Privacy policy

Who is responsible

In this policy, “we” means the publisher of this website. It decides why and how the personal data described below is processed, and is therefore the data controller:

Company

Firalis SAS To be confirmed

Registered office

35 rue du Fort, 68330 Huningue, France

Registration

504 944 364 RCS Mulhouse

Privacy contact

To be supplied

Data protection officer

To be confirmed

Questions about this policy can be sent to the privacy contact above or through the contact form.

What we collect, and why

This website has no user accounts, no newsletter and no comments. It handles personal data in the four situations below.

When you write to us

The contact form asks for:

• your name — required;
• the name of your organisation — optional;
• your email address — required;
• the subject of your message, chosen from a list — required;
• your message — required;
• your agreement that we may hold these details to answer you — required.

Without the required information the message cannot be sent. Please do not include sensitive information, such as health data, in your message.

The website does not save your message. When you send it, the site composes an email from what you typed and sends it to the people who handle enquiries, with your email address as the reply address. From then on, your message exists only in that mailbox.

To stop automated abuse, the form also relies on a hidden field and on the time taken to fill it in, and it limits how many messages can be sent from the same connection in a short time. To do so, it keeps, for ten minutes after a message is sent, a code computed from your IP address and a secret key of the website — never the address itself.

• Purpose: to read and answer your message and follow it up.
• Legal basis: your consent, given by ticking the box (Article 6(1)(a) GDPR). You can withdraw it at any time; this does not affect what was done before. The protection against abuse relies on our legitimate interest in keeping the form usable (Article 6(1)(f) GDPR).
• Who receives it: To be supplied; the email is delivered by To be supplied.
• How long it is kept: messages, To be decided; the anti-abuse code, ten minutes.

When you apply for a job

The application form on the Careers page asks for:

• your name — required;
• your email address — required;
• your phone number — optional;
• the group company you are interested in, chosen from a list — optional;
• your message — required;
• your CV, as a PDF or DOCX file of 5 MB at most — required;
• your agreement that we may hold these details and your CV to consider your application — required.

Without the required information the application cannot be sent. Please do not include sensitive information, such as health data, in your message or your CV.

The website does not keep your application. When you send it, the site checks your CV, composes an email from what you typed, attaches the CV and sends it to the group, with your email address as the reply address. The file received by the server is then deleted, as it is when an application is refused: no copy of your CV is kept on the website. From then on, your application exists only in that mailbox.

The form is protected against automated abuse in the same way as the contact form, with its own count: for ten minutes after an application is sent, it keeps a code computed from your IP address and a secret key of the website — never the address itself.

• Purpose: to consider your application for a position within Firalis Group and its companies, and to contact you about it.
• Legal basis: your consent, given by ticking the box, and the steps taken at your request before entering into a possible employment contract (Article 6(1)(a) and (b) GDPR). You can withdraw your consent at any time; this does not affect what was done before. The protection against abuse relies on our legitimate interest in keeping the form usable (Article 6(1)(f) GDPR).
• Who receives it: To be supplied; the email is delivered by To be supplied.
• How long it is kept: your application and CV, To be decided; the anti-abuse code, ten minutes.
• Your rights: to access, correct or erase your application, or to withdraw your consent, write to To be supplied. See also Your rights.

When you visit the website

The website sets no cookie and uses no audience measurement (see Cookies and similar technologies). As with any website, the server that hosts it receives technical information with each request — IP address, page requested, date and time, and the browser’s identification string — and may record it in logs.

• Purpose: to deliver the pages and to keep the service running and secure.
• Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
• Who receives it: the hosting provider, To be supplied
• How long it is kept: To be supplied

People presented on the website

The Team page gives the name, title, role and professional affiliation of the group’s chief executive and of the members of the two boards presented there, with a short professional biography of the chief executive. News items may name people and show photographs taken at professional events. This information comes from the group companies and was previously published on their own websites.

• Purpose: to present the people who lead and advise the group, and its activity.
• Legal basis: our legitimate interest in presenting the group’s governance and activity (Article 6(1)(f) GDPR). To be confirmed
• Who receives it: anyone visiting the website.
• How long it is kept: To be decided

If you appear on this website and wish to object, or to have information about you corrected or removed, write to us as described under Your rights.

Transfers outside the European Union

The website itself sends nothing to third parties: its fonts are served from its own server, the map on the contact page is drawn from data stored on the site, and no content from another website — video, social media, analytics or captcha — is embedded in its pages.

Whether the hosting provider and the email service process data outside the European Economic Area: To be confirmed Where they do, the safeguards that apply will be stated here.

Security

Messages and applications sent through the website’s forms are not stored in its database, CVs are deleted from the server once sent, and IP addresses are never kept in clear. The forms are protected against automated submissions without relying on a third-party service.

Your rights

Under the General Data Protection Regulation and the French Data Protection Act, you have the right to:

• access the data we hold about you;
• have it corrected if it is inaccurate or incomplete;
• have it erased;
• restrict its processing;
• object to its processing when it relies on our legitimate interest;
• receive it in a structured, commonly used format, or have it sent to another controller, when it relies on your consent;
• withdraw your consent at any time, without affecting what was done before;
• give instructions on what should happen to your data after your death.

To exercise these rights, write to the privacy contact given under Who is responsible, or use the contact form. We answer within one month. This period can be extended by two further months for complex or numerous requests, in which case we tell you within the first month. If we have reasonable doubts about your identity, we may ask you to confirm it.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, at cnil.fr/fr/plaintes (in French).

No decision about you is made by automated means.

Cookies and similar technologies

This website sets no cookie on your device, neither its own nor a third party’s, and uses no audience measurement, advertising or social media tracker.

Under Article 82 of the French Data Protection Act, reading or writing information on your device requires your prior consent, unless it is strictly necessary to provide the service you asked for. As this website uses no tracker that requires consent, it shows no cookie banner.

Editors who sign in to manage the website receive the authentication cookies of WordPress, which are necessary for that purpose. If audience measurement or any other tracker requiring consent were added, your consent would be asked for first, and this section would be updated beforehand.

Changes to this policy

This policy may change, for example when the website changes. The date at the top of the page shows when it was last updated.