E-privacy
Preamble
The purpose of this Privacy Policy is to inform you about how your personal information may be collected and processed by Media Square.
Media Square offers its customers the possibility of marketing the advertising space available on their Internet site via its server.
Respect for privacy and personal data is a priority for Media Square, which is why we are committed to processing them in strict compliance with the French Data Protection Act of January 6, 1978 (hereinafter “Loi Informatique et Libertés”), as amended, and the General Data Protection Regulation (EU) of April 27, 2016 (hereinafter “GDPR”).
In any case, we undertake to respect the following two (2) essential principles:
-You remain in control of your personal data;
-Data is handled transparently, confidentially and securely.
Article 1. Definitions
Candidate: refers to persons applying for Media Square job offers.
Customer: refers to Internet site publishers using the Services to market the advertising space available on their site(s). Customers have access to the Dashboard .
Identifier: refers to the e-mail address (or user name) and password you choose when registering as a Customer, which you enter to connect to the Dashboard . Internet users: refers to persons browsing the Customers’ Internet site and likely to receive advertising, targeted or otherwise, via the Services.
Partners: refers to Media Square’s partners who offer advertising space auction services to advertisers.
Data subjects or You: refers to the persons concerned by the processing operations carried out by Media Square. Data subjects are Candidates, Customers, Prospects, Partners and Internet users.
Platform: refers to the Internet site and the Dashboard published by Media Square as well as all their graphic, sound, visual, software and textual components. The Platform is the exclusive property of Media Square.
Prospects: refers to persons contacted by Media Square as part of BtoB prospecting campaigns.
Server-side header bidding: refers to the solution developed by Media Square enabling the Customer to market its advertising space from the Media Square server.
Services: refers to the services provided by Media Square for marketing advertising space on customers’ websites.
Dashboard: refers to the dashboard accessed by the Customer to monitor and manage advertising campaigns. Access to the Dashboard is by means of Identifiers.
Article 2. Identity and contact details of the data controller
- MEDIA SQUARE AS DATA CONTROLLER
Media Square, a société par actions simplifiée (simplified joint stock company) with capital of 1,160,000.00 euros, headquartered at 29 rue de Trévise, 75009 Paris, France, registered in the Paris Trade and Companies Register under number 753 186 337, will be the data controller for all data processing relating to the administration of its Platform and the management of its relations with its Customers, Partners, Prospects and recruitment management.
-About the Platform :
Dashboard management; Service security management.
-Concerning commercial relations :
Management of commercial relations with customers and partners.
-For its BtoB marketing operations:
BtoB sales prospecting management;
Events management.
-Accounting and related operations:
Service billing management ;
General accounting.
-Concerning recruitment:
Application management and processing.
MEDIA SQUARE AS CO-PROCESSOR
Media Square will act as co-processor with its Customers for processing relating to the marketing of their advertising space via its Server-side Header Bidding service.
In accordance with Article 26 of the GDPR Media Square and the Customers have entered into an agreement relating to co-responsibility for processing, the broad outlines of which are as follows:
-The Customer is responsible for informing Internet users of the processing of their data and for obtaining their consent prior to their collection;
-The Customer is responsible for managing Internet users’ requests to exercise their rights.
However, in accordance with Article 26.3 of the GDPR, we inform you that you may exercise the rights listed in Article 11 of this Policy both with Media Square and with our Customers.
As Media Square does not control the collection of your data on our Customers’ websites, we inform you that we may pass on your requests to exercise your rights to our Customers so that they can deal with your request.
Legal reminder:
The data controller is, within the meaning of the Data Protection Act and the GDPR, the person who determines the means and purposes of the processing. When two or more data controllers jointly determine the purposes and means of processing, they are the joint data controllers (or co-controllers).
The processor is a person who processes personal data on behalf of the data controller, acting under the authority of and on the instructions of the data controller.
Article 3. Contact details of our DPO
Our Data Protection Officer (hereinafter “DPO” ) is available to respond to all requests, including the exercise of rights, relating to your personal data.
You can reach him at :
-by e-mail to the following address: privacy@mediasquare.fr
-Or by post: HAAS AVOCATS – 32 rue de la Boétie, 75008 PARIS
The Data Protection Officer’s role is to inform, advise and monitor Media Square’s compliance with the processing operations carried out via the Platform.
In accordance with data protection regulations, the DPO acts as a point of contact:
-Regarding data subjects for all matters relating to data processing carried out by Media Square or the exercise of your rights;
-Regarding the CNIL as part of its cooperation mission. The DPO may also contact this authority to request an opinion or prior consultation on all subjects concerning the protection of personal data;
-Regarding other DPOs appointed by participating subcontractors or data processors.
Article 4. Collection of data
As part of the provision of the Services, Media Square collects and processes personal data concerning its Customers in order to manage the Services offered. In this case, the data comes directly from the Customers.
For the Server-side header bidding service, MEDIA SQUARE collects Internet user data from its customers.
In the latter case, Media Square collects indirectly from its customers the User ID of Internet users as assigned by its partners. This data is pseudonymized and Media Square does not have access to the concordance tables.
In all cases, you will be informed of the purposes for which your data is collected by us via the various online data collection forms, e-mails sent to you or by you to us, or our Customers’ privacy policies.
Article 5. Consent
As part of our Server-Side Header Bidding service, Media Square’s Customers are responsible for collecting Internet users’ consent to the collection of the data mentioned in Article 7 of the Policy. This obligation in fact results from the data co-processing agreement concluded with our customers in accordance with Article 26 of the GDPR.
As part of its canvassing operations aimed solely at professionals, Media Square ensures that :
-Prospects have received sufficient information on the prospecting operations carried out;
-Prospects are able to oppose prospecting operations simply and free of charge (Opt-Out); and
-The request is related to the solicited person’s profession.
When commercial prospecting operations are aimed at professionals, it is possible for Media Square to carry out this processing without obtaining the prior consent of the person concerned, insofar as the latter has been informed in advance and is able to object to the processing in accordance with the recommendations formulated by the CNIL.
Article 6. Purposes and legal basis of processing
Where the legal basis for the processing operations carried out by Media Square is the pursuit of a legitimate interest, you may, on request, obtain information on the balancing of interests.
Your data is collected by Media Square to ensure :
-The smooth operation and continuous improvement of the Platform, its functionalities and the Services it offers;
Treatment details
Our monitoring of t h e proper functioning and improvement of the Platform and Services covers the following processing operations:
-Managing the security of the Platform and Services;
-Dashboard management ;
-Server-Side Header Bidding service management.
Legal basis
Our legitimate interest in providing you with quality and secure Services to meet your needs. Processing relating to the Server-Side Header service
-Customer and partner management ;
Treatment details
Customer and partner management covers the following processes:
-Contract management ;
Commercial follow-up of customer and partner relations.
Legal basis
Our legitimate interest in providing Customers and Partners with the best possible commercial relationship and ensuring the highest quality of our services.
-BtoB marketing operations management;
Treatment details
Our processing for the management of marketing operations includes :
-BtoB prospecting campaigns (email, telephone);
-Event organization and management.
Legal basis
Our legitimate interest in promoting and developing our commercial activity.
-Recruitment management ;
Treatment details
Our recruitment processing includes the operations necessary for the management and follow-up of your applications (organization of interviews, technical tests, etc.).
Legal basis
Execution of pre-contractual measures.
-Management of accounting and related operations ;
Treatment details
Our accounting processing includes :
-Invoice editing ;
-Foreign exchange management ; Billing follow-up and reminders;
-General corporate accounting ;
The publication of non-nominative statistics relating to Media Square’s activity.
Legal basis
Our legal obligation under Articles L102 B et seq. of the French Tax Code.
-Managing requests for rights arising from the GDPR and the amended Data Protection Act.
Treatment details
This processing covers all operations necessary for the follow-up of rights requests sent to Media Square (qualification of the request, investigations, carrying out of specific technical operations, etc.). It only concerns cases where Media Square acts as data controller.
Legal basis
Our legal obligation arising from Articles 15 et seq. of the GDPR and Articles 48 et seq. of the Loi Informatique et Libertés.
Article 7. Processed data
The compulsory or optional nature of the personal data collected and the possible consequences of a failure to reply are indicated at the time of their collection(s) on the associated forms. You can consult the details of the personal data we may hold on you below.
NB: the detailed information provided below is not intended to be exhaustive and aims above all to inform Users about the categories of data that Media Square is likely to process.
For the proper operation and ongoing improvement of the Platform, its functionalities and Services, the following data may be processed:
-Customer identity data : surname, first name, professional e-mail address;
-Customer connection logs to the Platform.
-Internet user data: The Internet user’ s userID as assigned by our Partners. Please note that this data is pseudonymized and that Media Square does not possess concordance tables.
To manage our customers and partners :
-Data relating to the identity of Customers and Partners: surname, first name, business details (e-mail address and telephone number), company ;
-Data relating to t h e use of our Services by our customers: accounts managed, date of last contact.
For the management of BtoB marketing operations:
-Data relating to the identity of Customers, Prospects and, where applicable, journalists invited to our events: surname, first name, business details (email address and telephone number), company, position;
-Data relating to our prospecting activities: accounts managed, date of last contact.
For application management :
-Data relating to the Candidate’s identity: surname, first name, age, date and place of birth, personal e-mail address, personal telephone number, photo, family situation;
-Information about the Candidate’s personal life: hobbies, motivation to apply ;
-Data on the candidate’s educational background: diplomas, distinctions, skills ;
-Details of the applicant’s professional background: position, company, professional references ;
-Any other personal data provided by the Candidate as part of the recruitment process.
To manage accounting and related operations :
-Customer and partner identity data : surname, first name, business details (e-mail address and telephone number), company, position;
-Data relating to the use of our Services: revenues generated by advertising campaigns.
-Payment data: direct debit, information on the nature of transactions carried out.
To manage your requests to exercise your rights :
-Data relating to your identity: title, surname, first names, address, telephone number, e-mail addresses, customer code, date of birth. A copy of an identity document or equivalent may be kept as proof of the exercise of a right of access, rectification or opposition, or to meet a legal obligation. In this respect , we are obliged to verify your age when you place an order, and to do so we must collect a copy of an identity document.
-Information relating to your request to exercise your rights
In any event, Media Square undertakes to process all data collected in compliance with the GDPR and the French Data Protection Act.
Article 8. Recipients
Within the limits of their respective responsibilities and for the purposes set out i n article 6, the main people who may have access to your data are as follows:
-Authorized staff in our technical, sales, administrative, legal and IT departments, responsible for improving our services, customer relations and prospecting;
-The authorized personnel of our subcontractors, particularly our IT service providers;
-Our partners’ authorized personnel;
-Financial organizations (banks, etc.) and supervisory bodies ;
-Where applicable, the relevant courts, mediators, chartered accountants, auditors, lawyers, bailiffs and debt collection agencies.
Your personal data will not be communicated, exchanged, sold or rented without your express prior consent in accordance with the applicable legal and regulatory provisions.
Article 9. Data transfers outside the European Union
In some cases , your personal information will be stored on servers located outside the European Union.
This is particularly the case when we transfer information to some of our Partners or subcontractors located in the United States.
We have taken appropriate measures to ensure that your data is kept securely via the contractualization of standard contractual clauses approved by the European Commission (art. 46 GDPR).
You may request access to documents ensuring appropriate contractual guarantees by sending a request to our Data Protection Officer by e-mail to privacy@mediasquare.fr or by post to HAAS AVOCATS – 32 rue de la Boétie, 75008 PARIS.
Article 10. Data retention period
We keep your data only for as long as is necessary for the purposes described in article 6.
For information, click below for more details on legal retention periods.
-For the proper operation and ongoing improvement of the Platform, its functions and Services, data enabling customers to be identified on the Platform is kept for the duration of their registration, and then for three years for intermediate archiving.
Logging of customer actions on the Platform is kept for a period of six months, except for operations considered sensitive by Media Square for fraud prevention purposes, in which case the retention period will be extended to a maximum of 6 years.
-To manage commercial relations with our customers and partners
Data used to manage the commercial relationship with our Customers and Partners is kept for as long as is necessary t o fulfill the contract, and for 3 years from the end of the commercial relationship for commercial prospecting purposes.
This data is then archived for a period of 5 years for evidentiary purposes.
-To manage the Server-side header bidding service
The data used to manage the Server-side header bidding service is kept for as long as it takes to fulfil its purpose, after which it is deleted.
-For managing BtoB marketing operations
Data used for marketing purposes is kept for a period of 3 years from the end of the commercial relationship if you are a customer, or from your last contact if you are not yet a customer.
-To manage accounting and related operations
Invoices and accounting data are kept for 10 years from the date of issue.
The accounting trace of payments is kept for a period of 10 years in intermediate archiving from the date of actual payment (cf. article L123-22 of the French Commercial Code).
In the context of pre-litigation management, data is deleted as soon as the dispute has been settled out of court or, failing that, as soon as the corresponding legal action has become time-barred. Data collected and processed in the context of litigation must be deleted when ordinary and extraordinary legal remedies are no longer available.
-For the managing your applications
Your data will be kept for a period of two years from the date of your last contact. It may be kept for a longer period with your consent.
-To manage your requests to exercise your rights
Data relating to the management of requests for rights are kept for as long as is necessary to process the request. They are then archived for the duration of the applicable criminal statute of limitations, i.e. six years, in intermediate storage.
Article 11. Your rights
In accordance with the Data Protection Act and the GDPR, you have the following rights (find out more):
-right of access (article 15 GDPR), rectification (article 16 GDPR, update, completeness of your data;
-right to erasure (or “right to be forgotten”) of your personal data (Article 17 GDPR), when they are inaccurate, incomplete, equivocal, outdated, or whose collection, use, communication or storage is prohibited ;
-right to withdraw your consent at any time (Article 7 GDPR);
-right to limit the processing of your data (Article 18 GDPR);
-right to object to the processing of your data (Article 21 GDPR) ;
-right to portability of the data you have provided to us, where your data is subject to automated processing based on your consent or on a contract (Article 20 GDPR);
-right not to be subject to a decision based exclusively on automated processing (Article 22 GDPR); no such decision-making is currently applied by Media Square ;
-the right to determine what happens to your data after your death, and to choose whether or not we pass on your data to a third party designated by you (article 85 of the LIL). In the event of your death, and in the absence of any instructions from you, we undertake to destroy your data, unless its retention is necessary for evidential purposes or to meet a legal obligation.
You can exercise your rights:
-by e-mail to privacy@mediasquare.fr
-by mail to HAAS AVOCATS – 32 rue de la Boétie, 75008 PARIS.
Finally, you may also lodge a complaint with the supervisory authorities, in particular the CNIL or any other competent authority.
Article 12. Security
Media Square complies with the GDPR and the French Data Protection Act regarding the security and confidentiality of your data.
We implement all necessary technical and organizational measures to ensure the security of our personal data processing and the confidentiality of the data we collect.
In this respect, we take all necessary precautions, in view of the nature of the data and the risks presented by the processing, to preserve security and, in particular, to prevent data from being distorted, damaged or accessed by unauthorized third parties (physical protection of premises, authentication procedures for persons accessing data with personal and secure access via confidential identifiers and passwords, secure https protocol, logging and traceability of connections, encryption of certain data, etc.).