PERSONAL DATA POLICY IMB PLATFORM (BOUYGUES MANAGEMENT INSTITUTE)
30/10/2023
Dear colleagues,
We are pleased to present our personal data policy regarding the personal information that we process in the context of your use of the IMB platform. This policy is presented in the form of questions and answers. It provides concise details about the personal data we hold about you and how we use it. It also reminds you of your specific data protection rights and explains how to exercise them.
YOUR QUESTIONS – YOUR RIGHTS
1. Who is responsible for processing my personal data?
2. Why do you need this personal data?
3. On what legal basis do you use my personal data?
4. How did you collect my data?
5. What categories of personal data about me do you collect?
6. Do you use a service provider (subcontractor) to process my data?
7. Do you transmit my personal data to other people?
8. Do you have sensitive data about me?
9. Are my personal data transferred outside the European Union?
10. Where are my data stored?
11. How long do you keep my data?
12. Will my data be used for automated decision-making or profiling?
13. What are my rights regarding my personal data?
14. What will happen if I object to the processing of my personal data or if I withdraw my consent?
15. How can I exercise my rights and who should I contact?
16. I am not sure that your processing respects my rights, I would like more information about my rights, who can I contact?
1. Who is responsible for processing my personal data?
The data controller the IMB platform is the company:
Bouygues
32 avenue Hoche
75008 Paris, France
RCS Paris 572 015 246
Email address: rgpd@bouygues.com
Training requests processing: Depending on the course, members are informed of their participation by the HR department.
2. Why do you need this personal data?
We use your personal data to allow you to access and register for training.
3. On what legal basis do you use my personal data?
We use your personal data because it is essential to provide you with access to the services of the IMB platform. Thus, we use the personal data that you have communicated via the platform based on your acceptance of this personal data policy.
4. How did you collect my data?
The personal data concerning you that we process are:
• Those associated with your professional computer account (Windows account) as an employee of the Bouygues group;
• Technical data corresponding to your computer use of the IMB platform (IP address, cookies, etc.).
5. What categories of personal data about me do you collect?
We process the following categories of personal data:
• First name, last name;
• Professional email;
• Name of the entity in which you work;
• IP address;
• Cookies (session authentication, audience measurement cookies).
6. Do you use a service provider (subcontractor) to process my data?
Yes, the company La Fabrique VingtCinq may have access to the personal data concerning you as part of its maintenance missions for the IMB site.
7. Do you transmit my personal data to other people ?
We automatically transmit your training registrations to the HR department. Your registrations are thus processed by Bouygues SA and only by it.
In addition, your data may also be transferred to the various external trainers to the Group who may intervene as part of the training. We only communicate the data that is necessary to these people in the context described above.
NB: We never sell your personal data to anyone.
8. Do you have sensitive data about me?
No, we do not collect sensitive personal data about you.
9. Are my personal data transferred outside the European Union?
Principle: We do not transfer your data outside the European Union.
Exception: We may be required to transfer your personal data outside of the European Union in very specific cases if you register for training located outside of the European Union. In this case, your training request will be transmitted to the HR department and/or trainers who may be located on site. These HR/trainers may not necessarily be located in a country of the European Union or a country considered adequate by the European Union in terms of personal data security. Any such transfer is therefore likely to entail higher risks to your rights and freedoms as well as to the security of your data.
10.Where are my data stored ?
Your personal data is stored in the European Union (in France).
11. How long do you keep my data?
We keep your data until your professional account is deleted.
12.Will my data be used for automated decision-making or profiling?
Your data is not used for automated decision-making or profiling.
13. What are my rights regarding my personal data?
As an individual, you have the following rights:
1. Right of access to your data
This means that you can ask us directly:
• If we hold any personal information about you; and
• That we provide you with all of this personal data. This right of access allows you to check the accuracy of the data and, if necessary, to ask us to rectify or erase it if it is inaccurate or outdated.
2. Right to modify your data
You can ask us to rectify any inaccurate information about you. This right allows you to avoid us disseminating or processing incorrect information about you.
3. Right to delete your data
4. Right to object to the processing of your data
You can object, for legitimate reasons, to the dissemination, transmission or retention of data about you.
5. Right to limit the processing of your data
This right allows you to request that only the data necessary for the data controller be processed.
6. Right to portability of your data
You have the option of retrieving some of your data in an open and machine-readable format (electronic format). Your data can thus be easily stored or transmitted from one information system to another, for reuse.
7. Right not to be subject to automated decision-making
The right not to be subject to a decision based solely on automated processing includes profiling and generally any processing producing legal effects concerning you or significantly affecting you in a similar way. However, your right does not apply when the decision taken following the automated decision:
• Is necessary for the conclusion or performance of a contract between you and a data controller,
• Is authorized by European Union law or French law and also provides appropriate measures to safeguard your rights and freedoms and your legitimate interests,
• Is based on your explicit consent.
8. Right to withdraw your consent to the processing of your data at any time (if your data is processed on the basis of your consent)
9. Post-mortem rights
You have the option of defining directives concerning the fate of your personal data after your death.
NB: These rights are not absolute. You can exercise them within the legal framework provided and within the limits of these rights. In some cases, we may not be able to comply with your request (legal obligation, respect for our commitments to you, etc.). If this is the case, we will communicate to you the reasons for this refusal. For more information about your rights, please visit the CNIL website: https://www.cnil.fr/en/understanding-your-rights
14.What will happen if I object to the processing of my personal data or if I withdraw my consent?
If you request the deletion of information about you contained in the IMB tool (data necessary for identification to your user account), you will no longer be able to use the IMB tool to view and register for training offered by the Bouygues group via this tool.
NB: In very limited cases, it is possible that we may not be able to comply with your request (legal obligation, respect for our commitments to you, etc.). In such a case, we will communicate to you the reasons for this refusal.
15. How can I exercise my rights and who should I contact?
To exercise your rights, please contact: rgpd@bouygues.com
You can also contact the Legal Department by mail at its headquarters address:
Bouygues
Attention Legal Department
32 avenue Hoche
75008 Paris, France
RCS Paris 572 015 246
To exercise your rights regarding the processing of your personal data, please contact the HR department of the entity to which you belong or the Data Protection Officer of the relevant profession (if the profession has appointed one).
In case of difficulties, you can also file a complaint with the competent supervisory authorities. In France, the competent authority is the CNIL (https://www.cnil.fr/en/act).
16. I am not sure that your processing respects my rights, I would like more information about my rights, who can I contact?
For France, you can contact the CNIL: https://www.cnil.fr/en (general information).