Privacy Policy

Preamble

VOCALCOM undertakes to respect the confidentiality of the personal information that You have provided, in strict compliance with all applicable data protection laws and regulations, including the national data protection laws in force in France and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

VOCALCOM's products and services are intended for professional customers and not for non-professional and/or private users. Consequently, VOCALCOM undertakes to process users' Personal Data only within a professional framework: requests made by private and non-professional users, by any means, will not be processed. As an exception, this provision does not apply to the management of applications for VOCALCOM job offers.

1. What are "Personal Data"?

Personal Data means any information or set of information that allows You to be identified directly (e.g. your first and last name, e-mail address, postal address, etc.) or indirectly (e.g. by means of pseudonymised data such as a unique identification number, etc.). Unique identifiers may also be considered Personal Data, such as the IP address of your computer.

The processing of personal data is subject to a specific legal and regulatory framework, which in France essentially consists of the GDPR and the French Data Protection Act ("Informatique et Libertés") of 6 January 1978.

2. Who is the data controller responsible for protecting your Personal Data?

A data controller is an entity that determines the purposes and means of processing your Personal Data and is responsible to You for compliance with the applicable personal data protection regulations.

VOCALCOM is the data controller for the management of the Website, marketing communications and the processing of applications relating to its own job offers.

VOCALCOM has appointed a Data Protection Officer (DPO) who will be your contact for any question relating to the processing of your Data. You can reach the DPO:

• by e-mail at the following address: dpo@vocalcom.com
• by post at VOCALCOM – DPO – Legal Department – Tour Eqho, 2 Av. Gambetta, 92400 Courbevoie, France.

3. Which Personal Data, how and why?

We collect your Personal Data in the following ways and for the following purposes.

Data may be collected directly from You in an active manner (You entrust us directly with your Personal Data), for example when You fill in a contact or application form, or in a passive manner by means of technologies such as cookies and other trackers, for which your consent is required when they are not strictly necessary for the proper functioning of the site. You can change your choices at any time via the "Cookie Settings" link at the bottom of the page.

The collection of your data necessarily relies on one of the legal bases set out in the regulations. When processing is based on your consent, You have the right to withdraw it at any time by contacting the DPO at the addresses provided above.

3.1 When You are a customer / prospect of Vocalcom

3.2 When You are a candidate for a position at Vocalcom

For applicants to Vocalcom's recruitment processes who have been referred by third parties, our partners in the recruitment and selection process, You can exercise your rights directly with these third parties in accordance with their data protection policy.

4. With whom are Personal Data shared?

Access to your Personal Data is strictly limited to authorised persons of VOCALCOM and its subsidiaries and to our authorised service provider(s).

In order to process all or part of your Personal Data, We use trusted third-party service providers, acting as data processors on our instructions and solely on our behalf, in particular for:

• the hosting, operation or maintenance of our databases, websites and mobile applications;
• the provision of authentication services;
• the provision of marketing services, including sending commercial offers.

For all such data sharing, We take care to work only with trusted companies and to secure these relationships (contracts, audits, guarantees and security tests, etc.).

We may, in some cases, share some of your Personal Data with partners, who will use it for their own purposes. In such cases, these partners act as data controllers and their personal data processing policy applies to the shared data. We will ask for your consent to such sharing where required by law, or at least allow You to object to it.

We may also offer You the opportunity to use your social network login details. In this case, You share your profile information with us. The Personal Data shared depend on the configuration of the social network platform. These social networks apply their own privacy policies.

Finally, We may share your Personal Data with third parties in order to comply with any legal obligation or administrative or judicial decision.

5. Are Personal Data transferred outside the European Economic Area?

Your Data are processed in France by VOCALCOM and hosted in France and in England by our office automation tool providers. However, We may transfer these Data to one of our subsidiaries located abroad, or to certain service providers located abroad, including outside the European Economic Area (EEA), in countries whose personal data protection regulations differ from those applicable within the EEA.

Nevertheless, any transfer of Data outside the EEA will be carried out with appropriate safeguards that comply with the applicable personal data protection regulations. VOCALCOM takes the necessary steps with its subsidiaries and/or processors and/or partners to ensure an adequate level of protection for your Data, in full compliance with the applicable regulations, and puts in place safeguards ensuring a level of protection of your privacy and fundamental rights equivalent to that offered by the European Union (in particular through the European Commission's Standard Contractual Clauses). We can provide You with more information about these transfers upon request sent to the address given in the "What are your rights?" section.

6. How long do We keep your Data?

Your Data are retained for as long as necessary for the purpose for which they were collected and will in any event be destroyed at the end of that period.

Retention periods vary depending on whether We have an ongoing contractual relationship with You (You are an active customer), have had a contractual relationship with You in the past (You are an inactive customer) or have never had such a relationship with You (You are a prospect). Data relating to your browsing of our online services, collected by cookies You have authorised, have a specific retention period.

The table below sets out the main retention periods for your data, in accordance with applicable legislation and our internal data retention policies.

In any event, We regularly review the information We hold. When retention is no longer justified by legal, commercial or customer account management requirements, or when You have exercised a right of modification or erasure, We securely delete it.

7. How are your Data secured?

VOCALCOM protects your Personal Data by implementing physical security measures to protect them from unauthorised access, misuse, disclosure, loss and destruction.

Your Personal Data are stored on secure servers. We implement, and require our processors and partners to implement, appropriate security and data protection measures in line with the latest technology.

When the processing of Personal Data involves a transfer, We ensure that the transfer is carried out under appropriate conditions guaranteeing a sufficient level of protection, security and confidentiality.

8. What are your rights?

In accordance with the applicable personal data protection laws and regulations, You have the following rights with regard to the processing of your Personal Data.

To exercise your rights, please send your request to VOCALCOM's DPO using one of the following channels:

• by e-mail to the following address: dpo@vocalcom.com
• by post to VOCALCOM – DPO – Legal Department – Tour Eqho, 2 Av. Gambetta, 92400 Courbevoie, France.

As these rights are purely personal and can only be exercised by the data subject, please attach to your request, in addition to the reasons for it, a copy of your identity document. It will not be kept longer than necessary to verify your identity.

8.1 Right of access

The user may access his/her Personal Data processed by VOCALCOM. Upon request, VOCALCOM will provide the user with a copy of all his/her Personal Data and all legally required information, namely:

• the categories of Personal Data collected and processed;
• the purposes of the processing;
• the categories of recipients to whom the Personal Data have been or may be disclosed;
• the retention period of the Personal Data;
• information about the user's rights with regard to his/her Personal Data.

8.2 Right to portability

For the processing operations listed in Article 3 above whose legal basis is the user's consent or the performance of a contract, the user also has the right to the portability of his/her Personal Data.

This right differs from the right of access in that (i) it only concerns the Data provided by the user to VOCALCOM and (ii) it allows these Data to be obtained in a structured, machine-readable format.

The right to portability also allows the Data to be transferred to another data controller, at the user's choice, provided that this is technically possible.

8.3 Right to rectification

The user may request the correction of his/her Personal Data if they are inaccurate, incomplete or out of date.

8.4 Right to erasure

The user may request that his/her Personal Data be deleted in the following cases:

• the Personal Data are no longer necessary for the purposes for which they were collected or processed;
• the user has withdrawn his/her consent, provided that consent was the legal basis for the collection and processing and that there is no other legal basis;
• the user has objected to the collection or processing of his/her Personal Data in accordance with Article 8.5 below;
• the processing of the user's Personal Data is unlawful;
• the Personal Data must be deleted for VOCALCOM to comply with a legal obligation;
• the user was a minor at the time of collection. In this case, and provided the user is a minor at the time of the request, the holders of parental authority may also ask VOCALCOM to delete the Personal Data.

If the Data in question have been disclosed to third parties, VOCALCOM will inform these third parties of the user's request, to the extent possible.

8.5 Right to object

Subject to a legitimate justification relating to his/her particular situation, the user may object to any processing of his/her Personal Data based on the necessity of performing a task in the public interest or on the pursuit of the legitimate interests of VOCALCOM or a third party.

The user may also object at any time, without giving reasons, to the processing of his/her personal data for direct marketing purposes.

8.6 Right to restriction of processing

The user may request the restriction of the processing of his/her Personal Data in the following cases:

• if he/she disputes the accuracy of the Personal Data, for the time necessary for VOCALCOM to verify it;
• if the processing is unlawful and the user wishes to restrict it rather than request deletion;
• if the user wishes VOCALCOM to retain the Personal Data because they are necessary for the establishment, exercise or defence of legal claims;
• if the user has objected to the processing, during the period in which VOCALCOM verifies whether it has overriding legitimate grounds to continue it.

VOCALCOM will then cease processing the Data concerned and retain them for the appropriate period.

8.7 Right to set instructions regarding Data after death

The user may give VOCALCOM instructions on how his/her Personal Data are to be stored, deleted and disclosed after his/her death.

8.8 Right to withdraw consent

For all processing operations listed in Article 3 above whose legal basis is the user's consent, the user has the right to withdraw that consent at any time, without having to justify it to VOCALCOM.

8.9 Right to lodge a complaint with a supervisory authority

Finally, the user has the right to lodge a complaint with the competent supervisory authority regarding the processing carried out by VOCALCOM.

In France, this authority is the Commission Nationale de l'Informatique et des Libertés (CNIL). For more information and to contact it: www.cnil.fr/fr/webform/adresser-une-plainte

9. Changes to this information

We may change this information from time to time. When necessary or required, We will inform You and/or ask for your consent. We therefore invite You to consult it each time You visit so that You are aware of its latest version.