Personal data charter

I. SCOPE OF APPLICATION AND DEFINITIONS

Evok Collection L (hereinafter “Evok Collection”) is a limited liability company of a Member State of the European Community or party to the Agreement on the European Economic Area, registered with the Paris Trade and Companies Register under number 893 661 884, whose registered office is located at 7, rue des Trois Cantons, L-8399 Windhof, Luxembourg, and whose branch office is located at 46, rue Pierre Charron, 75008 Paris, with a share capital of €9,025,000.00, which carries out consulting, management and executive management activities in the high-end hotel and restaurant sectors, including the services usually associated therewith (spa, fitness and wellness, events), for and within the framework of several establishments belonging to the Evok Collection group – designated as “Evok Collection members” –, namely:

Nolinski Paris, Paris 1st
Brach Paris, Paris 16th
Brach Paris Fitness Club, Paris 16th
La Cour des Vosges, Paris 4th
Nolinski Venezia, Venice, Italy
Brach Madrid, Madrid, Spain

and websites published by the Evok group for the promotion and operation of its establishments and activities, namely:

In connection with the group’s activities, Evok Collection carries out processing of personal data within the meaning of the French Data Protection Act of 6 January 1978 relating to information technology, files and civil liberties and Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 relating to the protection of natural persons with regard to the processing of personal data, which entered into force on 25 May 2018, hereinafter the “Processing”.

Personal Data: Personal Data means any information relating to an identified natural person or a natural person who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to that person. In determining whether a person is identifiable, account should be taken of all the means reasonably likely to be used to identify that person by the Data Controller or by any other person.

Processing: Processing means any operation or set of operations performed on Personal Data, regardless of the process used, including collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Data Subject: The Data Subject is the person to whom the Personal Data being processed relates.

The purpose of this Personal Data Processing Policy Charter is to inform persons who come into contact, or wish to come into contact, in any way whatsoever, with the Evok Collection group, and in particular users of the Evok Collection group websites, of the conditions under which their Personal Data may be subject to Processing and of the rights of Data Subjects in this respect.

II. DATA PROCESSED

1°) Categories of Data:

Without prejudice to the specific provisions relating to Bast activities (see the Bast section below), the Data processed by Evok Collection, irrespective of the source from which they are collected, are as follows:

Personal Data: title, surname, first name, legal age, country of origin or residence where this may be revealed by Contact Data or other Personal Data;
Contact Data: email address, landline and mobile telephone numbers, postal address, social media identifiers;
Connection Data: details relating to the connection device such as IP address, IMEI number or mobile telephone number; type and model of device; location of the device; access software and operating systems; date and time of connection;
Browsing Data: pages viewed on the website or before connecting to the website; times and duration of visits; browsing history; storage of preferences.

2°) Data Subjects:

Personal Data and Contact Data processed by Evok Collection are collected from all persons who enter into contact with Evok Collection or with establishments belonging to the Evok Collection group: customers, prospects, suppliers, business partners, members of the press, job applicants, etc., whether by consulting and browsing the group’s websites, submitting contact forms or booking forms, sending emails or other correspondence, orally by telephone or in person, or by providing a business card or any other medium containing such Data.

Connection Data and Browsing Data processed by Evok Collection are collected from any person who continues browsing the Evok Collection group websites after having accepted the use on such websites of cookies other than strictly necessary cookies (learn more about Cookies).

Minors. The Evok Collection group websites are intended for adults. It is the responsibility of any person holding parental authority over minors to supervise and monitor such minors’ communications, and in particular their internet browsing.

3°) Data collected directly by Evok Collection:

Evok Collection directly collects certain Data itself in certain circumstances, as follows:

on or through the websites evokcollection.com and hameaudelavoliere.com: when the user confirms that he or she is an adult before continuing to browse the website: Personal Data; when the website user completes and submits a registration form for the “EVOK NEWS” newsletters: title, surname, first name and email address, or subscribes to the latest news from the Evok Collection group: email address; when the website user completes and submits a contact form on hameaudelavoliere.com via the “Location” tab: surname and email address. Where Evok Collection requires the website user to provide the above-mentioned Data, such Data are necessary for the performance and provision of the requested service, in accordance with the purpose of the Processing.

The installation or reading of Cookies and trackers directly by Evok Collection – learn more about Cookies: Personal Data, Contact Data, Connection Data, Browsing Data; upon receipt of any other correspondence or contact of any kind (letters, emails, SMS, fax, telephone, invitations via social networks, online sharing, etc.) from any person who has contacted Evok Collection by any means whatsoever, and in particular at any address ending in “@evokcollection.com”: Personal Data and Contact Data, depending on the content communicated by the person and the chosen means of communication; and, where the contact is made via the internet: Connection Data and Browsing Data; on the occasion of any meeting between persons in a professional or commercial context resulting in the voluntary communication by the Data Subject of such Data, whether orally or by providing a business card, brochure or any other document containing the Data: Personal Data and Contact Data, depending on the content communicated by the person.

4°) Data collected by members of the Evok Collection group other than Evok Collection:

Evok Collection processes Personal Data, Contact Data, Connection Data and Browsing Data collected by the following members of the Evok Collection group:

SAS BRACH Paris – Paris Trade and Companies Register 803 406 685, whose registered office is located at 1-7 rue Jean Richepin – 75116 Paris; see the Personal Data Processing Charter of Brach Paris.

SAS BRACH Paris Fitness Club – Paris Trade and Companies Register 823 711 239, whose registered office is located at 17, avenue de l’Opéra – 75001 Paris; see the Personal Data Processing Charter of Brach Paris Fitness Club.

SAS NOLINSKI PARIS – Paris Trade and Companies Register 803 406 909, whose registered office is located at 16, avenue de l’Opéra – 75001 Paris; see the Personal Data Processing Charter of Nolinski Paris.

SAS Cour des Vosges – Paris Trade and Companies Register 827 781 584, whose registered office is located at 19, Place des Vosges – 75004 Paris; see the Personal Data Processing Charter of Cour des Vosges.

Nolinski Venezia S.R.L – VAT No.: IT04707740272 – Tax Code: 04707740272, whose registered office is located at Calle Larga XXII Marzo-S. Marco 2032 – 30124 – Venezia; see the Personal Data Processing Charter of Nolinski Venezia.

S.L Brach Madrid – NIF: B67341891, whose registered office is located at Gran Vía, 20 – Madrid; see the Personal Data Processing Charter of Brach Madrid.

5°) Data collected by the Evok Collection group’s commercial partners:

Evok Collection processes Personal Data, Contact Data, Connection Data and Browsing Data collected by the following partners of the Evok Collection group:

La Fourchette SAS, through the booking module module.lafourchette.com accessible by activating the restaurant booking form on the nolinskiparis.com and brachparis.com websites; see the Privacy Policy of La Fourchette SAS.

TravelClick Inc., a company incorporated under US law, through the hotel room booking module reservations.travelclick.com, accessible by activating the booking form on the nolinskiparis.com and brachparis.com websites; see the TravelClick Inc. Privacy Policy.

Cimalpes SAS, publisher of the cimalpes.ski website including a booking module, for Bast; see the Personal Data and Cookies Policy of Cimalpes.

Evok Collection also processes the same categories of Data communicated to it by booking operators, in particular online booking operators, to which persons provide Data in order to make a booking at an Evok group establishment. Persons are invited to consult the personal data processing policies or terms of such operators on their websites or by any other means.

6°) Data collected via authorised third-party Cookies on Evok Collection group websites

Evok Collection processes Connection Data and Browsing Data collected by Cookies authorised by Evok and implemented on the evokcollection.com and hameaudelavoliere.com websites by Google, through the Google Analytics and Adwords tools used by Evok Collection.

For more information, see the Cookies Policy.

7°) Publicly available Data:

Evok Collection also processes Personal Data and Contact Data that are publicly available, such as, for example, those provided on a website, telephone answering service, publication masthead, public professional register, etc.

III. CHARACTERISTICS OF PROCESSING

1°) Data Controller:

Evok Collection is the Data Controller, i.e. the person who determines the purposes and means of the Processing, as set out in this Charter.

2°) Activities giving rise to Processing:

The Personal Data described in Section II are used and processed by Evok Collection in connection with the following activities:

development of hotel, restaurant and wellness establishments;
development of policies and means for the promotion and dissemination of the group and its establishments;
development of commercial offers of the group and its establishments;
creation of events, particularly in and around the group’s establishments;
communication regarding the foregoing activities: offers, events and various news to prospects, the press, partners and participants in the same business sector.

3°) Purposes of Processing:

Personal Data and Contact Data. The Processing of such Data is intended, in particular, for communication, promotional and commercial prospecting purposes relating to the activities of the Evok Collection group, as well as for the implementation of loyalty programmes. In this context, the Data may notably be used to:

communicate news and updates relating to the Evok Collection group, in particular through newsletters;
send invitations to public relations events;
communicate commercial offers;
send communications by email (mailings) or SMS.

Data relating to electronic communications. In connection with the sending of our newsletters and electronic communications, we may use tracking technologies, such as tracking pixels, to measure the opening of our messages, analyse their performance, improve our content and better tailor our communications to the interests of their recipients.

Recipients may object to the use of these tracking technologies at any time via the link provided for this purpose in our communications, without such objection resulting in their unsubscription. They may also manage their communication preferences or unsubscribe at any time using the links provided at the bottom of each newsletter.

Connection and Browsing Data: please refer to the “Cookies” section.

4°) Legal Bases for Processing:

Personal Data and Contact Data. The Processing is based on:

where the Data Subject submits a contact form or a subscription form for a newsletter (“EVOK NEWS”) or group news, or uses any other means of correspondence through which he or she provides Data, at least one of the following grounds: performance of the request expressly made by the Data Subject; the consent thus given by the Data Subject;
where the Data Subject communicates his or her Data without using a form: the consent of the Data Subject; and the pursuit of the legitimate interests of Evok Collection, taking into account its activities and corporate purpose, for communications to Evok Collection customers or professionals connected with or interested in Evok Collection’s business sector.

The legitimate interests pursued by Evok Collection consist in pursuing its corporate purpose by communicating about the development of its establishments, responding promptly to requests from the public and professionals, and ensuring the dissemination, visibility and attractiveness of its offers and activities, particularly insofar as this involves attracting and welcoming the public.

Connection and Browsing Data. Processing is based on the consent of the Data Subject, which is requested when the Data Subject first connects to the website on which the Data are collected.

5°) Data Retention Period:

Personal Data and Contact Data are retained in a form enabling Data Subjects to be identified for a period that does not exceed the time necessary for the purposes for which they are processed.

Where Processing is based on the consent of the Data Subject, the Data processed are retained by Evok Collection only for as long as such consent remains in effect.

Any new act of communicating Data by the Data Subject, even if such Data have already been communicated previously, by any of the means of collection referred to in Section II “Data Processed”, triggers a new retention period, independently of any previous retention periods.

6°) Data Recipients and Subcontracting:

Certain operations necessary for the Processing implemented in connection with the Activities (ii) (formatting and maintenance of the database, retention of Personal Data and Contact Data) are performed on behalf of Evok by BOWO SAS, whose registered office is located at 176, rue du Temple 75003 Paris (SIREN 827 530 684), acting as a processor.

See Bowo’s Personal Data Protection Charter.

The Data collected or received by Evok Collection are not transmitted by Evok Collection to any other recipient, except, where applicable, to legally authorised authorities in connection with a specific assignment or the exercise of a statutory right of disclosure.

III. BAST

In addition to the provisions set out in the preceding sections, in connection with its activity of managing bookings and hotel services relating to Bast and for the purposes of entering into and providing such services, Evok Collection carries out Processing having the following characteristics, which is in addition to the other Processing otherwise referred to in this Charter.

1°) Data Subjects concerned by the Processing:

Any person booking or staying, or wishing to book or stay, in one of Bast’s two chalets: Nanuq and Les Bastidons.

2°) Categories of Data collected:

Data relating to civil status: surname*, first name*, title*, copy of the identity document provided at check-in*, nationality*; country of residence*; other information contained in the identity document: date* and place of birth, height, eye colour, photograph; shoe size and weight where ski equipment is requested;
Data relating to personal life: family situation and composition*, age of children; lifestyle habits: consumption, food preferences and other specific personal information communicated by the persons;
Data relating to professional life, where the booking is made for professional purposes communicated by the persons;
Special categories of Data relating to, or potentially revealing, even allegedly:

the health of persons, where the Data are voluntarily communicated by the persons with a view to receiving a specific service or assistance (for example: disability, special meal or specific hygiene measure);

the political, trade union, philosophical or religious beliefs of persons, where the Data are voluntarily communicated by persons due to specific requests or the name under which the booking is made or the invoice issued (for example: booking a stay for a political, trade union or religious organisation or association; preparation of special meals as part of the half-board package);

Evok Collection processes Special Categories of Data only where they accompany a request made by a Data Subject and where the Processing is necessary for the performance of the services so requested. Special Categories of Data incidentally or allegedly revealed by other non-special categories of Data processed by Evok Collection are not, as such, subject to Processing.

Location Data: place* and dates* of the stay; ski areas visited where ski lift passes are requested;
Payment Data*: depending on the circumstances and the payment method chosen by the customer: bank account details, IBAN, name or company name of the account holder, bank card details or other payment cards accepted by Evok (American Express, Diners, etc.); amounts paid for the services and invoicing instructions.

The Data marked with an asterisk (*) above are essential for entering into bookings and for stays to take place, which cannot occur without the communication of such Data.

The other Data are necessary only insofar as the Data Subject wishes to obtain services whose content or nature depends on the Data concerned; the provision of such Data is therefore left entirely to the discretion of the Data Subjects.

3°) Collection of Data:

The Data processed by Evok Collection in connection with the management of bookings and hotel services relating to Bast are collected: directly by Evok Collection when it is contacted by email, through the booking contact form available on the www.hameaudelavoliere.com website, or by telephone;

by booking and tourism networks or operators to which persons provide Data in order to make a booking at the Nanuq and Les Bastidons chalets, and which transmit the Data collected to Evok Collection. Persons are invited to consult the personal data processing policies or terms of such operators on their websites or by any other means (including, for example but without limitation, Cimalpes SAS, publisher of the cimalpes.ski website including a booking module for the Hameau de la Volière; see Cimalpes’ Personal Data and Cookies Policy).

4°) Contractual requirement for Data:

Only Data relating to civil status, certain Data relating to personal life, certain Location Data and Payment Data are necessarily required for entering into bookings and providing the services; they are marked above with an asterisk. Other Data may be freely and voluntarily communicated by Data Subjects in connection with their specific requests.

5°) Purposes of Processing:

The purpose of the Processing referred to in this section is to provide the services requested by Evok Collection customers in connection with their stay at Bast:

management of chalet capacity and accommodation arrangements;
management of customer access to the chalets;
planning and provision of the services requested by customers in connection with their stay, and the resources and supplies required accordingly;
payment for the services.

6°) Legal Bases for Processing:

The Processing referred to in this section is based on one or more of the following grounds:

the need to perform contractual and pre-contractual services requested by Data Subjects;
compliance with the Data Controller’s legal obligations, in particular with regard to accounting and the archiving of commercial documents and invoices.

7°) Data Retention Period:

The Data referred to in this “Bast” section are retained for the period strictly necessary to perform the contractual and pre-contractual services requested by Data Subjects in connection with their booking and stay.

Data relating to civil status, Data relating to professional life and Data relating to personal life may be retained for an additional period of one year from the end of the stay.

Special Categories of Data are retained only for the period strictly necessary to provide the requested service or comply with the applicable legal obligation (including the retention and archiving of nominative invoices, accounting records and other accounting or tax obligations).

Payment Data are retained only for the period strictly necessary for each payment for which they are communicated or to comply with the applicable legal obligation (including the retention and archiving of nominative invoices, accounting records and other accounting or tax obligations).

8°) Data Recipients and Subcontracting

For the performance of Processing operations relating to the management of hotel services, Evok Collection uses a platform provided by the German company protel hotelsoftware GmbH, which also stores the Data communicated by Evok Collection and, in this respect, acts as a processor. See protel’s privacy policy.

For the performance of Processing operations relating to invoicing and payment for services, Evok Collection transmits Payment Data as well as the civil status and Personal Data strictly necessary for invoicing and payment to the aforementioned Cimalpes SAS (see Cimalpes’ Personal Data and Cookies Policy).

IV. COOKIES

1°) Definition:

A Cookie is a tracking tool consisting of a small file or short alphanumeric combination automatically installed or read by a network or website provider on the Data Subject’s terminal equipment (computer, mobile telephone, tablet, games console), thereby enabling access to information already stored in that terminal or the entry or storage of information in such equipment.

2°) Purposes of the Cookies used and information transmitted by Cookies:

The operation of the evokcollection.com and hameaudelavoliere.com websites involves the use of Cookies as follows, presented according to the functionality served by each type of Cookie:

– Implementation and facilitation of electronic communications and provision of online communication services exclusively: Functionality Cookies;

– Improvement of browsing on the websites; organisation of displayed content (including interactive Google Maps), storage of Personal Data previously entered by the Data Subject, monitoring of the user’s preferences and choices, for example to facilitate a booking operation: Efficiency Cookies;

– Audience measurement: Audience Cookies;

– Monitoring of browsing (websites, pages viewed, searches carried out and keywords used, etc.) and of the Data Subject’s preferences for the purpose of personalised advertisements or targeted advertising: Advertising Cookies. Advertising Cookies are also placed by Google through Google Maps available on the websites: the Data collected (Connection, Location and Browsing Data) are not processed by Evok Collection but by Google;

– Promotion of the websites and improvement of their usability through content-sharing features on social networks (Facebook, Twitter, Instagram, Google+, Pinterest, LinkedIn), using sharing buttons allowing browsing to be tracked by such social networking websites, whether or not the buttons and links are activated by the website user: Social Network Cookies.

3°) Consent of Data Subjects:

The use of Efficiency Cookies, Advertising Cookies, Audience Cookies and Social Network Cookies, i.e. all Cookies other than Functionality Cookies, requires the consent of the Data Subject and, where the Data Subject is a minor, the consent of the person holding parental authority, whose email address the minor Data Subject is required to provide.

In accordance with Article 32 II of the French Data Protection Act of 6 January 1978, the person’s consent may result from his or her connection settings. The website user is invited to check or modify his or her settings before continuing to browse the website. By continuing to browse the website, i.e. by going to another page of the website or by clicking on an element of the website (image, link, “search” button, for example), the Data Subject expresses his or her consent to the use of the Cookies referred to above.

The user may object to Cookies or withdraw consent at any time: see Prohibition or Management of Cookies.

4°) Duration of Cookies:

Unless the Data Subject exercises his or her right to object or withdraws consent, consent to the placement of Cookies is given for thirteen (13) months. At the end of this period, the Data Subject’s consent must be obtained again in order for Cookies to be used. Accordingly, Cookies remain active for only thirteen months after they are first placed on the terminal equipment of the user who consented to them. The duration of a Cookie is not extended by subsequent visits to the websites.

5°) Prohibition or Management of Cookies:

Website users may object to the use of Cookies or certain Cookies on their terminal and have, in particular, the following means available to them for this purpose.

Browser settings:

Go to the browser menu (Safari, Mozilla, etc.), then to the “Preferences”, “Settings” or “Tools” section, and proceed as follows depending on your browser:

Safari: “Privacy” > “Cookies and website data”: select the desired options; to object completely, select “always block” and check the “Website tracking: Ask websites not to track me” box if it is not already checked;

also, to manage Data and Cookies already stored on the terminal: “Manage Website Data”: carry out the desired deletion operations by selecting the sources and categories of Data and Cookies in the table and then clicking the “delete” button;

Mozilla Firefox: “Privacy & Security” > “Cookies and Site Data”: perform the desired operations after consulting the “learn more” section;

– to block all Cookies: check the “Block Cookies and site data (may cause websites to break)” option;

– to manage Cookies: select “Accept Cookies (recommended)” and choose from the available options (i) as regards Cookie retention: to limit this as much as possible, select “until Firefox is closed”, (ii) as regards acceptance of third-party Cookies: to limit this as much as possible, select “Never”;

– using the “Clear Data”, “Manage Data” or “Exceptions” buttons, the user may also delete all (“Clear”) or some (“Manage”) Data and Cookies already stored on the terminal or allow only certain websites to use Cookies (“Exceptions”);

Internet Explorer: “Internet Options” > “Privacy” tab > “Advanced” button to display the “Advanced Privacy Settings” window > check “Override automatic cookie handling”, then select the desired options: allow, block or be prompted to determine the desired configuration for first-party and third-party Cookies.

Chrome: “Show advanced settings” (at the bottom of the page), then Privacy and Security, then “Content settings”, then “Cookies”:

– to delete all or some Cookies: “All cookies and site data” > Delete all; or search for the website name and Delete;

– to change default Cookie settings: enable or disable “Allow sites to save/read cookie data”; check “Block third-party cookies and site data” to block third-party Cookies;

– to block Cookies only from a specific website: next to “Block”, “Clear on exit” or “Allow”, click “Add”, then enter the web address and click “Add”.

Other specific solutions:

In addition to general browser settings, there are control, management or personalisation solutions depending on the purpose of the Cookies or the entity using them.

Advertising Cookies. These Cookies are implemented through the Adwords tool provided by Google. To disable them: https://policies.google.com/technologies/product-privacy?hl=en, then select “Ad settings” and choose the desired options. The user may also install a browser plug-in so that personalised Google ads remain disabled even after Cookies have been deleted by clicking “Learn more”.

Google advertising Cookies may also be disabled by following Google’s Cookies information and selecting the account settings for advertising preferences, or through Google’s privacy settings.

More generally, most Advertising Cookies can also be controlled through a platform centralising users’ choices: www.youronlinechoices.eu, optout.aboutads.info (USA) or youradchoices.ca.

Google Maps Cookies: follow Google’s product privacy page, then access the desired options in the Google Maps menu. Google Maps’ terms of use are also accessible through the link displayed on the interactive maps available on the websites.

Audience Cookies. These Cookies are implemented through the Google Analytics tool provided by Google. Users can disable them by installing the browser add-on available here: Google Analytics Opt-out Browser Add-on.

Social Network Cookies, implemented through the sharing buttons available on the evokhotels.com and hameaudelavoliere.com websites. Social networks generally allow users, whether members or not, to block, manage or personalise Social Network Cookies through modules accessible to everyone and through member account settings.

Facebook and Instagram (and other Facebook products): Facebook Cookies Policy;

Pinterest: Pinterest Cookies Policy;

LinkedIn: LinkedIn Cookie Policy.

Cookie Personalisation Page. Users may also visit the dedicated Cookie Personalisation page on the website.

6°) Consequences of prohibition:

Objecting to Functionality Cookies, in particular where the user objects to all Cookies, results in the communication service being unable to function. The user will therefore be unable to use or browse the website.

Objecting to Efficiency Cookies does not prevent access to the websites and their features but may result in less efficient or fluid browsing and reduced performance of the features and services offered on the websites, including booking services.

V. RIGHTS OF THE DATA SUBJECT

1°) Right of access:

A Data Subject who provides proof of identity has the right to ask Evok Collection to obtain confirmation as to whether or not his or her Personal Data are being processed; information relating to the purposes of the Processing, the categories of Personal Data processed and the recipients or categories of recipients to whom the Data are disclosed; where applicable, information relating to intended transfers of Personal Data to a State that is not a member of the European Community; communication, in an accessible form, of the Personal Data relating to him or her and any available information as to their source; and information enabling the Data Subject to understand and challenge the logic underlying automated Processing, where applicable, in the event of a decision based on such Processing producing legal effects concerning him or her.

At the Data Subject’s request, Evok Collection will provide him or her with a copy of his or her Personal Data. Beyond the first copy, reproduction and delivery costs shall be borne by the Data Subject.

Evok Collection will not respond to requests that are manifestly abusive, in particular due to their number or repetitive or systematic nature.

2°) Right to rectification:

A Data Subject who provides proof of identity has the right to obtain, without undue delay, the rectification of Personal Data concerning him or her that are inaccurate. Having regard to the purposes of the Processing, the Data Subject has the right to have incomplete Personal Data completed, including by providing a supplementary statement.

3°) Right to erasure:

A Data Subject who provides proof of identity has the right to obtain from the Data Controller the erasure, without undue delay, of Personal Data concerning him or her where one of the following grounds applies:

the Data are no longer necessary in relation to the purposes for which they were collected or processed;
the person has withdrawn his or her consent and there is no other legal basis for Processing the Data;
the person has exercised his or her right to object;
the Data were collected from the Data Subject when he or she was a child.

4°) Right to restriction of Processing:

A Data Subject who provides proof of identity has the right to obtain restriction of Processing in the following cases:

the Data Subject contests the accuracy of the Data stored, for a period enabling the Data Controller to verify the accuracy of the Data;
the Processing is unlawful and the Data Subject opposes the erasure of the Data and requests restriction of their use instead;
the Data Controller no longer needs the Data, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
the Data Subject has exercised his or her right to object under paragraph 6°), pending verification as to whether the legitimate grounds pursued by the Data Controller override those of the Data Subject.

Where Processing has been restricted under this paragraph, such Data shall, with the exception of storage, be processed only with the Data Subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

A person who has obtained restriction of Processing under this paragraph shall be informed before the restriction of Processing is lifted.

5°) Data portability:

Where Processing is based on the consent of the Data Subject or on the performance of a contract or pre-contractual measures requested by the Data Subject and the Processing is carried out by automated means, the Data Subject has the right, without prejudice to the right provided for in paragraph 3°) and to the rights and freedoms of others, to receive the Data concerning him or her provided to Evok in a structured, commonly used and machine-readable format and to transmit those Data to another Data Controller, or to have the Data transmitted directly to another Data Controller where technically feasible.

6°) Right to object:

The Data Subject may object at any time, on legitimate grounds, to the Processing of his or her Data where such Processing is based exclusively on the legitimate interests pursued by Evok or by a third party authorised by Evok Collection.

The Data Subject has the right to object, free of charge and at any time, to the use of Data concerning him or her for prospecting purposes, including commercial prospecting and profiling where such profiling is related to such prospecting, by the current Data Controller (Evok Collection) or by a subsequent Data Controller.

The exercise of this right shall not affect the lawfulness of Processing carried out before the right to object was exercised.

7°) Withdrawal of consent:

Where Processing is based on the person’s consent, he or she has the right to withdraw consent at any time.

The exercise of this right shall not affect the lawfulness of Processing based on consent carried out before its withdrawal.

8°) Automated individual decision-making, including profiling:

Unless he or she has given explicit consent or such Processing is necessary for entering into or performing a contract, the Data Subject has the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

9°) Instructions concerning the Processing of Data after death:

Any person may define instructions concerning the retention, erasure and disclosure of his or her Personal Data after death. These instructions may be general or specific. General instructions concern all Personal Data relating to the Data Subject and may be registered with a trusted digital third party certified by the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés). Specific instructions concern the Personal Data Processing operations referred to in those instructions. They are registered with the relevant Data Controllers. General and specific instructions define how the person wishes the rights referred to in this section to be exercised after his or her death.

The Data Subject may amend or revoke his or her instructions at any time.

The instructions may designate a person responsible for implementing them. Following the death of the Data Subject, that person shall be entitled to review the instructions and request their implementation by the relevant Data Controllers. In the absence of such designation or, unless otherwise provided in the instructions, following the death of the designated person, the Data Subject’s heirs shall be entitled to review the instructions following the death of their author and request their implementation by the relevant Data Controllers.

10°) Exercising rights with Evok Collection:

Data Subjects may exercise the rights provided for in this section by sending their requests or instructions by post to:

Evok Collection L

Personal Data Protection

17, avenue de l’Opéra – 75001 Paris

or by email to:

inforgpd@evokcollection.com

The request must include documentation proving the identity of the person making the request. Where there are reasonable doubts, Evok Collection may request additional information necessary to confirm that identity.

The person must specify in his or her request the rights he or she wishes to exercise, as well as the Data and Processing (purposes, legal bases) to which the exercise relates and, where applicable, the instructions that he or she wishes to send to the Data Controller.

Incomplete requests cannot be processed. In any event, Evok Collection reserves the right to request additional information necessary to implement the rights invoked.

11°) Complaint to the supervisory authority:

Without prejudice to any other effective administrative or judicial remedy, any Data Subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or the place where the alleged infringement occurred, if he or she considers that the Processing of Personal Data concerning him or her infringes the regulations relating to the protection of Personal Data.

In France, the supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL), located at 3, place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07.

VII. DATA PROTECTION OFFICER

Mr Anthony Hamet has been appointed Data Protection Officer (DPO).

Data Subjects may contact the DPO regarding any questions relating to the Processing of their Personal Data and the exercise of the rights granted to them by the General Data Protection Regulation.

To contact the DPO:

– by postal mail

Evok Collection L

Personal Data Protection

For the attention of the Data Protection Officer

46, rue Pierre Charron – 75008 Paris

Email: inforgpd@evokcollection.com

Personal data charter

Book