Last updated: 01/12/2024
BU Invest attaches great importance to the protection and respect of the privacy and personal data (“Personal Data”) of the persons whose data it is required to collect as part of its activities (the “Person (s) concerned”) and of the users of the website. www.billup.com (hereinafter the “Site”).
BU Invest is committed to implementing adequate measures for the protection, confidentiality and security of personal data and to respecting this policy in accordance with the regulations in force in France and in the European Union, in particular the General Regulation on the Protection of Personal Data EU 2016/679 and the rules of national law adopted for its application.
BU Invest allows you to delete your personal data, simply write an email to dpo@billup.com by specifying your email.
This Policy (hereinafter the “Policy”) aims to inform Data Subjects of the practices and treatments inherent to the collection and use of Personal Data that BU Invest is required to perform as data controller and of the means at their disposal to control this use and exercise their rights relating to their Personal Data.
SECTION 1. PERSONAL DATA COLLECTED
BU Invest is likely to collect and process Personal Data provided in the context of meetings, or the processing of a file, whether provided orally, in paper or digital format, for example when visiting the premises of BU Invest, by telephone, by mail or when visiting the Site.
1.1. Principles applicable to the collection of Personal Data
BU Invest applies the principle of minimizing and protecting Personal Data from the moment of conception (“privacy by design”) and by default (“privacy by default”).
Only Personal Data that is relevant, adequate and limited to what is necessary for the purposes of the processing is collected, and in particular to the following purposes:
• processing requests that are entrusted to BU Invest by its customers;
• commercial prospecting;
• responding to inquiries;
• analysis of applications for job offers;
• sending informational or commercial emails;
• guarantee the access and navigation of users on the Site;
• participation in surveys or analyses to improve the relationship and the customer experience set up by BU Invest;
• improving the efficiency and functionality of the Site.
1.2. Personal data collected on the Site
Users can browse the Site without the need to communicate Personal Data concerning them.
However, users are required to provide personal information when necessary for the performance of certain services, in particular: filling out a contact form. In this case, the personal information of the users required is: Name (s), First name (s), Email address.
This Personal Data is then kept for the time necessary to fulfill the users' request.
In the absence of concrete implementation, they are deleted within the time recommended by the CNIL, i.e. after three years from their collection by the Site.
When using the Site, some user data is collected automatically: IP address, Reference of the browser software used, Navigation data (date, time, content consulted, search terms used, etc.), Operating system reference. Among the technologies used to collect this information, BU Invest may use “php” sessions that store each user's data using a unique session ID. These php sessions keep the data in memory only for the duration of navigation.
The data collected during the navigation of users on the Site is deleted when the user's browser closes, or, where applicable, within a maximum period of thirteen months from their collection.
SECTION 2. BASIS FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA
Personal data is processed by BU Invest in the cases authorized by the regulations in force, and in particular under the following conditions:
• The Data Subject has given free, specific, informed and unequivocal consent to the processing of his Personal Data (it is specified that for minors under 18 years of age, consent must be given by the legal representative); • The processing is necessary for the execution of a contract or pre-contractual measures at the request of the Data Subject;
• The processing is necessary for compliance with legal and/or regulatory obligations imposed on BU Invest (such as the fight against fraud);
• The processing is justified by the protection of legitimate interests of BU Invest (such as the protection of the security of its computer network).
SECTION 3. DURATION OF PRESERVATION OF PERSONAL DATA BU Invest keeps the Personal Data that it processes under the conditions detailed in this Policy for the time necessary to achieve the purposes pursued, subject to legal possibilities and obligations in terms of archiving, obligations to keep certain data and/or anonymization. Some Personal Data collected via the Site is kept for the period indicated in Article 1.2.
SECTION 4. RECIPIENTS OF THE PERSONAL DATA COLLECTED
The duly authorized staff of BU Invest may have access to the Personal Data collected and may be required to process them, without prejudice to their possible transmission to the bodies responsible for a control or inspection mission in accordance with the legislation and/or regulations in force or for the purposes of responding to a judicial or administrative decision.
Authorized personnel are subject to an obligation of discretion and confidentiality.
As part of its activities, BU Invest is likely to transmit the Personal Data collected to external service providers that it uses as part of its mission, in particular when organizing events. In these circumstances, BU Invest undertakes to use service providers offering sufficient guarantees as to the implementation of appropriate technical and organizational measures so that the processing meets the legal and regulatory requirements in force and guarantees the protection of the rights of the Persons Concerned.
SECTION 5. DATA TRANSFER
Personal Data collected from users of the Site is stored in France.
However, they can be transferred within or outside the European Union as part of BU Invest's activities. In the event of recourse to service providers located outside the European Union, BU Invest undertakes to verify that appropriate measures have been put in place so that the Personal Data of the Persons Concerned benefit from an adequate level of protection (in particular thanks to standard contractual clauses from the European Commission or even Internal Corporate Rules (“BCR”)).
SECTION 6. DATA SECURITY
BU Invest collects and processes users' Personal Data with the utmost confidentiality and in compliance with applicable laws. When the disclosure of Personal Data to third parties is necessary and authorized, BU Invest ensures that these third parties guarantee the Personal Data concerned the same level of protection as that offered to them by BU Invest, and requires contractual guarantees so that, in particular, the Personal Data is processed exclusively for the purposes accepted by the Data Subject, with the required confidentiality and security.
BU Invest puts in place technical and organizational measures to ensure that the storage of Personal Data is secure for the period necessary to exercise the purposes pursued in accordance with applicable law. The attention of the Persons Concerned is drawn to the fact that no transmission or storage technology is completely infallible.
Also, and in accordance with the applicable regulations, in the event of a proven breach of Personal Data likely to generate a high risk for the rights and freedoms of Data Subjects, BU Invest will communicate this violation to the competent supervisory authority and to the Persons Concerned when required by said regulation, and in accordance with the procedures provided for. It is the responsibility of the Persons Concerned to exercise caution to prevent any unauthorized access to their Personal Data and in particular to their computer and digital terminals (computer, smartphone, tablet).
SECTION 7. USER RIGHTS
It is recalled that the Data Subjects have the following rights, subject to the limitations provided for by the legislation and/or regulations in force:
7.1. Right to information on the processing of Personal Data
BU Invest is committed to making its best efforts to provide concise, transparent and accessible information on the conditions for processing the Personal Data of Data Subjects.
7.2. Right to access Personal Data Each Data Subject has the right to obtain confirmation that Personal Data concerning him or her is being processed by BU Invest and to receive a copy in electronic form (for any additional copy, BU Invest will be entitled to require the payment of fees based on the administrative costs incurred).
7.3. Right to erasure (“right to be forgotten”) and to rectify Personal Data Each Data Subject has the right to request the deletion of Personal Data concerning him or her, and the right to request the correction of Personal Data concerning him or her when they are erroneous or obsolete. BU Invest undertakes to ensure compliance with this right as soon as possible and by default within 30 days from the request made to it in sufficiently clear and unequivocal terms. It is specified that BU Invest may keep certain Personal Data when required to do so by law or in case of legitimate reason.
7.4. Right to object Data Subjects may object at any time and for reasons relating to their particular situation or for legitimate reasons to the processing of Personal Data concerning them for direct marketing purposes or to the reuse of Personal Data concerning them for different treatments, except in the event of the execution by BU Invest of one of its legal obligations.
7.5. Right to limit the processing of Personal Data
Data Subjects have the right to request the limitation of the processing carried out on Personal Data concerning them. This right is applicable only: • if the Data Subject disputes the accuracy of his Personal Data; • if the Data Subject can establish that the processing of Personal Data concerning him or her is unlawful and requests a limitation of their use rather than an erasure; • if BU Invest no longer needs the Personal Data relating to the Data Subject but that these are still necessary for the Data Subject to the establishment, exercise or defense of legal claims; • if the Data Subject no longer needs the Personal Data concerning the Data Subject but that these are still necessary for the Data Subject for the establishment, exercise or defense of legal claims; • if the Data Subject no longer needs the Personal Data concerning the Data Subject; • if the Data Subject no longer needs the Personal Data concerning the Data Subject; is opposed to processing that would be based on the legitimate interest of the data controller, during the verification of whether the legitimate reasons pursued by the data controller prevail over those of the Data Subject.
7.6. Right to file a complaint with a supervisory authority
If they consider that the efforts made by BU Invest to preserve the confidentiality of Personal Data do not guarantee the respect of their rights, Data Subjects have the possibility of filing a complaint with the competent supervisory authority: in France, the CNIL via the internet https://www.cnil.fr/fr/plaintes or by post to the following address: 3 place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 or by - Telephone: +33 (0) 1 53 73 22 22 22).
7.7. Right to the portability of Personal Data Data Subjects have a right to the portability of their data, authorizing them to obtain from BU Invest the Personal Data concerning them in a structured, commonly used and machine-readable format and to request that this Personal Data be transmitted to another data controller.
7.8. Right to decide the fate of Personal Data after death
Data Subjects have the right to organize the fate of Personal Data concerning them after their death by adopting general or specific guidelines that BU Invest undertakes to respect. In the absence of such guidelines, BU Invest recognizes the possibility for heirs to exercise certain rights, in particular the right of access if necessary for the settlement of the deceased's estate and the right to object.
7.9. Conditions for exercising rights
To exercise their rights, Data Subjects are invited to contact the BU Invest Personal Data Protection Officer in accordance with the procedures described in article 9. It is specified that to help them exercise their rights, the CNIL provides them with letter templates on its website (https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles ). Before processing the request (s) of the Persons Concerned, BU Invest may verify the identity of the Persons Concerned by asking them for proof of identity. The Personal Data Protection Officer will respond to the request as soon as possible and in any event within one (1) month from the proof of identity to respond to it. If necessary, this period may be extended by two (2) months taking into account the complexity and number of requests sent to BU Invest, the organization then undertaking to inform the Data Subject of the extension and the reasons for the delay.
SECTION 8. MODIFICATION OF THE PERSONAL DATA PROTECTION POLICY
BU Invest reserves the right to make changes to this Personal Data Protection Policy at any time in order to comply with legislative and regulatory developments and/or to improve its Personal Data processing and protection policy. In case of modification, a new version will be updated and put online with the “Last Updated” date.
SECTION 9. CONTACT
For any question relating to this Policy in order to rectify, supplement or update, the Persons Concerned are invited to contact BU Invest:
• by sending an email to the address dpo@billup.com ;
• or by sending a letter to the following address: BU Invest - For the attention of the Data Protection Officer - 386 Route de Chavanne - 74940 Annecy.
