1. Preamble

BLUEDIGITAL attaches great importance to protecting the privacy and personal data of the users stored on its network.

BLUEDIGITAL undertakes to comply with the provisions of European Regulation 2016/679 of 27 April 2016, known as the General Data Protection Regulation (GDPR), with the amended French Data Protection Act of 6 January 1978 (loi Informatique et Libertés) and with the amended decree of 20 October 2005.
All information collected is recorded by BLUEDIGITAL.

2. Categories of data collected

BLUEDIGITAL collects personal data transparently and explicitly.
BLUEDIGITAL undertakes to respect the principle of data minimisation, collecting only the information strictly necessary for the purposes of the processing.

Accordingly, in the course of operating its services, BLUEDIGITAL collects:
– Login data: last name, first name and email address, including the logging of related login attempts.
– Contact data: last name, first name and email address.
BLUEDIGITAL does not collect any sensitive data (Article 9 of the European regulation).

3. Purposes of processing

The data collected on the pages used to create and manage a user profile is used to manage the account.

The legal bases for this processing are the performance of a contract under Article 6.1 of the GDPR (all of the company’s services) and, for training activities, the legal obligation of a training organisation to issue a personal certificate of training.

Each collection of data is carried out specifically for explicit purposes, clearly stated on the page of the service where the data is collected.

That page also states whether the data requested is required or optional for the purpose concerned, and the consequences of not providing the required data.

BLUEDIGITAL reserves the right to create additional and/or complementary means of collection. In that case, BLUEDIGITAL will state the specific purposes of the processing concerned on the data collection page, in accordance with the regulations.

BLUEDIGITAL does not carry out any processing that leads to a decision based solely on automated processing of your personal data.

4. Recipients of the data

The data may be received by:

– BLUEDIGITAL’s teams,
– subcontractors and partners, only where necessary to carry out the processing concerned, as indicated where applicable on the data collection page,
– where applicable, the authorities, in accordance with applicable laws and regulations.

Personal data is transferred to recipients (whatever their legal status: subcontractor, controller or simple recipient) securely and under an agreement between BLUEDIGITAL and each recipient. BLUEDIGITAL ensures that each recipient knows the guiding principles of personal data protection and is bound by them under the law and/or a specific contract.

5. Location, retention and security of data

BLUEDIGITAL takes care to store personal data in a country that guarantees an adequate level of protection with regard to the protection provided by European Union law. To that end, BLUEDIGITAL has taken every safeguard to comply with the regulations protecting privacy and personal data by signing the European Commission’s standard contractual clauses with the subcontractor that hosts the personal data. Personal data is therefore stored by BLUEDIGITAL securely and in accordance with the regulations.
The data is currently hosted in France by OVHcloud.

The retention periods applied by BLUEDIGITAL comply with the regulations in force in France at the date of this policy, which in principle means until the account is deleted, generally corresponding to the term of the contract.

BLUEDIGITAL applies a set of security measures suited to the level of risk and the sensitivity of the data. These include encryption of all communications over HTTPS, a certificate guaranteeing the identity of the site, a strong password policy, an active software firewall detecting malicious actions on the site, anti-DDoS (denial of service) protection from the hosting provider and a dedicated server ensuring that data is sealed off and isolated. Further security measures are set out in the Information Systems Security Policy applied by BlueDigital’s staff, which is available to customers of the service on request.

6. Rights of individuals

Individuals have the following rights:

– the right of access to their personal data,
– the right to rectify their personal data if it is inaccurate or incomplete,
– the right to restriction under the conditions set out in Article 18 of the European regulation,
– the right to erasure of their personal data where:

- it is no longer necessary for the purposes for which it was collected or otherwise processed,
- consent is withdrawn, for processing based on consent,
- there is a valid objection to the processing,
- the data has been processed unlawfully, or
- the law requires it.

– the right to object on legitimate grounds,
– the right to data portability,
– the right to set guidelines on what happens to their personal data after their death, and
– for processing based on consent, the right to withdraw consent at any time.

To exercise one or more of these rights, please provide proof of identity and contact the DPO, the person in charge of data protection at BLUEDIGITAL (dpo_bluedigital.fr).

7. Personal data breaches

BLUEDIGITAL undertakes to notify its customers without delay of any event it becomes aware of that constitutes a breach of logical or physical security rules, or of any computer infection, hacking or cyberattack affecting the personal data collected, so that the customer can meet its obligation to notify its data protection authority and, where applicable, the individuals concerned.

8. Return or deletion of data

At the end of the contractual relationship, or earlier at the customer’s request, BLUEDIGITAL will destroy all documents, processing and personal data relating to the contract in its possession, in compliance with data protection rules, unless European Union or Member State law requires the personal data to be stored.
BLUEDIGITAL undertakes to confirm this destruction on request.

 

9. Audience measurement

BLUEDIGITAL measures traffic on its bluesecure.fr and bluesecure.io websites with Matomo, an analytics tool that BLUEDIGITAL hosts and runs itself, on a server located in France at OVHcloud. No data is shared with the Matomo publisher or with any third party.

This measurement sets no cookies and identifies no visitor. It is used only to produce anonymous statistics: pages viewed, visit duration, referring website or campaign, browser and device type, approximate country and number of forms submitted. The content of forms is never sent to Matomo. IP addresses are truncated by their last two bytes before being stored, which prevents tracing them back to a person. Raw data is deleted automatically after 25 months.

This processing is based on BLUEDIGITAL’s legitimate interest in understanding and improving the audience of its websites (Article 6.1.f of the GDPR). It is configured to meet the conditions set by the CNIL, the French data protection authority, for audience measurement tools that are exempt from consent.

You can object to this measurement at any time: click “Cookie Settings” at the bottom of the page, then “Customize”, and turn off the “Audience measurement” option. Your choice is stored in your browser.

When you submit a form, the website or campaign your visit came from is attached to your request, so that our teams know how you found us. This information is kept with your request, under the same conditions.