Privacy policy

 

Please find below our policy for processing personal data (“Data”), in connection with information relating to you and allowing you to be identified directly or indirectly.

 

This Policy aims to provide you with further information in connection with our commitment to protecting your Data, whether you are a customer, partner, supplier, shareholder or more generally a contact of any GECINA Group company.

This policy is part of an approach to ensure transparency and fair treatment. It describes the way we collect, use and manage your personal data, and presents your rights, as well as the way we ensure compliance with our legal obligations.

It is intended to supplement the information that we provide you with, particularly in relation to any contracts entered into with you. If there are any contradictions between the terms of this policy and any contractual stipulations, the latter will take precedence.

 

 

1. WHO COLLECTS YOUR DATA – THE CONTROLLER

 

The GECINA Group companies use your Data in accordance with the General Data Protection Regulation 2016/679 of April 27, 2016 (“GDPR”) and the amended French Data Protection Act 78-17 of January 6, 1978 (“French Data Protection Act”) (collectively “the Data Protection Regulations”).

When you complete a form on one of our websites or you enter into a commercial or investment relationship with a GECINA Group company, Data may be collected by or on behalf of a GECINA Group company. Your data may also be provided to the GECINA Group or between companies of the GECINA Group, following a merger or acquisition

A Data Protection Officer (“DPO”) has been appointed. The DPO is authorized to handle all issues relating to the protection of personal data and is responsible for ensuring the GECINA Group's compliance with Data Protection Regulations. If you have any questions concerning the use of your personal data, you can contact the DPO by email at protectiondesdonnees@gecina.fr or by post at GECINA DPO, 16 rue des Capucines 75084 Paris cedex 02, France.

 

 

2. WHAT DATA IS COLLECTED AND FOR WHAT PURPOSE?

 

- To respond to you when you complete a contact form on one of our webSites (Gecina, Youfirst Campus, Youfirst Campus Immobilier, Youfirst Residence Immobilier,….), the GECINA Group may collect the following Data:

  • Surname / first name
  • Civil status 
  • Phone number
  • Email address
  • Any other Data that you may voluntarily wish to provide us with

 

These Data are processed exclusively with a view to responding to your requests for information and their processing, i.e. their use, is based on your consent and/or the legitimate interest of the GECINA Group (the interests pursued by the GECINA Group must not create an imbalance to the detriment of your interests and fundamental freedoms) in responding to your request.

 

 

- In order to answer our clients or potential clients (prospects) demand for commercial information the GECINA Group may collect the following Data :

  • Surname / first name
  • Civil status 
  • Phone number
  • Email address
  • Any other Data that you may voluntarily wish to provide us with

Prospect Data, in the context of a B to B relationship (professional to professional), may also come from a source accessible to the public, such as social networks, provided that the processing of this Data is in relation to the function of the natural person concerned.

As part of the implementation of commercial prospecting actions with a view to offering the customer new future services, the GECINA Group may proceed to the creation of groups of customers with similar profiles (characteristics) in order to respond to their expectations in the best way. 

These Data are processed for the purpose of creating a prospect file and. with a view to responding to your requests for information. and their processing (use) is based on your consent and/or the legitimate interest of the GECINA Group in sending you communications relating to the goods or services for which you are already a customer.

 

- In connection with the application of precontractual measures (i.e. prior to the conclusion of a contract) or contracts, the GECINA Group may be required to collect various items of personal data, including but not limited to:

  • Identification information: surname, first name, date and place of birth, photo, signature, company registration number
  • Personal characteristics: marital status, number of children, student status, professional status
  • Contact data: email address, phone number, postal address
  • Employment-related information: type of employment contract, date hired, profession, employer name and address
  • Information on guarantees: identity, resources, bank details
  • Financial information: income and other resources, means of payment, incorporation certificate, balance sheets.

 

- We use the personal data to review our customers’ solvency, as well as to manage and monitor our relationships, particularly for the management of contracts and their transfer, invoices and receipts, the management of complaints, the sending of all information related to the buildings and their maintenance, the collection of unpaid invoices and the management of disputes, the creation of a customer file and the provision of a Customer Space. The data collected are essential for these processing operations.

We may also collect the data of the occupants of the properties, for the strict purpose of managing the lease contract.

These personal data are collected directly from you, but we may also receive data concerning you that has been collected from you by a third party. This may in particular be the case in the context of mergers, contributions, acquisitions of buildings, ……  carried out between companies of the GECINA Group or with third parties.

 

- When you enter into a commercial or investment relationship (as a shareholder or buyer of one or more assets from the Group’s portfolio) with a GECINA Group company, the following Data may be collected:

  • Surname / first name
  • Civil status (Mr/Mrs/Ms)
  • Contact details (phone number, postal address, email address, etc.).

These Data are processed to monitor this commercial or investment relationship and their processing is based on the performance of the contract and/or the legitimate interest of the GECINA Group.

 

In this context, we also collect and process:

For retailers: all Data strictly linked to commercial activities, either directly from you, or from the company that you work for.

For investors: date and place of birth, percentage of capital and voting rights held, information as part of KYC (“know your customer”), collected in the context of the fight against money laundering and the financing of terrorism, other Data but strictly linked to the investment, either directly from you, or from the company that you work for.

For suppliers: name of the supplier’s contact person, email, phone number, position, powers, information as part of the referencing procedure, which consists of setting up a database of the Group's suppliers and bringing together the documents that must be checked beforehand on this supplier, ........and all Data strictly linked to the provision of goods and/or services, either directly from you, or from the company that you work for.

 

- When you visit one of our internet sites, we collect the data transmitted to our server, allowing you to access the internet, by your browser, the software you use to allow you to access information on the internet. During your visit of our site, only the data that are technically necessary for us to present the site to you will be collected.

Processing is carried out in the legitimate interest of improving the site’s stability and features. The data will not under any circumstances be transmitted or used for any other purpose.

 

- Cookies: to make our site’s visits attractive and allow certain features to be used, we use cookies on various pages. To learn more about cookies, click on this link.

When you browse our sites, a "cookies" banner appears to inform you about the cookies that may be installed and to obtain your consent when necessary.

 

 

 

3. LEGAL BASIS FOR PROCESSING PERSONAL DATA

 

The legal basis of a processing is the legal foundation of this processing. It authorizes the Group to collect or use Data.

We process your personal data exclusively in the cases permitted by the regulations and specifically when:

  • You have freely given your consent, for example for commercial prospecting operations
  • The processing is required for the performance of precontractual measures or contracts
  • The GECINA Group needs to comply with legal or regulatory requirements
  • The processing can be justified by a legitimate interest for the GECINA Group.

 

 

4. STORAGE OF YOUR DATA

 

Your Data are stored for a limited period corresponding to the purposes for which they have been collected, in accordance with the regulations in force and any legal, contractual, tax and social requirements, in addition to the GECINA Group’s legitimate interests.

With regard to customers, data are stored for the duration of the contractual relationship and beyond, during three years for residential leases or five years for commercial leases or civil leases, after the end of the relationship.

With regard to data collected to deliver commercial information, it is stored as long as the customer or potential customer remains active, or for a maximum of three years after the last contact.

With regard to candidates for lettings, in cases when a lease is not signed, the information is stored for three months after being collected.

With regard to commercial or investment relationships, the personal data collected in this context are stored for the duration of the commercial or investment relationship.

With regard to data collected in response to your requests, these data are stored for the duration of the management of these requests.

With regard to cookies, cookies that do not require consent can be configured for a maximum validity period of 13 months. Those requiring consent may need to be configured for a maximum validity period of 6 months.

Following the end of these periods, the corresponding data are erased or anonymized, provided that they are no longer required to apply any contracts, ensure compliance with any legal obligations or provide proof of rights and/or when there is no longer any legitimate interest in storing them.

 

 

5. RIGHTS RELATING TO YOUR DATA

 

In accordance with the Data Protection Regulations and the legal limits in force, your rights include:

-      The right to access your Data, which is the right to know what information we hold about you, particularly to check that they are accurate and exhaustive

-      The right to have your Data rectified

-      The right to have your Data erased

-      The right to object to or request a restriction, a temporary freeze, of the processing of your Data

-      The right to the portability of the Data that you have provided us with, consisting of the possibility of recovering your data in a structured format, commonly used and readable by a computer, or of having this data transmitted directly to another data controller

-      The right to give specific or general instructions concerning the processing of your Data following your death.

For the processing of your Data based on consent, you also have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness (compliance with the law) of processing based on consent before its withdrawal.

 

You can exercise these rights by emailing our DPO:

 

-      Or by post for the attention of: GECINA DPO, 16 rue des Capucines, 75084 Paris cedex 02, France.

Your requests will be processed as quickly as possible, and in compliance with the deadlines provided for by the regulations. In addition to your request, in case of doubt about your identity, we will ask you to attach a photocopy of proof of identity, so that we can carry out the necessary checks.

 

 

6. SHARING YOUR DATA

 

Your Data are strictly confidential and may not, without your approval, be transferred to any third parties outside of the GECINA Group for commercial and/or promotional reasons.

Some of your Data may be disclosed to our providers / subcontractors strictly in connection with our processing operations for the following purposes:

  • Management of buildings, such as work carried out by a provider in our properties
  • Management of pre-litigation cases and disputes: legal advisors, bailiffs, collection agencies, etc.
  • the range of additional services offered to the customer: the service providers in charge of these services;
  • Management of the investment relationship: the GECINA Group may entrust the management of the investment relationship to third-party companies, to which the Data collected as listed in point 2 may be transferred for the performance of this relationship.
  • Management of any documents required by the regulations, such as documents relating to supplier referencing
  • Internet site administration and maintenance operations: your Data collected using online forms may be transferred to our provider for maintenance and administration operations.
  • Carrying out satisfaction surveys, polls, etc.: organizations in charge of the service
  • Legal reasons: your Data may be disclosed to the competent judicial or administrative authority, when the regulations or an administrative or judicial decision so requires.

 

Customer Data may also, where applicable, be transferred to other GECINA Group companies, in particular within the framework of service agreements or for commercial prospecting operations.

Your Data may also be transferred to other companies of the GECINA Group or to third parties, in particular in the context of mergers, contributions, sales of buildings, etc.

 

 

7. WHERE ARE YOUR DATA LOCATED?

 

Your Data are processed, most of the time, within the European Union and are not, where possible, transferred to third countries.

However, in connection with the GECINA Group’s processing operations and purposes, as described previously, if your Data are transferred to third countries (countries outside the European Union), the GECINA Group undertakes to take all adequate and appropriate measures, in accordance with the Personal Data Protection Regulations, to ensure that the level of protection that you are guaranteed with these Regulations is not compromised.

Initially, the existence of an adequacy decision from the European Commission will be verified, noting that the third country ensures an adequate level of protection of personal data, i.e. comparable to that guaranteed in the European Union, in accordance with Article 45 of the GDPR. If this is the case, the transfer of personal data to said country may take place, without specific authorization or particular measure.

In the absence of an adequacy decision, verification of the existence of measures ensuring a sufficient level of protection, as provided for by articles 46 and following of the GDPR (standard contractual clauses, Binding corporate rules, code of conduct, certification, specific contractual clauses) will be carried out.

If after verification, it appears that the effectiveness of the guarantees put in place is compromised by local legislation or practices, additional measures will be taken.

 

 

8. CHANGES TO THIS POLICY

 

This Policy reflects our current privacy standards, which may be subject to change. Any change will be effective following the publication of the latest up-to-date version of this privacy policy.

We will publish any changes on this page and at the places we consider appropriate depending on the area concerned and the significance of the changes made.

 

 

9. FRENCH DATA PROTECTION AGENCY (CNIL)

 

You can submit complaints to the French Data Protection Agency (CNIL), which is the regulatory authority responsible for ensuring compliance with the Personal Data Protection Regulations in France, directly online at https://www.cnil.fr/fr/agir  or by post at Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy - TSA 80715, 75334 Paris Cedex 07, France.