PRIVACY POLICY - Léti’Quête EI Laëtitia Vasseur-Reibel

6 - INTERNATIONAL DATA TRANSFERS

6.1 - No transfers outside EU/EEA

The Controller undertakes not to transfer the personal data of Users, Clients or Consultants outside the European Union or the European Economic Area.

All personal data collected is hosted exclusively on servers located in the European Union, thus guaranteeing an adequate level of protection in accordance with the GDPR.

6.2 - Exceptional cases of transfers

In the event that, in the future, certain data should be transferred outside the European Union or the European Economic Area (for example, in case of a change of host or service provider), the Controller undertakes to:

• Only make these transfers to countries recognized by the European Commission as ensuring an adequate level of protection, or

• Implement appropriate safeguards in accordance with Articles 46 and 47 of the GDPR (standard contractual clauses, binding corporate rules, etc.), or

• Obtain explicit consent from the persons concerned before any transfer.

The Controller will inform Users, Clients or Consultants in advance of any change in its data transfer policy and will update this Privacy Policy accordingly.

6.3 - Use of third-party services

The Controller uses certain third-party tools and services for managing its activity, notably:

• Squarespace (Website hosting) whose servers are hosted in Ireland

• Perfactive (appointments, client monitoring, billing and accounting) whose servers are hosted in France

• Infomaniak (videoconferencing with Kmeet and data storage with Kdrive) whose servers are hosted in Switzerland

These providers are subject to strict data protection obligations and do not perform transfers outside the EU/EEA without appropriate guarantees.

6.4 - Use of third-party tools and data transfer

The Company may use certain third-party tools for web traffic analysis, digital marketing or other features aimed at improving Services and user experience.

In case of using such tools, the Company undertakes to:

1. Rigorous selection of providers: Choose only providers compliant with GDPR and offering sufficient guarantees regarding the protection of personal data.

2. Web analysis tools:

   • The Company currently does not use any tool for web traffic analysis.

   • In case of future use of tools like Google Analytics or similar, likely to transfer data outside EU/EEA, the Company will implement GDPR-compliant guarantees, such as standard contractual clauses approved by the European Commission.

   • The Company will systematically configure these tools to anonymize IP addresses and limit collection to strictly necessary data.

3. Marketing tools:

   • For its marketing campaigns and newsletters, the Company currently uses MailerLite whose servers are hosted in Ireland (See MailerLite Privacy Policy).

   • In case of future use of marketing tools based outside EU/EEA, the Company will obtain prior explicit consent from Users, Clients or Consultants and inform them of potential risks related to these transfers.

4. Social media:

   • Share buttons and social media widgets present on the Website may collect certain information. These data transfers are managed directly by the platforms concerned.

   • The User can prevent this collection by logging out of their social media accounts before visiting the Website or by using browser extensions that block trackers.

5. Transparency and information:

   • The Company will maintain and make available on the Website an exhaustive list of third-party tools used, specifying for each its purpose, the nature of data collected and the place of their processing.

   • Any addition of a new tool likely to transfer data outside EU/EEA will be notified to concerned Users, Clients or Consultants.

6. Rights of data subjects:

   • The rights of Users, Clients or Consultants as defined in Article 9 of this Privacy Policy also apply to data likely to be transferred via these third-party tools.

   • Any User, Client or Consultant may specifically object to the use of these tools by contacting the Company by email at the following address: contact@letiquete.fr.

6.5 - Specific guarantees for transfers via WhatsApp

The Company may be contacted via WhatsApp by its Clients.

This application being owned by Meta (formerly Facebook Inc.), an American company, exchanges via this channel may involve data transfers outside the European Union.

6.5.1 - Legal framework for WhatsApp transfers

Data transfers to the United States currently take place within the framework of the Data Privacy Framework (DPF), an agreement that replaced the Privacy Shield following the adequacy decision adopted by the European Commission on July 10, 2023.

Meta is certified under this legal framework.

However, the Company recognizes that the international legal landscape regarding data protection is constantly evolving and that this mechanism could be subject to modifications or invalidation, as was the case for previous mechanisms (Safe Harbor, Privacy Shield).

In case of invalidation or substantial modification of the DPF by a court decision or regulatory evolution, the Company undertakes to:

1. Measures within 30 (thirty) days:

   • Temporarily cease using WhatsApp for any communication involving sensitive personal data

   • Inform concerned Clients by email of the situation and available secure alternatives

   • Implement Standard Contractual Clauses (SCCs) adopted by the European Commission, complemented by additional technical and organizational measures

2. Measures within 90 (ninety) days:

   • Conduct a new Data Protection Impact Assessment (DPIA)

   • Progressively migrate to alternative messaging solutions based in the EU

   • Offer all Clients an alternative communication channel compliant with GDPR requirements

3. Transparent information:

   • The Client will be informed of the evolution of the legal situation and measures taken

   • Specific consent will be collected before continuing exchanges via WhatsApp if this solution remains used

The Company undertakes to actively monitor regulatory and jurisprudential developments concerning international data transfers, to adapt its practices and protection measures according to legal developments, and to inform Users, Clients or Consultants of any significant change in the applicable legal framework.

6.5.2 - Technical and organizational measures

To secure these transfers and protect your data, the Company has implemented the following guarantees:

1. Limitation of shared data: Only information strictly necessary for communication concerning appointments and services is exchanged via WhatsApp

2. Prohibition of sensitive data sharing: No health data or sensitive information is transmitted via this channel

3. End-to-end encryption: The Company exclusively uses end-to-end encryption offered by the application for all communications

4. Regular data deletion: Systematic purging of conversation histories every 3 months

5. Standard contractual clauses: In addition to the DPF, the Company relies on standard contractual clauses adopted by the European Commission

6. Impact assessment: The Company has conducted a data protection impact assessment (DPIA) specific to the use of WhatsApp

7. Compensatory measures: Implementation of additional guarantees recommended by the European Data Protection Board (partial anonymization, pseudonymization)

6.5.3 - Transparency and User choice

The Company undertakes to:

• Not use WhatsApp as the preferred communication channel

• Systematically offer alternative communication channels (telephone, SMS, email) that are more secure

• Respect the Client's choice regarding their preferred communication channel

The Client may at any time request that communications continue via another channel of their choice by contacting the Controller by email at the following address: contact@letiquete.fr.

6.5.4 - Residual risks and specific rights

Despite these guarantees, the Client is informed that residual risks exist concerning potential access to their data by US authorities.

In case of concerns regarding these transfers, the Client has, in addition to the rights mentioned in Article 9, specific rights:

• Right to obtain a copy of appropriate safeguards implemented

• Right to file a complaint with the supervisory authority (CNIL)

• Right to an effective judicial remedy

• Right to compensation for material or moral damage suffered

6.6 - Processing of data on social networks

6.6.1 - Presence on social networks

The Company is currently present on only one social network: Facebook.

The User who interacts with the Company's pages or profiles on this platform is informed that their personal data may be collected and processed by:

• The Company, in its capacity as data controller for data it collects directly

• The social network platform itself, in accordance with its own privacy policies

6.6.2 - Data collected via social networks

Within the framework of its presence on social networks, the Company may collect the following types of data:

• Public profile information (name, username, profile picture)

• Interactions with published content (comments, shares, "likes")

• Private messages sent to the Company via platform messaging systems

• Anonymized statistical data on page attendance and engagement

The Company does not have access to personal data that the User has not made public or voluntarily shared with it.

6.6.3 - Purposes of processing data on social networks

Personal data collected via social networks is processed by the Company for the following purposes:

• Communicate with the User at their request

• Respond to questions, comments and information requests

• Analyze engagement and interaction with published content

• Improve its services and communication

• Inform the User about its activities, offers and events

6.6.4 - Legal basis for processing

The processing of data collected via social networks is based on:

• The User's consent manifested by their voluntary action of interacting with the Company's pages

• The Company's legitimate interest in developing its activity and communicating about its services

• The execution of a contract when the interaction is related to a service provision

6.6.5 - Data transfers via social networks

The User is informed that most social network platforms are based outside the European Union and may transfer their data to third countries.

The Company is not responsible for data transfers made by social network platforms themselves.

To learn more about these transfers and the guarantees implemented, the User is invited to consult the privacy policies of the platform concerned:

• Facebook/Instagram: https://www.facebook.com/privacy/policy/

6.6.6 - Specific rights concerning social networks

In addition to the rights mentioned in Article 9 of this Privacy Policy, the User may exercise control over their data on social networks by:

• Configuring privacy settings of their accounts

• Limiting information they make public

• Using platform logout features before visiting the Website

• Deleting their interactions (comments, "likes") with the Company's pages

• Directly contacting the platform concerned to exercise their rights on data it holds

The Company undertakes to follow up on any request for deletion of content published by the User on its pages within a maximum period of 48 (forty-eight) working hours.