Data Protection Policy
The Corsican Chamber of Commerce and Industry (CCI) undertakes to ensure that the processing of personal data carried out on its website https://ajaccio-tinorossi-port.cci.corsica complies with the General Data Protection Regulation (GDPR) and the amended French Data Protection Act.
The purpose of this policy is to set out the policy applied by the Corsican Chamber of Commerce and Industry (hereinafter referred to as the CCI of Corsica) regarding the protection of personal data processed on its website https://ajaccio-tinorossi-port.cci.corsica.
These explanations are provided in the most transparent and accessible way possible, so that you can understand the circumstances under which your data is processed.
The collection and processing of personal data relating to users, prospective clients and staff members by the Corsican Chamber of Commerce and Industry (CCI) are necessary for the purposes of its activities.
General Protection of Personal Data
A. The principles of protection
1.Loyalty and transparency
The Corsican Chamber of Commerce and Industry informs those concerned about each processing operation carried out by means of information notices.
Wherever possible – that is, except in cases where the data must remain confidential – no data is collected without the knowledge of the individuals concerned.
- Legitimacy and proportionality
Personal data is processed for specific purposes that are intended to be legitimate, specific and explicit.
The Corsican Chamber of Commerce and Industry is committed to upholding the principle of proportionality. All data collection will be adequate, relevant and limited to the data necessary for the purposes of the processing.
Where possible, the data will be updated and procedures will be put in place to enable its erasure or rectification (in the case of inaccurate data).
- Features of the protection
2. Purposes and legal bases
Legal basis for processing:
- Legitimate interest pursued by the Corsican Chamber of Commerce and Industry (CCI) in relation to the following processing operations:
- General publications, in particular those relating to the organisation of the Corsican Chamber of Commerce and Industry,
- Consent of the individuals concerned
- Cookies requiring consent,
- The preparation and publication of certain content,
- Data-specific characteristics
B. Data processing
The data processing carried out by the Corsican Chamber of Commerce and Industry may involve the following categories of data:
- Civil status, identity, identification data, images
- Personal life
- Economic and financial information
- Login details
- Location data
- Other
- Data source
The sources of the data processed may be, depending on the circumstances:
– staff at the Corsican Chamber of Commerce and Industry,
– contributors to publications,
– website users,
– certain service providers
- The mandatory nature of data collection and the consequences of failing to provide data
Some of the data collected, particularly that relating to posts or certain cookies, may be optional.
Data collected for other purposes is mandatory unless otherwise stated at the time of collection.
- Automated decision-making
The processing operations carried out do not involve automated decision-making.
- People affected
The individuals affected by the processing are as follows:
– staff at the Corsican Chamber of Commerce and Industry (CCI) responsible for publishing content and the technical administration of the websites.
– the people identified in the publications
– users of websites managed by the Corsican Chamber of Commerce and Industry
– staff responsible for hosting, site maintenance and video streaming.
- Recipients of the data
C. Categories of recipients
As regards content published by the Corsican Chamber of Commerce and Industry, the general public is the intended audience for all or part of the information.
Subject to their respective needs, the following are the recipients of all or part of the data:
– staff at the Corsican Chamber of Commerce and Industry (CCI) responsible for publishing content and the technical administration of the websites, and their line managers; ;
– staff at the Corsican Chamber of Commerce and Industry (CCI) responsible for processing enquiries received via the contact forms;
– service providers responsible for hosting, website maintenance and video streaming;
– users of the websites managed by the Corsican Chamber of Commerce and Industry;
– staff responsible for overseeing the security of the Corsican Chamber of Commerce and Industry’s information systems.
- Data transfers
We would like to draw your attention to the fact that, as they are published on the internet, the content on our website may be accessible outside the European Union.
In its capacity as Data Controller, the Corsican Chamber of Commerce and Industry (CCI) is the recipient of the data collected and subsequently gathered. We would also like to inform you that, for the purposes of the Corsican Chamber of Commerce and Industry’s (CCI) activities, certain information may be passed on to certain service providers.
- Retention periods
Without prejudice to the statutory limitation periods, the retention periods are as follows:
– time taken to prepare the publications: 13 months
– data relating to communications with service providers: 13 months
– data collected via forms: 13 months
– log data: 13 months
– information about cookies: please see the cookie policy available on our website (https://ajaccio-tinorossi-port.cci.corsica/politique-cookies/)
- Data security
Data security is a major concern for the Corsican Chamber of Commerce and Industry. To this end, technical and organisational measures have been put in place in line with the sensitivity of the data collected.
The purpose of these measures is to ensure the confidentiality and integrity of the data, but above all to protect it against any malicious intrusion, loss, alteration or disclosure to unauthorised third parties.
Despite these measures, data security and confidentiality depend above all on everyone following best practice; this is why the Corsican Chamber of Commerce and Industry strongly urges everyone concerned to remain vigilant.
- Subcontracting
The Corsican Chamber of Commerce and Industry (CCI) may use service providers in certain areas. Where this is the case, the data provided to such service providers is limited to that which is strictly necessary for the intended purpose. Furthermore, the CCI of Corsica will only disclose such data after receiving a commitment and sufficient guarantees from the service provider regarding data security and confidentiality.
Special protection of personal data
A. Rights of data subjects
You have certain rights regarding the processing of your personal data. The Corsican Chamber of Commerce and Industry (CCI) takes this matter very seriously, and endeavours to process your data as transparently and fairly as possible, taking into account the circumstances and the specific context.
1. How to exercise your rights
For any information or to exercise your data protection rights concerning the processing of personal data managed by the CCI de Corse, you may contact our Data Protection Officer by writing to dpo@cci.corsica or to the following postal address: DPO, CCI de Corse, Quai du Nouveau Port, 20200 Bastia, taking care to prove your identity and to indicate precisely your surname, first name and address for the reply.
- Diversity of rights
B. Right to question
Under the right of access, you may ask whether any personal data concerning you is being processed, as well as for information regarding the purpose of any such processing and any transfers of such data.
You may also request access to this data, as well as any information regarding its source.
However, this information must not infringe copyright or intellectual property rights.
A copy may be provided to you, but this may be subject to payment of a fee not exceeding the cost of reproduction.
- Right of access
Under the right of access, you may enquire as to whether or not your data is being processed. If so, you may request a copy of the data and information relating to you, namely:
- The objectives,
- The categories of personal data concerned,
- The recipients or categories of recipients, where applicable, and the international organisations to which the data have been or will be disclosed, in particular if they are located in third countries,
- The shelf life, or, at the very least, if this cannot be determined, the criteria used to determine it,
- Your right to rectification, erasure, restriction or objection,
- Your right to lodge a complaint with a supervisory authority,
- Information regarding the source of personal data where such data is not collected directly,
- The existence of automated decision-making, including profiling (where applicable, information relevant to the underlying logic and the possible consequences of such processing).
- Right to rectification
This right allows you, if your personal data is out of date, incorrect or incomplete, to request that it be rectified or supplemented.
- Right to erasure
In certain cases, as provided for by the legislation and regulations in force, you may ask the Corsican Chamber of Commerce and Industry to erase your personal data.
The Corsican Chamber of Commerce and Industry emphasises that this right is not a general right. Indeed, the legislation and regulations provide for restrictions on this right.
- Right to restriction
You have the right to request, in the circumstances provided for by law and regulations, that the processing of your personal data be restricted.
- Right to data portability
You may request that your personal data be transferred to another data controller. However, this right is not a general right; it is subject to certain legal and regulatory restrictions.
Firstly, it is limited in terms of the processing operations concerned, but also in terms of the data concerned. Some of the data held by the CCI of Corsica is not portable.
- Right to object
You have the right to object; this means that you may, at any time and on grounds relating to your particular situation, object to the processing of your personal data. This right is, however, limited to processing carried out on the basis of the legitimate interests pursued by the Corsican Chamber of Commerce and Industry (CCI).
If you exercise this right, the Corsican Chamber of Commerce and Industry will ensure that it no longer processes your data, unless it can demonstrate the existence of legitimate and compelling grounds for continuing to process it. These grounds must override your interests, rights and freedoms.
If the processing is necessary for the establishment, exercise or defence of legal claims, the right to object does not apply.
You may opt out of personalised marketing.
- Right to withdraw consent
Some processing operations may be based on your consent. Naturally, you may withdraw this consent at any time. In that case, without affecting the lawfulness of any processing carried out prior to your withdrawal, the Corsican Chamber of Commerce and Industry will cease to process your data.
- Right to set guidelines post-mortem
You may set out specific instructions regarding the retention, erasure and disclosure of your data following your death.
These guidelines will apply only to processing carried out by the Corsican Chamber of Commerce and Industry and will be limited to that scope alone.
Once a person has been appointed by Decree, you will also be able to set out general guidelines.
- Right of appeal
You also have the right to lodge a complaint with the CNIL at cnil.fr/plaintes or by post at the following address: Commission nationale de l’informatique et des libertés, Service des plaintes, 3 Place de Fontenoy, TSA80715, 75334 PARIS CEDEX 07
- Possible changes
This policy may be subject to updates. The Corsican Chamber of Commerce and Industry therefore encourages you to check it regularly.