INVESTORS AND FOREIGN TALENTS DATA PROTECTION CHARTER
Business France is the national agency supporting the international development of the French economy, responsible for fostering export growth by French businesses, as well as promoting and facilitating international investment in France.
Business France is also in charge of the welcometofrance.com website, whose purpose is to inform and guide international talents and their families in the main steps to carry out before and during the year of their move in France. A "contact us" section allows to link the users with Business France teams.
In this framework, you will find hereafter the commitments regarding the protection of personal data made by Business France, public institution located 77 Bd Saint Jacques 75014 PARIS, acting as the controller for the processing of personal data referred to in this document.
Our Data Protection Officer
1. Business France has designated a Data Protection Officer whose contact details are as follows: firstname.lastname@example.org
The Personal data that we process
2. In the context of processing personal data, Business France collects and processes the following data:
- Data allowing your identification and those of your family (partner, dependent child)
- Data linked to your personal, professional and family life
- Economic and financial data concerning your mobility in France/project in France
- Personal data of your family accompanying you in your mobility France
in order to answer to your information query as formulated on the website welcometofrance.com or sent by email to Business France employees.
The purposes of our data processing
3. We are processing data for the following purposes:
- management of the information requests of foreign investors and talent regarding international mobility in connection with the company, its counsel and, where applicable, the public administrations concerned;
- the historic record of requests and answers provided to users;
- statistical analysis of the navigation on welcometofrance.com as well as the number and type of requests made (activity indicators, piloting).
The legal bases of our data processing
4. We implement data processing only if at least one of the following conditions is met:
- your consent to the processing operations has been obtained;
- the existence of our legitimate interest, or that of a third party, which justifies that we implement this processing of personal data;
- the execution of a contract binding us to you requires that we implement this processing of personal data;
- we are subject to statutory and regulatory obligations which require this processing of personal data.
The recipients of your data
5. The personal data we collect, and those we obtained subsequently, are intended for us in our capacity as controller, that is for Business France corporate services, its offices and international representatives abroad, some of which are located outside of the European Union, and for other stakeholders of the internationalization of the French economy (notably the Regions and the Chambers of Commerce and Industry based in France) and when your request requires it to French administrations.
6. We ensure that only authorised persons have access to this data. Our service providers can be recipients of this data to perform the services we entrust to them. Some personal data may be sent to third parties or to legally authorised authorities in order to meet our legal, regulatory or contractual obligations.
7. Your personal data can be subject to a convergence, mutualization or a sharing between all Business France entities.
Transfer of your data
9. For some of the processing, we can be led to transfer your personal data out of European Union to Business France offices abroad located within the French Embassy and to Business France abroad offices located out of French Embassy in the following countries:
Cameroun, South Africa, Japan, United States (Boston, Detroit, NewYork, San Francisco), Turkey, India, Australia, China (and Taiwan) Switzerland.
10. Each of these transfers is governed by legal instruments that comply with the applicable legal framework. Indeed, Switzerland benefits from an adequacy decision, which means that they offer your personal data a level of protection equivalent to the one which is applied on the European Union territory. Transfers made to other countries are covered by the following appropriate safeguards: standard contractual clauses approved by the European Commission.
The duration for which we keep your data
11. The periods for which we keep your personal data are proportionate to the purposes for which your data were processed, that is for the longest duration mentioned below:
- one (1) year as from your request
- duration required to process your request
increased, when applicable, by the legal prescriptions and also to ensure the respect of legal or regulatory requirements compulsory for Business France.
12. You can exercise your rights, by justifying your identity, by email to email@example.com or by post at the following address:
To the Data Protection Officer
77 Bd Saints Jacques
13. To do so, you have to clearly indicate your surname and first name, the address you want the reply to be sent and to join the copy of an identity document containing your signature.
14. As a principle, you can exercise freely all your rights. However, concerning the right of access, Business France may ask for the payment of reasonable fees based on the administrative costs for any copy of data required.
15. Concerning the right of information, Business France will not have to answer if you have already the information you ask for.
16. Business France will inform you whether it cannot answer your request.
17. The failure to provide information or modification of data can have consequences in the process of your query related to your global mobility or investment in France. Your request related to your rights will be kept for monitoring purposes.
Your rights are the followings:
a) Your right of information
18. The present document provides you with information related to the purposes, legal framework, interests, recipients or categories of recipients with whom your personal data were shared, and the possibility of a data transfer to a third country or international organisation.
19. In addition to this information and with the aim of ensuring fair and transparent processing of your data, the present document provides additional information concerning:
- the period for which your personal data will be kept;
- the existence of the rights which are granted to you and the terms and conditions to exercise them.
20. If we decide to process data for purposes other than those indicated, all information relating to those new purposes will be communicated to you.
b) Your right of access to and rectification of your data
21. You have the right to access and rectify your personal data, which you can exercise at the following address: firstname.lastname@example.org
22. In this respect, you have the confirmation as to whether or not your personal data are being processed and where this is the case, access to your data and the following information:
- the purpose of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipient as well as the international organisations to whom the personal data have been or will be disclosed, in particular recipients in third countries;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the personal data are not collected from the data subjects, any available information s to their source;
- the existence of automated decision-making, including profiling, and in this case, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
23. You can ask us to, as the case may be, rectify or complete your personal data that are inaccurate, incomplete, equivocal or expired.
c) Your right to erasure of your data
24. You can ask us to erase your personal data where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you withdraw the consent you have previously given;
- you object to the processing of your personal data and there is no legal reason for such processing;
- the processing of personal data does not comply with the provisions of the applicable legislation and regulations;
- your personal data has been collected in relation to the offer of information society services to children under 16 years of age.
25. Nevertheless, the exercise of this right will not be possible when the retention of your personal data is necessary for compliance with statutory or regulatory provisions and in particular for example for the establishment, exercise or defence of legal claims.
d) Your right to restriction of processing
26. You may request restriction of processing of your personal data where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
- the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
e) Your right to object to data processing
27. You have the right to object to the processing of personal data concerning you when the processing is based on the legitimate interest of the controller, or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
28. Business France does not process anymore the personal data, except if Business France can demonstrate there are legitimate and compelling interests to process prevailing on your interests and rights and liberty, or for the contestation, exercise or defence of legal rights.
f) Your right to data portability
29. Since the 25th of May 2018, you have the right to portability of your personal data. The data on which this right can be exercised are:
- only your personal data, which excludes anonymised personal data or data that does not concern you;
- declarative personal data and personal data relating to our functioning, as mentioned above;
- personal data which does not adversely affect the rights and freedoms of others such as those protected by trade secrets.
30. This right is limited to processing based on consent or contract as well as to personal data that you have personally generated.
31. This right does not include derived or inferred data, which are personal data created by Business France.
g) Your right to withdraw your consent
32. When the data processing we carry out is based on your consent, you may withdraw it at any time. We will then stop processing your personal data but this will have no impact on the previous transactions to which you have consented.
h) Your right to lodge a complaint with a supervisory authority
33. You have the right to lodge a complaint with the French data protection authority (the Cnil) on the French territory without prejudice to any administrative or judicial remedy.
i) Your right to define post-mortem directives
34. You can give instructions in relation to the storage, erasure and communication of your personal data after your death to a certified trusted third party in charge of enforcing the wishes of the deceased in compliance with the applicable legal framework.