Data processing

Persons affected by the data protection policy

This privacy policy is intended for the citizens, users and partners of La cité Internationale de Toulouse who wish to obtain further information on the processing of personal data and, more generally, for any person interested in this information.

Definitions

• Controller : the natural or legal person, public authority, agency or other body which determines, alone or in collaboration with others, the purpose and means of the processing of personal data
  
  
• Personal data : any information that directly or indirectly identifies a person.
• Identity data (surname, first name, address, date and place of birth, etc)
• Personal life data (personal characteristics, life habits, family situation, etc.)
• Professional life data (CV, employment status, training)
• Economic information (income, financial situation, bank card, banking coordinates, etc.)
• Connection data (IP address, login details, etc.)
• Location data (geolocation)
• Cookies, tracers and browsing data (audience tracking, advertising, social networks)
• Sensitive data (religious, political, philosophical opinion, trade union membership, sexual orientation, health data, etc.)
  
  
• Processing : any operation or set of operations concerning personal data, whether or not by automatic means. In general, the collection, recording, organisation, structuring, storage, adaptation, modification, consultation, use, communication, dissemination, deletion or destruction of your personal data consists of processing of personal data;
• File : any structured and stable set of personal data accessible according to specific criteria;
• Recipient : the natural or legal person, public authority, department or any other body which receives personal data, whether or not it is a third party;
• Authorised third parties : the authorities also entitled, in the context of a particular mission or the exercise of a right of communication, to ask the Data Controller to communicate personal data to them;
• Data subject : any person whose data are processed;
• Processor : the natural or legal person, public authority, department or other body which processes personal data on behalf of the Controller;
• Consent : any freely given, specific, informed and unambiguous expression of will by which the data subject agrees, by means of a declaration or a clear positive act, to personal data relating to them being processed.

Your personal data

Your personal data is processed in accordance with GDPR Article 6 (lawfulness of processing) in the following cases :

• The performance of a contract we have entered into with you, and/or
• Compliance with a legal obligation, and/or
• Your consent to the use of your personal data
• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless the interests or fundamental rights and freedoms of the data subject which require the protection of personal data prevail, in particular where the data subject is a child. However, this does not apply to processing by public authorities in the performance of their tasks.

Your personal data may be processed via our website when you fill in a form. 

Processing information

For each instance of personal data processing carried out by La Cité Jardins, general information regarding the said processing is ensured for the persons concerned.

In the interests of transparency, La Cité Jardin systematically specifies the following information:

• Subject of processing
• Purposes of processing
• Legal basis for processing
• Categories of personal data processed (data sources, mandatory data collection, automated decision making)
• People involved
• Recipient of the data
• Data transfers outside the European Union
• Duration of storage of personal data

Why does La Cité Jardins collect your data?

La Cité Jardin collects and uses your data mainly for the purpose of processing your requests for information.

When is your data collected?

When you browse our website, you may enter personal information (for example, when you contact us via the contact form or any other form).

Some of the data listed below is collected automatically as a result of your interactions on the site, and some is collected through forms you fill out. The compulsory nature of each data item is systematically indicated by an asterisk. Your data is processed by La Cité Jardins and is not disclosed or sold to other companies for marketing or commercial purposes. Your data will not be transferred to a country outside the European Union or to an international organisation.

When you browse our website:

• We collect your IP address
• We collect cookies
• We collect login and navigation data

 The usefulness and purpose of the processing

The data collected via the contact form allow us to contact you again following one of your requests, to ensure the follow-up of your requests as well as to guarantee the effectiveness of a competence implemented by La Cité Jardins.

Your requests and solicitations also allow us to improve the presentation and functionality of our site to provide an optimal service.

Personal databases are never used without informing you of the purpose of such use. Your explicit consent is requested directly on our website.

When you provide us with personal information relating to an application, this information enables us to contact you again if your profile is suitable for the various job offers available.

Data storage

In general, La Cité Jardins applies storage periods for any type of archive on the basis of the required administrative usefulness.

Apart from the required administrative usefulness period, La Cité Jardins sets the storage periods in accordance with and in compliance with Article 5.1 e) of the GDPR.

For the sake of precision, the duration of administrative usefulness (D.A.U.) refers to the period of time during which the documents are necessary for the activity of the service and/or the citizen to assert their rights. This is a mandatory storage period for documents and is usually expressed in years. Based on legal criteria (in particular the limitation periods set by law) or administrative criteria, it covers the first two ages of archives (i.e. current and intermediate archives)

Thus, the storage of archives meets three cardinal challenges :

• The day-to-day management of the service (having the information needed for the proper functioning of the service at all times)
• Justification of rights and obligations (keeping evidence in case of dispute)
• Preservation of memory (building up the materials of history)

Regarding the three ages of the archive, these are explained as follows :

• The current archives: the file is live for the purposes of the case, it is in the office or in its immediate vicinity;
• Intermediate archives: the file is closed but kept by the producing department, for reasons of activity or legal requirement, in a dedicated archive room nearby;
• Final archives: after sorting and possible elimination, the file of historical (and sometimes legal) interest is transferred to the regional, departmental or municipal archives for permanent storage.

Regarding the final fate of the archives :

At the end of the D.A.U. of the documents and unless extended, the documents can either be kept permanently (document of historical value) or destroyed. This destruction can only be carried out after the competent archivist has given their approval for disposal.

Regarding the destruction of archives :

Public archives are inalienable and imprescriptible: they are part of the public domain and cannot be altered or destroyed without the authorisation of an authorised State representative. Therefore, every civil servant is responsible for the documents they produce or receive, but does not own them. For example, when their D.A.U. expires, public archives separate the documents to be preserved from those of no historical or scientific interest, which are destined for disposal.

In addition, La Cité Jardins applies the following retention periods with regard to the processing of personal data relating to your navigation on the website.

Recipients and transfers of data
The management of the website is outsourced to a specialist service provider (Eolas). La Cité Jardins ensures that the data remains confidential and is not used for any other purpose.

Recipients and transfers of data
The management of the website is outsourced to a specialist service provider (Eolas). La Cité Jardins ensures that the data remains confidential and is not used for any other purpose.

Exercise of personal rights

The French Data Protection Act of 20 June 2018 relating to data processing, files and freedoms and the GRDP (Article 12 to 21 of the GRDP) grant you rights relating to your private life. These are the right to information, the right to access, the right to object, the right to restrict processing, the right to rectification and the right to deletion.

• The right to information
  The privacy policy contains all the information relating to the purposes of the processing that may be carried out, the categories of personal data processed and the recipients or categories of recipients to whom the data are communicated, in order to guarantee your right to information.

• The right to access
  You can ask La Cité Jardins directly if it holds data about you and also request information regarding their processing. You can also request a copy of all your data.

• The right to rectification
  You can request to change your personal data at any time.

• The right to object
  The right to object allows you to object to the processing of your data by La Cité Jardins, provided that the processing is not necessary for compliance with a legal obligation or the performance of a contractual obligation.
  
  
• The right to restrict processing
  You may request the restriction of the future processing of your personal data under certain conditions: when you contest the accuracy of a personal data, when you need it for the establishment, exercise or defence of your legal rights. You can also demand the restriction of the processing of your data if the processing is unlawful and you do not wish to delete it.

• The right to deletion
  You may request the deletion of your personal data, provided that the processing is not necessary for the implementation of a contractual obligation or the fulfilment of a legal obligation.

• Withdrawal of consent
  If you have consented to the processing of your personal data, you may withdraw your consent at any time and unconditionally. The information related to the exercise of these rights is kept FIVE (5) years from the date of response from La Cité Jardins, in accordance with the legal statute of limitations for personal legal actions. Your data related to the exercise of your rights is then deleted after this period. In the context of a request to exercise a right, La Cité Jardins undertakes to reply to you, in accordance with the legislation in force, within a period of one month, which may be extended by a further two months subject to justification (Article 12 of the GRDP).

How can I exercise each of these rights ?

You can exercise each of the above rights by providing us with proof of identity.

• By writing to the following address : La Cité Jardins, 18 Rue de Guyenne, 31700 Blagnac

In accordance with the GDPR, La Cité Jardins reserves the right to charge a reasonable fee that takes into account the administrative costs incurred in providing the information, communicating or taking the actions requested. La Cité Jardins also reserves the right to refuse to respond to any request that is clearly unfounded or excessive, informing you of the reasons for the refusal.

La Cité Jardins informs you that you have the right to contact the Commission National de l'Informatique et des Libertés (CNIL), and to make a complaint at this address www.cnil.fr