fren+33 (0)4 78 95 24 38
·
bcf@bcf-avocats.com

Privacy Policy

Last update: February 1, 2023

BCF AVOCATS is the data controller and undertakes to respect the legal and regulatory provisions in force relating to data processing, files and freedoms, and in particular to law n ° 78-17 of January 6, 1978 relating to to data processing, files and freedoms amended by law n°2004-801 of August 6, 2004 relating to the computerized processing of personal data, by law for a digital Republic n°2016-1321 of October 8, 2016, to the General European Data Protection Regulation (EU) 2016/679 and to Law No. 2018-493 of June 20, 2018 on the protection of personal data.

Personal data is processed lawfully, fairly and transparently.

The personal data collected is adequate, relevant and limited to what is strictly necessary with regard to the processing purposes.

1. Purposes of processing personal data

The data controller collects the personal data of the user of the site for the purposes of (‘):

  • Carry out operations relating to the management of the relationship with the user and the monitoring of the commercial relationship
  • Carry out operations relating to commercial prospecting,
  • Manage requests for the right of access, rectification and opposition.

2. Personal data collected

The user expressly and unequivocally agrees to communicate the personal contact data concerning him.

The user may be required to communicate personal data of third parties. In this case, the user must first ensure that the consent of this third party is obtained in the event of communication to the company BCF AVOCATS of personal data concerning him, and must inform him of the purpose of the processing.
The user must be able to demonstrate to the data controller, upon written request from the latter, that this collection of consent has been obtained.

3. Duration of retention of personal data

The data controller will keep the information and personal data for the maximum legal or regulatory period applicable depending on the purpose of the processing.

4. Commitments of the data controller

The data controller undertakes to:

  • process personal data only for the sole purposes described above,
  • process personal data in accordance with the European Data Protection Regulation or any other provision of European Union law or the law of the Member States of the European Union relating to data protection,
  • in the event of transfer of personal data to a third country or to an international organization, inform the user beforehand,
  • guarantee the confidentiality of personal data by taking all appropriate technical and organizational measures to (i) prevent access to personal data by unauthorized persons, (ii) by performing identity and access controls via an authentication system and a password policy, (iii) by opting for an authorization management system and (iii) processes and systems making it possible to trace all the actions carried out on its information system and to carry out, in accordance with the regulations in force, reporting actions in the event of an incident affecting personal data.
  • ensure that persons authorized to process personal data undertake to respect confidentiality or are subject to an obligation of confidentiality and receive the necessary training in the protection of personal data,
  • take into account, with regard to its tools, applications or services, the principles of protection of personal data from the design stage,
  • delete, anonymize or archive personal data at the end of the retention period.

The data controller will in no way be responsible for security incidents related to the use of the Internet, in particular in the event of loss, alteration, destruction, disclosure or unauthorized access to personal data or user information.

5. Subcontractors/Service Providers

The user accepts that the personal data concerning him collected by the data controller will be transmitted to the subcontractors/service providers with whom he is in a contractual relationship for the sole purpose of carrying out the aforementioned purposes, provided that these third party recipients of the personal data are subject to regulations guaranteeing an appropriate and appropriate level of protection as defined by EU Regulation No. 2016/679.

However, the data controller cannot itself be held responsible for any lack of compliance with the GDPR by the subcontractor/service provider.

6. Exercise of rights and collection of consent

The user gives his consent to the collection and processing of personal data by checking the appropriate box under the contact form on the website.

The following rights are guaranteed by the data controller to the user and, where applicable, to third parties whose personal data has been communicated by the user: right of access, rectification, erasure and opposition, right to restriction of processing, right to portability, right not to be subject to an automated individual decision (including profiling).

Any request for a copy of personal data must be made in writing and addressed to the data controller.

By sending a written request, and at any time, it is possible to request a correction or deletion of personal data.

All requests must be sent in writing to the following address:bcf@bcf-avocats.com

At any time, the user may lodge a complaint with a competent national data protection authority: https://www.cnil.fr/fr/vous-souhaitez-contacter-la-cnil

7. Security and confidentiality of personal data – Notication

The data controller undertakes to put in place:

  1. physical security measures to prevent access to personal data by unauthorized persons,
  2. identity and access controls via an authentication system as well as a password policy,
  3. processes and systems to trace all the actions carried out on its information system and to carry out, in accordance with the regulations, reporting actions in the event of an incident affecting personal data.

Thus, in terms of computer security, the data controller strives to apply the recommendations formulated by the National Commission for Computing and Liberties (CNIL) in this area: password policy coupled with a second authentication , changing passwords regularly, etc.

The data controller notifies the user and the competent supervisory authority of any violation of personal data within a maximum period of seventy-two (72) hours after becoming aware of it by e-mail to the e-mail address of which it has. This notification is accompanied by all relevant documentation.

8. Documentation

The data controller puts in place and keeps the documentation necessary to demonstrate compliance with all its obligations arising from the regulations and to allow audits to be carried out, including inspections, by any auditor it has appointed, and contribute to these audits.

9. Transfer of personal data

In the event of transfer of all or part of the personal data subject of the Processing to a third country, i.e. located outside the European Union or not offering a level of protection recognized as adequate, according to the meaning defined by the European Commission, or to an international organization, the data controller undertakes to provide the appropriate guarantees provided for by the Regulations and to ensure that their subcontractors/service providers comply with them.

Under no circumstances does the data controller sell, rent or use, other than for the purposes specified, the personal data of which he is the recipient. The disclosure of personal data to third parties is only carried out by the data controller for the purpose of carrying out the purposes and to third parties having the quality of subcontractors/service providers under the conditions referred to herein.

10. Intellectual Property

If personal data is covered by an intellectual property right and/or an industrial property right, the user must inform the data controller of the conditions attached to their use.

11. Update of the Privacy Policy

The data controller regularly updates this privacy policy, which is available in the tab provided for this purpose on the site.

Any user may, at any time, consult the privacy policy and/or withdraw their consent by notifying such withdrawal to the data controller at the following address: bcf@bcf-avocats.com

12. Contact us

By mail : DPO Société BCF AVOCATS, 74, rue de Bonnel, « Le Bonnel Part-Dieu » – 69003 LYON (France).

By e-mail : bcf@bcf-avocats.com