Privacy Policy

The website “www.balea.com” (hereinafter the Site) is intended to present the activities of SAS Balea (hereinafter “Balea”).

It is accessible 7 days a week, 24 hours a day, subject to any interruptions required for the technical maintenance, servicing and updating operations that Balea may deem necessary.

When you first connect to the Balea website, a consent management window allows you to accept, refuse or configure, purpose by purpose, the storage of cookies and trackers, as well as the resulting processing of browsing data.

Our cookie policy is intended to help you better understand the measures we implement with regard to browsing on our website. In particular, it informs you about the cookies present on our website and their purpose, and explains how to configure them (ARTICLE 2).

ARTICLE 1 – Personal data

1.1 Definitions

Personal data: personal data means any information relating to a natural person who is identified or who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to that person.

Processing of personal data: processing of personal data means any operation or set of operations performed on such data, whatever the process used, and in particular collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, as well as blocking, erasure or destruction.

Cookie: a cookie is an item of information placed on a user’s device by the server of the website they visit, or by a third party. It contains several pieces of data: the name of the server that placed it, an identifier in the form of a unique number and, where applicable, an expiry date. This information is sometimes stored on the device in a simple text file that a server accesses in order to read and record information.

1.2 Data controller

The controller of the personal data referred to herein is Balea, registered with the Montpellier Trade and Companies Register (RCS) under no. 340 024 973, whose registered office is located at 8 Avenue du Grand Chêne – 34270 Saint Mathieu de Tréviers – France, and represented by Mr Vassili COSMAS.

Balea has appointed a Data Protection Officer (DPO). For any question relating to this policy or to the processing of your personal data, you may contact the DPO in writing, using the contact details given in paragraph 1.7.

1.3 Data collected

1.3.1 Data collected on the Site

When the user uses the general contact form, Balea collects and processes the following data: email, first name / surname, company name, telephone number, message.
When the user uses the product / project contact form, Balea collects and processes the following data: email, first name / surname, company name, telephone number, message.
When the user subscribes to the newsletter (dedicated form), Balea collects and processes the following data: email
When the user applies for a job vacancy (recruitment form), Balea collects and processes the following data: surname, first name, email, telephone number, position applied for, message, curriculum vitae and cover letter.
When the user exercises their rights (the “data subject rights” form), Balea collects the data required to process and verify their request.
Whether the provision of data is mandatory or optional is indicated at the time of collection by an asterisk.

In addition, certain data is collected automatically as a result of the user’s actions on the Site (see ARTICLE 2 on cookies).

1.3.2 Data collected as part of the contractual relationship between Balea and the customer

In the context of the contractual relationship between Balea and the customer, Balea collects and processes the following data: surname, first name(s), address, telephone number (landline or mobile), fax number, email address, position within the company.

Balea undertakes to request only the data strictly necessary to handle the file.

1.4 Data recipients

The communication and sales departments are recipients of the following data: surname, first name, where applicable company name and position within that company, postal address, email.

The accounting department is a recipient of the following data: surname, first name, email, where applicable company name, postal address.

The recruitment department is a recipient of the following data: surname, first name, email, curriculum vitae and cover letter.

For the purposes described in article 1.5, certain data may also be processed, on behalf of and under the authority of Balea, by processors acting under agreements compliant with Article 28 of the GDPR: customer relationship management (CRM) tool, email service provider, website audience measurement tool, and hosting and maintenance providers.

Balea undertakes not to sell or rent the data collected. The personal data provided may only be disclosed to third parties in the following cases: with the authorisation of the data subject; at the request of the legally competent authorities, pursuant to a judicial order, or in the context of legal proceedings.

1.5 Purposes – Legal basis for processing

The processing operations implemented by Balea are based on the following legal grounds, depending on the purpose pursued:

Performance of a contract or of pre-contractual measures (Article 6(1)(b) of Regulation (EU) 2016/679 of 27 April 2016): responding to requests submitted through the contact forms; drawing up quotations and contracts; commercial management of the contract.
Balea’s legitimate interest (Article 6(1)(f)), with the possibility for the data subject to object at any time: business-to-business (B2B) commercial prospecting, in particular by email, following initial contact; managing and developing the customer relationship within our CRM tool; audience measurement and improvement of the Site; management of job applications.
Consent of the data subject (Article 6(1)(a)): subscription to and sending of the newsletter; the storage of cookies and trackers that are not strictly necessary, together with the associated purposes (audience measurement, advertising, retargeting), under the conditions set out in ARTICLE 2.
Compliance with legal obligations (Article 6(1)(c)): accounting management and retention of the related documents.
Management of requests to exercise rights: the handling of requests from data subjects to exercise their rights, in compliance with Balea’s legal obligations.

1.6 Data retention period

Data relating to the management of the commercial relationship and to the settlement of invoices is retained in the active database until the end of the commercial relationship between the parties, then in an archive database for a period of 5 years from the end of the commercial relationship.

Personal data relating to prospects is retained for a period of 3 years from its collection by the controller or from the last contact initiated by the prospect.

Data relating to newsletter subscription is retained until the data subject withdraws their consent (unsubscribes).

Personal data relating to job applications is retained for a period of 2 years from its collection by the controller or from the last contact initiated by the applicant.

At the end of these periods, unless the data subject’s consent is obtained for a longer period, the data will be archived for the statutory limitation period before being permanently destroyed.

Personal data relating to a request to exercise data subject rights is retained for a period of 5 years from its collection by the controller.

1.7 Rights of holders of personal data

Individuals whose personal data is collected have a right of access to the personal data concerning them, a right to have it rectified or erased, a right to restriction of processing, a right to data portability and a right to object to processing. They also have the right to withdraw their consent at any time where the processing is based on consent.

The Customer is nevertheless informed that the personal data collected is necessary for the performance of the Service, so that if the Customer exercises their right to erasure of that data, or their right to object or to restriction of processing, before the end of the contractual relationship, the Service cannot be performed.

These rights may be exercised:

by writing to the Data Protection Officer at gdpr@balea.com;
by completing the online “data subject rights” form;
or by post, by printing this form.

Balea responds to any person exercising one of the above rights within one month of receipt of the request. This period may nevertheless be extended by two months, taking into account the complexity and the number of requests; in that event, Balea will inform the data subject of the extension within one month of receipt of the request.

Where the data subject submits their request in electronic form, the information is provided electronically where possible, unless the data subject requests otherwise.

Where the controller refuses to act on the request made by the data subject, it will state the reasons for that refusal.

The data subject may lodge a complaint with the French data protection authority (Commission Nationale de l’Informatique et des Libertés – CNIL) or with the supervisory authority of the European Union Member State in which they reside, and may seek a judicial remedy.

Right of access: any data subject may ask the controller to confirm whether or not personal data concerning them is being processed. If so, the data subject may obtain a copy of the personal data being processed together with the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients of the data; where possible, the envisaged data retention period or, where this is not possible, the criteria used to determine that period; where the personal data is not collected from the data subject, any available information as to its source; where applicable, the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. The controller may charge a reasonable fee based on administrative costs for any further copy requested (Article 15(3) of the GDPR). Where requests are manifestly unfounded or excessive, the controller may charge a reasonable fee taking into account the administrative costs of providing the information, or refuse to act on those requests (Article 12(5) of the GDPR).

Right to rectification: any person whose personal data is processed has the right to obtain the rectification of inaccurate personal data concerning them, and to have that data completed where the purpose of the processing so requires.

Right to erasure: any person whose personal data is processed has the right to obtain from the controller the erasure of that data in the following cases: where the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; where the data subject has withdrawn the consent on which the processing was based and there is no other legal basis for the processing; where the processing is based on the controller’s legitimate interest and the data subject has objected to it in the absence of overriding legitimate grounds; where the processing is carried out for prospecting purposes or for profiling related to such prospecting and the data subject has objected to it; where the data has been unlawfully processed; where the data must be erased in order to comply with a legal obligation under Union law or under the law of the Member State to which the controller is subject. In certain cases, however, the controller may refuse to erase the data: in order to comply with a legal obligation requiring the processing, provided for by Union law or French law; where the sole purpose of the processing is statistical; where the processing is necessary for the establishment, exercise or defence of legal claims.

Right to restriction: any person whose personal data is processed may ask the controller to restrict the processing in the following cases: where they contest the accuracy of their data, for a period enabling the controller to verify it; where the processing does not comply with the regulations but the data subject does not wish the data to be erased; where the controller no longer needs the data but it is still required by the data subject for the establishment, exercise or defence of legal claims; where they have objected to the processing, pending verification of whether the legitimate grounds pursued by the controller override those of the data subject. Where processing has been restricted, the data may not, other than for storage, be processed except with the data subject’s consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State. Should the restriction subsequently be lifted, the controller will inform the data subject beforehand.

Right to portability: any person whose personal data is processed may ask the controller to provide that data to them or to transmit it to another controller, where the processing is based on their consent or on the performance of a contract to which they are party (or of pre-contractual measures taken at their request), and where the processing is carried out by automated means.

Right to object: any person whose personal data is processed has a right to object to that processing under the following conditions: where the processing is based on the pursuit of the legitimate interests of the controller or of a third party, on grounds relating to their particular situation and if the controller does not demonstrate the existence of compelling legitimate grounds overriding the interests, rights and freedoms of the data subject, or the establishment, exercise or defence of legal claims; where the processing is carried out for prospecting purposes or for profiling related to such prospecting, the data subject may object without having to give any reason; where the processing is carried out for statistical purposes, on grounds relating to their particular situation.

1.8 Data storage location and transfers

The hosting servers on which Balea processes and stores its own databases are located within the European Union.

The use of certain third-party tools involves the following processing operations:

Audience measurement and, where applicable, advertising services (Google): Google LLC is certified under the EU–US Data Privacy Framework and additionally relies on the European Commission’s standard contractual clauses to govern transfers to the United States.
Customer relationship management (CRM): the data of customers and prospects located in the European Union is hosted within the European Union. The provider acts as a processor; where some of its own sub-processors are located outside the European Economic Area, the transfers are governed by the European Commission’s standard contractual clauses.
Emailing: the electronic communications provider processes the data on behalf of Balea within the European Economic Area.

In all cases, Balea ensures that these transfers are governed by appropriate safeguards in accordance with the GDPR. You may obtain a copy of these safeguards by writing to the contact details given in paragraph 1.7.

1.9 Complaints to a supervisory authority

Any person whose personal data is processed may lodge a complaint regarding the processing of data concerning them with the CNIL or with the supervisory authority of the European Union Member State in which they reside.

ARTICLE 2 – Cookies

The Site uses cookies and trackers intended to facilitate browsing, to measure audience and, where applicable, to deliver advertising content. On your first visit, a consent management window allows you to accept, refuse or configure these trackers, purpose by purpose. You may change your choices at any time by clicking the dedicated cookie management icon on the Site.

2.1 Types and purposes of cookies used

Strictly necessary cookies: these cookies are essential to the operation of the Site and to storing your consent choices. They do not require your consent; deleting them may cause browsing difficulties.

Audience measurement cookies: these cookies allow us to analyse visits to and use of the Site in order to improve its performance and content. They are stored subject to your consent.

Advertising cookies (personalised and non-personalised advertising) and retargeting cookies: where applicable, these cookies allow us, together with our partners, to offer you Balea content and advertising, including on other websites, and to measure their performance. They are stored only with your consent.

The storage of cookies that are not strictly necessary may give rise to the processing of personal data (for example identifiers, IP address, browsing data). The list of partners that may place trackers and the details of the purposes are accessible and configurable at any time in the Site’s consent management window.

2.2 Cookie management

You may accept or refuse cookies, purpose by purpose, directly from the Site’s consent management window, or change your choices at any time via the dedicated icon. You may also configure your browser to accept or refuse cookies; to find out how to change your preferences, please consult your browser’s help section. If you choose to refuse all cookies, access to certain features of the Site may be reduced. For further information on cookie management tools, you may consult the CNIL website: https://www.cnil.fr/fr/cookies-les-outils-pour-les-maitriser.

2.3 Retention period of consent and cookies

Your consent choices are retained for a period of 6 months (the “euconsent-v2” cookie). At the end of that period, your consent is collected again. The lifetime of the cookies stored does not exceed 13 months, in accordance with the CNIL’s recommendations.

ARTICLE 3 – Responsibility

None of the information appearing on the Site may be construed as pre-contractual information relating to the services of Balea, or as constituting any contractual warranty offered by Balea in the course of its business.

Balea cannot guarantee to the user the confidentiality of correspondence sent by email or by any other means of communication using the internet network, which may be intercepted by a third party, given the way in which data circulates on that network.

Furthermore, it is the responsibility of each user to take all appropriate measures to protect their own data and/or software from contamination by any viruses circulating on the internet.

Balea cannot be held liable for the direct or indirect consequences that may arise from errors in the contact details you enter or from any other incomplete or incorrect information you transmit through this Site.

ARTICLE 4 – Security

Balea takes all necessary precautions to ensure the security of your personal data. A strict internal data protection policy is implemented, reinforced by the use of physical and logical security measures.

By default, we limit the collection of our visitors’ personal data to what is strictly necessary for the services we make available, in order to comply with the principle of minimisation to which we are particularly committed.

We apply the same rigour to the security of your information throughout our commercial relationship, and until the end of its retention period.

The security of personal data relies on everyone’s good practice. You are therefore invited, through your constant vigilance, to help preserve the integrity and confidentiality of the information concerning you.

ARTICLE 5 – Intellectual property

Please refer to Article 4 of the Site’s legal notice.

ARTICLE 6 – Hyperlinks

Please refer to article 6 – Responsibilities of the Site’s legal notice.

ARTICLE 7 – Applicable Low

This site is governed by French law, to the exclusion of its conflict of laws rules. Any dispute arising out of or in connection with the use of the present site shall be submitted to the competent courts in accordance with common law.