This policy aims web users (hereafter the «Users») liable to communicate their personal data on the websites and domains (hereafter the «Websites ») of UTAC Holding and its subsidiaries (hereafter the «UTAC group»). The UTAC group undertakes that personal data processed on these websites comply with the General Data Protection Regulation (GDPR) (EU Regulation 2016/679 dated April 27 2016 and the French Data Privacy Law n° 78/17 dated January 6 1978).

Data privacy policy

Each website of the UTAC group and each online service strictly limits the collection of personal data (minimisation of data).
This policy aims to give to the User the required legal information as follows : (this information is notified to the User before the personal data is collected and independently from any other information, in compliance with the current legal provisions) :

(a) Identity and contact details of the data controller of personal data (hereafter the « processing»)

The identity and the contact details of the data controller are the following : UTAC HOLDING, Société par actions simplifiée, registered at the French Trade and Commerce Registry of Evry under the number 824 418 248 with its headquarters at Autodrome de Linas-Montlhéry, Avenue Georges Boillot, 91310 Linas.

(b) Contact details of the data protection officer

The contact details of the data protection officer are the following : UTAC HOLDING DPO, UTAC Holding, Autodrome de Linas-Montlhéry, Avenue Georges Boillot, 91310 Linas. The User claims concerning data privacy may be addressed to: dpo@utac.com

(c) Purpose of the processing

The purposes of the processing of personal data are the following :

(i) identification of the persons ordering and/or using the services of the Websites and/or the services available on the Websites

(ii) execution and/or delivery of the services used and/or ordered by the User

(iii) monitoring the services ordered and/or used by the User

(iv) prospection and/or sending information to the Users.

(d) Legal basis of the processing

The legal basis of the processing is the following :

(i) the processing is necessary for the execution of the contractual relation that the User wishes to have with the UTAC group by ordering and/or using the services, this personal data being necessary for the execution of the services ordered by the User

(ii) the processing is also necessary to protect the legitimate interests of the UTAC group by enabling to keep the justification of the transactions with the User and/or if need be, to proceed to debt recovery

(iii) the processing relies on the User’s consent insofar as the User wishes to order and/or use the services on the Websites

(iv) the processing is monitored in compliance with the provisions of the law n°78-17 dated January 6 1978 and EU regulation n° 2016/679 dated April 27 2016 (GDPR) and other legal provisions in force (hereafter the « Regulation»).

(e) Recipient of personal data

The recipients of the personal data are the following : UTAC employees in charge of the execution and/or monitoring of the service ordered and/or delivered by the User, the execution and/or delivery by the UTAC group of the services ordered and/or used by the User and, if necessary, the employees of the supervisory authority for the services which the UTAC group has received an accreditation from, the subcontractors of the UTAC group participating in the execution of the tasks and needing to access such processing (only when this is deemed necessary). In such case, this processing shall be executed in compliance with the current Regulation applicable to the subcontractors.

(f) Transfer of personal data

The User is informed that the data protection officer may, if necessary, proceed to the transfer of personal data towards a third party country or an international organisation which has received official approval on behalf of the European Commission being specified that concerning the transfer to a country or an international organisation which has not been approved by the European Commission, such transfer shall be allowed only subject to the implementation of appropriate guarantees and that the concerned Users have subscribed to corporate binding rules, enforceable rights and legal remedies, further to the conditions of the rules and regulations in force.

(g) Period storage of personal data

The period of storage of personal data policy is the following : personal data is necessary for the execution, the monitoring and/or the delivery of services executed through the Websites, therefore the User’s personal data is stored

(i) for the length of time that the User is liable to make orders, meaning as long as the User has not declared his intention of not being a client of the UTAC group anymore or of not having its personal data stored, through a claim made by the User sent to the following address : dpo@utac.com (in compliance with the following provisions)

(ii) within the limit of 36 (thiry six) months as from the last order of services made by the User on the Websites, date after which the personal data will no longer be stored and

(iii) within a reasonable period or a longer period upon requirement by the services of the UTAC group required for the purposes of personal data processing, namely for analytic, scientific or statistic purposes (Article 5 GDPR).

(h) Rights of the User which may be exercised before the Data Protection controller (as identified above)

This policy has also the aim to inform the User of the existence of the right to ask the data protection controller :

  • access to personal data as well as available information as to their source ;
  • correct or delete of the same ;
  • limitation of the personal data processing ;
  • opposition by the User to the personal data processing ;
  • opposition of the User at any time to the personal data processing for commercial purposes and profiling ;
  • portability of personal data within the conditions of the Regulation ;
  • withdrawal by the User, at any time, of its consent to the processing of its personal data (without breaching the lawfulness of the processing based on the consent made before such withdrawal) ;

The User may exercise the above rights identified under (h) by sending a claim at the following address : dpo@utac.com
If need be, it is specified that if a User requests the deletion of its personal data and/or is opposed to the processing of personal data and/or requests the limitation of its personal data and/or requests the withdrawal at any time of its personal data (further to the above mentioned provisions), this may lead to impossibility to deliver the ordered and/or used services by the User and, more globally, impossibility to execute the ordered and/or used services, so, in such cases

(i) as from the date of request by the User of the exercise of its rights, the User will not be able to access the services delivered by the UTAC group on its Websites

(ii) if these rights are exercised at the time of the order of services, then such order will not be able to be executed by the User

(iii) and, if the User holds a subscription, then the related account containing its personal data will be deleted.

(i) Claim to CNIL

The User is informed of the right to lodge a complaint before the relevant controlling authority which is the Commission Nationale de L’Informatique et des Libertés (CNIL) : 3 Place de Fontenoy – TSA 80715 – 75334 Paris 07.

(j) Information regarding the contractual nature of the provision of personal data

As regards the provision to the User of information regarding whether the requirement to provide personal data has a regulatory or contractual nature or whether it conditions the conclusion of a contract and whether the concerned person is required to provide the personal data, as well as the potential consequences of the non-provision of this data, the User is hereby informed of the following :

(i) the request to provide personal data is of a contractual nature (as part of the relationship that the User intends to have with the UTAC group by placing an order for services and/or using these services)

(ii) the provision of this data, insofar as it is necessary for the execution of the ordered services conditions the conclusion of this contractual relationship

(iii) for these reasons the User is required to communicate its personal data if the User wishes to order and/or use the UTAC group’s services and on its websites

(iv) the non provision of this personal data does not enable to order the UTAC group’s services.

(k) Automated decision making

The collection of personal data does not lead to the process of automated decision making in the terms of the current rules and regulation. An automated decision making is a decision taken regarding a person, by way of algorithms applied to this personal data, without the intervention of any human being.

(l) Potential subsequent processing of personal data

In the event that personal data is subsequently processed for other purposes than those for which the personal data was initially collected and as identified above, the data controller shall provide beforehand to the concerned person by way of an « opt-in », information regarding this other purpose and any other relevant legal information required, namely the right to oppose.
Personal data collected in the course of services provided on the UTAC group’s website is processed in compliance with secured protocols and enables the UTAC group to manage the claims received in its IT applications.

Age of the person providing personal data

The collection of personal data can only concern individuals aged 15 (fifteen) years old or above, and the personal data, as indicated above, is required for the execution and monitoring of the services ordered and/or requested on the Websites, therefore the individuals under 15 (fifteen) years old cannot give their consent for the collection of personal data (and consequently access the services provided in the Website) on the only condition that they are duly authorised by the relevant legal guardian holder so that, by requesting services on the Websites and/or communicating personal data to the UTAC group, the Users declare that they are (i) either aged 15 (fifteen) or above (ii) either they are duly authorised by the relevant legal guardian. This provision is without prejudice of the User’s undertaking towards the UTAC group by which the User declares and garantees to the UTAC group that it has the legal capacity to use the UTAC group’s services delivered on the Websites and, if necessary, to pay the said services.

Exercise your rights

For any information or exercice of your data privacy rights monitored by the UTAC group, you may contact the person in charge of data protection (DPO) :
By email : dpo@utac.com
Or by post (with a copy of your identity card in the event you exercise your rights) at the following address :
UTAC
To the attention of the legal department
Autodrome de Linas-Montlhéry
Avenue Georges Boillot
91310 LINAS
FRANCE

Amendment to this charter

This policy may be amended. For this purpose, the User is invited to regularly visit the latest version of the UTAC group’s websites.

May 2019