Personal data privacy policy
LAST UPDATE : 28/03/2023
onepoint, a simplified joint stock company (“société par actions simplifiée”) with a share capital of 1,302,770 euros, whose registered office is located at 29 rue des Sablons, 75116 Paris, registered with the Trade and Companies Register of Paris under number 440 697 712, represented by David R. LAYANI in his capacity as Chairman (“onepoint” or “we” or “us”) publishes the website www.gamabu.com (the “Site”) which presents its products and/or services.
Aware of the importance of ensuring the confidentiality of personal data that are transmitted to it and the privacy of data subjects, onepoint undertakes, within the framework of its activities and in accordance with the legislation in force in Europe (Regulation 2016/679 of the European Parliament and the Council of 27 April 2016) and in France (together the “Applicable Regulation”), to ensure the protection, confidentiality and security of personal data, as well as the respect of privacy.
By the term “personal data” (or “personal information”), we mean any information relating to an identified or identifiable natural person. An “identifiable natural person” is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
This does not include data for which the identity has been deleted (anonymous data).
This external Privacy Policy (“Privacy Policy”) describes how onepoint, its subcontractors and potential partners collect and process the personal data of the Site’s Visitors (or also referred to as “Users” in particular in our GTU), as well as its customers and prospects concerning the Gamabu products and/or services, in particular its Serious Games offer and more generally any person whose personal data we may process, in accordance with the General Data Protection Regulation (“GDPR”) via our Site.
It also describes the legal basis applicable to personal data processing, the people we share such data with, and the way in which it is stored.
Onepoint is the Data Controller, this means that we decide how we retain and use your personal data. We are required under the Applicable Regulation to provide you with all information contained in this Privacy Policy.
It is therefore important that you read this Privacy Policy, as well as any other information that we may provide on specific occasions when we collect or process your personal data, so that you know how and why we use such data.
1 • How are your personal data collected ?
The data we collect or retain about you may come from a variety of sources. Some of it has been collected directly from you when you are using the Site, or from your company using the Site, customer or prospect of our Gamabu products and/or services; some of the rest may have been collected in compliance with applicable regulations in the past. Also under Applicable Regulation, we may also collect information about you when you interact with us, for example, when you call us, or when you use certain social networks (Twitter, Facebook, LinkedIn, etc.). Some data may come from sources accessible to the public (for example from the press and websites or applications of all kinds including social networks) or from external companies.
Our Site does not provide for automated decision-making.
2 • What personal data are processed and for what purposes ?
Below you will find an overview of the different types of data subjects covered by this Privacy Policy as well as:
- Type of personal data about you that we use and store;
- Purposes for which such personal data is collected;
- Legal basis for data processing.
For all the categories below, onepoint also processes your data to comply with legal or regulatory requirements. For this purpose, onepoint seeks to:
- Retain the required data in order to comply with legal requirements;
- Manage data communication requests from competent authorities.
2•1 if you are Visitor of the Site
TYPE OF PERSONAL DATA
- Last name, First name, if you contact us
- E-mail address, if you contact us
- Data relating to navigation on the Site by means of cookies according to our Privacy Policy available on our Site.
- Any information you may have included in the contact form, if you have contact us via the Site.
The data collected on the Site during your navigation are not mandatory.
The mandatory data of the contact form, and your identity and contact details if you contact us by email, are mandatory so that we can process your demand.
PURPOSE & LEGAL BASIS FOR DATA PROCESSING
| PURPOSE | LEGAL BASIS FOR DATA PROCESSING |
|---|---|
| To enable you to access or use our Site, and improve the user experience. | Our legitimate interest: cookies enabling or facilitating communication by electronic means or strictly necessary for the provision of the service you have specifically requested. |
| To enable the proper functioning of our Site. | Our legitimate interest: customer service management. |
| Access to a demo. | In execution of the contract that binds us through the GTU or pre-contractual measures taken at your request. |
| To manage your questions and demands, enabling the settlement of disputes. | In execution of the contract that binds us through the GTU or pre-contractual measures taken at your request. |
| To manage the demands concerning data subjects’ rights. | In accordance with our legal obligations. |
| Prepare reports or compile statistics to improve the performance of our Site, our goods and services. | Your consent (cookies). |
2•2 If you are customers / Prospects
TYPE OF PERSONAL DATA
- Civility, Last name, First name
- Telephone number
- Business e-mail address
- Company name
- Reports and record of actions
- Any information you may have included in the contact form, if you have contact us via the Site
The mandatory data of the contact form available on our Site, are mandatory so that we can process your demand.
The other categories of data abovementioned are also mandatory. Otherwise, we will not be able to contract with you or respond to your request.
PURPOSE & LEGAL BASIS FOR DATA PROCESSING
| PURPOSE | LEGAL BASIS FOR DATA PROCESSING |
|---|---|
| To enable you to access or use our Site. | Our legitimate interest: cookies enabling or facilitating communication by electronic means or strictly necessary for the provision of the service you have specifically requested. |
| Access to a demo. | In execution of the contract that binds us through the GTU or pre-contractual measures taken at your request. |
| To send commercial communications about our products or services (such as newsletters with updates from onepoint, promotional offers and quality surveys to assess customer satisfaction) by phone or email. | B to B: Our legitimate interest to develop our activities. B to C (if applicable): Your consent. We can also send you communications on basis of our legitimate interest: developing our business when you are one of our customers for analogous products or services. |
| To manage your questions and demands concerning a contract, to enable the settlement of disputes. | In execution of the contract that binds us through the GTU or pre-contractual measures taken at your request. |
| To manage the demands concerning data subjects’ rights. | In accordance with our legal obligations. |
| To conduct statistical analysis and market research studies. | Our legitimate interest: to know our market in order to develop our activity. |
| To prepare reports or compile statistics to improve the performance of our Site, our goods and services. | Your consent (cookies) |
This Privacy Policy does not apply for the processing of personal data in the course of a service provided by onepoint on behalf of a customer. onepoint will comply with the contractual provisions negotiated between the parties and with the instructions of the data controller.
3 • If you fail to provide personal data
If you choose not to supply the personal data we request, we may not be able to provide you with the products and/or services you have requested or achieve the purposes for which we have requested such personal data.
4 • Are your data shared ?
4•1 In what context may we need to communicate your data ?
We may share your Personal Data with companies within the onepoint Group.
We will share your personal data with third parties when required by law, when necessary to manage our contractual relationship with you or when we have any other legitimate interest in doing so.
We may need to disclose personal data in response to a request from a regulatory authority, such as the tax authorities or CNIL (the French data protection authority), etc., and/or a court (in response to a judgement, a court order or injunction) on request or if the law requires us to do so, or in order to protect our interests, our property and/or our security and/or those of a third party.
We may also share personal data with companies assisting in the fight against fraud and investigating fraud.
We may also disclose your personal data as part of the fight against money laundering and terrorist financing, with the implementation of monitoring of contracts and/or transactions which could lead to the drawing up of a suspicious activity report or the freezing of assets.
We may transfer your personal data to service providers not affiliated with the onepoint Group, such as:
Banks and insurance companies, when you are a customer or prospect;
Providers of computer systems and support for our business, including providers of delivery services, email archiving, backup and disaster recovery service providers, and providers of cybersecurity, hosting and maintenance services;
Marketing and advertising service providers.
We may also communicate your personal data to third parties in the following cases:
If we sell or buy a business or assets, we may disclose your personal data to the seller or prospective purchaser of this business or these assets;
In the event that onepoint or almost all of its assets are acquired by a third party, in which case the personal data held by onepoint will be part of the transferred assets;
In the event that we are bound to disclose or share your personal data in order to comply with any legal obligation, any lawful requirement of the government or law enforcement authorities, and in case it is necessary to comply with national security or law enforcement requirements, or to prevent illegal activity.
Third parties with whom we share your personal data are limited (by law and by contract) in their ability to use your personal data only for the specific purposes we have identified. We will always do our best to ensure that third parties with whom we share your personal data are subject to confidentiality and security obligations in accordance with this Privacy Policy and applicable laws. We only allow them to process your personal data for specific purposes and in accordance with our instructions.
Except as expressly stated above, we will never share, sell or lease your personal data to a third party without notifying you and/or obtaining your consent. If you have given your consent for us to use your information in a particular way, but you change your mind afterwards, you can contact us and we will stop doing so. For cookies subject to your consent, you can change your choice at any time by clicking on the “Cookie Management” tab at the bottom of the page of our Site.
4•2 Can external service providers have access to your data ?
As part of our business, especially regarding communication, we employ the services of service providers not affiliated with the onepoint Group.
Thus, you may be required to communicate on a voluntary basis, some of your personal data directly on their platform, for example, through subscription to a newsletter or the creation of a personal user account.
For these treatments, the providers act as the Data Controller. For more information, we invite you to read their own privacy policy.
In particular, we can call upon the following communication companies: \
MailJet Newsletter and emailing platform : https://mailjet.com/privacy-policy/
Amazon Simple Notification Service Pub/sub messaging, SMS, email, and mobile push notifications platform : https://aws.amazon.com/en/privacy/
Hubspot Communication and marketing platform : https://legal.hubspot.com/privacy-policy
5 • Are your data transferred to companies located outside the European Union ?
When the processing of your Personal data involves a transfer outside the European Union, these transfers are made with appropriate guarantees and in full compliance with the Applicable Regulation.
Transfers outside the European Union are based on standard contractual clauses, in accordance with the standard clauses validated by the European Commission.
6 • Does the site use cookies ?
The term cookie covers all trackers that provide access to information stored in the terminal equipment of a visitor (web beacons, pixels, etc.).
Thanks to cookies, we can collect your connection data (e.g. IP address, geographical position, type and version of your internet browser, operating system, information on your visits and use of our website, etc.).
For more information on cookies that we use on our Site, please refer to our Cookie Policy.
7 • How long are your data retained ?
We will only retain your personal data for the time necessary to achieve the purposes for which we collected it, including to comply with any legal or accounting requirement.
To determine the appropriate retention period for personal data, we take into account the quantity, nature and sensitivity of personal data, the potential risk of harm resulting from the unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the possibility of attaining those purposes by other means, as well as applicable legal requirements.
Data relating to the Site Visitor
- Claims, questions, complaints: 3 years following the closure of a claim, question or complaint.
- Your consent concerning Cookies: Except if you have withdrawn your consent, 6 months from collection, unless you again give us your consent to their use once this period has lapsed.
Customer data
- During the term of the contractual relationship with onepoint, plus another 3 years without prejudice to the retention obligations or limitation periods.
Prospect data
- We store your information for a maximum of 3 years from the last contact from you.
8 • What rights do you have over your data ?
As a data subject, you have different rights. These rights are not absolute and each of these rights is subject to certain conditions in accordance with the GDPR and applicable national laws.
The right of access - you have the right to obtain from us the confirmation that your personal data is or is not processed by us, as well as certain other information (similar to those provided in this Privacy Policy) on how it is used. You also have the right to access your personal data by requesting a copy of your personal data. This allows you to know and verify that we use your information in accordance with data protection laws. We may refuse to provide information when it may reveal personal data about another person or negatively affect the rights of another person.
The right of rectification - you can ask us to take steps to correct your personal data if it is inaccurate or incomplete (for example, if we have the wrong name or the wrong address).
The right to erasure - also known as the “right to be forgotten”, this right allows you, in simple terms, to request the deletion or erasure of your personal data when, for example, there is no compelling reason for us to continue using it, or its use is illegal. However, this is not a general right of erasure and there are some exceptions, for example when we have to use information to defend a lawsuit or to be able to comply with a legal requirement.
The right to limit processing - you have the right to “block” or prevent further use of your personal data when we evaluate a request for rectification or as an alternative to erasure. When processing is limited, we may still retain your personal data, but we cannot use it further.
The right to portability of data - you have the right to obtain and reuse certain personal data for your own needs in different companies (which are separate data controllers). This only applies to personal data that you have provided to us, which we process with your consent and for contract performance purposes, which is processed by automated means. In this case, we will provide you with a copy of your data in a structured, commonly used and machine-readable format or (where technically possible) we will be able to transmit your data directly to another data controller.
The right of objection - you have the right to object to certain types of processing, for reasons related to your particular situation, at any time, to the extent that such processing takes place for the legitimate interests pursued by onepoint. We will be allowed to continue processing personal data if we can demonstrate that the processing is justified by compelling and legitimate reasons that outweigh your interests, your rights and freedoms or if we need them for the institution, the exercise or defence of legal proceedings. If you object to the processing of your personal data for direct marketing purposes, we will no longer process your personal data for such purposes.
The right to withdraw your consent - when we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of the processing that took place prior to this withdrawal.
The right to provide us with instructions on the use of your personal data after your death - you have the right to provide us with instructions on the management (e.g., retention, erasure and disclosure) of your data after your death. You can change or revoke your instructions at any time.
9 • How do you exercise your rights ?
We have appointed Claire DESSUREAULT as Data Protection Officer for onepoint. If you have any questions about this Privacy Policy, the way we process your personal information, or if you wish to exercise any of your rights, please contact our DPO at the following address: dpo-gamabu@groupeonepoint.com.
If you are not satisfied with our response to your claim or if you believe that the processing of your personal data does not comply with applicable data protection laws, you may file a complaint with the supervisory authority competent for data protection. The Commission Informatique et Libertés (CNIL), is the data protection authority in France (www.cnil.fr).
We will review all such requests and provide our response within the time frames provided by Application Regulation.
Please note, however, that certain personal data may be exempted from such requests in certain circumstances, especially if onepoint must continue to process your personal data for its legitimate interests or to comply with a legal requirement. We may therefore refuse to comply with your request within the respect of the Application Regulation.
You will not have to pay any fees to access your personal data (or to exercise any other rights). However, in certain cases, we may charge a reasonable fee if your request is clearly unfounded or excessive.
We may need to ask you for specific information to help us confirm your identity and to guarantee your right to access this information (or to exercise your other rights) when there is reasonable doubt concerning your identity. This is an appropriate security measure to ensure that personal data is not disclosed to a person who does not have the right to receive it. The information you us provide will not be kept beyond necessary time to achieve the purpose for which it is processed, namely to confirm your identity in order to respond to your request.
10 • How are data protected ?
Onepoint ensures that data is processed securely and confidentially, including when certain operations are performed by subcontractors. For this purpose, the appropriate technical and organisational measures to prevent the loss, misuse, alteration and deletion of your personal data are put in place. These measures are adapted according to the level of sensitivity of the processed data and according to the level of risk that the processing or its implementation entail. We have procedures in place to deal with suspected data breaches and we will notify you and any appropriate supervisory authority of an alleged breach when we are legally required to do so.
Unfortunately, the security of data transfers over the Internet or data storage systems cannot be 100% guaranteed. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of an account you have with us has been compromised), please inform us immediately by contacting us using the above details.
11 • What are the links between the Site and third party sites ?
The www.gamabu.com Site of onepoint may contain links to other websites operated by third parties. Please note that this Privacy Policy only applies to personal data collected by onepoint. We are not responsible for personal data that third parties may collect, save and use on their own websites. We recommend that you read carefully the privacy policy of each website you visit.
Moreover, the onepoint Group is not responsible for hypertext links to its own Site which may be included in third-party websites, even if the onepoint Group has authorised the publisher of the third party website to place such a link.
12 • Changes to this Privacy Policy
Onepoint is free to modify this Privacy Policy periodically to reflect the evolution of our practices in this area. When we modify this Privacy Policy, we also change the “Last Update” date at the top of the first page. We encourage you to periodically review this Privacy Policy to be updated on how onepoint protects your data.
13 • Language
This Privacy Policy is available in English. However, the French version prevails.