Protection of personal data

Data controller, purposes and legal basis
In accordance with applicable regulations, in particular European Regulation 2016/679, known as the General Data Protection Regulation (GDPR), and national provisions relating to information technology, files and freedoms, Bpifrance Assurance Export, as data controller, collects and processes your personal data:

Based on the execution of these General Terms of Use, to carry out and manage the operations specified in Article 2 "Presentation of the Site" and Article 3 "Access and Use of the Site" of the General Terms of Use, and more specifically for the following purposes:

  • User access to the Site,
  • Collection of acceptance of the General Terms and Conditions of Use,
  • Traceability and proof of operations carried out on the Site,
  • Website hosting,
  • Site maintenance, security, and support

Based on Bpifrance Assurance Export's legitimate interest in promoting its activities for the following purposes:

  • Access to all services and features available on the Site;
  • Electronic marketing and sales prospecting;
  • Publication of customer testimonials for commercial and institutional communication purposes;
  • Conducting satisfaction surveys related to the use of the Site and its features;
  • Production of anonymous and general statistics relating to the use of the Site and its functionalities;
  • Contacting a business manager from the nearest Bpifrance Regional Directorate with the information he/she has submitted on the Bpifrance Assurance Export website, with a request/inquiry made by the User to the contact address;
  • Sending newsletters about news from the Export Department

Based on the legitimate interest of Bpifrance or Bpifrance Assurance Export in defending its rights, particularly in court:

  • Complaints and dispute management;

Based on compliance with legal obligations: compliance with the legal, tax or regulatory provisions to which Bpifrance or Bpifrance Assurance Export is subject.

In this context, Bpifrance or Bpifrance Assurance Export is required to directly collect the following categories of personal data: photograph, surname(s), first name(s), professional email address, mobile number, affiliated company, function in the company and details of the planned export project, connection data including IP addresses, and browsing data.

Mandatory nature of the data
The mandatory nature of personal data is indicated by Bpifrance Assurance Export by means of an asterisk on the forms for collecting said data.

Without this personal data, Bpifrance Assurance Export will not be able to process the User's request or grant them access to the desired Functionality.

Data sources
Data is collected directly from Users, as part of their access to and use of the Site or from information submitted by Users in forms.

When the User provides personal data relating to other persons, it is his responsibility to duly inform these persons of the transmission of their data to Bpifrance and to make available to them the information contained in this information notice.

When the information contained in this notice is provided to a legal entity, the latter undertakes to inform the natural persons concerned of the processing of personal data and to make available to them the information contained in this notice.

Data recipients
The data is intended for Bpifrance Assurance Export and may also be shared with:

  • To the State, with regard to devices managed in its name, on its behalf and under its control;
  • To any French or European administrative, judicial, arbitral or control authority that needs to know about it in the context of an administrative, judicial or arbitral procedure that benefits from a right of communication based on a legislative provision in the context of a French or European administrative or judicial procedure, at their request;
  • To the service providers in charge of development, management and maintenance, and technical support;
  • To other companies within the Bpifrance Group, for the implementation of the purposes described above. This intra-group transfer of information does not in any way exempt Bpifrance Group entities from the legal, regulatory, or contractual confidentiality obligations that apply to them with respect to third parties.

Bpifrance Assurance Export takes care to limit transfers of personal data outside the European Union. When such transfers must be implemented, Bpifrance Assurance Export relies on the following:

  • From a decision issued by the European Commission, attesting to the level of adequacy of the regulations of the country to which your data is transferred;
  • One of the derogations provided for by the GDPR (in particular when the transfers are implemented because they are necessary for the conclusion or performance of a contract concluded in your interest between Bpifrance and the legal entity to which you are linked);

In other cases, Bpifrance Assurance Export ensures that the transfer is supervised in accordance with the GDPR and implements appropriate safeguards regarding the protection of personal data, through legal, technical and organizational measures.

Data retention periods
In order to comply with its obligations, Bpifrance has defined specific retention periods for the implementation of certain processing activities. Thus, barring any legal dispute, your personal data is retained for a period of three years from the date of collection or the last contact from the prospect.

In any event, personal data is kept by Bpifrance for a period not exceeding that necessary for the achievement of the purposes specified above, plus, where applicable, the periods of French and European legal and regulatory limitation.

Data Protection Officer, User Rights and How to Exercise Those Rights
The Bpifrance Group has appointed a Data Protection Officer whom the User can contact using the contact details provided in this Article.

In accordance with the GDPR and national provisions relating to information technology, files and freedoms and subject to the conditions provided for by this regulation for the exercise of these rights, the User benefits from a right of access, a right of rectification, a right to erasure, as well as the right to portability of his personal data.

The User also has the right to request the limitation of the processing which concerns him and the right to oppose, for reasons relating to his particular situation, the processing of his data, including profiling. Finally, the User has, in accordance with national provisions relating to data processing, files and freedoms, the right to organize the fate of his post-mortem personal data.

These rights can be exercised by sending a letter, either by post to Bpifrance, DCCP, Data Protection Officer (DPO), Bpifrance, DCCP, 27-31 avenue du Général Leclerc, 94710 Maisons-cedex » or online via the following form: https://rgpd.bpifrance.fr/fr/form/bpi/formulaire-rgpd-bpifrance.

Finally, the User has the right to lodge a complaint with the National Commission for Computing and Liberties (CNIL), if he considers that the processing operations described infringe his rights.