Lemonway, as data controller, responds to its obligations to comply the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and with Act n°78-17 of 6 January 1978 on Information Technology, data files and civil liberties.
The purpose of this information notice on the protection of personal data is, in particular, to explain how your data is obtained, why it is processed, the measures implemented to ensure its protection and the rights that may be exercised in accordance with the provisions of the RGPD.
This information notice on the protection of personal data may be amended to comply with any changes in legislation, regulations or technology.
Lemonway, acting in its capacity as data controller, is responsible for its obligations towards the users (hereinafter the "Users") of this website (hereinafter the "Site").
1. Data processing manager
Lemonway, a SAS with capital of €2,418,772.22, registered with the Paris Trade and Companies Registry under number 500 486 915, is responsible for the processing of data. Its registered office is located at 8 rue du Sentier, 75002 Paris - France. Lemonway is a payment institution approved by the ACPR (CIB: 16568), located at 4 Place de Budapest, 75009 Paris
2. Purposes of processing
As part of the operation of the Website, personal data is processed for the following purposes:
- Operation and browsing of the Site;
- Management of audience measurement on the Site and advertising targeting;
- Personalising browsing preferences;
- Subscribing to the Lemonway newsletter and other Premium content (in particular for access to white papers, Webinars and case studies);
- Management of contact requests and personalised quotes;
- Management of customer support and complaints;
- Management of the credit card payment search module;
- Management of recruitment applications.
3. Nature and source of personal data collected.
To implement the purposes defined in this Notice, Lemonway collects the following categories of personal data directly from the persons concerned:
- Identification and contact data (last name, first name, e-mail, telephone number, etc.);
- Connection, monitoring and preference setting data on the Site (logs, event logs, etc.);
- Data relating to transactions (amount, date of payment, bank details, etc.);
- Data relating to education and employment (level of study, previous post held, etc.).
4. Recipients of collected data.
To achieve the purposes described in this Notice, Lemonway may transmit your personal data:
- To sub-contractors exclusively authorised by Lemonway, for the execution of services performed on its behalf (for example, IT or marketing services);
- Official entitites, authorised administrative or judicial authorities, or authorised third parties, upon request.
5. Legal basis for processing personal data.
Lemonway's need to collect personal data from Users results from:
- Management of audience measurement on the Site and advertising targeting;
- Personalization of browsing preferences;
- Subscribing to the Lemonway newsletter and other Premium content (in particular for access to white papers, webinars and case studies);
- Management of contact requests and personalised quotes;
- Management of the credit card payment search module;
- Management of recruitment applications.
- Where the person concerned has given their consent to the collection of their personal data, they may withdraw their consent at dpo@lemonway.com.
- The personal data collected as part of the management of customer support and customer complaints results from the performance of the contract and results from the legitimate interest as regards the data necessary for the operation and browsing of the Site ("technical cookies").
6. Rights of individuals
Individuals whose personal data has been processed by Lemonway have rights that they may exercise by contacting the Data Protection Officer at the following e-mail address: dpo@lemonway.com. Lemonway undertakes to respond to requests to exercise these rights within one (1) month of receipt of the request.
Persons concerned by the processing of personal data by Lemonway have the following rights:
- Right of access to personal data. The person concerned has the right to access his or her personal data. In this case, a copy of the personal data to which the request relates as well as the information relating to its processing will be sent to the person concerned;
- Right to rectification of personal data supplied. The data subject has the right to request rectification of his or her personal data if it is inaccurate, erroneous, incomplete or obsolete;
- Right to erasure of personal data. The data subject has the right to request the erasure of his or her data if one of the grounds in paragraph 1 of Article 17 of the GDPR applies;
- Right to request a restriction of processing relating to his or her person. The data subject may object to the processing of personal data on grounds relating to his or her particular situation, provided that there are no compelling reasons for continuing the processing. The data subject may also object to commercial canvassing;
- Right to object in the event of a legitimate reason or use for commercial purposes. The data subject has the right to object to the processing of his or her personal data if, for reasons connected with his or her personal situation, there are no legitimate grounds for continuing the processing. The data subject may also object to his or her personal data being processed for the purposes of commercial canvassing;
- Right to data portability. The data subject retains the right to request recovery of the personal data he or she has provided to Lemonway, in a structured, commonly used and machine-readable format, to transmit it to another data controller. This right may only be exercised if the data processing is based on the consent of the data subject or on a contract;
- Right to lodge a complaint with a supervisory authority (CNIL). If the data subject considers that Lemonway is not complying with its obligations under the RGPD and the Data Protection Act, he or she may lodge a complaint or request with the competent authority. As Lemonway's head office is located in France, the competent authority is the Commission Nationale Informatique et Libertés. The person concerned may contact the Commission Nationale Informatique et Libertés electronically via the following link: www.cnil.fr/fr/plaintes/internet or by post at the following address: - 3, place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.
Lemonway does not implement or cause to be implemented any individual decision based exclusively on automated processing within the meaning of Article 22 of the RGPD (including profiling) and producing legal effects concerning it or significantly affecting it in a similar way.
7. Retention period of personal data
Once the purposes of data processing have been achieved, and taken into account any legal or regulatory obligations requiring the retention of certain data, Lemonway will proceed with the anonymisation or deletion of personal data. The length of time that data is kept depends on the nature of the data and the purposes for which it is used. When personal data is collected for several purposes, it is kept until the longest retention period has expired.
8. Transfer of personal data
Personal data processed by Lemonway may be transferred to a country within or outside the European Union.
If data is transferred outside the European Union, rules ensuring the protection and security of personal data are put in place:
- Either the European Commission has adopted an adequacy decision which recognises the local regulation in terms of protection of personal data at a level equivalent to that of the European Union. In this case, Lemonway is exempt from implementing appropriate safeguards within the meaning of Article 46 of the GDPR;
- Or appropriate safeguards are put in place, such as the integration of standard contractual clauses approved by the European Commission in contracts concluded with Third Parties.
schen Kommission genehmigt wurden, in die mit Dritten geschlossenen Verträge.
9. Data security
Considering the nature of personal data and the risks presented by their processing, Lemonway implements the technical and organizational measures necessary to preserve the security of your data, and, in particular, to prevent it from being distorted, damaged, or accessed by unauthorized third parties, or to prevent any improper use.
Lemonway has obtained certification to the PCI-DSS standard, which defines a set of requirements to be met to guarantee the security of payment card transactions and aims to protect the sensitive data of cardholders. The rules cover a wide range of aspects, including data security, network protection, the implementation of security policies, access control and data encryption. In addition, regular audits are carried out to demonstrate Lemonway's compliance with the PCI-DSS standard.
10. Violation of personal data
Lemonway agrees to implement all appropriate technical and organizational measures to ensure a level of security appropriate to the risks of data breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data or unauthorized access to such data.
In the event of the detection of a personal data violation that affects or presents a high risk for the rights and freedoms of the persons concerned, Lemonway undertakes to:
Notify the CNIL of the breach within the regulatory timeframe stipulated in Article 33 of the RGPD;
Inform the persons concerned of (i) the nature of the violation, (ii) its probable consequences, (iii) the measures taken or proposed to remedy it, including, where appropriate, measures to mitigate its possible negative consequences and (iv) the name and contact details of the Data Protection Officer from whom further information may be obtained.
Under no circumstances may the undertakings set out in the point above relating to data breaches be assimilated to any acknowledgement of fault or responsibility for the occurrence of the personal data breach in question.
11. Cookies and other tracers
Cookies or other tracers are defined as tracers deposited and read during consultation of the Site, regardless of the type of terminal used (computer, smartphone, etc.). Lemonway uses cookies for technical purposes to ensure the proper functioning and navigation of its Site ("Technical Cookies"). These cookies are exempt from consent.
Lemonway also deploys cookies to manage audience measurement and advertising targeting. In this respect, Users' consent is collected by means of a dedicated banner on the Site.