact the Publisher in order to:
access the processing of Personal Data necessary for “the organisation and settlement of the deceased’s estate”;
obtain disclosure of “digital assets” or “data resembling family memories that may be transferred to heirs”;
request the closure of the Website User’s account on the Website, where applicable, and object to the continued processing of their Personal Data.
In any event, the Website User may inform the Publisher at any time that they do not wish their Personal Data to be disclosed to a third party after their death.
9. Exercise of Website Users’ Specific Rights
These rights may be exercised at any time by contacting the Publisher, whose contact details are provided in the Legal Notice.
For the purpose of exercising their rights under the conditions set out above, and where the Publisher has reasonable doubts as to the identity of the person making the request, the Publisher may ask that person to verify their identity by providing their surname, first name and email address and attaching a copy of a valid identity document to their request.
The Website User will receive a response within a maximum period of one (1) month from receipt of the request.
Where necessary, this period may be extended by up to two (2) additional months, taking into account the complexity and/or number of requests. The Publisher shall inform the Website User of any such extension.
Where the Website User requests the deletion of their Personal Data and/or exercises their right to have their Personal Data erased, the Publisher may nevertheless retain such data in the form of Intermediate Archiving for the period necessary to comply with its legal obligations or for evidentiary purposes during the applicable limitation period.
10. Electronic Communications and Statistical Tracking
Funyo Racing uses the Brevo platform to manage the sending of its electronic communications, including invitations to its events, newsletters and information relating to its activities.
In this context, the following data may be processed: surname, first name, company, job title, email address, telephone number, history of communications, and information relating to the communications sent.
Where this functionality is enabled, emails sent by Funyo Racing may contain a technical tracking device, also known as a tracking pixel. This device is used to measure certain statistical information, including email opens, clicks on links contained in the emails, the date and time of access, and certain technical information relating to the device used.
This data is used solely to measure the effectiveness of our communications, improve the content we offer, better meet the expectations of our contacts and limit the sending of irrelevant communications.
The processing carried out in connection with our electronic communications is based, depending on the circumstances, on your consent where required by applicable regulations, or on our legitimate interest in managing our professional relationships and improving the quality of our communications.
The data is intended exclusively for authorised personnel of Funyo Racing and its service provider Brevo, acting as a data processor within the meaning of the General Data Protection Regulation.
Data relating to communication campaigns is retained for as long as necessary to manage our relationship with you and, in any event, for a maximum period of three (3) years from your last contact or your last interaction with our communications, unless a legal obligation requires a different retention period.
You may withdraw your consent at any time where consent constitutes the legal basis for the processing, or exercise your right to object to the processing of your data for direct marketing or statistical tracking purposes. You may also request access to, rectification, restriction of processing or erasure of your data, in accordance with applicable regulations.
To exercise your rights or obtain any further information concerning the processing of your Personal Data, please contact us at: nbrouard@sagcom.fr.
Brevo SAS
106 Boulevard Haussmann
75008 Paris
France
Function: Management of the contact database; sending of email campaigns, newsletters and event invitations; and statistical tracking of campaigns where this functionality is enabled.
Transfers of data outside the European Union: Any transfers are governed in accordance with the provisions of the General Data Protection Regulation, in particular through the implementation of the appropriate safeguards provided for under applicable regulations.