Data Protection Notice
Thank you for your interest in our company. GP SAS has a strong focus on protecting users’ data and complying with the provisions regarding your right to data protection.
You can view the website www.joa-camp.com/fr without providing any personal data. However, we may need to process your personal data if you wish to receive specific services from our company through the website. If such processing is required and there is no legal basis for doing so, we will systematically seek the consent of the data subject.
Processing personal data such as your name, address, email and telephone number is always done in accordance with the GDPR (General Data Protection Regulation) and the national data protection regulations that apply to GP SAS. Through this data protection declaration, our company wishes to inform the public of the nature, scope and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed of the rights they have in this area.
As the data controller, GP SAS has implemented numerous technical and organisational measures to ensure the personal data collected on this website remains as protected as possible. However, data sent over the internet is susceptible to security lapses which make absolute protection impossible. For this reason, data subjects also have the option of providing their details to us through other means such as over the telephone.
Our website contains links to other service provider and partner websites. Our privacy policy does not cover the protection of your data on those websites. Any data collected by the operators of those websites does not fall within our scope of knowledge or influence.
Data controller
Data controller entity:
GP SAS
The entity responsible under the terms of the GDPR (General Data Protection Regulation), all data protection laws in EU member states, and all other directives regarding data protection is:
GP SAS
Route du Demi-Bœuf
44310 La Limouzinière
FRANCE
Tel.: +33 (2) 43 32 16 00
Email: info@joa-camp.com
Website: www.joa-camp.com/en
Contact details of the external data protection officer:
Christian Bonnin
Integraal-MD
44200 Nantes
Email: dpo@groupe-pilote.com
Définitions
The data protection notice uses the terms defined in the GDPR (General Data Protection Regulation).
Personal data
Personal data means all information about an identified or identifiable natural person (hereinafter the ‘data subject’). Data subjects are identifiable if they can be directly or indirectly identified, especially by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more special characteristics that express the physical, physiological, genetic, mental, commercial, cultural or social identity of that natural person.
Data subject
The data subject is an identified or identifiable natural person whose personal data are processed by the data controller.
Processing
Processing includes any operation or set of operations performed with or without automated processes and applied to single elements or sets of personal data, such as collecting, recording, organising, structuring, storing, adapting/modifying, extracting, viewing, using, communicating by sending, distributing or other method of provision, merging or interlinking, limiting, erasing and destroying.
Data controller
The data controller is a natural person or legal entity, public authority, department or other body that determines the purposes and processing means, alone or in conjunction with others. If the purposes and means of this processing have been set in law by the EU or a member state, the data controller may be named or specific criteria applicable to their appointment may be included in EU or member state laws.
Subcontractor
The subcontractor is the natural person or legal entity, public authority, department or other body that processes personal data on behalf of the data controller.
Recipient
The recipient is the natural person or legal entity, public authority, department or other body to whom the personal data is communicated, whether or not they are a third party. However, public authorities likely to receive personal data as part of a special investigation in accordance with EU or member state laws are not considered to be a recipient in this sense.
Third party
A third party is a natural person or legal entity, public authority, department or body other than the data subject, data controller, subcontractor and people under the direct authority of the data controller or subcontractor, who are authorised to process the personal data.
Consent
Par By consent, we mean any expression of choice that is free, specific, informed and unequivocal, being a clear and positive action or declaration by which the data subject agrees to their personal data being processed.
Information about personal data collection
Collection of data and general information
GP SAS needs to collect personal information from you in order to provide a service. We collect personal information when you provide it to us by telephone, post or email, or by using one of our websites or products and services. Note that, in some situations, if you do not provide us with the personal information we require, we cannot provide the products and/or services you have requested as we may be in breach of our legal obligations.
By collecting data, GP SAS can provide customers with friendly services and optimise the information and deals displayed on our website in order to best meet the public’s needs. Our legitimate interests are to:
- properly administer and manage our customer relationships,
- understand how our customers use our services, and optimise our vehicle fleet,
- analyse the service and products our customers want and how they want our services and products to be improved,
- understand how our customers use our websites and identify issues caused by using those websites,
- improve the customer’s browsing experience,
- inform our customers of the various products and services we offer and highlight new ones,
- understand customer feedback and provide the best possible response,
- improve deals and benefits offered to our customers,
- manage disputes and incidents, and obtain legal and professional advice.
Whenever someone views the website joa-camp.com/, some data and general information is recorded. That information is saved to the server’s log files. The following data may be recorded:
- Type and version of the web browser used
- Computer’s operating system,
- URL of the website from which the system accessed joa-camp.com,
- Sub-websites from which the system accessed joa-camp.com,
- Date and time of website access,
- System’s internet service supplier,
- Other similar information and data that helps us block attacks on our IT systems.
Some data and information collected anonymously will be assessed by GP SAS for statistical purposes in order to improve our company’s data security and protection, ensuring optimal protection for the personal data that we process. Anonymous data on the server’s log files will be recorded separately from all of the data subject’s other personal data.
Personal data categories
While performing our profession, we may process the following personal data categories:
- Permanent details: permanent details include, for instance, first name and surname, company name, address (home and/or work), date of birth and nationality.
- Contact details: contact details include, for instance, telephone number and email address (personal and/or professional).
- Optional details: optional details are those that you provide to us without us requesting them, such as your vehicle fitting requests and vehicle category requests. They can also include other information such as details of your travel to the agency (flight, train, etc.).
Use of social media
GP SAS is active on various social media.
Social networks are social platforms on the internet forming online communities, which enable users to communicate between themselves in a virtual setting. Social networks can serve as platforms for sharing opinions and experiences, and enabling the internet community to present personal and commercial information.
We do not have knowledge of the content of the data sent or their use by those companies. You can view the privacy policies of those individual companies for more information on the purpose and scope of processing they perform on that data, as well as their provisions regarding the use of your personal data:
- Facebook : Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA For residents outside the USA and Canada, the data controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
- Instagram : Instagram, 200 Jefferson Dr, Menlo Park, CA 94025, USA. For residents outside the USA and Canada, the data controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Using Google tools
Our website www.joa-camp.com/ uses several tools provided by the American internet giant, Google. They help us improve efficiency, remain organised, grow our business and provide you with support.
Google Analytics
GP SAS utilise un service d’analyse de site internet fourni par Google. Analytics emploie des méthodes qui permettent GP SAS uses a website analysis service provided by Google. Analytics uses methods that enable a fine grain analysis of internet users’ use of the website. The service uses cookies, which are text files recorded on the data subject’s computer, and sends them to a Google server (for more information, refer to: Cookies policy). This data is stored by Google in the USA. When required, Google may send personal data gathered in this manner to third parties. The following are some of the affected data: website URL (referring website) from which the system accessed another website, which pages on the website the user viewed, how many times and for how long.
Google uses this information to assess your use of the www.joa-camp.com/ website, produce reports on website activity and provide additional services regarding internet use. This data essentially enables us to optimise our www.joa-camp.com/ website and perform cost-benefit analyses of online advertising.
Google Tag Manager
Our website www.joa-camp.com/ uses Google Tag Manager. It allows us to manage tags through a dedicated platform and gather useful data to steer and improve our products and services. In the IT and programming world, tags mean a series of characters that automatically trigger a computer programme to perform an action. They primarily enable data to be entered.
Remarketing
We create remarketing campaigns using the Google Ads platform. Remarketing lets us reconnect with internet users who have already interacted with our website, www.joa-camp.com/, on a desktop or mobile device. This enables us to re-expose our website visitors to advertisements while they browse Google or its partner websites. Advertisements are displayed by using cookies. You can block cookies by changing your browser settings and/or objecting their use for Google remarketing (details at www.google.com/policies/technologies/ads/).
Google Ads
Our teams use Google Ads, Google’s online advertising platform. Google Ads saves cookies to your computer (‘Cookie Conversion’), when you visit our website through a Google ad. They only remain active for thirty (30) days and cannot be used to personally identify you. The information gathered using conversion-tracking cookies is used to generate conversion statistics for Google Ads customers. AdWords customers can see how many users clicked on their ad and were guided to a page with a conversion-tracking tag.
Politique de confidentialité de Google
Google privacy policy
Google’s privacy policy contains more comprehensive details on the purpose and scope of Google’s data collection and processing. It also has information about your rights and the settings you can adjust to protect your privacy: policies.google.com/privacy. Google also processes your personal data in the USA and complies with the EU-US Privacy Shield (www.privacyshield.gov/EU-US-Framework). You can also contact Google at: Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
HubSpot tool use
Our website www.joa-camp.com uses HubSpot. It enables us to create forms, through which we gain a better understanding of our website visitors. This tool also enables us to customise the user experience on our websites by creating a cookie for each visitor.
HubSpot privacy policy
HubSpot’s privacy policy contains more comprehensive details on the purpose and scope of HubSpot’s data collection and processing. It also has information about your rights and the settings you can adjust to protect your privacy: https://legal.hubspot.com/fr/data-privacy. HubSpot also processes your personal data in the USA and complies with the EU-US Privacy Shield (www.privacyshield.gov/EU-US-Framework). You can also contact HubSpot at: HubSpot Inc. 25 First Street, 2nd Floor – Cambridge, MA 02141 USA.
You may send us requests via email using the contact page on our website. If you send us a request for information, we will save the information you have provided (email address, subject of your email, content of your message and contact date), including the contact details you have entered (full name, address and telephone number) in order to process your request and provide subsequent replies. We will not provide this information to another party without your consent. The email address you enter will remain on our IT system until you ask that we erase it or you revoke your agreement to its storage.
Purpose and legal basis for data processing
The following form the legal basis for the data processing we perform:
| The purposes for which we collect information are: | Processing that information is justified by: |
| Performing a contract to which the data subject is party. For instance, this is the case when processing data relating to the provision of a service. The same applies to data processed in relation to performing pre-contractual actions. For example, all requests regarding our products and services | Art. 6, section 1b of the GDPR: processing is necessary for the performance of a contract between us and you. |
| Complying with a legal obligation imposed on our company, such as tax obligations. | Art. 6, section 1d of the GDPR. |
| Protecting the vital interests of the data subject or of another natural person. An example is if visitors to one of our agencies injure themselves. They must then provide their name, age and social security number, and other information required by a doctor, hospital or other third party. | L’art. 6, al. 1 lit d du RGPD. |
| Processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. We are specifically authorised to perform such processing, as it is specifically mentioned in European legislation. That legislation considers that legitimate interests may exist when the data subject is a customer of the data controller (Recital 47, sentence 2 of the GDPR). | Art. 6, section 1f of the GDPR. |
| Performing our commercial activities for the prosperity of all our employees, customers and shareholders. One example is ensuring the proper administration and management of our customer relationships, understanding how our customers use our services, optimising our vehicle fleet, and analysing services and products that our customers want. Another example is understanding the way in which they would like our services and products to be improved, understanding how our customers use our websites and identifying issues caused by using our websites, improving the user experience, informing our customers of the various products and services that we offer, highlighting new offerings, understanding customer feedback and providing the best possible response, improving deals and benefits offered to our customers, managing disputes and incidents, and obtaining legal and professional advice. | Art. 6, section 1f of the GDPR. |
| In addition to the situations mentioned above, our company’s legal basis for processing personal data is Article 6, section 1a of the GDPR, and we request consent for each specific purpose. | Art. 6, section 1f of the GDPR. |
Personal data retention period
The retention period for your personal data varies according to the purpose of their collection:
- Permanent, contact and contractual data are retained after the commercial relationship ends, with selective archiving.
- Telephone conversations with our customer care team are not recorded.
Recipients of personal data
In-house transmission
GP SAS sends your personal data to various specialised in-house departments in order to meet its legal and contractual obligations. Personal data are only sent or disclosed within the necessary scope in accordance with the current data protection requirements.
Group-level sharing
GP SAS is a subsidiary of Pilote Group, a company located in France and operating at a European level. GP SAS is likely to share information about data subjects with other Pilote Group entities within the scope of this policy.
Sharing with third parties
Joa Camp may be required to share personal data with third parties in order to provide the corresponding applications and services. Those third parties provide external services. They only process the data in accordance with our instructions, and they are prohibited from using those data for their own commercial purposes.
Transfer to a third party state or international organisation
GP SAS may be required to transfer personal data to recipients located outside the EEA (European Economic Area) for the aforementioned reasons. Data is only shared in order to perform our contractual and legal obligations, and with your permission. The conditions for sharing that data are protected in accordance with current personal data protection regulations.
Rights of the data subject
You may exercise any of your rights in this section by approaching the data protection officer appointed in this privacy policy as the appropriate contact person for privacy issues.
Right of access
Les directives et prescriptions européennes accordent à la personne concernée par le traitement de ses données personnelles le droit d’obtenir gratuitement de la part du responsable du traitement des informations les données European directives and regulations give data subjects the right to obtain from the data controller, free of charge, the personal data held about them, the processing purpose, the data categories concerned, the recipients or recipient categories to whom those data have been sent, the retention periods and a copy of that information. To exercise your right of access, send your request to dpo@groupe-pilote.com
Right of confirmation
The European directives and regulations give the data subject the right to have the data controller confirm that their personal data is being processed. If a data subject wants to exercise their right of confirmation, they can send a request any time to the data protection officer.
Right to rectification
You have the right to ask us to rectify incorrect and incomplete personal information about you. If a data subject wants to exercise their right to rectification for incorrect or incomplete personal data, they can send a request any time to the data protection officer. We will do our utmost to update your personal data as quickly as possible.
Right to erasure
Conformément aux directives et prescriptions européennes, la personne concernée a le droit d’obtenir du responsable In accordance with the European directives and regulation, the data subject has the right to ask the data controller to erase their personal data, as quickly as possible, for one of the following reasons, as long as their processing is not required:
- Personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- The data subject withdraws consent on which the processing is based according to Art. 6, section 1a and Art. 9, section 2a of the GDPR, and where there are no other legal grounds for the processing.
- The data subject objects to the processing pursuant to Art. 21, section 1 of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21, section 2 of the GDPR.
- The personal data have been unlawfully processed.
- The data must be erased in order to comply with legal obligations as provided under EU law or the law of the member state by which the data controller is governed.
- Personal data is collected within the scope of the offer of information society services covered by Art. 8, section 1 of the GDPR.
If one of the following points is applicable and a data subject wants their personal data held by GP SAS to be erased, they may contact the data protection officer at any time. That officer will immediately action their request. Please note that we may retain some information about you when required by law or we have a legitimate reason to do so.
Right to restriction of processing
The data subject may ask the data protection officer to restrict the processing of their personal data when one of the following applies:
- The accuracy of the personal data is disputed by the data subject, for a period that enables the data controller to check the accuracy of those data.
- The data has been illegally processed and the data subject is opposed to erasing their personal data, instead demanding their use be restricted.
- The data controller no longer needs the personal data for the processing purpose, but the data are still required by the data subject in order to ascertain, exercise or defend their legal rights.
- The data subject opposes its processing under Art. 21, section 1 of the GDPR, while it is ascertained whether the data protection officer’s legitimate motives override those of the data subject.
Right to data portability
The data subject also has the right to data portability, meaning the right to receive the personal data they provided in a structured, commonly used format that can be machine-read and the data subject has the right to provide those data to another data controller.
When the data subject exercises their right to data portability under Art. 20, section 1 of the GDPR, they also have the right to have that personal data sent directly from one data controller to another, when technically possible and subject to that action not affecting the rights and freedoms of a third party.
Right to object
In accordance with European directives and regulations, all data subjects have the right to object to the processing of their personal data at any time, for reasons relating to their specific situation. From that moment, GP SAS will not process the personal data unless we can prove that there are legitimate, overriding reasons for processing them which prevail over the data subject’s interests, rights and freedoms, or to ascertain, exercise or defend its legal rights.
The data subject also has the right to object to the processing of their personal data for the purpose of canvassing.
Right to complain
The data subject has the right to lodge a complaint about the processing of their personal data to the data protection officer or a supervisory authority.
Withdrawing your consent for data processing
Conformément aux directives et prescriptions européennes, toute personne concernée a le droit de révoquer à tout
In accordance with European directives and regulations, all data subjects have the right to withdraw their consent for the processing of their personal data at any time.
If the data subject wishes to exercise their right to withdraw consent, they can contact the data protection officer at any time by emailing dpo@groupe-pilote.com.
As a responsible company, we do not use automatic decision making or profiling processes.