Privacy policy

Controller

LEWYS, a French simplified joint-stock company (société par actions simplifiée) with share capital of €1,000

Registered office

11 rue des Archives, 75004 Paris

Registration

990 483 844 R.C.S. Paris

Contact

contact@lewys.fr

Data protection officer

[TO BE COMPLETED] — to be stated if an officer is appointed; otherwise delete this line

We collect only the data necessary for the purposes described below. No sensitive data within the meaning of Article 9 of the GDPR is collected.

• Data submitted via the forms: surname and first name, establishment, job title, business e-mail address, telephone number, size of the establishment, subject of the request and content of the message.
• Data submitted with a job application: surname and first name, e-mail address, telephone number, message, CV and, where applicable, the position applied for. The CV is sent by e-mail to the recruitment team and is not stored on the website.
• Browsing data: IP address, browser type, pages viewed and date of viewing, recorded by our hosting provider in its technical logs for security purposes.
• No audience measurement tool is used on this website at present. We carry out neither profiling nor automated decision-making.

• Responding to your contact and diagnostic requests — legal basis: your consent, obtained when you submit the form.
• Reviewing your application and getting back to you — legal basis: pre-contractual measures taken at your request.
• Managing the commercial and contractual relationship — legal basis: the performance of pre-contractual measures or of the contract.
• Ensuring the security and proper functioning of the website — legal basis: our legitimate interest in protecting our systems.

Your data is intended solely for authorised persons within Lewys. It is not assigned, rented out or resold to any third party.

Certain technical service providers may have access to it, strictly within the scope of their assignment, acting as processors within the meaning of Article 28 of the GDPR:

• Hosting provider for the website and back office: [TO BE COMPLETED]
• E-mail sending and receiving service: [TO BE COMPLETED]

[TO BE COMPLETED] — To be determined once the hosting provider and e-mail service have been chosen. If any data leaves the European Union, the safeguards governing such transfers must be specified: an adequacy decision or the European Commission's standard contractual clauses. If no transfer takes place, this must be stated explicitly.

• Contact requests that did not lead to any business: 3 years from the last exchange.
• Unsuccessful applications: [TO BE COMPLETED] — the French data protection authority (CNIL) recommends not keeping them for more than 2 years after the last contact, unless the applicant objects.
• Data relating to a contractual relationship: for the duration of the relationship, then archived for the applicable statutory limitation periods.
• Browsing data and connection logs: 12 months maximum.

A cookie is a file placed on your device when you visit a website. Some cookies are strictly necessary for the website to function and do not require your consent; others, in particular audience measurement and advertising cookies, may only be placed once you have given your consent.

This website does not place any cookies that require consent. It uses no audience measurement tool, no advertising network and no social sharing buttons. Fonts are hosted on our own servers and do not generate any request to a third party.

The only exception: blog articles may contain a YouTube video. The player is embedded via the youtube-nocookie.com domain, which does not place any advertising tracker until the video is started. By starting playback, you agree to Google placing technical cookies on your device, under the conditions described in its own privacy policy.

You may set your browser to refuse cookies at any time. Refusing cookies does not prevent you from browsing the website.

We implement appropriate technical and organisational measures to protect your data against unauthorised destruction, loss, alteration, disclosure or access: encryption of communications using the HTTPS protocol, access restricted to authorised persons only, and selection of service providers offering sufficient guarantees.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access: to obtain confirmation that your data is being processed and to receive a copy of it.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to request the deletion of your data, within the limits laid down by law.
• Right to restriction of processing: to request that processing be frozen in certain cases.
• Right to object: to object to processing based on our legitimate interest, or to direct marketing.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
• Right to give instructions regarding what happens to your data after your death.

To exercise these rights, write to contact@lewys.fr stating your request. Proof of identity may be requested if there is reasonable doubt. We respond within one month, which may be extended by two months if the request is complex.

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.

This policy may be amended to reflect legal, regulatory or technical developments. The date of the last update is shown at the top of the document. We encourage you to consult it regularly.