Privacy Policy”

Privacy Policy

This Privacy Policy informs you about how Créastyl collects and processes your personal data through its website creastyl.co.uk/ (hereinafter referred to as the “Site”) in its capacity as the data controller within the meaning of the provisions of the General Data Protection Regulation (GDPR) No. 2016/679 of April 27, 2016, and the French law known as the “informatique et libertés” law No. 78-17 of January 6, 1978 (hereinafter collectively referred to as the “Regulations”).

1. Definitions from the GDPR

The following definitions are those derived from the General Data Protection Regulation No. 2016/679 of April 27, 2016 (GDPR) and the “informatique et libertés” law No. 78-17 of January 6, 1978.

Personal Data

Personal data is any information relating to an identified or identifiable natural person. This person can be identified directly (e.g., by name and surname) or indirectly (e.g., by a telephone number, license plate number, an identifier such as a social security number, a postal or email address, as well as voice or image), through a single piece of data or the cross-referencing of several pieces of data (e.g., a woman living at a certain address, born on a certain day, and a member of a certain association).

Recipient

The natural or legal person, public authority, service, or any other entity authorized to receive data recorded in a file or processing due to its functions.

File

A file is a data processing that is organized into a stable and structured set of data. The data in a file is accessible according to determined criteria.

Data Controller

The data controller is the legal entity (company, municipality, etc.) or natural person that determines the purposes and means of data processing, i.e., the objective and the way to achieve it. In practice and in general, it is the legal entity embodied by its legal representative.

Data Processor

The data processor is the natural or legal person (company or public organization) that processes data on behalf of another entity (“the data controller”) within the framework of a service or provision.

Processing

Processing of personal data is an operation or set of operations carried out on personal data, regardless of the method used (collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, communication by transmission, dissemination, or any other form of provision, alignment).

Processing of personal data is not necessarily computerized: paper files are also concerned and must be protected under the same conditions.

Data processing must have a specific, predefined purpose before the data is collected and processed.

2. Who is responsible for processing personal data through the Site?

This responsibility falls to the company Créastyl (hereinafter “Créastyl” or “the Company” or “We”), a simplified joint-stock company located at 41 Rue Saint-Antoine, 59100 Roubaix

Whenever Créastyl determines the purposes of processing your personal data and the processing methods used, it will be qualified as the data controller and will assume all the obligations that the Regulations place on it.

A dedicated contact for data protection can be reached at the following address: dpo@creastyl.com.

3. How is your personal data collected?

Personal data is collected from our contact form and newsletter subscription requests.

We collect Personal Data that you provide to us directly:

This includes Personal Data that you provide to us directly by responding to our collection forms, especially those available online on our Site (such as name, email address, etc.). This includes contact data as well as any other information you wish to share with us.

It can also include data that you spontaneously communicate to us when contacting our teams.

Finally, we also process data that you provide to us during our exchanges (during a phone call or a demonstration of our software, for example).

The data collected by Créastyl in this way is either mandatory or optional. Mandatory fields are identified within each of the forms by an asterisk for each relevant field. When data is collected orally, we will specify whether the information is mandatory or optional. All data that you spontaneously communicate to us is, by definition, optional.

We collect some of your Personal Data automatically:

When you visit the Site, data is automatically recorded through your browsing traces on our Site, either:

Indirectly through third-party cookies,
Directly through server event logs (log files) by individuals responsible for managing the Site (either within the Company or as IT service providers).

This includes your browsing data.

When the collection of this browsing data is mandatory, it is collected to ensure the availability of the Site, improve it, and maintain a secure environment.

When the collection is optional, we obtain your prior consent for the browsing data used to measure the audience of our Site, the performance of our campaigns, optimize lead management, analyze your online behavior, and/or increase the interactivity of our Site and offer targeted advertising.

This may include, among other things:

Data related to your connection to the Site:

For example, your IP address, the website address you visit, your search engine and its settings, the date and time of your connection, how you navigate the Site, and all other usage tracking data related to your use of the Site.

Data related to the equipment you use to access the Site:

Depending on the equipment you use and the settings enabled, the following data may be collected: the type of equipment (mobile phone, tablet, PC, MAC, etc.) and the operating system you use, as well as their settings.

4. For what purposes and how long do we use your personal data?

We use your data for the following purposes as outlined in the table below.

These data are collected in one of the cases provided for by the Regulations, namely the following legal bases:

Execution of a contract to which you are a party or the performance of pre-contractual measures concerning you,
Compliance with a legal obligation,
Your consent to the use of your data,
Our legitimate interest in using your data.

Below are detailed information about the processing carried out through the Site.

Processing Name	Purposes	Legal Base(s)	Data Concerned	Retention Period
Site Forms	Process your request and provide you with the requested information or services.	Processing is necessary for the legitimate interest of Créastyl in managing its interactions with the public (customers and prospects) and enabling it to respond to requests.	Identity and contact data; Professional life data; Other (content of correspondence, for example).	Data is retained for 3 years from the last active contact, then archived for 5 years for evidentiary purposes.
Recruitment	Study and manage job and internship applications.	Processing is necessary for the execution of pre-contractual measures and the establishment of the contractual relationship between Créastyl and job or internship applicants.	Identity and contact data; Information in CVs, letters and emails submitted by applicants, interview dates, salary positioning, follow-up on applications, type and duration of proposed contracts.	Data is retained for 2 years from the last contact.
Event Organization	Management of event organization, including sending invitations, tracking registrations, tracking satisfaction, handling questions and requests during events.	Processing is necessary for Créastyl’s legitimate interest in promoting and improving its events among a professional audience and organizing these events.	Identity and contact data; Data related to event registration and participation; Exchanges related to event organization.	Data is retained for 3 years from the last active contact, then archived for 5 years for evidentiary purposes.
Management of the Créastyl website	Technical administration of the Site (maintenance, hosting); Site security; Improvement of user experience; Production of audience and service usage statistics.	Processing is necessary for Créastyl’s legitimate interest in managing its showcase website and making it available securely; Consent for third-party cookies.	Identity and contact data; Data related to Site navigation (timestamp, IP address, technical data related to the equipment and browser used, cookies) and on digital platforms via share buttons and media (cookies and other trackers); Data related to contact management (timestamp and subject of the request, follow-up, actions taken, statistics); Audience statistics.	13 months
Prospection Management	Management of the commercial relationship with customers regarding contracts, quotes, orders, invoices, accounting, especially customer account management, customer relationship monitoring such as conducting satisfaction surveys, handling complaints and after-sales service, selecting customers for studies, surveys, and product tests.	Processing is necessary for the legitimate interest of Créastyl in managing its business and contractual and commercial relationships. When the professional is an individual assimilated to a consumer under consumer law, processing is based on the contract between Créastyl and this professional or on pre-contractual measures at their request.	Identity and contact data;	Data is retained for the duration of the business relationship and, where applicable, for the duration of the statutory limitation periods.

Information related to professional life;	Economic and financial data.	The data is retained for 3 years from the end of the contractual relationship in active databases and then archived for 5 years for probative purposes.
Communication Management	Regularly send newsletters to subscribers.	Consent	Email address	For the duration of the person’s subscription to the newsletter (unsubscribe possible via the unsubscribe link in the newsletters).

If you have submitted a spontaneous application on the Site and it has not been accepted, we will contact you to ask if you want us to keep your personal data in order to offer you another position in the future, or if you want your data to be deleted. In any case, your personal data will be automatically deleted 2 years after your last contact with Créastyl.

Personal identity documents related to the exercise of rights of access, rectification, deletion, limitation, erasure, and portability are kept for 1 year from their receipt.

In the event of a legal proceeding, personal data concerning you will be retained to enable Créastyl to defend its interests.

5. Who are your personal data intended for?

Within Créastyl

Whether individually or in aggregate form, your personal data is processed by Créastyl’s employees.

In all cases, only data strictly necessary for the purpose of the processing is transmitted to employees authorized to know it due to their functions. All individuals who may have access to your personal data are contractually bound to confidentiality.

In specific cases, only the following have access to your personal data:

Legal representatives of Créastyl;
Commercial manager of Créastyl
Your customer account manager;
Members of Créastyl responsible for technical operations related to the exercise of individuals’ rights.

Transfers outside Créastyl

Several categories of third parties mentioned below may have access to your personal data. Only personal data strictly necessary for the intended processing purposes is transmitted to these third parties.

Subcontractors, including our Providers:
- Information technology:
  - Responsible for the administration, hosting, and maintenance of the Site
  - In charge of site administration, hosting: Planethoster – 4416 Louis-B.-Mayer, Laval, Quebec, Canada, H7P 0G1
  - Provider of CRM solution
  - Provider of analysis and advertising tools (Google Analytics)
- Marketing service providers (marketing agency and search engine optimization, professional contact enrichment and validation solution)

We ensure that these subcontractors commit contractually to implementing protection levels equivalent to ours and, in any case, compliant with the Regulation.

The companies providing third-party cookies to which you give your consent for installation (see cookie policy).
Exceptionally, competent authorities (administrative, judicial, police) due to a legal obligation or to ensure the rights, property, or safety of Créastyl

Créastyl undertakes not to transmit your personal data to third parties unless:

You have given your prior consent to share your personal data with third parties,
The sharing of your personal data with said third party is necessary for the provision of the requested products or services,

A competent judicial or administrative authority requires Créastyl to provide said personal data.

Transfer outside the EU

We strive to keep your personal data within the European Union. Concerned about the security and confidentiality of your data, we inform you that if your data were to be transferred outside the EU, we ensure that any transfers are made to:
o Either to a country recognized by the European Commission as ensuring an adequate level of protection;
o Or to a country that does not offer adequate protection but whose transfer is permitted under applicable regulations. These transfers are notably governed by the European Commission’s standard contractual clauses, which the CNIL has previously recognized as guaranteeing a sufficient level of protection for privacy and fundamental rights.

6. What are your rights regarding your personal data?

6.1 Right of access

You have the right to obtain from Créastyl confirmation as to whether or not personal data concerning you is being processed. If the data is being processed, you have the right of access to this data and the following information:

The purposes of the processing;
The categories of personal data concerned;
The recipients or categories of recipients to whom the data have been or will be disclosed;
The envisaged period for which the data will be stored if possible, or, if not possible, the criteria used to determine that period;
The right to request from Créastyl rectification or erasure of personal data or restriction of processing or to object to such processing
The right to lodge a complaint with the CNIL;
Where personal data is not collected from you directly, any available information about the source;
The existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

Finally, when personal data is transferred to a third country or an international organization, you have the right to be informed of the appropriate safeguards relating to the transfer.

Upon request, Créastyl will provide a copy of the data being processed. It may require payment of reasonable fees based on the administrative costs of any additional copies you request.

If you request a copy of the data electronically, Créastyl will provide it in a commonly used electronic format unless you request otherwise. The right to obtain a copy of personal data must not adversely affect the rights and freedoms of others.

6.2 Right to Rectification

You have the right to request Créastyl to correct your inaccurate data as soon as possible. You also have the right to have incomplete personal data concerning you completed, including by providing an additional statement.

6.3 Right to Erasure

You have the right to have your personal data erased as soon as possible when one of the following grounds applies:

Personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
You withdraw your consent on which the processing is based, and there is no other legal ground for the processing. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
You exercise your right to object, and there are no overriding legitimate grounds for the processing;
Personal data has been unlawfully processed;
Personal data must be erased to comply with a legal obligation;
Personal data was provided on a voluntary basis.

Please note that the right to erasure may not apply if processing is necessary:

to comply with a legal obligation;
for the establishment, exercise, or defense of legal claims.

6.4 Right to Restriction of Processing

You have the right to request the restriction of processing of your personal data when one of the following applies:

A verification of your data is necessary after your claim regarding the accuracy of your personal data;
Processing is unlawful, and you oppose the erasure of your personal data and request the restriction of their use;
Créastyl no longer needs the personal data concerning you for processing, but the data are necessary for you for the establishment, exercise, or defense of legal claims;
You have objected to processing, and Créastyl is verifying whether its legitimate grounds override your legitimate grounds.

6.5 Right to Data Portability

You have the right to receive the personal data you have provided to Créastyl in a structured, commonly used, and machine-readable format when, cumulatively:

Processing is based on consent or on a contract;
Processing is carried out by automated means.

When exercising this right, you have the right to have your personal data transmitted directly by Créastyl to another controller where technically feasible.

The right to data portability shall not prejudice the rights and freedoms of others.

6.6 Right to Object

Pursuant to the right to object, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data based on the legitimate interests of Créastyl.

Créastyl will no longer process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

You have the right to object at any time to the processing of your personal data for direct marketing purposes. To do so, you can do so for free:

By clicking the link in the email sent to you by Créastyl,
By sending an email to Créastyl at the following email address: dpo@creastyl.com.

6.7 Fate of Personal Data Post-Mortem

In accordance with the law, you have the right to define your directives regarding the storage, erasure, and communication of your personal data in the event of your death.

You can communicate your directives to us or register them with a certified digital trust third party. You can designate the person of your choice who will be responsible for carrying out your directives. Otherwise, it will be your heirs.

6.8 Regarding Consent

Several processing of your personal data is subject to your consent. This is the case, for example, when you request information through the contact form on the website.

You can withdraw your consent at any time. Simply send an email to the following address: dpo@creastyl.com.

This withdrawal of consent does not affect the lawfulness of the processing of personal data carried out based on your consent before its withdrawal.

Please note that personal data whose processing is required to respond to your requests or provide the requested services are marked with an asterisk on the collection form. Without this information, Créastyl will not be able to respond to your requests or provide the requested products or services.

7. How to Exercise Your Rights

For any request to exercise your rights, please refer to: this link.

7.1 Exercise of Rights Procedures

You can send your requests to the following addresses:

Créastyl 41, rue saint Antoine CS 59059 Roubaix Cedex 1 – France

dpo@creastyl.com

To exercise your rights regarding your data, please attach a copy of a valid identity document (identity card or passport) unless the information provided in your request can identify you with certainty.

To assist you in your request, you can use the following link to access a letter template provided by the Commission Nationale de l’Informatique et des Libertés (the “CNIL”): https://www.cnil.fr/fr/modele/courrier/exercer-son-droit-dacces.

7.2 Response Time

Créastyl has a period of one (1) month to respond to your request from the date of receiving it. This period may be extended by two months due to the complexity of your request and the number of requests received. Créastyl will inform you within one month of receiving your request.

Regarding commercial offers sent by electronic means, you have the option to unsubscribe at any time by clicking on the hyperlink available in each email sent by Créastyl.

You also have the right to lodge a complaint with the CNIL, the supervisory authority (www.cnil.fr).

8. Use of Your Data by Third-Party Platforms

The website may contain links to other websites. Similarly, other websites may reference or link to our website. We have no control over these other domains and websites. We encourage our users to read the privacy policies of each website and application they may interact with. We do not endorse, verify, or approve the privacy practices or content of such websites or applications. If you visit the other relevant websites or applications, you do so at your own risk and are subject to their privacy policy.

8.1 Social Media Plugins

Our website uses plugins (extensions) provided by third-party companies (e.g., Facebook, Twitter, Google+, etc.).

If you interact using the plugins by clicking on the icons available on our pages, some of your personal data, including your technical and browsing data, will be transmitted and stored on a server of the third-party company operating the corresponding social network of the icon you clicked on. This data will then be processed by the third-party company in accordance with its terms and your account settings within that social network.

Your data may be hosted outside of the European Union, including in the United States. If you do not want a third-party company operating a social network to link the personal data collected through the website to your user account within the relevant social network, you must log out of that social network before visiting the website. In any case, the use of these plugins is managed by third-party companies that are the publishers of social networks and is exclusively governed by the terms of the social network to which you belong. We invite you to read the conditions applied by these third-party publishers of social networks.

8.2 Google Services

This site uses several features offered by Google. As a result, some of your personal data, including your browsing data, may be transferred to this company, whose servers may be located outside of the European Union, including in the United States. The use of your personal data by Google is subject to the terms and conditions established by this company. We recommend that you read them carefully in order to fully exercise your rights in this regard.

The services include YouTube, Google Analytics, Google Ads, Google Maps.

The integration of YouTube videos accessible on the website requires the installation of YouTube plugins.

When you visit one of our pages with a YouTube plugin, a connection is established to YouTube’s servers through which information about the pages you have viewed is transmitted. Usually, if you are logged into your YouTube account, you allow YouTube to directly assign your browsing behavior to your personal profile and offer you targeted advertising. You can avoid this by logging out of your YouTube account.

Please note that we have chosen to opt for the “enhanced privacy mode” offered by YouTube, which, according to Google, “allows you to embed YouTube videos without using tracking cookies.” This feature is intended to prevent the usual placement of additional cookies by Google in order to offer you personalized advertising.

For more information about the use of user data by YouTube, please see the data protection policy on YouTube’s website: YouTube Privacy Policy.

Google Analytics uses cookies to analyze your use of the website based on your consent.

A specific setting has been implemented to anonymize the user’s IP address.

You can prevent the storage of cookies by properly configuring your browser. However, in such a case, you may not be able to use all the functions of the website. Additionally, by downloading and installing the Browser Plugin available at the following link: Browser Plugin, you can prevent:

Google from collecting personal data generated by Google Analytics cookies related to your use of the website (including your IP address),
The processing of this data by Google.

By doing so, an Opt-Out cookie will be installed, preventing the collection of your data during your future visits to the website.

For more information on the use of user data in Google Analytics, please see Google’s data protection statement at the following link: Google Analytics Data Privacy Statement.