Private Policy

NICOLS takes the respect of privacy and the protection of personal data very seriously and undertakes to implement appropriate measures to ensure the protection of personal data and to process and use such data in compliance with the applicable provisions and in particular European Regulation 2016/679 of 27 April 2016, known as the “General Data Protection Regulation” (hereinafter the GDPR) and law no. 78-17 of 6 January 1978 known as the Data Protection Act.


I. Data controller

Your data is collected by:

A simplified joint-stock company with capital of €152,000.
Registered in the ANGERS Trade and Companies Register (RCS) under number 338 576 374
Whose registered office is at CHOLET (49300) – Route de Cholet – Le Puy-Saint-Bonnet
Acting as Data Controller in accordance with the definition provided in Article 24 of the GDPR



II. Identification of the data collected, purpose and use of the data processed

NICOLS, as Data Controller, collects, consults, uses, modifies, stores, transmits and erases Personal Data (hereinafter the “Data”) in the context of its commercial and contractual activities.

In accordance with Article 4 of the GDPR, the terms “Data” or “Personal Data” refer to any information relating to an identified or identifiable natural person (hereinafter referred to as “Data Subject”); an “identifiable natural person” is a natural person who can be identified, directly or indirectly, in particular by referring to an identifier such as a name or identification number, location data, an online username, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.


Most of this data is collected directly from the Data Subject, when they:


Within the framework of the data collection activities mentioned above, NICOLS collects the following data:


In order to better understand the data processing carried out by NICOLS, we inform the Data Subject that NICOLS may process their data for the following purposes: 

Processing related to management:


Processing related to customer relationship management:


Processing related to commercial prospecting and in particular:

Complaint management processing:


Processing related to the management of commercial activity:



III. Hosting of Data

The Personal Data collected and processed by NICOLS is hosted in the European Union. 



IV. Destination of data collected

The data collected is processed only in the European Union.



V. Conservation of data

Data is stored for a period appropriate to the purposes of the processing and in accordance with the legislation and regulations in force.

Customer data is retained during the contractual relationship, and may be retained for ten (10) years after the termination of the contractual relationship to meet accounting and tax obligations. 

Individual prospect data may be retained for up to three (3) years after the last contact from the prospect. 



VI. Exercise of rights

If your personal data is being processed, you are the ‘data subject’ in terms of GDPR and you have the following rights towards the controller:


You may ask the controller to confirm whether your personal data is processed. In the case of such processing, you may request the following information from the controller:

As a data subject, you have the right to be informed whether the personal data concerning you are transferred to a third country or to an international organization. In this regard, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.


2) Right to rectification

You have the right to have corrected and/or completed your personal data from the controller if your personal data processed is incorrect or incomplete. The controller has to make the correction without delay.



You have the right to obtain from the controller restriction of processing where one of the following applies:

If the restriction of processing has been restricted in accordance with the conditions mentioned above, you will be informed by the controller before the restriction of processing is lifted.



a) Obligation regarding erasure

You have the right to obtain from the controller the erasure of your personal data immediately and the controller is obliged to erase this data without delay where one of the following reasons applies:


b) Obligation to inform other controllers (third parties)
If the controller has made your personal data public and is obliged to erase them accordance to Article 17 (1) of the GDPR, he has to take reasonable steps, taking into account the available technology and the cost of implementation, including technical measures, to inform the controllers who process the personal data that you, as the person concerned, have requested the erasure of any links to, or copy or replication of those personal data.


c) Exceptions
The right to erasure does not apply to the extent that processing is necessary:




If you have made use of your right to correct, erase or restrict the processing of your personal data, the controller is obliged to inform all recipients to whom the personal data have been disclosed of this correction or erasure of the data or limitation of the processing, unless this proves to be impossible or involves a disproportionate effort.
You have the right to be informed of these recipients by the controller.



You have the right to receive the personal data relating to you which you have provided to the data controller, in a structured, commonly used and machine-readable format. In addition, you have the right to transmit this data to another controller without hindrance by the controller, who has been provided with the personal data, where:



For reasons arising from your particular situation, you have the right to object at any time to processing of personal data concerning you, which is carried out based on point (e) or (f) of Article 6 (1); this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you, unless the controller can prove that there are compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or the processing serves to establish, exercise or defend legal claims.

Where the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing; this also applies to profiling, insofar as it is related to such direct marketing.
Where you object to the processing for the purposes of direct marketing, the personal data concerning you will no longer be processed for these purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the possibility of exercising your right to object by automated means using technical specifications.



You have the right to withdraw your declaration of consent under Data Protection Act at any time. The withdrawal of the consent does not affect the legality of the processing carried out on the basis of the consent until the withdrawal.



You have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effect on you or which significantly impairs you in a similar manner. This does not apply if the decision:

However, these decisions may not be based on special categories of personal data in accordance with Article 9 (1), unless point (a) or (g) of Article 9 (2) applies and appropriate measures to safeguard the rights and freedoms and your legitimate interests are in place. Regarding the cases referred to in (1) and (3), the data controller has to take appropriate measures to safeguard the rights and freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the data controller, to state his or her own position and to contest the decision.



Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes this Regulation.

The supervisory authority with which the complaint has been lodged is to inform the complainant on the progress and the outcome of the complaint including the possibility of judicial remedy accordance to Article 78.


In accordance with the General Data Protection Regulation 2016/679 of 27 April 2016, each person has a right of access, rectification, erasure and portability of his/her Personal Data, and a right to limit and object to the processing of such data. 


These rights may be exercised by contacting us at the following address: 

Les personnes disposent également du droit d’introduire une réclamation auprès de la CNIL. 

Individuals also have the right to lodge a complaint with the CNIL (French Data Protection Authority). 


In accordance with law no. 2016-1321 of 7 October 2016, individuals who so wish are able to decide what happens to their data after their death. For more information on the subject: