Personal Data

When you access and use the services offered by the website http://labelisation.cartes-bancaires.com/ (hereinafter the “Site”), we, the Groupement des Cartes Bancaires CB, process your Personal Data as described in this privacy policy (hereinafter “the Policy”). Your Personal Data is processed in accordance with applicable French and European regulations, in particular Regulation (EU) 2016/679 on the protection of Personal Data (hereinafter the “GDPR”).

 

The terms “personal data” (hereinafter “Personal Data”), “Processing”, “Data Controller”, “Processor”, “Recipient” and “Consent” used in this Policy refer to the terms defined in Article 4 of the GDPR. All of these definitions are reproduced in the appendix to this Policy.

 

1 - Why we process your Personal Data:

We process Personal Data concerning you for the following reasons (in accordance with Article 6 of the GDPR, we indicate in parentheses the legal basis on which we rely to process your Personal Data):

  • To ensure the operation and security of the Site (performance of the Terms of Use);
  • To carry out the referencing and labeling of stakeholders involved in the technical organization of CB payment card acceptance (performance of the contract).

Information relating to acceptance professionals who have chosen labeling is published on the Site only to promote the list of CB-labeled acceptance professionals. It is not collected via the Site but through the labeling process managed separately.

 

 

2 - How long we retain your Personal Data:

The Personal Data we process is retained for the following periods:

  • Operation and security of the site: Retention period: 1 year.
  • Referencing and labeling of stakeholders involved in the technical organization of CB payment card acceptance: Retention period: 2 years (1 year for the lifetime of the referencing, plus one additional year to allow the stakeholder to re-register without re-entering all their data if no update is required).

 

3 - Recipients of your Personal Data:

We do not sell your Personal Data and only disclose it to technical service providers acting as Processors in:

  • the distribution and operation of the Site;
  • the development, maintenance and hosting of the Site;

Through our contracts, we ensure that these technical service providers comply with applicable French and European regulations protecting Personal Data.

We do not transfer your Personal Data outside the European Economic Area, and we ensure through our contracts that our technical service providers do the same.

 

4 - Transparency and management of your Personal Data:

We do everything we can to be transparent and allow you to control and manage your Personal Data. At any time, you may:

You may exercise your rights by emailing our Data Protection Officer at protegezvosdonnees@cartes-bancaires.com, enclosing a copy of both sides of your ID document with your request.

If, after contacting us, you believe your rights are not being respected, you may file a complaint online with the Commission Nationale de l’Informatique et des Libertés (CNIL) or by post.

 

5 - Use of cookies:

The Site uses various cookies to improve the interactivity of the Site and the services offered.

 

What is a “cookie”?

 

A “cookie” is a limited-size file, generally made up of letters and numbers, sent by the web server to the cookie file in a site user’s browser and stored on their device. Cookies allow the site visited to collect information about a user’s visit, such as their browsing path or preferred language, in order to improve their browsing experience as well as the content and features of the website.

The Site uses the following cookies:

  • has_js - technical cookie used by the Drupal CMS to detect the presence of javascript. Validity period: duration of the session
  • Drupal.tableDrag.showWeight - technical cookie used by the Drupal CMS to manage tables. Validity period: 1 year
  • SESS<32-character identifier> - technical cookie used by the Drupal CMS to associate an authenticated user with a browsing session, so that their identity is retained while navigating between the site’s different pages. Validity period: 23 days.

 

These cookies are essential for the proper functioning of the Site and cannot be disabled on our systems.

You can configure your browser to block or be alerted to the use of these cookies. However, if this category of cookies - which does not store any personal data - is blocked, some parts of the site may not work.

 

As an example, the following links, as of 27 January 2021, show how to manage cookies on the most common browsers:

 

To answer any questions you may have regarding the protection of Personal Data processed during your visit to our site, we have appointed a Data Protection Officer whom you can contact by email at protegezvosdonnees@cartes-bancaires.com.

 

Last updated: 27/01/2021

 

Appendix: Reproduction of definitions from Article 4 of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

For the purposes of this Regulation, the following definitions apply:

  • “personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  • “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
  • “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
  • “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
  • “recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
  • “consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.