Preamble

 
 JCDecaux is very attached to the protection of privacy and personal data. These values form part of JCDecaux’s corporate social commitments in the context of its Sustainable Development Policy.
 
 Each legal entity of JCDecaux within the European Union, which collects or uses your personal data for the purposes of its own business is acting as the controller (hereinafter “JCDecaux” or “we”, “us”, etc.) and agrees to implement appropriate measures to ensure the protection, confidentiality and security of the personal data of any data subject from whom such data are collected, in accordance with legal requirements and, in particular, European Regulation 2016/679 on the protection of personal data (“GDPR”) and national laws applicable within the European Union.
 
 The purpose of this privacy and data protection policy (hereinafter the “Data Protection Policy”) is to inform you about the commitments made by JCDecaux to ensure your personal data are respected and protected.

Scope

This Data Protection Policy applies to all processing of personal data implemented by JCDecaux, acting as the controller, within the European Union, in relation to external persons (hereinafter “you”), including but not limited to clients, prospects, partners, job applicants, users of our products and services (such as self-service bike systems), suppliers, service providers and Internet users.

Definitions

“Controller”: the legal entity which determines the purposes of such processing and the means implemented.
 “Personal data”: any information that can be used to directly or indirectly identify a natural person.
 “Processing”: operation or set of operations which is performed on personal data, such as collection, recording, use, transmission or disclosure.

“Processor”: the legal entity which processes personal data on behalf of the controller.

Data collected

JCDecaux only collects and processes personal data that is relevant, adequate, not excessive and strictly necessary in relation to the purposes previously determined. JCDecaux takes all useful measures to ensure that your data are accurate, complete and, where necessary, kept up to date.
 
 JCDecaux agrees to obtain the consent of the data subjects whenever consent is required and to inform them of the processing of their data.
 
 We process personal data concerning you and which you have provided to us in the following contexts in particular:

• When you subscribe to one of our services (in particular, via offers to subscribe to our services such as our self-service bike services or free Wi-Fi);
• When you use our services;
• When you browse our websites;
• When you provide us with products or services;
• When you take part in events or public relations activities organised by JCDecaux;
• When you give your consent to receive our newsletters and other commercial information from us;
• When you wish to apply for a job offer at JCDecaux;
• When you wish to get in touch with us to ask us a question or make a complaint.

 In these contexts, JCDecaux may collect and process the following personal data:

• Your identity: surname, name, preferred form of address (Mr./Mrs./Ms.), date of birth, photocopy of your identity card whenever necessary, and your function;
• Your contact details: postal address, email, phone number;
• Your identifiers (when you create an account upon subscription to a service): subscriber number, secret code;
• Your transactions and payment information: details of the transaction, bank cheque, bank account information;
• Your job application information: CV, motivation letter, interview notes;
• Your technical and browsing information on our websites (please see section 8 below on cookies);
• Any other information you directly and voluntarily provide us with in the course of your use of our websites, services and any contracts you may enter into with us.

 The mandatory nature of any information to be completed by you is typically marked by an asterisk in the corresponding forms at the time such information is collected. Any failure to complete that information or any response JCDecaux considers abnormal may result in JCDecaux refusing to process your request.
 
 JCDecaux may ask you to provide certain personal data for direct marketing/communication purposes. You may give your free and explicit consent or not for the collection and processing of your personal data by ticking a consent box.
 
 You agree that the personal data you provide about yourself to JCDecaux will be current, accurate, complete and unequivocal.

Purposes of collection

JCDecaux agrees to collect and process your personal data lawfully and fairly.
 The processing implemented by JCDecaux pursues specified, explicit and legitimate purposes.
 Your data may be processed for the following purposes in particular:

• To allow you to subscribe to/access our services (management of your subscription request and account);

     In this context, the legal grounds for the processing is the performance of the contract between you and JCDecaux.

• To manage your subscription and your use of our services;

     In this context, the legal ground for the processing is the performance of the contract between you and JCDecaux.

• To process your transactions and your payments;

     In this context, the legal grounds for the processing is either the performance of the contract between you and JCDecaux when management of your transactions and payments is involved, or else compliance with legal requirements if JCDecaux implements anti-fraud measures.

• To manage the contractual relationship with our clients, service providers and partners (management of the contract, orders, deliveries, invoices, public relations, etc.);

     In this context, the legal grounds for the processing is the performance of the contract between you and JCDecaux.

• To send you commercial information about us;

     In this context, the processing is based on the legitimate interest of JCDecaux, and more specifically our financial interest in making you personalised offers, better understanding your needs and offering you adapted services.

• To analyse your browsing on our websites and improve the use of our websites (see section 8 below on cookies);

     In this context, the legal grounds for the processing is the legitimate interest of JCDecaux, and more specifically our financial interest in continually improving our websites and our services and in understanding your needs in order to be able to meet your expectations.

• To handle any questions or requests and deal with any complaints you may have;

     In this context, the legal grounds for the processing is either the performance of the contract if the request or complaint concerns the contractual relationship between you and JCDecaux, or else the legitimate interest of JCDecaux, and more specifically our financial interest in conducting clear communications with you and in understanding your needs and expectations.

• To handle your job application submitted online on one of our websites.

In this context, the legal grounds for the processing is the legitimate interest of JCDecaux, and more specifically our interest in responding to your job applications and finding suitable profiles for the positions available within JCDecaux.

Data recipients

JCDecaux only discloses your personal data to certain authorized recipients, in compliance with applicable rules.
 
 JCDecaux can provide access to your personal data to the companies in its group, to local government authorities or bodies, to its partners and to its possible third-party service providers, acting as processors, for the provision of services in connection with JCDecaux’s services and IT applications (such as hosting, storage, analytical, data processing, database management or IT maintenance services). These third-party providers will act only on the instructions of JCDecaux and will only have access to your personal data to achieve the purposes pursued upon collection of such data and shall be under the same security and confidentiality obligations as JCDecaux.
 
 JCDecaux agrees to obtain your prior consent, in particular via an opt-in mechanism (box to be ticked), before disclosing your data to partners for direct marketing purposes.
 
 In addition, your personal data may be disclosed on the following grounds:

• In the context of a merger or acquisition of all or part of JCDecaux by a third party, as hereby accepted by you;
• In response to legal or administrative proceedings of any kind or enforcement measures requested by the competent authorities;
• To comply with legal obligations, protect the rights and/or safety of an individual, protect the rights and property of JCDecaux, including the need to ensure that this Data Protection Policy is respected and to prevent any technical, security or fraud-related issues.

Data retention

 
 JCDecaux will keep your personal data for as long as necessary to achieve the purposes for which they are collected and processed. JCDecaux may, however, keep your personal data for a longer period whenever this a legal obligation for us or to take into account the applicable statute of limitation period to assert, exercise or defend legal claims.
 
 In defining an appropriate data retention period, JCDecaux relies in particular on the following criteria:

• Data on your subscription, payments and use of our services are kept for the entire period of your subscription / of the contractual relationship, and subsequently in accordance with applicable statute of limitation periods;
• Data on the management of the commercial relationship with our service providers and partners are kept for the entire period of the contractual relationship, and subsequently in accordance with applicable statute of limitation periods;
• When you agree to receive marketing communications, JCDecaux will keep your personal data until you indicate that you no longer wish to receive such communications, or otherwise for the period defined by applicable legislation;
• When your data are collected in the context of requests/queries relating to IT services and applications, JCDecaux will keep your data for the period necessary to process such requests or queries;
• Job application files can be kept up to two years from the date of last contact with the applicant, unless the applicant agrees to a longer period; in such case, the data can be archived in accordance with the applicable statute of limitation periods.

Cookies

 You are informed that, when browsing our websites, cookies can be placed on your web browser to enable you, in particular, to benefit from optimal browsing. Cookies are data stored on the terminal equipment of an Internet user. Our websites use cookies to send information to the user’s browser, enabling the browser to pass data back to the original website (for instance, a session ID, language preference or date). Other types of trackers, such as Web beacons, can also be used. These beacons make calls to servers to display a pixel and enable us to share data with third parties for the purposes described in our  Cookie Management Policy .

Security

 
 JCDecaux will ensure the security of your personal data through a data protection system that uses physical and logical security measures.

Data transfer

The subsidiaries, service providers or other third parties listed above to whom JCDecaux may disclose your personal data may be domiciled abroad, and in particular outside the European Union.
 
 In such case, JCDecaux shall require them to take, in accordance with applicable legislation, all organisational and technical measures to ensure an adequate level of protection of your personal data (in particular, by the use of Standard Contractual Clauses approved by the European Commission – of which you may obtain a copy, as applicable, upon request to:  protecciondedatos@jcdecaux.com).

Rights of data subjects

 
 Under applicable data protection legislation, you have certain rights regarding the collection and processing of your personal data, namely:

• A right to be informed: you have the right to be informed in a concise, transparent, intelligible and easily accessible form about the way in which your personal data are processed.
• A right of access: you have the right to obtain (i) confirmation as to whether personal data concerning you are processed or not and, if processed, to obtain (ii) access to such data and a copy thereof.
• A right to rectification: you have the right to obtain the rectification of any inaccurate personal data concerning you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• A right to erasure: in some cases, you have the right to obtain the erasure of personal data concerning you. However, this is not an absolute right and JCDecaux may have legal or legitimate grounds for keeping such data.
• A right to restriction of processing: in some cases, you have the right to obtain restriction of the processing of your personal data.
• A right to data portability: you have the right to receive the personal data concerning you which you have provided to JCDecaux, in a structured, commonly used and machine-readable format, and you have the right to communicate those data to another controller without hindrance from JCDecaux. This right only applies when the processing of your personal data is based on your consent or on a contract and such processing is carried out by automated means.
• A right to object to processing: you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you when such processing is based on the legitimate interest of JCDecaux. JCDecaux may, however, invoke compelling legitimate grounds for continued processing. When your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of such data. You may, in particular, exercise that right by clicking on the “unsubscribe” link provided at the bottom of any messages received.
• A right to lodge a complaint with the competent supervisory authority: you have the right to contact a supervisory authority (in France, the CNIL) to complain about JCDecaux’s personal data protection practices.
• A right to give instructions concerning the use of your data after your death (this right applies in France): you have the right to give JCDecaux instructions concerning the use of your personal data after your death.

 To exercise these rights, you can send a request to the following address: JCDecaux, Data Protection Resposible, Avenida de Aragón, 328 – 28022 Madrid, or an email to  protecciondedatos@jcdecaux.com, together with a copy of your identity document.

Changes to the policy

JCDecaux may update this Data Protection Policy at any time to reflect possible new practices and service offers. In such event, the date of the Data Protection Policy will be updated and the date when such changes were made will be indicated. We invite you to check for any possible updates of this Data Protection Policy, which will be published on the websites of JCDecaux. If JCDecaux makes any changes that it considers substantial, you will be informed by a notice posted on our websites.

Links to third-party websites

While browsing our websites, you may come across content containing links to third-party applications and websites. JCDecaux has no control over the cookies or other functions used by such third-party applications and websites, and any personal data processing that may be implemented by such applications and websites are not governed by this Data Protection Policy.
 
 Accordingly, it is up to you to directly contact and/or visit such third-party applications and websites to obtain further information on their data protection guidelines.

Contact us

If you would like more information about this Privacy and Personal Data Protection Policy, please contact:  protecciondedatos@jcdecaux.com.
 
 JCDecaux has also appointed a Data Protection Responsible, who can be contacted at: JCDecaux, Avenida de Aragón, 328 – 28022 - Madrid.

 This Policy may be updated at any time; so we advise you to check for updates from time to time.
 
 Latest update: 23 May 2018