Data protection policy

Users of this website may communicate their personal data to GRTgaz, its publisher, using the various data collection media, tools and services provided (hereinafter, “you” or “your Personal Data”). 

The Personal Data collected may be subject to automated or non-automated processing, in accordance with the provisions relating to the protection of personal data, including the General Data Protection Regulation (GDPR) applicable as of 25 May 2018 and in the terms and conditions attached to each data collection tool, as well as this Policy.

By “Personal Data”, we mean all information about a person by which they may be identified. This does not include data for which the identity has been deleted (anonymized data).

GRTgaz collects the following categories of Personal Data, for the purposes described below in Our Policy:

1. your identity;
2. your Faro ID;
3. information filled out in data collection forms, questionnaires, and information requests;
4. your image or your voice if you use GRTgaz tools that can record you and which you consent to being published on the website;
5. information that you communicate publicly on our social networks or our Websites, e.g. to state your opinion;
6. when you use our Websites: information on your browser, you browsing behaviour, the type of device that you are using (smartphone, computer, tablet, etc.), your device’s operating system, your internet service provider, your device’s IP address, the geolocation of your device;
7. when you use our mobile applications: We may collect data relating to your GPS location, with your consent if this is necessary, as well as the frequency with which you use the application. We also collect information about the browser that you use and your browsing behaviour.

Your Personal Data are processed for the purposes described below:

We only communicate or share your Personal Data in the following cases:

• with subcontractors acting on our behalf: e.g. technical service providers responsible for sending emails for Us or hosting our website. We may also share information concerning you with suppliers that help Us with the operation of our Websites;
• with certain commercial partners, provided that you give your consent: e.g. We share your Personal Data with third parties with which we are the joint organisers of an event;
• with a third-party as part of company restructuring or reorganisation, including wind-up, liquidation or any transfer including disposal or merger; 
• with GRTgaz employees authorised due to their role and bound by an obligation of confidentiality;
• when We are legally obliged to do so to comply with an applicable law, to respond to a judicial ruling, or more generally to satisfy the request of an authority.

Third parties with which We share Your Personal Data are legally and contractually limited to using this Personal Data for the purposes identified by Us. We do our utmost to ensure that the third parties with which We share Your Personal Data are subject to obligations of confidentiality and security that comply with this Policy and the GDPR. We only allow them to process your Personal Data for specific purposes and in compliance with our instructions.

Except for those instances specifically mentioned above, We shall not share, sell or rent your Personal Data to a third party without informing you beforehand and/or obtaining your consent. If you have given Us your consent to use your Personal Data in a specific way, but subsequently change your mind, you should contact Us and We will desist from doing so.

When viewing our Website, information about your browsing may be recorded in “Cookie” files installed on your device (computer, tablet, smartphone, etc.), according to the cookie preferences that you express and which can be changed at any time.

To find out more about our Website’s cookies policy, please see the dedicated page: information about cookies.

Your Personal Data that We collect may be transferred and processed in a country or region where GRTgaz operates, which may be outside of the European Union. 

When we transfer your Personal Data to countries/regions located outside of the European Union, We ensure a level of protection that is suitable for the information being transferred to the third-party countries/regions by transferring your Personal Data in countries/regions that are subject to an “adequacy” finding by the European Commission within the meaning of Article 45 of the GDPR. Data transfer agreements are drawn up with recipients based on contractual clauses of a type approved by the European Commission or any other applicable transfer mechanism that may be available (e.g. BCR).

Your Personal Data are only stored, in a format that allows for you to be identified, for a length of time that is reasonably necessary to achieve the purpose described above, or the length of time permitted by law. 

To determine the length of time appropriate to the storage of Personal Data, We consider the quantity, type and sensitivity of this Personal Data, the potential risk and harm resulting from its use or unauthorised disclosure, the purposes for which we are processing the Personal Data, and the possibility of achieving these purposes by other means, as well as the requirements of applicable legal provisions.

We store Personal Data for the following periods: 

• claims, questions, complaints: 3 years following the closure of a claim, question or complaint,
• contact form: 3 years from the date of your request,
• newsletter subscription: when the data subject unsubscribes,
• Website browsing: see the durations relating to cookies.

Once the fixed deadlines are passed, the Personal Data are either deleted or stored after being anonymized, in particular for statistical uses. These data can be stored in the event of litigation or pre-litigation. Users are reminded that deletion and anonymization are irreversible operations, and GRTgaz is unable to restore these data afterwards.

You have various rights as a data subject. These rights are not absolute, and each is subject to certain conditions under the GDPR and applicable domestic laws.

The right to access

You can request to access your data being held by Us. In this case, We will provide you with the information required by law according to the processing purposes, the category of data processed, the category of recipient(s), the length of data storage, etc.

The right to portability

You can also obtain a copy of all your information being held by Us, in a compatible format whose structure allows you to exercise your right of data portability, for data processing based on your consent or the performance of a contract between GRTgaz and you, or where the processing is carried out by automated means. 

The right to rectification

You can request that measures are taken to correct your Personal Data if it is inaccurate or incomplete (e.g. if We have the wrong name or wrong address).

Right to deletion

You can request the deletion of your Personal Data if (i) these data are no longer necessary for the envisaged purpose; (ii) you have withdrawn your consent under conditions where the processing in question required your consent; (iii) you object to the processing; (iv) the data processing is illegal; (v) the information must be deleted in application of legal obligations applicable to GRTgaz. 

The right to restrict data processing

You can request that the processing is restricted (i) if you dispute the accuracy of your personal information, which will allow GRTgaz to check this accuracy; (ii) if you want to restrict the processing rather than delete these data, despite the fact that the processing is illicit; (iii) if you want GRTgaz to store your information because you need it for certification purposes or for the exercise or defence of your legal rights; (iv) during the time necessary for GRTgaz to consider the good grounds for your request to object.

The right to withdraw your consent

When the processing of your Personal Data depends on consent, you can withdraw this consent at any time. This will not affect the legitimacy of the processing operations carried out before your consent was withdrawn.

Right to object

When Our processing is based on our legitimate interest, you can object if it appears that your interests or fundamental freedoms prevail over our legitimate interests.

The right to provide instructions on the use of your Personal Data after your death

You have the right to provide Us with instructions on the management of your Personal Data after your death (e.g. the storage, deletion and disclosure of these data). You can change or rescind your instructions at any time.

Lodging a claim regarding your Personal Data

If you have any questions about the way We process your Personal Data, or if you would like to exercise your rights, please contact our Data Privacy Manager at: protectiondesdonnees@grtgaz.com. 

In principle, the exercise of your right of access (or any other right) will not incur any fees. Occasionally, if your request is manifestly baseless or excessive (in particular due to its repetitive nature) We may request the payment of reasonable fees and/or refuse your request. 

It may happen that We need to ask you for specific information to help confirm your identity and guarantee your right to access this information (or to exercise your other rights). This is an appropriate security measure to ensure that your Personal Data are not disclosed to a party that is not entitled to receive them.

You also have the right to lodge a complaint with the competent supervisory body, which is the French Data Protection Authority (CNIL). You can do this here or in writing to: CNIL, Service des Plaintes, 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, FRANCE.

We ensure an adequate level of protection for your data and take care that the appropriate security, technical and organisational measures (including awareness raising and training for staff involved in processing operations) are in place to protect your Personal Data against all accidental or wrongful destruction, loss or accidental alteration, unauthorised disclosure or access, and against all other forms of illicit processing.

However, to the extent that the Internet is not a completely secure environment, We cannot guarantee the full security of your Personal Data that we store or send. We encourage you to exercise caution when you use the Internet to access our websites and applications.

It is possible that links are inserted by websites or third-party services over which We have no control and which are governed by their own confidentiality policy. This Policy does not apply to these third-party websites. We invite you to check the confidentiality policies of these third-party websites that you visit to find out how they process your personal data.

Our Policy may be modified to reflect any changes in the way that We process your information. We will publish an update to this Policy on the Website.

If you would like to update Us about the information we hold about you or your preferences, or if you have any questions about the protection of your Personal Data, please contact Us via email at: protectiondesdonnees@grtgaz.com.