II. Identification of the data collected, purpose and use of the data processed
NICOLS, as Data Controller, collects, consults, uses, modifies, stores, transmits and erases Personal Data (hereinafter the “Data”) in the context of its commercial and contractual activities.
In accordance with Article 4 of the GDPR, the terms “Data” or “Personal Data” refer to any information relating to an identified or identifiable natural person (hereinafter referred to as “Data Subject”); an “identifiable natural person” is a natural person who can be identified, directly or indirectly, in particular by referring to an identifier such as a name or identification number, location data, an online username, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
Most of this data is collected directly from the Data Subject, when they:
- Create an account on the NICOLS site
- Make an enquiry on the NICOLS sitePlace an order on the NICOLS site
- Browse the NICOLS website and/or consult the products
- Participate in a game or contest
- Contact Customer Service
- Write a visible opinion/comment on the NICOLS site
Within the framework of the data collection activities mentioned above, NICOLS collects the following data:
- Identity data
- Contact data
- Invoicing data and payment terms
- The history of the contractual relationship
- A copy of the correspondence between the Data Subject and the reservation centre,
- If applicable, responses to surveys and questionnaires and comments/opinions,
- Technical information related to web browsing (e.g. IP address).
In order to better understand the data processing carried out by NICOLS, we inform the Data Subject that NICOLS may process their data for the following purposes:
Processing related to management:
- Contracts and customer accounts
- Invoicing and recovery
Processing related to customer relationship management:
- Managing people’s opinions on products, services or content
- Customer relationship monitoring such as satisfaction surveys
- The management of the loyalty programme within a legal entity or several legal entities
- Selecting customers and users to carry out loyalty-building and product testing actions
Processing related to commercial prospecting and in particular:
- The selection of people to carry out prospecting activities
- Conducting solicitation operations
- The organisation of competitions, or any promotional operation.
Complaint management processing:
Managing complaints and after-sales service
- Processing of requests regarding rights of access, rectification, opposition, deletion, etc.
- Litigation management.
Processing related to the management of commercial activity:
- The selection of people to carry out studies and/or surveys
- The development of business statistics
VI. Exercise of rights
If personal data obtained from you is processed, you are affected within the meaning of the RGPD and have the following rights vis-à-vis the person responsible.
1) Right of access
If personal data concerning you is processed by us, you may request confirmation thereof from the person responsible. If such processing is carried out, you may request access to the following information:
The purposes for which personal data is processed;
The categories of personal data processed;
The recipients or categories of recipients to whom personal data concerning you has been or is being disclosed;
The existence of a right to rectify or erase personal data concerning you, a right to restrict processing by the controller or a right to object to such processing;
The existence of a right of recourse to a supervisory authority;
All available information as to the origin of the data, if the personal data has not been collected from the data subject;
The existence of an automated decision-making system including profiling in accordance with art. 22, paras. 1 and 4 of the GDPR and - at least if applicable - evidentiary information as to the logic involved as well as the scope and expected effects of such processing for the data subject.
You are entitled to demand related information, if your personal data is transferred to a third country or an international organization. In this context, you may demand to be informed of the appropriate safeguards with regard to the transmission in accordance with art. 46 of the GDPR.
2) Right of rectification
You have the right to rectify and/or add to any personal data processed about you that is incorrect or incomplete. The data controller is obliged to rectify the data immediately.
3) Right to restrict processing
You have the right to request the restriction of the processing of your personal data under the following conditions:
If you dispute the accuracy of your personal data, for a period of time that allows the data controller to verify the accuracy of the data;
If the processing is unlawful and you object to the erasure of your personal data and instead request that their use be restricted;
If the controller no longer needs the personal data for processing purposes, but they are necessary for you to establish, exercise or defend a legal claim, or
If you have objected to the processing in accordance with art. 21 para. 1 of the RGPD and if it has not yet been established that the legitimate motives of the responsible party prevail over your motives. If the processing of your personal data has been restricted, such data may only be processed with your consent - except as regards its retention - or for the establishment, exercise or defence of legal claims, in order to protect the rights of another natural or legal person or for important public interest reasons within the union or a member state.
If the processing has been restricted in accordance with the above conditions, the responsible party will inform you prior to the lifting of the said restriction.
4) Right to erasure
a) Obligation to erase
You have the right to demand that the controller immediately erase your personal data, and the controller is obliged to do so, if one of the following reasons applies:
Your personal data is no longer required for the purposes for which it was collected or processed in any other way.
You revoke your consent on which the processing was based in accordance with Art. 6, para. 1, let. A or art. 9, para. 2, let. A of the RGPD and the said processing is devoid of any other legal basis.
You object to the processing in accordance with art. 21, para. 1 of the RGPD and there are no compelling and legitimate grounds for carrying out the said processing or you object to the processing in accordance with art. 21, para. 2 of the RGPD.
Your personal data has been processed unlawfully.
The erasure of your personal data is required to comply with a legal obligation under the law of the Union or the law of the Member States to which the controller is subject.
Your personal data has been collected in accordance with art. 8, para. 1 of the RGPD with regard to information society services.
b) Information to third parties
If the controller has made your personal data public and is required to erase it in accordance with art. 17, para. 1 of the GDPR, then it shall take all appropriate measures, even of a technical nature taking into account the available technology and the costs of implementation, in order to inform those responsible for processing the personal data of the fact that you, as the data subject, have required them to erase all links to such personal data or copies or replications of such data.
c) Exceptions
The right to erasure does not apply insofar as processing is required:
to exercise the right to freedom of expression and information;
to comply with a legal obligation requiring processing in accordance with Union law or the law of the Member States to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority delegated to the controller;
for reasons of public interest in the field of public health in accordance with art. 9, para. 2, let. H and i and art. 9, para. 3 of the RGPD;
For archiving in the public interest, for the purposes of scientific or historical research or for statistical purposes in accordance with art. 89, para. 1 of the RGPD, insofar as the right referred to in paragraph a) renders the achievement of the purposes of such processing probably impossible or seriously compromises it, or
For the establishment, exercise or defense of legal claims.
5) Right to information
If you have asserted your right to rectification, erasure or restriction of data processing vis-à-vis the data controller, the latter is obliged to inform all recipients to whom your personal data have been disclosed of such rectification, erasure or restriction of data processing, unless this proves impossible or involves a disproportionate effort.
You are entitled to obtain information on such recipients from the data controller.
6) Right to data portability
You have the right to obtain from the data controller the personal data concerning you that you have made available to the controller, in a structured, common and machine-readable format. You also have the right to transfer this data to another data controller without being prevented from doing so by the data controller to whom the personal data has been made available, provided that:
Processing is based on consent in accordance with art. 6, para. 1, let. A) or art. 9, para. 2, let. A) of the GDPR or on the basis of a contract in accordance with art. 6, para. 1, let. B) of the RGPD
Processing is carried out using an automated procedure. As part of exercising this right, you may also obtain that your personal data be directly transferred from one controller to another, insofar as this is technically feasible and does not infringe the rights and freedoms of other persons. The right to data portability does not apply to the processing of personal data required to perform a task in the public interest or in the exercise of public authority delegated to the data controller.
7) Right to object
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you carried out pursuant to Art. 6, para. 1, let. E or f of the GDPR; this also applies to profiling based on these provisions.
The controller will no longer process your personal data unless it can justify the processing on compelling legitimate grounds overriding your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defense of legal claims. If your personal data is processed for use in direct advertising, you have the right to object at any time to the processing of such data for the purposes of such advertising; this also applies to profiling insofar as it is carried out in connection with such advertising.
If you object to the processing for the purposes of direct advertising, your personal data will no longer be processed for these purposes.
Within the framework of the use of information society services - notwithstanding directive 2002/58/ec - you have the possibility of exercising your right to object by means of automated procedures based on technical specifications.
8) Right to revoke data protection declaration of consent
You have the right to revoke your data protection declaration of consent at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of that consent until the revocation.
9) Automated decision on a case-by-case basis including profiling
You have the right not to be subject to a decision resulting exclusively from automated processing - including profiling - which has legal effects on you or affects you in a similar way. This does not apply if the decision:
is required for the conclusion or performance of a contract between you and the controller,
is lawful according to the legal requirements of the Union or the Member States to which the controller is subject and if these legal requirements contain appropriate measures to safeguard your rights and freedoms and your legitimate interests or
is taken with your express consent. Such decisions must not, however, be based on particular categories of personal data in accordance with Art. 9, para. 1 of the GDPR, unless Art. 9, para. 2, let. A or g applies and appropriate measures have been taken in order to protect the rights and freedoms as well as your legitimate interests.
Concerning the cases mentioned in (1) and (3), the responsible party shall take appropriate measures in order to preserve the rights and freedoms as well as your legitimate interests, in particular the right to obtain from the responsible party the intervention of a person, heard on the presentation of his own point of view and on the contestation of the decision.
10) Right of recourse to a supervisory authority
Without prejudice to any other administrative or judicial recourse, you have the right of recourse to a supervisory authority, in particular on the territory of the member state where your place of residence, your place of work or the place of the alleged infringement is located, if you consider that the processing of personal data concerning you contravenes the RGPD.
The supervisory authority with which the appeal has been lodged, notifies the applicant of the progress and outcome of the appeal, including the possibility of a judicial remedy under Art. 78 of the RGPD.
In accordance with the General Data Protection Regulation 2016/679 of April 27, 2016, each person has a right of access, rectification, erasure and portability of their Personal Data, and a right to limit and object to the processing of such data.
These rights may be exercised by contacting us at the following address:
BY MAIL: NICOLS, Route de Cholet, 49300 Le Puy-Saint-Bonnet.
BY EMAIL: nicols@nicols.com
Individuals also have the right to lodge a complaint with the CNIL.
In addition, and since the law n°2016-1321 of October 7, 2016, people who so wish, have the possibility of organizing the fate of their data after their death. For more information on the subject: https://www.cnil.fr/.
