Table of contents
Protecting the security and confidentiality of your personal data and that of your employees is a strategic priority for the Ayming Group.
This is why we have set up this Personal Data Protection Policy to guarantee the security of the information you provide to us. We hope it will help you understand what data the Ayming Group may collect, the nature of the data processed, and how the Ayming Group uses and protects it.
Perimeter
The Personal Data Protection Policy applied by the Ayming Group protects the information that you entrust to us in the context of our missions, our commercial/contractual exchanges or via our website (registration / download / contact form).
Fair collection of relevant and strictly necessary data
We only collect, store and update data that is necessary for the performance of our duties. The storage of your personal data in our systems is primarily the result of a decision on your part to entrust us with this data; under no circumstances do we proceed to capture it without your knowledge and without you being informed.
In the interests of transparency, we will provide you with as much information as possible about the purposes for which your data is collected and the rights you have.
Type of data processed
As part of our commercial activities, we collect various categories of personal data concerning your employees, whether you are a prospect, customer or supplier, such as identification data (surname, first name, title), professional contact details (addresses, telephone numbers, e-mail address, job title) as well as a customer relations history (appointments, satisfaction mark, complaint, response to satisfaction surveys, etc.).
Your data is communicated to us when you contact us, in particular via the form available on our website, via our partners or directly by you in the course of our exchanges.
In addition, as a customer, you may be required to provide us with various types of information necessary for the successful completion of a project. The contract between us details the data, the purposes of the processing, the operations carried out, the retention periods and the security measures implemented by us.
Use of your personal data
When you provide us with personal data, we use it, in accordance with your instructions or agreed purposes, to process the assignments you have entrusted to us, to answer your questions, or to give you access to specific information or offers.
In addition, only in the context of our business relations :
- we may store and process your professional data (name, first name, position, etc.) and share it within the Ayming Group in order to better understand your needs and how we can adapt our services;
- we (or a third party acting on our behalf) may use your personal data to contact you about an offer from the Ayming Group that may meet your needs, or to invite you to complete online surveys in order to assess your satisfaction and help us better understand your expectations.
If you do not wish your personal data to be used for direct marketing or market research, we will respect your choice. We do not sell your personal data to third parties.
Limited shelf life
Your data will not be retained beyond what is necessary; retention periods vary according to the nature of the data, the purpose of the processing and legal or regulatory requirements.
Data collected from forms on our websites is kept for a period of 3 years from the last exchange.
The length of time that data received as part of our contractual relationship is kept is specified in the contract.
Enhanced safety features
The Ayming Group has appointed a CISO (Information Systems Security Manager) to guarantee the security, availability and integrity of the information system and data.
It is our responsibility to ensure that your data is not disclosed inappropriately. For this reason, access to personal data on all our systems is subject to strict implementation conditions:
- the implementation of filtering and control systems on our networks (Firewall),
- centralized rights profile management. All access requests are managed via our
ticketing tool, including validation workflows, - detection of external and internal intrusions and implementation of regularly tested alert procedures
, - tried-and-tested backup and recovery systems to ensure that
data can be restored in the shortest possible time.
The servers, owned by the Group, are hosted in France by a renowned HDS-certified hosting provider, offering every guarantee of optimal service quality and enhanced performance. Our servers are administered by our IT Department to ensure complete control over security. This organization is fully in line with Ayming’s ISO 27001 certification process.
Ayming France has been ISO 27001:2013 certified since 2019 for its Acciline+ activities and all solutions derived from the Acciline+ solution, as well as for its Innovation Financing and Management activities. All our IT procedures have been brought into line with the requirements of ISO 27001:2013, and Ayming France’s management has confirmed its commitment to data protection by launching steps to extend this scope to its other activities.
Ayming Spain is ISO 27001:2013 certified for its Innovation activities.
Transfer of your personal data to third parties
The transmission of data to third parties may be justified:
- When the circumstances of the assignment require it: transmission to subcontractors bound by contractual clauses guaranteeing the security and confidentiality of your data, or to independent service providers who are themselves bound by professional ethics (lawyers and doctors involved in occupational risk management assignments). Any such transfer is specified in the contract.
- Communication to public or private bodies, where provided for by law.
These transfers are carried out in compliance with current regulations.
As Ayming is an international group, we may transfer personal data outside the European Union, in particular to entities within its group, for the exclusive purpose of managing our business. In such cases, we undertake to put in place appropriate protection mechanisms.
Rigorous control of our subcontractors
The Ayming Group ensures that your data continues to benefit from an adequate level of protection in terms of security and confidentiality throughout its processing.
We take particular care to ensure that our subcontractors are able to guarantee the security and confidentiality of the data we entrust to them.
Access rights to your data
In accordance with current regulations,
- you have the right to access, limit, port, delete and rectify your personal data;
- You may also, for legitimate reasons, object to the processing of your personal data;
- you may withdraw your consent to the processing of your data for the future. In this case, any processing carried out prior to the withdrawal will be deemed lawful.
These rights can be exercised by sending us a letter with a copy of your identity card to the following address:
Groupe AYMING – DPO (Data Protection Officer)
114 rue Chaptal
92300 Levallois.
dpo@ayming.com
Conformity check
In order to guarantee the correct application of our rules and the compliance over time of our practices, monitoring is carried out by our DPO with each Ayming Group data controller and audits are carried out by our team of internal quality auditors, trained in the specific rules of the GDPR.
The DPO reports on these actions directly to the Ayming Group’s General Management.
Document update
This document is updated to reflect changes in the content of the services offered to you.