Data Protection policy
This information notice (hereinafter the “Policy”) describes how IER SAS, whose registered office is located at 3, rue Salomon de Rothschild, 92150 Suresnes, France (“IER” or “we”), collects and uses the personal data entrusted to it in its capacity as data controller.
This Policy applies to you if you are:
- A user of this website or of any website published by IER; and/or
- A representative (employee, officer, agent, etc.) of a current or prospective corporate customer; and/or
- A representative (employee, officer, agent, etc.) of a service provider or supplier; and/or
- A journalist, or a representative of a public authority, administration or any other third party interacting with IER,
(hereinafter collectively referred to as “you”).
This Policy does not apply to the collection and use of data relating to IER’s staff members, whether employees or non‑employees, nor to job applicants seeking a position within IER, who are provided with a separate information notice.
Who are your personal data disclosed to?
The personal data we collect are intended to be used by authorized IER personnel who need to access them on a need to know basis, depending on the reason why you have entered into contact with IER. However, such data will also be made accessible to our technical service providers (“processors” within the meaning of the applicable data protection legislation), strictly to the extent necessary for, and within the limits of, the tasks entrusted to them (in particular IT service providers).
Some of your personal data may also be disclosed to third parties who may use them for their own purposes, where this is necessary in light of the reason for which you have entered into contact with IER :
- institutional or commercial partners in connection with the management of IER’s activities;
- public bodies and administrations that are legally authorized to receive certain personal data;
- representatives acting on our behalf for the management of a dispute or case (such as lawyers, bailiffs or other legal representatives);
- statutory auditors, chartered accountants and external auditors;
- in the event that our company or all or part of its assets are acquired by a third party, your personal data may be made accessible to any person involved in the preparation and completion of the transaction and included among the transferred assets.
Where such recipients are located in non European countries that do not benefit from an adequacy decision issued by the European Commission, any transfer of data (limited to the personal data strictly necessary) is governed by the execution of Standard Contractual Clauses with the relevant recipient, a copy of which can be obtained by contacting: dpd@ier.fr.
How do we use your personal data?
We may collect your personal data on various occasions, in the course of our activities, depending on the reason why you have entered into contact with IER, as described in the table below.
| Purpose | Legal bases | Retention period |
|---|---|---|
| – Monitoring and management of IER’s activities – Management of our relationship within the framework of the agreement binding you, or the person you represent, to IER (performance and monitoring of our services, management of our relationships with suppliers and service providers, invoicing, management of unpaid invoices and debt recovery, etc.) | Performance of a contract to which you are a party; Our legitimate interest in performing a contract to which a third party (such as your employer) is a party, or in taking pre contractual steps at the request of a third party (such as a request for information or for the issuance of a quotation on behalf of your employer) | 2 years after the end of our relationship. |
| – Continuous improvement of our products and services | Our legitimate interest (to carry out our activities, improve our services and ensure our security), unless you object, which you may do at any time and by any means. | 10 years after our last contact |
– Provision of our products and services – Improvement of customer knowledge – Monitoring of the customer relationship and customer loyalty activities (including, in particular, the need for a better understanding of the individuals with whom we interact, as well as the sending of messages regarding our latest news and updates) – Responding to calls for tenders issued by potential customers – Preparation of statistics – Creation and management of relevant contact lists – Management of the IT security of our premises and of our website- | Our legitimate interest (to carry out our activities, improve our services and ensure our security), unless you object, which you may do at any time and by any means. | 3 years after your last contact with us |
| Management of disputes involving IER | Our legitimate interest in ensuring the establishment, exercise or defence of legal claims. | For the duration of the proceedings (until all avenues of appeal have been exhausted). |
| Compliance with our legal, accounting and tax data‑retention obligations | Our legal obligations | For the duration of the required retention period |
| Handling your requests to exercise your personal data rights | Our legal obligations | 6 months after our last interactions |
At the end of the retention periods set out in the table above, your data will, where necessary, be archived for a period not exceeding the applicable statutory limitation periods, mandatory archiving requirements, or the duration of legal proceedings in the event of a dispute. Once these periods have expired, the data will be destroyed.
What personal data do we collect?
In addition to the data that we collect directly from you, we may, depending on your situation, collect certain information about you indirectly (for example, if your data are provided to us by one of your colleagues). In such cases, we may collect the following categories of data:
- Identification and contact details, information about your employer and your role, as well as your communication preferences with us;
- Business information;
- Profile and usage data, including passwords for platforms or password‑protected services to which IER may have granted you access;
- Technical data, including information collected during your visits to our website, such as your IP address and log‑in data. Our website also uses cookies strictly necessary for its proper functioning and use (language‑preference cookies and audience‑measurement cookies exempt from consent, in accordance with CNIL guidance). These cookies do not require your consent and you cannot object to their use, except by changing your browser settings. However, you are informed that doing so may prevent the website from functioning properly.
Where certain personal data are necessary for us to perform a contract to which the person you represent is a party, or to comply with a regulatory obligation, we will inform you of this at the time of collection.
What are your rights over your personal data and how can you exercise them?
You have the following rights with respect to our use of your personal data:
- to obtain confirmation as to whether or not personal data concerning you are being processed and, where they are, access to such data and to information relating to their processing;
- to obtain the rectification of inaccurate data;
- in certain specific cases, to obtain the erasure of some of your data;
- in certain specific cases, to obtain the restriction of the processing we carry out;
- to object to the processing of your data, on grounds relating to your particular situation, or, irrespective of your particular situation, to object to the use of your data for direct marketing purposes;
- to withdraw your consent at any time for the future, where consent is the legal basis for the processing of your data;
- to receive the data you have provided to us and/or to request that we transmit them to another data controller, where the processing is based on your consent or on a contract and the processing is carried out by automated means (right to data portability);
- if you reside in France, to define directives regarding the fate of your personal data after your death.
To exercise your rights, you simply need to send your request to: dpd@ier.fr. We encourage you to include with your request any document that may help verify your identity and substantiate the reasons supporting your request.
If, after contacting us at dpd@ier.fr, you still encounter an unresolved issue relating to the use of your personal data, you may lodge a complaint with the CNIL (the French data protection authority).