1. Data Controller
The data controller responsible for collecting and processing your personal data is:
25 rue de Ponthieu
2. Processing Activities: Purpose, types of data collected, legal basis and storage.
We collect different categories of information based on the type of person and nature and purpose of the data processing. The below table describes how, why and for how long we process your personal data, depending on whether you are a website visitor, job applicant, or client.
Website Visitors (Using our website)
We automatically collect personal data from you through your web browser or device and through cookies.
This collection is done:
– to deliver the website,
– optimize your experience,
– obtain statistics.
IP-address, device type, browser type, referring site, pages accessed during your visit, cookies, the date, and time of each visit.
GDPR, Article 6(1)(a) (consent).
GDPR, Article 6(1)(f) (our legitimate interest in providing the website, to improve user experience, and develop and improve our website).
Duration of Storage:
Data relating to statistics and audience measurement are kept for up to 12 months from the date of your visit. (Specific storage periods depend on the individual cookie.)
We collect personal data directly from you to communicate with you and to respond to your queries (i.e., through our “Contact us” page).
Data collected: Name and email address.
Legal basis: GDPR, Article 6(1)(f) (our legitimate interest in being able to respond to your enquiry and communicate with you).
Duration of Storage: Up to two years from the date on which you contacted us.
Applying for a Job:
The purpose of our processing of your personal data is to evaluate your qualifications in relation to the position you are applying for; to communicate with you during the recruitment process; to keep records related to hiring; and to comply with our legal requirements.
We collect data from:
– your named referees (if applicable), from whom we collect: your full name, periods of previous employment, performance during previous employment.
– third party recruitment services (LinkedIn)
The data provided in your CV and covering letter.
Data you provide to us during interviews.
Data you provide to third party recruitment services.
Any personal data provided to us by your referees (if applicable).
Legal basis: GDPR, Article 6(1)(f) (our legitimate interest in assessing your qualifications in relation to the position for which you have applied).
Duration of Storage:
If you are employed by us, your personal data will be transferred to your personnel file. If your application is rejected, your information will be stored for up to two years after the recruitment process ends so as to be considered for future employment opportunities with us.
Administration of business relationships:
We process your personal data when you are a contact person or representative of a company that is a client of Operandi Strategy, including for administration of the business relationship.
We process your personal data for the purpose of proposing, planning, performing, and managing the business relationship.
We collect data from the following sources:
– directly from you,
– your employer.
Contact information, including name of the contact person, job title, work email address, work address and work phone number.
Financial data of the legal entity and data related to invoice payments.
Data related to business administration (requests for information, contract management, correspondence, and after-sales services).
GDPR Article 6(1)(b) (necessary for the performance of a contract, or in view of concluding a contract, between the company you represent or your company and Operandi Strategy).
GDPR Article 6(1)(c) (legal obligation, such as record keeping obligations)
GDPR Article 6(1)(f) (our legitimate interest in managing our business relationships).
Duration of Storage: For the duration of the commercial relationship with your company, or as otherwise required by applicable regulations.
3. Recipients of personal data
Depending on the circumstances, we may share your data with:
- Service Providers, as part of our business operations and to perform certain services and functions, such as payment processing, marketing, web analytics, hosting, email communication and customer support services. Pursuant to our instructions, and to provide services to us, these service providers may access, process, or store your personal data.
- Public Authorities, if required to (i) comply with a legal obligation or lawful request by public authorities, (ii) protect and defend our legal rights or property, or (iii) protect against legal liability.
4. Transfer of personal data to third countries
In certain situations, we will transfer personal data outside EU/EEA. Transfers to third countries are made on the following legal basis:
- the country has been deemed by the European Commission as having an adequate level of protection with respect to personal data; or
- where the country does not have an adequacy decision from the European Commission, the Commission’s standard contractual clauses (“SCCs”) for the transfer of personal data to third countries will be put in place. To obtain a copy of our SCCs contact: email@example.com
5. Your rights
When we process your data, you have the following rights:
- to access, rectify, or erase your personal data.
- to object to or restrict the processing of your personal data.
- if the processing of your personal data is based on your consent, to withdraw your consent at any time.
- to receive a copy of your personal data in a structured, commonly used, and machine-readable format (data portability).
- to determine the retention, deletion, and communication of your personal data after your death.
- to file a complaint with a supervisory authority (in France, the Commission nationale de l’informatique et des libertés (CNIL)).
You can exercise your rights by contacting us; see Section 6.
6. Contact Operandi Strategy regarding your privacy
If you have questions about our processing of your personal data, or if you wish to exercise your rights, please write to firstname.lastname@example.org. We will respond to your request within one month. If your request is not sufficiently precise or does not contain all the elements required to answer your request, we may ask you to provide additional details.
You may also file a complaint with your local data protection authority. In France, this authority is:
Commission nationale de l’informatique et des libertés (CNIL)
3 place de Fontenoy
75334 PARIS CEDEX 07
Telephone: +33 (0)1 53 73 22 22
If you wish to file a complaint with the CNIL, you can complete the online form available at: www.cnil.fr/fr/plaintes
We will take all reasonable steps to communicate any changes to this Policy and will post any updated Policy on our website.
Updated: 1 November 2022.