1. PURPOSE OF THIS NOTICE
The purpose of this Notice is to explain which personal data concerning you is processed by Ardian France, and where applicable the local Ardian entity organizing the event, hereinafter ‘Ardian’, as data controller, how it is processed, and for what purposes. This Notice does not replace other notices or disclaimers that may have been provided to you by Ardian; it complements them.
Ardian is committed to protect your personal data and privacy. Ardian collects your personal data and determines the purposes and means of processing this data. This means that the Ardian entity that manages the event you are attending, acts as “data controller” of this data in accordance with applicable privacy law.
This Notice applies to all event attendees, including yourself, any individuals accompanying you (such as family or children, where applicable), or those whose personal data you have provided to us, to the extent that Ardian processes their data.
2. PROCESSING PURPOSES, DATA CATEGORIES, RETENTION AND LEGAL BASES
Your personal data is collected by Ardian, either directly from you or from the person inviting you to the event, if they handled your registration on your behalf.
The following table outlines the purposes for which Ardian processes your personal data, the categories of data involved, the retention period and the corresponding legal bases for processing related to event and communication management. Where applicable under applicable law, Ardian has identified its legitimate interests in processing the personal data.
| Purpose | Categories of data | Retention period | Legal basis |
| Managing Ardian’s communication for events and promotional activities | Identification data and contact details |
For as long as you are part of the event contact database to manage distribution lists for event communications and promotional activities. You may unsubscribe from receiving such communication at any time |
Consent from individuals whose personal data is processed for communication activities, such as sending invitations to events or promotional activities |
| Taking photographs and videos during the event to support coverage and documentation | Photos and videos | As long as your consent is provided, but no longer than the duration of Ardian’s lifespan (except for children’s information, which will be deleted after 1 year) to cover and report on events, as well as to preserve the company’s history and support future events | Consent from individuals for taking their photographs and using their image as part of the event coverage process |
| Organising and managing events | Personal information required for specific events, such as travel details, flights, hotel bookings, dietary preferences, identification data, contact details, passport information if required, Christmas events related information such as children gift wishes and all other information you may provide us in the registration forms | For as long as you are part of the event contact database to manage future events and your preferences. You can request the deletion of your information from the database at any time | Ardian's legitimate interest in ensuring an efficient organization and management of events |
| Covering and reporting on events on supports such as websites managed by Ardian or social networking sites for marketing, promotional, social networking, advertising and non-commercial use | Records of the event, which may include photos and videos of participants (where consent is provided), for marketing, social networking, record and archiving purposes | For the duration of Ardian’s lifespan to cover and report on events, as well as to preserve the company’s history and support future events | Ardian's legitimate interest in covering events for marketing, social networking, record and archiving purposes |
3. RECIPIENTS OF YOUR PERSONAL DATA
Your personal data is shared only when necessary for the relevant processing with:
a) Ardian relevant departments
Ardian’s appropriate departments (as needed and for purposes consistent with those stated in this Notice), which typically includes the Communication and Investor Relations teams.
b) Service providers
Service providers, such as event management agencies, hotels, and airlines, as required to manage the event or facilitate communication with you.
c) Social networking sites
Social networking sites, where applicable and in line with your consent, as required, in relation to event coverage.
Personal data will be shared with these third parties to achieve the processing purposes mentioned in this Notice.
Ardian adopts appropriate physical, technical, and organisational security measures to protect your personal data and will ensure compliance with these protection standards when selecting its service providers. Ardian enters into contracts specifying the conditions and methods of data processing with its service providers acting as processors to ensure they also adopt appropriate technical measures (e.g., use of passwords, encryption of sensitive personal data, regular backups, use of secure networks, etc.) and organisational measures (e.g., having adequate policies in place, accessing data only when necessary, entering into non-disclosure agreements if required, etc.) to protect your data and process it only according to Ardian's instructions and for the agreed purposes.
4. DATA TRANSFERS TO THIRD COUNTRIES
Ardian may need to transfer your Personal Data to other entities of the Ardian Group or service providers which assist Ardian in fulfilling the purposes specified in this Notice. In any event, Ardian communicates your personal data to the above recipients on a strict need-to-know basis and only as necessary for fulfilling duly identified processing purposes. Please also note that Ardian does not sell personal information, including information of California residents.
Please note that some of these recipients may be located outside the European Economic Area in countries that are not regarded by the European Commission (“EC”) as providing an adequate level of protection to Personal Data (e.g. China, Singapore, USA).
For transfers of your Personal Data to such countries, Ardian has implemented appropriate safeguards approved by the EC. This includes:
- The existence of an adequacy decision made by the European Commission for the country to which your personal data is transferred;
- The conclusion of standard contractual clauses reproducing the models adopted by the European Commission; and
- Binding Corporate Rules (“BCR”) between the various entities of the Ardian group.
You can access a summary of the BCR by clicking here or by writing to our data protection officer by using the contact details specified below, in Section 6 (Contact details) of this Privacy Policy.
In the absence of adequate protection or appropriate transfer mechanisms, Ardian will only transfer your personal data to a third country under one of the following conditions:
- By obtaining your consent to transfer your personal data after informing you of the possible risks of such a transfer;
- When the transfer is necessary for the performance of a contract between you and Ardian or a contract between Ardian and a third party concluded in your interest;
- If the transfer is necessary for important reasons of public interest;
- If the transfer is necessary for the establishment, exercise, or defence of legal claims; or
- If the transfer is necessary to protect your vital interests or those of others, where the data subject is physically or legally incapable of giving consent.
5. YOUR RIGHTS AND OBLIGATIONS
As a data subject, you benefit from various rights regarding the processing of your Personal Data. These are as follows:
- right to request from Ardian access to and rectification or erasure of your Personal Data;
- right to request from Ardian restriction of the processing concerning you;
- right to object to the processing of your Personal Data;
- right to portability of your Personal Data;
- right to specify guidelines regarding the use of your Personal Data after your death, in certain jurisdictions;
- where processing is based on your consent, the right to withdraw the consent you gave, at any time and without affecting the lawfulness of processing based on your consent before withdrawal thereof; and
- right to lodge a complaint with the French Data Protection Authority (CNIL).
Ardian is committed to utmost care when it comes to protecting your personal data and complying with the applicable data protection legal framework.
This is the reason why Ardian requires your assistance to this end. Thus, you commit to inform Ardian in case the personal data you shared with Ardian would become obsolete or inaccurate.
Additionally, if you bring other individuals to the event or provide Ardian with information that can directly or indirectly identify them (e.g., individuals accompanying you, including family members and guardians of children), you represent and warrant that, prior to sharing this information, you have provided them with this Notice and, where applicable, obtained their consent for the processing of their data.
California disclosure
All terms used under this section shall have the same meaning as those defined under the California Consumer Privacy Act of 2018 and all related amendments and regulations (“CCPA”).
Ardian does not sell the Personal Information of California residents.
Under certain circumstances and if you are a California resident, you have the following rights:
- Right to know about the processing of your information by Ardian in the preceding 12 months, including (i) the categories and specific pieces of Personal Information Ardian has collected about you; (ii) the categories of sources from which Ardian has collected your Personal Information, and the business or commercial purpose for the collection; (iii) the categories of third parties with whom Ardian has shared your Personal Information and the business or commercial purpose for said sharing.
- Please note that you may only make a ‘right to know’ request to Ardian up to two times in any twelve-month period.
- Right to deletion of your Personal Data (subject to Ardian’s right to maintain your Personal Data for specific purposes permitted under the CCPA).
- Right to opt-out of the sale of your Personal Data to third parties.
- Right to non-discrimination when exercising any of the rights listed above (and any other rights under the CCPA and all related amendments and regulations).
You may submit requests to exercise one of your rights by emailing dataprivacy@ardian.com, by registered mail at Ardian, Data Protection, 20 Place Vendôme, 75001 Paris, FRANCE, or by calling toll-free (within the U.S. only) 833-544-9273.
6. CONTACT DETAILS
If you wish to exercise any of your rights, have questions about this Notice, or about how your personal data is processed by Ardian, you can contact the data controller by sending an email to dataprivacy@ardian.com or a postal letter addressed to: Ardian, Data Protection, 20 Place Vendôme, 75001 Paris, France.
Please note that you may be asked to verify your identity by answering certain questions, and Ardian may not respond to your request until your identity is verified.