Data Privacy Policy and Cookie Policy

Users are informed that personal data concerning them may be collected by NEXEREN SASU, a company with share capital of €1,500,000, registered with the Lyon Trade and Companies Register (RCS) under number 753 351 709, with its registered office at 65 Rue Hélène Fürth, 69140 Rillieux-la-Pape, France (hereinafter the “Company”) when they browse the website https://www.nexeren.com/ and use the mobile application (hereinafter the “Platforms”).

This privacy policy describes how the Company uses and protects any information that users provide when they use the Platforms.

The Company pays particular attention to protecting users’ privacy and personal data. Accordingly, the Company undertakes to strictly comply with applicable laws and regulations, including French Law No. 78-17 of January 6, 1978, as amended, on Information Technology, Data Files, and Civil Liberties (hereinafter the “French Data Protection Act”), and Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).

In the course of its business, and to monitor user behavior on the Platforms, the Company collects and processes personal data.

 

PRELIMINARY ARTICLE – DEFINITIONS

Capitalized terms used in this privacy policy have the meanings set out below:

  • Personal Data: any information relating to an identified or identifiable natural person (…); an “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (Article 4(1) GDPR).
  • Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction (Article 4(2) GDPR).
  • Controller: “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law”;
  • Cookies and Trackers: a cookie is a text file placed on the hard drive of the user’s device at the request of the website visited through a browser. It records information about the user’s browsing and allows that website to determine whether the same browser has connected before. Its retention period is set by the website operator and may be limited to the browsing session or extend beyond it.
    This includes trackers placed and read, for example, when visiting a website, reading an email, or installing or using software or a mobile application, regardless of the type of device used, such as a computer, smartphone, e-reader, or internet-connected video game console.

ARTICLE 1 – PURPOSE

Users can browse the Platforms without disclosing any personal information.

Where applicable, the Company may ask users to provide Personal Data about themselves so that they can use the services offered on the Platforms.

The Personal Data collected to provide the services corresponds to the information required by the Company and its business partners, if any, to properly perform the services or to give users access to all the features of the Platforms.

To use all the features of the Platforms, the following information may be collected: last name, first name, email address, phone number, company and job title, IP address, gender, date of birth, mailing address, resume, and cover letter.

By providing this information, users agree that it may be collected, processed, and stored by the Company for the purposes and within the scope described below.

The Company may process users’ Personal Data for the following purposes:

  • Providing the information or services requested by users, such as access to operational information about the sites, the NEXEREN data center register, and service ticket tracking; requesting a call back from the Company’s teams; receiving a response to a job application; completing the contact form; and receiving the newsletter;
  • Creating and managing user profiles;
  • Creating and managing access to our online services;
  • Conducting statistical analyses;
  • Providing users with appropriate information or services;
  • Collecting browsing and behavioral data on the website, in particular through cookies, so that the Company can improve its products and the browsing experience on the Platforms;
  • Detecting malicious behavior such as fraud, phishing, or spam;
  • Authenticating users in their customer area using the personal credentials they have set up for this purpose.

The processing carried out by the Company is based on the following legal grounds:

  • Performance of a contract or pre-contractual measures (e.g., account creation, access to the customer area, order processing, response to a request for a quote or service);
  • Consent (e.g., newsletter subscription, non-essential cookies, direct marketing where required);
  • Legitimate interest (e.g., responding to requests submitted via forms, improving the Website, securing the Website, preventing fraud);
  • Legal obligation (e.g., retaining data required for accounting, tax obligations, and obligations related to dispute management).

ARTICLE 2 – SPECIFIC DATA COLLECTION AND USE

In addition to the purposes set out in Article 1 of this privacy policy, users may post comments on the Platforms.

Users may save their contact information, namely the name and email address used to post the comment, for future visits by means of a cookie.

This cookie is retained for one (1) year.

Users may change their choice at any time and delete this cookie.

For security purposes, the user’s IP address is checked to prevent spam and help detect unwanted comments.

Users may use the contact form on the Platforms to be contacted and/or to obtain sales information about the Company’s products and services.

For this purpose, users provide their last name, first name, contact email address, and/or phone number, and expressly consent to the Company using this data for direct marketing purposes.

Personal Data collected through the contact form is retained for a reasonable period consistent with the purpose of the collection.

Users may provide data marked as “optional” in the contact form.

“Optional” data is collected and retained under the same conditions that the Company applies to the data required to contact users.

Users may apply for jobs by responding to a job posting published on the Platforms.

Users consent to the Company using this data to process their application for the position concerned and/or to inform them of a similar job opening.

For this purpose, users provide the Company with all personal information relevant to these purposes.

Personal Data disclosed in this context is subject to a strict duty of confidentiality on the part of the staff who may have access to it, and is accessible only to authorized Company personnel.

If a candidate’s application is not successful, the data collected in this context will be permanently deleted at the end of the recruitment process and will not be archived, in accordance with French labor law.

Users may provide their Personal Data to the Company in order to open a user account.

Users set a password for this purpose.

Data collected for these purposes is retained for as long as necessary to provide the service and maintain the user’s account.

ARTICLE 3 – DATA DISCLOSURE

Only the Company receives Personal Data.

Under no circumstances does the Company sell the personal data of visitors to and users of the Platforms for advertising or commercial purposes.

The Company’s processor undertakes, under the same conditions, not to sell the Personal Data of visitors to and users of the Platforms for any purpose whatsoever.

The processor is bound by a duty of confidentiality and may use users’ data only in accordance with the Company’s policy.

Where necessary, and only within the limits of the purposes set out above, users’ Personal Data may be disclosed to the Company’s staff and processor in order to respond to users’ requests.

Personal Data may also be disclosed to public authorities, solely to meet legal obligations, as well as to officers of the court, ministerial officers, and debt collection agencies.

Personal Data will not be sold, transferred, rented, or exchanged for the benefit of third parties without the user’s express prior consent, unless required to do so for a legitimate reason such as a legal obligation, the fight against fraud or abuse, or the exercise of the right of defense.

In accordance with applicable regulations and the French Health Data Hosting standard (HDS v2, requirement 31), users are informed that no personal health data is transferred to any country outside the European Economic Area.

ARTICLE 4 – DATA RETENTION

Users’ Personal Data is retained by the Company for no longer than necessary for the purposes for which it is collected and processed and, in any event, for a maximum of thirty-six (36) months from the date of collection.

For information purposes:

  • Data from contact forms / prospects: up to 3 years from the last interaction;
  • Job application data: deleted at the end of the recruitment process;
  • Cookies: maximum of 13 months in accordance with applicable regulations;
  • Data required for contract management, billing, and accounting obligations: retained for the applicable statutory period.

Users are informed that a specific retention period may apply to their Personal Data under a legal or regulatory provision.

ARTICLE 5 – USER RIGHTS

5.1 Exercising Your Rights

In accordance with the GDPR, users are informed that they have rights regarding their personal data.

Users may exercise their rights directly with the Company, subject to providing proof of identity.

Users may also exercise their rights with the Company’s Data Protection Officer (DPO), whose contact details are provided in Article 9 below.

Users have the following rights:

5.1.1 – Right of Access

Users may ask the controller whether it holds information about them and request a copy of all such data.
Exercising the right of access allows users to check the accuracy of their data and, if necessary, have it corrected or erased.

5.1.2 – Right to Rectification

Users may ask the controller to rectify, update, block, or delete information concerning them.

5.1.3 – Right to Erasure

Users may ask the controller to delete all or part of their Personal Data, provided that the request is based on one of the grounds set out in Article 17 of the GDPR.

5.1.4 – Right to Restriction of Processing

Users may ask the controller to temporarily suspend the use of all or some of their data.

5.1.5 – Right to Data Portability

Users may ask the controller to provide them with a copy of their personal data in a structured, machine-readable format so that it can be transmitted to another controller.

5.1.6 – Right to Object

You may object to the processing of your personal data, except where the controller demonstrates compelling legitimate grounds for the processing.

5.1.7 – Right to Withdraw Consent

Where processing is based on consent, users may withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

The Company undertakes to respond to users’ requests to exercise their rights within a reasonable time.

5.2 Opting Out of Direct Marketing

Users who do not wish to receive telephone marketing calls may register free of charge on an opt-out list, such as the French Bloctel register: https://www.bloctel.gouv.fr/

Users who do not wish, or no longer wish, to receive our news and offers may inform the Company using the contact email address provided in our communications or via the link included in those communications. Users may also change the settings of their online profile.

ARTICLE 6 – SECURITY

In accordance with Article 32 of the GDPR, the Company implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

To this end, the Company takes all necessary measures to preserve the integrity and confidentiality of Personal Data and, in particular, to prevent it from being altered, damaged, or accessed by unauthorized third parties.

ARTICLE 7 – COOKIE POLICY

As publisher of the Platforms, the Company may place cookies on the hard drive of the user’s device in order to improve the browsing experience on the Platforms.

A cookie notification banner is displayed on the Platforms when the user first visits them.

Users can accept or refuse cookies using checkboxes and can change their choice at any time.

Users are informed that embedded content (videos, images, articles, etc.) from third-party websites may be displayed on the Platforms.

This embedded content may allow the third-party websites from which it originates, and on which the user has a personal account, to place tracking and data collection cookies on the user’s device.

The Company is not responsible for third-party cookies placed on the user’s device by social networks and other third-party companies.

7.1 Types of Cookies

The following types of cookies may be used on the Platforms:

7.1.1 – Strictly Necessary Cookies

These cookies are necessary for browsing the Platforms.

7.1.2 – Analytics and Functional Cookies

To tailor the Company’s services to users’ needs, the number of visits, the number of pages viewed, and visitor activity on the Platforms are measured.

These cookies help us understand how the Platforms are used and how they perform, and improve how they work by analyzing traffic on information pages and tracking open rates, click-through rates, and bounce rates at an individual but non-identifying level.

Important: these cookies are subject to their own privacy policies and are in no way the responsibility of the Company (Google Search Console, etc.).

Users are informed that the IP address of the device used to connect to the Platforms may be collected by the Company to determine the city from which the connection was made, for statistical purposes.

7.1.3 – Social Sharing Button Cookies

These social cookies allow users to share pages and content on third-party social networks via social sharing buttons.

Important: these cookies are subject to their own privacy policies and are in no way the responsibility of the Company (Facebook, YouTube, Twitter, LinkedIn, Instagram, and TikTok):

7.2 Cookie Settings

Most web browsers are set by default to accept cookies.

Users can change these default settings so that all cookies are systematically rejected, or so that only some cookies are accepted or refused depending on who sets them.

If cookies are refused, deleted, or blocked, users are informed that browsing on the Platforms may be impaired or limited.

The Company accepts no liability for any consequences resulting from a degraded browsing experience caused by the user refusing cookies and/or deleting or blocking cookies required for the Platforms to function.

7.3 Browser Settings

Each web browser has its own cookie management settings.

Depending on the browser used, cookies can be deleted as follows:

  • Google Chrome:
    • Click the Tools icon, select Settings, then click Privacy and security.
    • Click “See all cookies and site data.”
    • Select the cookies you want to refuse, then click Remove.
    • Click the Tools button, then Internet Options. On the General tab, under Browsing history, click Settings.
    • Click View files.
    • Select the cookies you want to refuse, then click Delete.
    • Click the browser’s Tools icon, then select Options.
    • In the window that opens, choose “Privacy” and click “Show Cookies.”
    • Select the cookies you want to refuse, then click Remove.
    • Click the Edit menu, then select Preferences.
    • Click Security, then Show Cookies.
    • Select the cookies you want to refuse, then click Remove.

    For more information, users can visit the website of the CNIL (French Data Protection Authority) at www.cnil.fr.

    ARTICLE 8 – FILING A COMPLAINT WITH THE SUPERVISORY AUTHORITY

    If users believe this privacy policy has not been complied with, they may file a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés, CNIL).

    To do so, users can submit a complaint online via the following link: https://www.cnil.fr/fr/saisir-la-cnil

    ARTICLE 9 – RESPONSIBILITIES

    The controller is the Company, as identified at the beginning of this policy.

    The Company uses NEXEREN (RCS 753 351 709), with its registered office at 65 Rue Hélène Fürth, 69140 RILLIEUX-LA-PAPE, France, as its processor for hosting user data.

    The health data we process is hosted exclusively on infrastructure that meets the security requirements of the French Health Data Hosting (HDS) standard and is located within the European Union.

    The Company has verified beforehand that its processors implement safeguards similar to its own and comply with strict confidentiality, use, and data protection requirements.

    The Data Protection Officer is Ms. Amandine ROUSSEY.

    Phone: +33 7 64 36 99 11

    Email: dpo@nexeren.com

    ARTICLE 10 – CHANGES

    This privacy policy may be amended or supplemented, in whole or in part, at any time to reflect legislative, regulatory, case-law, or technological developments.

    Except for substantial changes requiring the user’s express consent, continued use of the Platforms after such changes take effect will constitute acknowledgment and acceptance of the new privacy policy.

    If users do not consent, they may exercise their rights under the conditions set out in Article 5 above.

    The date of the latest update is stated in the following paragraph of this article. Users should therefore review this policy regularly.

    This privacy policy was last updated on: October 19, 2026