Ardian France S.A. firmly believes that trust is key for developing successful and lasting relationships. In this respect, the protection of your personal data and privacy is no exception.
This is the reason why Ardian France S.A. puts great emphasis on collecting and processing your personal data with utmost care and in compliance with the applicable legal framework.
3. CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING
Where you use the Website, Ardian processes your Personal Data for various purposes, each of them being duly legitimated by a valid legal basis.
First, Ardian collects and processes your Personal Data for managing and following up any questions and/or requests you may submit. As such, please note that this processing is only carried out in the event you submit a question and/or request. Otherwise, your Personal Data are not processed for this purpose.
This processing requires that Ardian collect and process the following categories of Personal Data: (i) identification data (i.e. your first name, your last name, and your contact details); (ii) data related to your professional life (i.e. the identity of your employer and your job position); and (iii) the content of the message(s) you sent to Ardian as part of your question/request.
While processing your Personal Data for this purpose, Ardian relies on its legitimate interest, which consists in duly managing its relationships with you.
Second, if you are an investor, you may have been granted by Ardian an investor account enabling you to access specific pages and contents through the Website.
For managing your investor account, and notably ensuring that you are entitled to access contents dedicated to investors only, Ardian needs to process and collect your identification data (i.e. your first name, your last name, your contact details as well as your login and password for accessing your investor account) as well as data related to your professional life (i.e. the identity of your employer).
The legal basis of this processing is the necessity for Ardian to perform a contract to which you are a party.
Third, if you are willing to subscribe to its newsletter, Ardian needs to collect and process your email address, which is a Personal Data, in order to properly manage your subscription.
Please note however that Ardian will only send you its newsletter and process your email address accordingly provided it has obtained your prior consent, which constitutes the legal basis of this processing.
Lastly, as Ardian is willing to understand how users interact with its Website, it needs to process various browsing information resulting from cookies which qualify as Personal Data. Thus, the fourth category of processing Ardian carries out with your Personal Data is the performance of analytic operation related to the Website traffic and use.
In this respect, the legal basis Ardian relies upon is its legitimate interest which consists in: (i) better understanding the way its Website is browsed by users (including you); and (ii) improving the Website where needed.
In any event, and disregarding the processing purpose at stake, please note that Ardian will comply with a strict data minimisation principle and will thus only collect and process Personal Data which is necessary for the above purposes.
Besides, for managing your questions/requests, your investor account as well as your subscription to the newsletter, the provision of your Personal Data is a contractual requirement. In this respect, sharing your Personal Data with Ardian is thus mandatory, otherwise Ardian will not be able to: (i) address your questions/requests; (ii) manage your investor account (including to give you access to content specifically dedicated to investors); and/or (iii) send you its newsletter.
4. DATA RECIPIENTS
For example, to manage your investor account, Ardian relies on the services of Intralinks, Inc., which notably administers the portal through which you can log in. Thus, Intralinks accesses your Personal Data, notably your login and password.
To the extent this is necessary, Ardian also communicates your Personal Data to other entities of the Ardian group (e.g. the question you submitted to Ardian actually concerns another entity of the Ardian group and the latter will thus contact you directly to answer your question if relevant).
Furthermore, as the case may be, Ardian shares your Personal Data with competent courts and any other governmental and/or public authorities requesting access to your Personal Data, within the extent legally permitted.
In any event, Ardian communicates your Personal Data to the above recipients on a strict need-to-know basis and only as necessary for fulfilling duly identified processing purposes.
5. TRANSFERS OUTSIDE THE EUROPEAN UNION
Please note that, as part of the processing implemented for managing your investor account and performing analytic operations, Ardian transfers your Personal Data to Google LLC and Intralinks, Inc. which are located outside the European Union, in the United States of America.
This country has not been subject to an adequacy decision by the European Commission so that the latter does not consider that personal data benefits from an adequate level of protection where such data is transferred to the United States of America as such.
Nevertheless, you are hereby expressly informed that both Google LLC and Intralinks, Inc. are Privacy Shield certified. In practice, this means that your Personal Data remains subject to an adequate level of protection where it is transferred to Google LLC and or Intralinks, Inc. in the United States of America.
You can access and check Google LLC’s and Intralinks, Inc.’s certifications on the official U.S. governmental website dedicated to Privacy Shield by using the following address: www.privacyshield.gov/list.
Besides, as indicated above, Ardian may need to transfer your Personal Data to other entities of the Ardian Group. Please note that some of these are located outside the European Union, in countries which are not regarded by the European Commission as providing an adequate level of protection to personal data (e.g. China, Singapore).
However, the Ardian group has implemented Binding Corporate Rules (“BCR”) to ensure that personal data transferred between the various entities of the Ardian group still benefit from an adequate level of data protection.
6. DATA RETENTION PERIODS
Ardian only retains your Personal Data for a retention period not exceeding what is necessary in light of the processing purpose at stake.
As a result, the data retention period implemented by Ardian depends upon the processing purpose as detailed below.
First, with respect to the management of your questions and/or requests, Ardian will not retain your Personal Data for more than five (5) years following the last contact on your initiative.
Second, regarding the management of your investor account, Ardian will retain your Personal Data until your investor account is closed. Nevertheless, if Ardian needs to retain your Personal Data for evidence purpose beyond the date your investor account is closed, the maximum retention period applicable will then be in line with the statute of limitation and will not exceed the period during which Ardian is required to retain evidence.”
Third, where Ardian processes your Personal Data for managing your subscription to its newsletter, your Personal Data will be retained by Ardian until you unsubscribe from the newsletter.
Lastly, the Personal Data processed by Ardian or on its behalf for performing analytic operations shall not be retained by Ardian after the analytic operations are finalized and the corresponding reports/summaries are completed.
Where the applicable retention period expires, Ardian either deletes your Personal Data or irrevocably anonymises it so that you can no longer be identified.
Where Ardian considers it does not need to retain your Personal Data in its active database, it will archive it and will ensure that access thereto is restricted to a limited number of persons who have an actual need to access your Personal Data.
7. YOUR RIGHTS AND OBLIGATIONS AS DATA SUBJECT
As a data subject, you benefit from various rights regarding the processing of your Personal Data. These are as follows:
- right to request from Ardian access to and rectification or erasure of your Personal Data;
- right to request from Ardian restriction of the processing concerning you;
- right to object to the processing of your Personal Data;
- right to portability of your Personal Data;
- right to specify guidelines regarding the use of your Personal Data after your death;
- with respect to the management of your subscription to Ardian’s newsletter, right to withdraw the consent you gave, at any time and without affecting the lawfulness of processing based on your consent before withdrawal thereof; and
- right to lodge a complaint with the French Data Protection Authority (CNIL).
Ardian is committed to utmost care when it comes to protecting your Personal Data and complying with the applicable data protection legal framework.
This is the reason why Ardian requires your assistance to this end. Thus, you commit to inform Ardian in case the Personal Data you shared with Ardian would become obsolete or inaccurate.
8. CONTACT DETAILS
Should you have any questions or requests regarding the processing of your Personal Data by Ardian, including the exercise of your rights specified in Section 6 (Your rights and obligations as data subject) above, please feel free to contact Ardian’s data protection officer (DPO) by using the following contact details: Ardian, Data Protection, 20 Place Vendôme, 75001 Paris - firstname.lastname@example.org