Protection of personal data

Why are personal data processed (purposes of processing)?

1 - Deal with requests made via the contact section of the Group's website;

2 - Collection of cookies collection of cookies or equivalent, enabling analysis of audiences and improvement of their browsing experience on the site when the persons concerned give their consent.

What is the legal basis for this processing?

This processing is based on consent.

Who receives the data?

The BOURBON departments able to respond to the request from the person concerned;

BOURBON's IT and communications department.

What are the conditions for transferring data outside the European Union?

Transfers outside the European Union take place when a request from a user of one of the BOURBON websites requires joint processing with one of our entities or subcontracting of the data by one of our partners outside this zone. These transfers are subject to appropriate security measures.

How long is the data kept?

For requests that do not require archiving, the data is deleted once the request has been processed. Data relating to a commercial relationship may be used for other commercial purposes (quotations, services, etc.) and fall within the scope of the section below.

When cookies or their equivalent are processed, they are kept for a period of 13 months to enable a relevant comparison of audiences over time.

The data is then anonymised for the purposes of statistical studies on visits to the Group's websites.

Preferences can be changed at any time under:

• Legal information for the https://www.bourbonoffshore.com/ website;
• Set your cookies at the bottom of the page for https://bourbon-career.talent-soft.com/

Why are personal data processed (purposes of processing)?

Personal data are processed for the following purposes:

• Recruitment management, including candidate profiling;
• Creating a pool of candidates.

What is the legal basis for this processing?

The legal basis for this type of processing is consent.

Who receives the data?

The recipients of the data are the BOURBON departments involved in recruitment (the HR department, the department in which recruitment is sought).

What are the conditions for transferring data outside the European Union?

Transfers outside the European Union take place when the recruitment process requires data to be co-processed or sub-processed by one of our entities or partners located outside this zone. These transfers are subject to appropriate security measures.

How long is the data kept?

If an application is successful:

The data relating to an employee is kept for the time of his/her presence within BOURBON and after his/her departure for the applicable legal retention period.

If an application is unsuccessful:

The data is kept in an active database for 2 years following the last contact with the candidate, then archived during the limitation period applicable to offences of discrimination in recruitment.

Why are personal data processed (purposes of processing)?

Data may be processed for the purposes of managing the contractual or pre-contractual relationship between BOURBON and the company to which the data subject belongs. Data may be processed for the management of commercial relations, operations, contracts, accounting, after-sales service and complaints, as well as for statistical studies.

It may also be used for commercial purposes such as canvassing, sending communications (newsletters, publications on social networks) or organising events (e.g., webinars, seminars, trade fairs, etc.).

What is the legal basis for this processing?

The legal basis for this type of processing is, as the case may be:

• Performance of the contract or pre-contractual measures at the request of the company to which the data subject belongs;

• BOURBON's legitimate interest in the development of its business in the event that pre-contractual measures are carried out at BOURBON's initiative.

Who are the potential recipients of the data?

The recipients of the data are the BOURBON departments involved in the commercial relationship.

It is also communicated to various public authorities and tax and financial bodies as a result of the existence of legal provisions, regulations, case law or to ensure the defence of the rights of the persons involved in the processing.

Finally, data may be communicated to co-contractors or sub-contractors. In this case, contractual clauses guarantee that the rights of the data subjects are respected.

What are the conditions for transferring data outside the European Union?

Transfers outside the European Union take place when the purpose requires the data to be co-processed or sub-contracted by one of our entities or partners located outside this zone. These transfers are subject to appropriate security measures.

How long is the data kept?

In the case of processing based on the performance of a contract or pre-contractual measures, the data is kept for the duration of the contract plus the applicable limitation period in order to meet our legitimate interest in ensuring the protection and defence of our rights in the event of litigation.

For accounting purposes, certain contractual items may be kept for 10 years from the end of the financial year.

Personal data relating to prospective customers is kept for 3 years from the end of the commercial relationship.

The duration of data processing based on the Group's legitimate interest in carrying out its activities is defined taking into account a weighting between the pursuit of the objectives and the rights of the persons concerned. Data is deleted when the purpose of processing is fulfilled, provided that no legal, regulatory or case law provision or defence of the rights of the persons involved in the processing is an obstacle to such deletion.

Right to be informed

(art. 13 and 14 of the RGPD)

The right to be informed obliges those responsible for processing personal data to inform the data subject of the details of the processing they intend to carry out.

Right of access

(art. 15 of the RGPD and art. 39 et seq. of the Loi Informatique et Libertés)

Exercising the right of access enables the data subject, without having to give any reasons, to know the nature of the personal data processed by the controller and to obtain a copy of it in an understandable format, regardless of the medium on which the data is recorded (electronic document, paper document, sound or video recording).

Right to request the rectification

(art. 16 of the RGPD)

The right to request the rectification of personal data consists of the data subject's right to request that personal data concerning him or her be rectified, completed or updated where errors or inaccuracies have been detected. This right can be exercised by providing a supplementary declaration, for example.

Right to withdraw consent

(art. 7 of the RGPD)

The data subject's consent may be withdrawn at any time where the processing is based on this legal basis. Exercising this right does not compromise the lawfulness of the processing carried out prior to the withdrawal.

Right to be forgotten or to request the erasure

(art. 17 of the RGPD)

The right to be forgotten allows data subjects to obtain the erasure of their personal data if the data processing corresponds to one of the following situations: 

• The data is used for prospecting purposes;
• The data are no longer necessary for the purposes for which they were originally collected or processed;
• The data subject has withdrawn his/her consent to the use of the data and requests that it be deleted;
• The data is processed unlawfully (e.g., publication of pirated data);
• The data was collected when the data subject was a minor in the context of the information society (blog, forum, social network, website, etc.);
• Data must be erased in order to comply with a legal obligation laid down by Union law or by the law of the Member State to which the controller is subject;
• The data subject objects to the processing of his/her data and the controller of the file has no legitimate or compelling reason not to comply with this request.

Right to restriction of processing

(art. 18 of the RGPD)

The right to restrict processing consists of a ban on processing the data subject's personal data, with the exception of storage.

The right to limitation applies in the following cases:

• During the period for verifying the accuracy of the data when it is contested by the data subject.

This freeze on the use of data does not imply deletion at this stage;

• Where the processing is unlawful and the data subject objects to their erasure and demands, instead, that their use be restricted;
• When the data is no longer necessary for the purposes of the processing operation, but is still necessary for the data subject to establish, exercise or defend legal claims;
• Where the data subject has objected to the processing[1] , during the verification as to whether the legitimate grounds pursued by the controller override those of the data subject.

Right to data portability

(art. 20 of the RGPD)

The right to data portability gives data subjects the opportunity to retrieve the data they have provided to a data controller in a structured, commonly used and machine-readable format for personal use or for transmission to a third party of their choice where:

• Processing is based on consent;
• The processing is based on a contract in application;
• Treatment is carried out using automated processes.

Exercising this right does not imply deleting data or closing a user account.

Portability concerns data that has been provided by the data subject (e.g., data enabling the creation of an online user account) as well as data that has been generated by the data subject's activity when using a service or device. Personal data derived or inferred from data provided by the data subject does not fall within the scope of the right to portability.

Furthermore, the processing of personal data covered by this right must be carried out using automated processes, which means that it cannot be exercised in respect of personal data stored on paper.

Right to object

(art. 21 of the RGPD)

The right to object allows data subjects to object, on grounds relating to their "particular situation", to their data being processed in one of the following ways:

• Processing is based on the legitimate interests pursued by the controller or by a third party[2] ;
• The processing is based on the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• Any profiling based on these provisions.

Right not to be the subject of an automated decision

(art. 22 of the RGPD and art. 10 of the Data Protection Act)

Data subjects shall have the right to request the controller not to base any decision exclusively on automated processing that may have a legal impact on them or significantly affect them, with the following exceptions:

• The decision is based on the explicit consent of the person concerned;
• The decision is necessary for the conclusion or performance of a contract between the data subject and the controller;
• The decision is authorised by European Union law or the law of the Member State to which the controller is subject, thus providing for appropriate measures to safeguard the rights and freedoms of the data subject.