ASPOOL DATA PRIVACY AND PERSONAL DATA PROCESSING POLICY

Version 0.6 updated on 01 April 2021

Regardful of your privacy and the protection of the personal data you provide it, ASPOOL undertakes to comply with applicable legislation covering privacy and personal data protection, in particular the European general data protection regulation. The purpose of this privacy policy (hereinafter “Privacy policy”) is:

• to allow you to communicate your personal data in a trusting and confidential manner when you use our web sites and/or mobile applications,
• to inform on how the data collected using our web sites and/or mobile applications is processed,
• to inform on the measures taken to guarantee the confidentiality and security of your personal data
• to guide you in your related rights.

ARTICLE 1 – DATA COLLECTION

ASPOOL, of which the registered office is located at ZAC de la Rouvellière, 72700 Spay, has several web sites (hereinafter “Web sites”) of which the list is below:

• Abriblue brand institutional Web site: www.abriblue.com/
• Stérilor brand institutional Web site: www.sterilor.com/
• Stérilor online sales Web site: www.boutique.sterilor.com/

ASPOOL also has one mobile application available for download on the Google (Android platform) and Apple (iOS platform), download platforms.  This application (hereinafter “Applications”) has specific general terms and conditions of use:

• Sterilor XP Application

ASPOOL therefore collects and processes your personal data, namely the information used to directly or indirectly identify you, in the following cases:

• When you browse the web sites,
• When you create a personal account and/or login to it,
• When you make a purchase,
• When you contact it, in particular using the contact form, by phone, by email or any other electronic means,
• When you apply for a job or an internship,
• When you subscribe to an emailing list

Some of the personal data you may be asked for is compulsory. The compulsory nature of the data you are asked for is indicated by an asterisk, the remaining data being optional. When applicable, the failure to provide compulsory personal data leads to it being impossible to access all the services on the Web site in question.
When the data is required by law or to fulfil the contract between us, and the data is not provided, it has an impact on our capacity to fulfil the contract. In that case, we may terminate your contract after having informed you.

ARTICLE 2 – DATA CATEGORIES

Depending on the processing, your personal data that may be collected and processed is the following:

Identification data:

• Title/surname/first name,
• Date of birth,
• Email address,
• Postal address,
• Country
• Phone number,
• Online account access password
• Login / user name

Economic information   

• Bank details

Professional life

• Position, company/business

Connection data

• Timestamps, IP address, browsing history, visit sequence, operating system, information on the devices you use to access the Web site and/or Application

ARTICLE 3 –  PURPOSE AND LEGAL BASIS FOR PROCESSING, RETENTION PERIOD

Below are the purposes and legal basis for our personal data processing:

Purpose of the processing	Legal basis for the processing	Personal data processed	Retention periods
Customer account and prospect management (account opening, order tracking, delivery management)	Contract fulfilment (or pre-contractual fulfilment for account creations)	Identification data Economic and financial information	Duration of the contractual relationship and 5 years maximum from its end on intermediate archiving
Campaign and communication operations Management on customer accounts (loyalty, special offers, catalogue management, miscellaneous information)	The legitimate interest of ASPOOL in developing its activity and communicate important information	Identification data Connection data	Duration of the contractual relationship and 5 years maximum from its end for customers or 3 years from the last contact for prospective accounts
Emailing campaign management for prospects	Consent of the person in question	Identification data Professional life	Until withdrawal of consent or 3 years after the last contact
Incoming request from professionals management	Consent of the person in question	Identification data Professional life	Until withdrawal of consent or 3 years after the last contact
Email distribution list subscription management	Consent of the person in question	Identification data	Until withdrawal of consent or 3 years after the last contact
Incoming requests from private individuals management	Consent of the person in question	Identification data	Until withdrawal of consent or 3 years after the last contact
Creation of statistics	Legitimate interests	Identification data Connection data	10 years from the last purchase date
Improvement of proposed services, service development, Web site operation and security	Legitimate interests	Identification data Connection data	10 years from the last purchase date
Invoicing and accounts management	The requirement to fulfil our legal obligations	Identification data Economic and financial information	10 years from the end of the fiscal year
Rights management for the people in question	The requirement to fulfil our legal obligations	Identification data	10 years from the registration date in our systems
Team recruitment process management and monitoring	Consent of the person in question	Identification data Professional life	Until withdrawal of consent or 2 years after the last contact
Send data for our customers or prospects who have opened accounts to other Nextpool Group consulting companies (see list below)	Legitimate interest of the Group as part of its single information system management	Identification data Professional life Economic and financial information	For customers: Duration of the contractual relationship and 5 years maximum from its end or until consent is withdrawn. For prospects: Until withdrawal of consent or 3 years after the last contact
Send contact details of users who have contacted us to ASPOOL local dealers to take charge of their request	Consent of the person in question	Identification data	Until withdrawal of consent or 3 years after the last contact

ARTICLE 4 – DATA RECIPIENTS

The personal data collected by ASPOOL is not sold to third parties. However, ASPOOL may share collected personal data with other entities, namely:

• The authorised members of ASPOOL customer services (After-sales, sales administration, accounts) as well as certain Nextpool Services support services (marketing, IT, trade) are recipients of personal data as part of the performance of missions resulting from the purposes identified in article 3.
• Assuming an acquisition of ASPOOL, the purchaser;
• Its subcontractors and service providers in charge of certain functions on its behalf (hosting, maintenance, sending of communications, after-sales department operation, etc.).
• Court officers, legal officials, public authorities, jurisdictions, administrative authorities when necessary from the initiation, exercise and defence of legal action.
• The other Nextpool Group companies, namely:
  • ALBON: 1 rue du Rhône 26140 Saint-Rambert d’Albon – France
  • NEXTPOOL SERVICES : Immeuble LE BOIS DES CÔTES, 300 Route Nationale 6, 69760 Limonest – France
  • ALBIGES: Parc d’activité Millau Viaduc, Avenue des Fialets 12100 MILLAU – France
  • NEXTPOOL IBERICA: C/ PAPIRO 3-5, – POLIGONO INDUSTRIAL “LA CANTUEÑA” (FUENLABRADA) – Spain

ASPOOL reserves the right to disclose your personal data to other parties when an applicable law or regulation, a court order or a regulation imposes or authorises it to do so, or if the disclosure is necessary as part of an investigation or a procedure on the national territory or in a foreign country.

As a rule, the collected personal data is not intended to be transferred outside the European Union. However, these transfers occur in compliance with applicable regulations and we have made sure that these transfers comply with the transfer mechanisms provided for by the GDPR. Below is the list of applications and subcontractors (outside the European Union) we use to provide you our services. These services are operated by Nextpool Services on behalf of ASPOOL, its sister company:

Supplier name	Reason for the transfer	Supplier country of origin
Salesforce CRM	Customer relationship management and mass and/or automatic emailing	United States, Privacy Shield Certification
Hubspot CRM	Customer relationship management and mass and/or automatic emailing	United States, Privacy Shield Certification
Zapier	Data automation	United States, Privacy Shield Certification
Services Google	Audience measurement, Sterilor XP application user account management	United States, Privacy Shield Certification

ARTICLE 5 – SECURITY

ASPOOL takes reasonable precautions to protect your personal data and applies the best industry practices to make sure it is not lost, misused, browsed, disclosed, modified or destroyed inappropriately.
If your personal data is breached resulting in a risk for the rights and freedoms of the persons in question, be aware that ASPOOL has a duty to notify the relevant controlling authority and to inform you of any breaches of personal data likely to result in a high risk for your rights and freedoms as quickly as possible, so that you can take the necessary measures.

ARTICLE 6 – COOKIE POLICY

We use cookies and tracers to provide you our services and measure our web site use. All the details of how we use cookies and how you can oppose their use are to be found on the pages of our web sites covering cookies.

ARTICLE 7 – YOURS RIGHTS

If you no longer wish to receive communications from ASPOOL (exercise of the right to oppose or the withdrawal of an existing consent), you can inform us of the fact by clicking on the unsubscribe link featured in every communication or by sending us an email to the following address: contactrgpd@nextpool.com.

Similarly, if, after having given your consent to the transfer of your data to Nextpool Group companies, you wish to reverse your decision and no longer receive communications from them, you can withdraw your consent by sending us an email to the following address: contactrgpd@nextpool.com. An incident declaration form is also available for you to use: https://nextpool.lpages.co/incident-rgpd/

Furthermore, you can access your data, correct it or have it erased. In certain circumstances, you also have a right to portability and a right to limit the processing of your data or to oppose the processing, as well as a right to be forgotten and a right to define post mortem directives (Consult the cnil.fr web site for more information about your rights). When the processing is based on your consent, you also have the right to withdraw such consent.

To exercise these rights, or for any questions about how your data is processed in this system, you can contact our Data Protection Officer using one of these means made available to you:

• electronically at the following address: contactrgpd@nextpool.com or using the form available at this address: https://nextpool.Ipages.co/incident-rgpd/
• by post by sending a letter to:
  • Data Protection Officer – Nextpool Services – Parc activité LE NORLY – Immeuble LE BOIS DES CÔTES, 300 Route Nationale 6, 69760 Limonest France

To allow ASPOOL to answer quickly, please indicate your surname, first name and email and postal addresses. You will then be sent an answer within one month of receipt of the request, except in special cases.
If, after having contacted ASPOOL, you consider that your data privacy rights have not been respected, you can make an online complaint to the CNIL (French data privacy watchdog).

ARTICLE 8 – CHANGES TO THE PRIVACY POLICY

ASPOOL reserves the right to modify or more generally update this privacy policy at all times without notice. Any substantial changes will be notified on the Web site and/or by email when applicable. We suggest you read this page regularly to stay informed of any changes made to the Privacy Policy.