This Privacy Policy (hereinafter referred to as “Policy”) describes how EXEL Industries (hereinafter referred to as “we”, “us” or “our”), as a Data Controller, collects, processes, uses and protects the personal data of its users, customers, suppliers, employees and any other stakeholders (hereinafter referred to as “you” or “your”), in accordance with applicable regulations, in particular the Data Protection Act (LIL) of 1978, the General Data Protection Regulation (GDPR) and any other applicable data protection law.
This policy does not apply to any third-party websites or applications that may be mentioned on the EXEL Industries website.

1. What is personal data?

Personal data (“Personal Data”) is information that can be used to identify, directly (e.g. surname, first name) or indirectly (e.g. a telephone number, an e-mail address, an identification number, location data, voice, image, IP address, etc.) an individual person.

2. Why do we use your Personal Data?

The table below indicates the purposes (objectives) for which your Personal Data is collected and, for each of them, the legal basis for legitimizing the processing and categories of data concerned:

PURPOSES	LEGAL BASIS	TYPES OF DATA CONCERNED
Management of the customer account (processing of orders, payments, invoicing, technical and after-sales assistance service, debt collection etc…).	The processing is carried out by virtue of the contractual performance.	Identification data (surname, first name, address, telephone number, e-mail address, etc.).Financial data: payment data, credit card information, etc.).
To respond to requests and questions that you may submit through the Site, and, more broadly, to manage our relationships with visitors to the Site.	The processing is carried out on the basis of our legitimate interest in ensuring proper communication with visitors to our Site.	Identification data Any data contained in correspondence.
To improve our services and our Site (notifications, updates, improve and personalize your user experience).	The processing is carried out on the basis of our legitimate interest, which consists in optimizing our tools and solutions in order to best satisfy our Site visitors, our customers and our prospects.	Identification data Technical data (e.g. IP address, browsing data, cookies, geolocation data, etc.)Any data contained in correspondence
To comply with the legal and regulatory obligations applicable to us.	The processing is necessary for compliance with legal obligations to which we are subject (e.g. to respond to legal or regulatory requests from judicial or administrative authorities).	Identification data Technical data (e.g. IP address, browsing data, cookies, geolocation data, etc.)Any data contained in correspondence
To manage any potential or actual disputes with you or third parties.	The processing is carried out on the basis of our legitimate interest in defending our interests, including through legal means.	Identification data Technical data (e.g. IP address, browsing data, cookies, geolocation data, etc.)Any data contained in correspondence
Establish statistics and audience measurements	The processing is carried out on the basis of your consent where required by law.	Statistical data (e.g. sections and content visited, browsing on the Site)
Sending advertising and tracking users for marketing purposes	The processing is carried out on the basis of your consent.	Identity: company, contact details Subject of the request (if using the contact form)

In some cases, the provision of your Personal Data is mandatory, otherwise we will not be able to provide you with the services and information you request. For example, if you contact us through the Site, you will need to provide us with your email address so that we can respond to you.
In any event, we will inform you when the provision of your Personal Data is mandatory.

3. With whom do we share your Personal Data?

As part of our processing, we may communicate your Personal Data to the following recipients:

• To members of our staff or subcontracted personnel who are required to process them. Depending on the purpose pursued, they will only be communicated, in whole or in part, to the duly authorised persons of the departments concerned.
• Interested parties in the event of litigation: lawyers, experts, insurance companies, etc.
• To service providers and subcontractors who assist us in providing our products and services (such as payment providers, shipping services, hosting providers, our IT (website) providers and other trusted partners to facilitate our business and marketing operations). 
• To financial and judicial authorities, arbitrators and mediators, public agencies and state agencies, upon request and within the scope permitted by law
• To competent courts, public authorities, government agencies, and law enforcement agencies (e.g., in cases where we need to respond to legal or regulatory requests).

Regardless of the recipient concerned, we will only disclose your Personal Data to them if they have a strict need to know and only to the extent required to achieve the purposes identified in this Policy. 

We raise awareness among all our employees of the challenges of personal data protection and privacy and take all measures to preserve and secure the information provided to us.

We do not sell, rent, or share your Personal Data with third parties for commercial purposes, unless you have agreed to it or if required by law.

4. Do we transfer data outside the European Economic Area?

In principle, we store all Personal Data within the European Union (EU) and the European Economic Area (EEA). However, because we operate globally, we may need to transfer certain Personal Data to countries other than those in which your Personal Data was collected, for example, in order to allow some of our suppliers to access such data in connection with the performance of the contract/order.

Some of these countries may be located outside the EU and EEA. In such cases, we will implement appropriate safeguards to ensure an adequate level of protection for Personal Data transferred outside of such territories, such as by entering into EU standard contractual clauses with the data importer, or by taking other steps to ensure that level of data protection under EU law.

5. How long do we keep your Personal Data?

Your Personal Data will be kept for as long as necessary to achieve the purposes for which it was collected, in accordance with the legal and regulatory deadlines.
It will be archived in accordance with the statutory limitation and retention periods.
In other words, this means that the retention periods vary depending on the data processed and its purposes. The table below indicates, for each purpose, the retention period applied to your Personal Data⁽¹⁾.

PURPOSES	RETENTION PERIOD
Management of the customer account (processing of orders, payments, invoicing, technical and after-sales assistance service, debt collection etc…).	We will retain your Personal Data for as long as necessary to achieve the purposes for which it was collected.
To respond to requests and questions that you may submit through the Site, and, more broadly, to manage our relationships with customers, suppliers and visitors to the Site.	We will keep your Personal Data for a maximum period of 12 months from the last contact at your initiative.
To improve our services and our Site (notifications, updates, improve and personalize your customer, supplier, Site visitor experience).	We will retain your Personal Data for a maximum period of 12 months, it being understood, however, that, in the majority of cases, your Personal Data will be aggregated shortly after its collection in the form of statistics that no longer allow you to be identified.
To comply with the legal and regulatory obligations applicable to us.	We retain your Personal Data for as long as we are subject to any relevant legal or regulatory obligations.
To manage any potential or actual disputes with you or third parties.	We will retain your Personal Data until all remedies have expired.
Establish statistics and audience measurements.	We keep your Personal Data for a maximum of 25 months. The lifespan of the trackers (used to measure the audience) is a maximum of 13 months.
Respond to an unsolicited application or job offer from you.	We store your Personal Data in accordance with the statute of limitations and legal retention periods and the recommendations of the French Data Protection Authority.(3)

In any event, upon expiry of the applicable retention period, we will irrevocably erase or anonymise your Personal Data, so that you can no longer be identified.

6. What rights do you have?

In accordance with the applicable legal framework for data protection, and in particular the GDPR, you have the following rights: right to information, collection of consent, right to object, rights of access and rectification, right to restriction, right to portability

¹ For the relevant categories of data, please refer to the table above in Section 3.
² “Cookies: solutions for audience measurement tools” French Data Protection Authority available here
³ Fact sheet n°9 of the recruitment guide “How long is the data collected for recruitment purposes kept?” (including the table on page 52) available here
⁴ See the fact sheet on “the rights of individuals over their data” available here

7. How to exercise your rights?

To exercise your rights, we invite you to contact us using the contact details provided in Section 10 (“How can you contact us?”). In order to be able to process your request in the best possible way, we may need to ask you for certain additional information to confirm your identity and/or facilitate the location of the Personal Data concerned by your request.
Please note that some of these rights are subject to specific conditions dictated by the applicable data protection legal framework. Thus, in the event that your particular situation does not meet these conditions, we will not be able to grant your request. We will inform you, if necessary, of the reasons for our refusal.
In any case, please note that you can lodge a complaint with your Data Protection Authority.

As part of our activities, we do not carry out profiling.
In addition, when you give your consent to the processing of your Personal Data, you have the option of withdrawing it at any time. Finally, when a Personal Data breach is detected that may pose a high risk to your rights and freedoms, you will be informed of the breach as soon as possible.

8. Cookies and Similar Technologies

We use cookies and similar technologies to collect information about your use of our services. See our Cookie Policy for more information.

9. Changes to this Policy

We reserve the right to modify this Policy at any time according to the needs of the company and legislative and regulatory developments. Changes will be posted on our website and will be effective immediately upon posting. We encourage you to review this Policy regularly.

10. How can you contact us?

If you have any questions or requests regarding the processing we carry out with your Personal Data under this Policy, including the exercise of your rights, as detailed above, you may contact us, by e-mail at the following address: privacy@exel-industries.com