This Policy applies to all measures implemented by AMA Group regarding the collection and use of your personal information when visiting AMA’s website or when using AMA’s products and/or services.
This policy details (i) the origin and nature of data collected by AMA, (ii) why data is collected by AMA (reason and purpose), (iii) how data is used by AMA, and (iv) rights that you have regarding this data, in compliance with law no. 78-17 of the 6 January 1978 (“Loi Informatique et Liberté“), as modified, and Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, a.k.a. “GDPR“, and repealing Directive 95/46/EC (collectively referred to as the “Personal Data Protection Legislation“).
AMA has endorsed security mechanisms restricting the access to personal data only to legal or natural persons who are allowed by specific authorisation or entitled to access personal data due to their role.
Furthermore, AMA ensures confidentiality and security of personal information for any natural person providing information to AMA via Non-Disclosure Agreements and/or, when applicable, via its Terms and Conditions.
AMA implements organisational and technical security measures intended to maximise security, confidentiality and integrity of your personal information. All data stored on our servers is protected by measures such as secure portal under HTTPS protocol, encryption of data in transit under TLS protocol, firewalls, antivirus software, access management, and intrusion detection.
However, due to the very nature of a worldwide public communication network such as the Internet, you acknowledge that complete security of electronic transmissions through the Internet and integrity of Personal Information cannot be warranted.
In case of a security breach resulting in a personal data breach, we commit to implement corrective measures as soon as possible and notify such breach to the competent supervisory authority, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons in accordance with the Personal Data Protection Legislation.
AMA may provide on demand a Data Processing Agreement for products and/or services provided by AMA, and containing specific provisions regarding confidentiality and processing of personal information within the scope of the use of AMA’s products and services.
AMA may collect your personal information (i.e. name / surname / phone number / email address / company name / country) via its website when you fill in the contact form and/or ask for a demo. The contact form relies on this Privacy Policy and your consent is therefore mandatory before your personal information can be collected and processed for newsletter and demo purposes.
AMA automatically collects information without you completing any forms, such as date and time of connection of a terminal to an electronic communication service / type of operating system used by the terminal / type and version of the browser software used by the terminal / language of use of the browser software used by the terminal.
- How: Browser data is collected by the installation of cookies on your terminal.
- Type of cookies: Technical cookies and cookies related to functionality.
- List of tracking cookies used by AMA for audience measurement and tracking of your activity: Google Adwords.
- Cookies placed on AMA’s website by third parties: Google, Hubspot.
Regarding contractual relationships between AMA and its customers, and as provided for in AMA’s Terms & Conditions, the legal representative or contract signatories and contacts is/are informed that their personal data will be processed for the purpose of maintaining the contractual relationship (including name, surname, professional email address and telephone number).
XpertEye user data is also automatically collected when using the services and as follows (consent is provided via the signature of the contract and/or AMA’s Terms and Conditions):
- Logs: Data collected for stats purposes (IP address, timestamp, user action, anonymised user identifier). All data collected is anonymised.
- User database: Data collected for customer management purposes (name / surname / phone number / email address).
For further information, refer to specific contract / T&Cs / DPA.
AMA undertakes to (i) collect, process and use personal data only within the scope of its website and products / services, (ii) ensure that security and confidentiality requirements are met while collecting, processing and using personal data, and (iii) provide appropriate training on personal data protection to its personnel.
- Consent;
- Performance of a contract;
- Legitimate interest;
- Compliance with legal obligations.
Performing “customer management” operations concerning:
- Customer requests (information requests, quotes, orders);
- Provision of AMA services;
- Customer relationship management (including but not limited to performance of satisfaction surveys, complaints management, etc.).
Improving your user experience on AMA’s websites:
- To conduct promotional activities (via newsletters in particular);
- To handle your requests relating to the right to access, correct or express objections regarding your personal information;
- To adapt AMA’s website and services, as well as the content and advertising they provide.
Conducting operations relating to direct marketing, including:
- Management and development of commercial statistics.
Those who may access and process your personal information are AMA’s staff in the marketing, sales, legal, accounting, logistics and IT departments in charge of handling customer relations and prospection.
AMA is entitled to process contact details collected via the website or the commercial relationship within the legal requirements of the applicable data protection and privacy laws in their latest version, especially the GDPR, and, to the extent required in connection with the commercial offer and its implementation, to pass on such data to companies affiliated to AMA.
AMA retains your personal information for as long as it remains strictly necessary for the management of the commercial relationship, and within the time limits set below.
Personal information is also deleted or anonymized upon request by the person whose personal information is collected and processed.
AMA retains your personal information for as long as it is active and/or as long as necessary to provide you with the services.
- Prospect or customer data used for prospecting purposes may be kept for a period of three (3) years from data collection or last contact from the prospect (prospects) or the end of the commercial relationship (customers) (CNIL deliberation n°2016-264, 21 July 2016, article 5). At the end of this three-year period, AMA (data controller) may contact you again to find out whether you wish to continue receiving commercial solicitations. In the absence of a positive and explicit response from you, the data shall be deleted or archived in accordance with applicable provisions, and in particular those provided for by the French Code de Commerce, Code Civil, and Code de la Consommation.
- Browsing data collected through cookies are kept for 30 days.
- Unless the customer requires otherwise, at the end of a subscribed software license, we will deactivate the related domain name, and will keep the LDAP data (login, roles, usage stats – all anonymized and encrypted) for a period of two (2) years. We can provide the customer with a report on this data upon request. Nominative user data collected through the use of XpertEye (via user base) are kept for two (2) years. Note that we keep information about the country related to users’ IP address for as long as necessary to fulfil our CSR reporting obligations (which may be longer than two years).
- Any other information is deleted five (5) years from last use by AMA.
Data generated during XpertEye calls is now securely stored on Microsoft Azure’s protected infrastructure (with users having the ability to delete their data at any time should they choose to do so), or on customers’ own cloud storage solutions or third party solutions at their request. If the data is stored on Azure’s infrastructure, neither AMA employees nor third parties can access any customer data. Only certain members of AMA’s technical support team with specific secured admin status may have access to the data but only at the customer’s specific request. In cases where the customer and/or user records personal data through the use of the services, the customer remains solely responsible for the use and/or processing of this personal data. The customer and all users it is liable for shall remain responsible for the storage of data processed directly or indirectly using the services as well as the use made of it, and undertake to use the services and any personal data gathered via the services in such a way that is fully compliant with personal data protection regulations, including the GDPR.
6.1. When data is collected, you are informed of this Privacy Policy and therefore of the identity of the data controller (AMA), processing purposes, whether responses are mandatory or optional, data recipients, and the existence of and procedures for exercising your rights of access, rectification and opposition to the processing of your data, as detailed in clause 6.3 of this Privacy Policy. Your consent is mandatory as detailed in clauses 2.1 and 2.3 of this Privacy Policy.
6.2. The data provided shall be kept for as long as the relationship is maintained or for the time necessary to comply with applicable laws. The data shall not be surrendered to third parties except where there is a legal obligation to do so. The data owner can also exercise their right to withdraw their consent at any time.
6.3. The data owner may exercise at any time, to the extent that it applies (articles 15 and 22 of the GDPR), the rights of access, correction or deletion, limitation of data processing, objection, portability, and to oppose automated individual decisions. AMA has appointed a Data Protection Officer to whom questions may be raised concerning the processing of personal data. Your requests should be sent in writing or by email to the contact details indicated below, signed and accompanied by a photocopy of an identity document bearing the signature of the holder. The request should indicate the address where the response should be sent. We shall respond within one (1) month following receipt of the request. This may be extended by two (2) further months where necessary, taking into account the complexity and number of requests.
By email to rgpd@ama.bzh
The data owner may also lodge a complaint with the French supervisory authority “Commission Nationale de l’Informatique et des Libertés”, 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, Tel: 01 53 73 22 22.
Within the purposes listed in clause 3.2 of this Privacy Policy, all or part of the Personal Information collected may be sent to recipients located in a country outside of the EU.
AMA ensures that your Personal Information is effectively protected. As such, all transfers are sent to recipients located:
- In countries having, according to criteria established by the European Commission, an adequate level of personal data protection; or
- In countries not offering adequate personal data protection but to which the transfer is done within the standard contractual clauses framework specified by the European Commission, or by the adoption of “binding corporate rules”.
For more information or if you have any questions regarding this Privacy Policy, you may refer to the documentation made available (i.e. Terms and Conditions, Technical Documentation, DPA – when applicable) or contact AMA by email at legal@amaxperteye.com or rgpd@ama.bzh.