Data protection
policy

Clause 1 – Definitions

For the application of this data protection policy (hereafter the “Data Protection Policy”), the terms below have the following meaning when they are used with an initial capital, regardless of whether they are conjugated, and whether they are used in the singular or in the plural:

  • “Personal data” : data through which a physical person can be identified, either directly or indirectly
  • “Arkhênum” : a simplified limited company formed under French law, with capital of €26,240, headquartered at 7 rue Joseph Bonnet, CS 22075 33072 Bordeaux Cedex, France, registered on the Bordeaux Trade and Companies register under the number SIREN 422 085 480 RCS Bordeaux
  • “Website” : the website operated by Arkhênum which can be accessed at https://www.arkhenum.com/
  • “User” : any person who accesses the Website and/or uses its features
  • “Contract” : contract for the provision of services entered into with Arkhênum for the purpose of preserving and digitising heritage and industrial documents
  • “Customer” : any person who has entered into a Contract with Arkhênum
  • “Prospective Customer” : any person potentially interested by the services provided by Arkhênum, but who is not an Arkhênum customer

Clause 2 – Application of the Data Protection Policy

Protecting the privacy and Personal Data of Users, Prospective Customers and Customers is of the utmost importance to Arkhênum. Arkhênum is careful to adopt a strict Data Protection Policy in line with current legislation and to comply with it. The aim of the Data Protection Policy is to inform Users, Prospective Customers and Customers of how Arkhênum collects and processes their Personal Data. Users, Prospective Customers and Customers can access the Data Protection Policy via the Website, and are invited to read it regularly. Arkhênum reserves the right to amend its Data Protection Policy at any time, and any new version will replace the previous version from the time it is first made public on the Website. If the User, Prospective Customer or Customer is a minor aged under eighteen (18) years or does not have legal capacity, they declare that they have secured in advance permission from their parents or legal representatives for Arkhênum to collect and process their Personal Data. If the User, Prospective Customer or Customer is a minor aged under fifteen (15) years, processing of their Personal Data on the basis of consent is subject to the consent of the minor in question and of the person(s) with parental responsibility for the minor. Arkhênum undertakes to comply with the provisions of French law no. 78-17 on data protection dated 6 January 1978 and regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46.

Clause 3 – Personal Data collected

3.1. Personal Data supplied by Users, Prospective Customers and Customers

  • Via forms accessible on the Website

Personal Data collected by Arkhênum on its Website is data supplied voluntarily by the User in order to be contacted by Arkhênum in view of a project, to send a speculative application or in response to a job offer published on the Website.

This Personal Data is :

  • Where required, to be contacted by Arkhênum: the User’s contact details (family name, given name, email address, telephone number (landline and/or mobile)); company name; any Personal Data provided in the free text field by the User when contacting Arkhênum.
  • If applicable, to make a speculative application or respond to a job offer published on the Website: the User’s contact details (family name, given name and email address); all data included on the CV provided; all Personal Data communicated in the free text fields by the User.

Personal Data marked with an asterisk during the data collection process is required and must be supplied to Arkhênum. If the User does not supply this Personal Data, Arkhênum will be unable to contact the User who has submitted the request, or to reply to online applications made by the User.

  • Other than via the forms accessible on the Website and/or via a Customer Account

For the purposes of drawing up a detailed quotation for the various document conservation and enhancement services offered by Arkhênum and then, if applicable, of entering into, performing and overseeing the Contracts signed, Arkhênum will collect, as appropriate to the service, the following Personal Data:

  • The User, Prospective Customer or Customer’s full contact details: family name, birth name, given name, postal address, business landline and/or mobile number, business email address.
  • The data required to create a Customer Account: company name, business name, family name and given name of the contact person, email address, telephone number and postal address.
  • Data relating to the Contract: transaction number, service(s) purchased, Customer relationship history, correspondence with Customer and the customer service department, discussions with and comments from Customers.
  • Data relating to the payment of invoices: entities invoiced, invoicing address(es), payment methods, discounts granted, payments received, balances and outstanding payments.
  • If applicable, in order to draw up the quotation, data concerning the User or Prospective Customer’s geographical location (which may vary depending on the services required): arrival address and departure address for documents to be processed, planned date of service provision.

Personal Data marked with an asterisk or indicated by Arkhênum as mandatory during the data collection process is required and must be supplied to Arkhênum. If this Personal Data is not supplied, Arkhênum will be unable to provide detailed quotations or engagement letters and if applicable to perform and oversee the Contracts entered into.

Depending on the specific situation in the departure or arrival countries in question, or in the event of legal or regulatory changes, additional Personal Data not provided for in the Data Protection Policy and which cannot be foreseen may be required for the performance of the Contract.

In such a situation, Arkhênum will make a specific request to the Customer. This additional Personal Data will be treated in the same way as the Personal Data listed in this Data Protection Policy and always in accordance with the Data Protection Policy.

3.2. Personal Data from cookies

Personal Data is also collected from Users via cookies placed on the device used by the User when accessing the Website (computer, tablet, mobile phone, smartphone), subject to the User’s agreement, which they can change at any time.

Cookies are small volumes of information stored on the Web browser of the device used by the User (computer, tablet, mobile phone or smartphone). Cookies can be permanent or temporary. Permanent cookies are stored on the User’s device for a maximum of thirteen (13) months. Temporary cookies disappear at the end of each browsing session.

When cookies are used, certain User data may be collected and processed, such as the User’s IP address or other mobile online identifiers.

The cookies used on the Website are varied and serve several different purposes.

3.2.1. Cookies used on the Website

(i) The cookies that do not require the User’s prior authorisation are as follows:

  • Strictly necessary cookies: these cookies do not store any information from which the User can be personally identified. They are however essential in order to browse the Website and use its features. These cookies are generally only defined in response to actions requested by the User, which equate to service requests, such as when the User configures their privacy preferences, connects to the Website or completes forms. For example, authentication and security cookies are used to identify and recognise registered Users and to enable them to access the requested content or features.
  • Functionality cookies: these cookies help the Website to function more smoothly and enable Users to use all the Website features and supply improved and personalised features, in particular by memorising connection data (IP address), User preferences, etc. These cookies are defined by Arkhênum or by its third-party suppliers whose services it has added to its pages. For example, these cookies make it possible to display the Website in French or in English depending on the User’s Web browser.

Although the User’s prior consent is not required to place these cookies, the User may, at any time, set their browser to block them or inform the User of their presence (see point 3.2.2.i).

However, if the User deletes these cookies, they may no longer be able to access the Website or use its features.

Arkhênum assumes no responsibility or liability for the consequences should the Website operate incorrectly because Arkhênum has been unable to save or read these cookies.

(ii) Cookies that can only be placed with the User’s prior consent are analysis and performance cookies. These cookies are used to monitor the Website and create audience statistics for it in order to improve the way it operates, in particular by measuring the number of visitors, the pages browsed, the time spent by the User on the Website, the type of browser used, the pages from which the User accessed the Website, the search engine used to access it, and the User’s geographical location when they accessed the Website. All the information collected by these cookies is combined together and is therefore anonymous.

Arkhênum secures the User’s prior consent before placing these cookies.

The User can withdraw their consent for the placing of these cookies at any time, and set their browser to block them or inform the User of their presence (see point 3.2.2). Blocking these cookies does not affect the Website’s features. However, if they are deactivated it will be impossible to collect information regarding how the User has browsed the Website and offer tailored content on this basis.

3.2.2. Users’ choices regarding cookies

(i) Refuse all cookies or only cookies for which the User’s prior consent is required, via the User’s browser.

Users can set their browser so that cookies are stored on their terminal, or conversely so that they are rejected, either systematically or depending on the sender.

Users can also set their browser so that they are asked to accept or reject cookies on a case-by-case basis, whenever a website tries to store a cookie on the terminal.

The User may at any time change their browser settings to accept or refuse all or certain cookies, and block or delete the cookies that have already been placed on their browser.

Cookie management settings differ depending on the browser used. Users should consult their browser’s help menu to find out how to change their cookie preferences:

Users can also use the website of the Commission Nationale de l’Informatique et des Libertés (French data protection agency, hereafter “CNIL”) to obtain information on settings for the most commonly used browsers at the following address : http://www.cnil.fr/vos-droits/vos-traces/les-cookies/conseils-aux-internautes/ or refer to their browser’s “Help” menu.

Using this information, the User can block all cookies or only block certain cookies for which their prior consent is required, with the consequences that are liable to be caused by blocking cookies, as set out above.

(ii) Refuse only the cookies for which the User’s prior consent is required using an opt-out link.

Users can click this opt-out link: Google Analytics : Google Analytics : https://tools.google.com/dlpage/gaoptout?hl=fr

Clause 4 – Personal data processing

4.1. Data controller

Arkhênum is the data controller for the Personal Data of Users, Prospective Customers and Customers.

4.2. Data Protection Officer

The Data Protection Officer appointed by Arkhênum is Laurent Onaïnty. For all questions relating to the Data Protection Policy and for all requests and questions relating to Personal Data, Customers, Prospective Customers and Users should contact the Data Protection Officer directly. His contact details are as follows:

  • Email address : e.fremau@arkhenum.fr
  • Telephone : + 33 (0)5 57 02 10 65
  • Postal address : Service Marketing, 7 rue Joseph Bonnet, 33100 Bordeaux, France

4.3. Purposes of processing

Personal Data belonging to Users, Prospective Customers and Customers is processed for operational purposes, which vary depending on the services concerned, and are as follows: contacting Users and Prospective Customers who have submitted a request via the Website; processing speculative applications and replies to job advertisements sent by Users; sending out newsletters to Users, Prospective Customers and Customers who have registered for them; processing requests for quotations received from Users and Prospective Customers, sending the quotations and contacting the Users and Prospective Customers once the quotation has been drawn up; replying to questions and complaints from Users, Prospective Customers and Customers and providing customer services to Customers; performing Contracts and informing Customers about the progress of the services they have entrusted to Arkhênum under Contracts; creating and managing Customer Accounts: the Personal Data will be used to identify the Customer and enable them to access certain features of the Customer Account, and in particular the progress of the services entrusted to Arkhênum; take payments from Customers; manage unpaid invoices and Customer disputes; carry out direct marketing operations such as contacting Users, Prospective Customers and Customers with sales proposals and news; carrying out satisfaction surveys; organising promotions; analysing the Personal Data of Users, Prospective Customers and Customers in order to supply them with tailored sales proposals and information; testing and improving the Website and the services offered; managing requests from Customers, Prospective Customers and Users to access, rectify, delete, limit or object to the processing of their Personal Data, or for data portability; check the information communicated by Customers, Prospective Customers and Users.

4.4. Direct marketing

Except where the User or Prospective Customer has expressly given their prior consent, Arkhênum undertakes not to use their Personal Data for direct marketing purposes, and in particular to send promotional messages, news updates, newsletter registrations or for any other informational purposes.

Arkhênum informs its Customers that its Personal Data will be used to send direct marketing messages relating to services similar to those supplied by Arkhênum. Other than in this context, Arkhênum undertakes to obtain the Customer’s express prior consent.

At any time, Users, Prospective Customers and Customers may opt not to consent to receiving direct marketing messages, or withdraw their consent, by clicking the opt-out link provided in the sales prospection emails sent to them or by altering their Customer Account settings.

4.5. Legal basis for processing

Personal Data processing is required to perform the Contract and/or carry out actions before entering into the Contract at the request of the Customer or User (requesting a quote, submitting an application, etc.).

Personal Data processing carried out for the purposes of direct marketing is based on express prior consent by the User, Customer or Prospective Customer. When direct marketing relates to services similar to those already supplied to the Customer, the Personal Data processing is based on Arkhênum’s legitimate interest in developing its business relationships with its Customers.

Lastly, Personal Data processing for specific purposes such as carrying out satisfaction surveys, analysing Personal Data to supply sales proposals and relevant information or testing and improving the Website is based on Arkhênum’s legitimate interest in developing and managing its business relationships with Customers, Users and Prospective Customers.

4.6. Recipients of Personal Data

The recipients of the Personal Data of Users, Prospective Customers and Customers collected by Arkhênum are the accredited staff in the Arkhênum customer services, marketing, recruitment, human resources and/or sales departments, as well as accredited staff working for sub-contractors used by Arkhênum who require access to the Personal Data in order to fulfil their roles, and in particular transport service providers, IT service providers, technical service providers, payment services providers, debt collection agencies and credit companies.

Customers’ Personal Data may also be communicated to Helvetia, an insurance company with which Arkhênum works, if the Customer has taken out the insurance policy offered by Arkhênum.

If required for the performance of the Contract, Customers’ Personal Data is liable to be communicated to accredited staff in Arkhênum subsidiaries or to accredited staff of international agencies with which Arkhênum works in partnership (in countries in which Arkhênum does not have subsidiaries), and to their sub-contractors, in accordance with the provisions of article 6 of the Data Protection Policy.

Arkhênum undertakes not to divulge the Personal Data of Customers, Prospective Customers and Users to any other third party, except with the explicit prior consent of the Customer, Prospective Customer and/or User, or in the circumstances listed below:

  • it may be necessary for Arkhênum to divulge the Personal Data of Customers, Prospective Customers and Users for legal reasons within the context of a court case, dispute and/or any claim made against it,
  • it may also be necessary for Arkhênum to divulge this Personal Data if it believes that to do so is necessary or appropriate for national security reasons, in application of the law or for another reason relating to the public interest,
  • it may also be necessary for Arkhênum to divulge this Personal Data if it believes that to do so is reasonably necessary to comply with this clause or protect its business or the Customer, User or Prospective Customer,
  • in the event of a company restructure, Arkhênum may legitimately transfer all Personal Data to its rights holder.

4.7. Personal Data retention period

The Customer’s Personal Data will be retained for the full duration of the performance of the Contract to ensure that Arkhênum and any sub-contractors can perform it appropriately.

The Customer’s Personal Data required to establish proof of the Contract will be retained for a period of five (5) years after the service for the Contract was entered into has been completed.
The Customer’s Personal Data collected when the Customer takes out an insurance policy will be retained for the duration of this insurance policy, and for the period necessary to manage any claim in connection with it.

Personal Data relating to the Customer Account will be retained for three (3) years from the last time the Customer uses the Customer Account. Once this period of time has elapsed, the Customer will be considered to be inactive and their Customer Account will be disactivated automatically.

The Customer’s Personal Data required by Arkhênum to fulfil its accounting obligations will be retained for a period of ten (10) years after the accounts for the year in question have been closed.
The Customer’s Personal Data used for direct marketing purposes will be retained for a period of three (3) years after the contractual relationship ends.

The Personal Data of Prospective Customers and Users who have not entered into a Contract with Arkhênum used for direct marketing purposes will be retained for three (3) years from the date it is collected on the Website. Once this period of three (3) years has elapsed, Arkhênum may recontact the User or Prospective Customer to establish whether they would like to continue receiving marketing messages.

Personal Data collected via cookies will be kept for thirteen (13) months from the date it is collected on the Website.

In the case of an unsuccessful application, Arkhênum may inform the User that it would like to keep their file, and in doing so give them the option of having it destroyed. If the User does not require Arkhênum to destroy their file at that time, the User’s Personal Data will automatically be destroyed two (2) years after the last contact with the User. Once the period necessary for the purposes for which the Personal Data of Customers, Prospective Customers and Users was processed has elapsed, Arkhênum undertakes to destroy or anonymise it.

Clause 5 – Rights of Users, Prospective Customers and Customers

Data protection legislation grants Users, Prospective Customers and Customers various rights as described below.

The right to access entitles Users, Prospective Customers and Customers to access Personal Data relating to them on a permanent basis.

The right to rectification entitles Users, Prospective Customers and Customers to update inaccurate or incomplete Personal Data relating to them.

The right to object entitles Users, Prospective Customers and Customers to object to the processing of their data, if they have legitimate grounds to do so.

The right to restrict processing entitles Users, Prospective Customers and Customers to restrict the processing of their Personal Data within the limits laid down in the legislation.

The right to data portability entitles Users, Prospective Customers and Customers to receive Personal Data relating to them and that they have supplied to Arkhênum and to communicate it to another data controller, within the conditions laid down in the legislation.

The right to have data erased entitles Users, Prospective Customers and Customers to have their Personal Data erased within the limits laid down in the legislation.

Users, Prospective Customers and Customers can at any time withdraw the consent they have given Arkhênum to process their Personal Data.

Users, Prospective Customers and Customers also have the right to make provisions for what should happen to their Personal Data after their death by issuing directives (general or specific) relating to the retention, deletion or communication of their Personal Data after their death.

Users, Prospective Customers and Customers are informed that they have the right to freely appoint a person responsible for the implementation of these directives and that they can amend or revoke the directives at any time.

Users, Prospective Customers and Customers can exercise their rights to access, rectify, delete, object to or limit the processing of their data, to data portability and to define directives relating to the retention, deletion or communication of their Personal Data after their death or communicate their decision to withdraw their consent by contacting Arkhênum:

  • by post at: Arkhênum, Délégué à la Protection des Données, Service Marketing, 7 rue Joseph Bonnet, CS 22075 33072 Bordeaux Cedex, France
  • by email at : e.fremau@arkhenum.fr

Arkhênum will ensure that it responds to requests from Customers, Prospective Customers and Users within a reasonable amount of time, and always within the timeframes laid down in the legislation.

To guard against abusive requests, Arkhênum will take all appropriate precautions to check the identity of the person from whom the request is received, before complying with their request if it is appropriate to do so.

Users, Prospective Customers and Customers also have the right to lodge a complaint with the CNIL and to bring legal action against Arkhênum in the competent courts if they observe that Arkhênum has infringed their data protection rights. If an infringement is observed, the User, Prospective Customer or Customer can claim full compensation for the prejudice suffered.

Lastly, Users, Prospective Customers and Customers have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Clause 6 – Security of Personal Data

6.1. Security and privacy measures

Arkhênum will employ its best efforts, taking all appropriate measures, to ensure that the Personal Data of Users, Prospective Customers and Customers is kept secure and private, so that it is not damaged, deformed or accessed and used inappropriately by unauthorised third parties. If a Customer believes that their Customer Account has been used inappropriately, they should contact Arkhênum immediately by emailing : e.fremau@arkhenum.fr

Arkhênum takes technical and organisational measures to guarantee appropriate security for the Personal Data of its Customers, Prospective Customers and Users, including in particular: management and access controls for Personal Data; installation of IT monitoring software on the Arkhênum network; use of firewall appliances to protect IT networks; installation and use of anti-virus software and firewalls; back-up and encryption of Personal Data; access to servers restricted by a login, a password and a secure virtual private network (VPN); regular evaluation of the integrity of protection systems; encryption of digital communications sent to Arkhênum’s partners; protection of current hard copy documents; storage of old physical files in secure archiving warehouses.

6.2. Transfer of Personal Data outside the European Union

Customers’ Personal Data may be transferred outside the European Union when such a transfer is strictly necessary to perform the Contract. Recipients of Customers’ Personal Data located in countries outside the European Union are listed in article 4.5 of the Data Protection Policy. Arkhênum will ensure that these transfers of Personal Data outside the European Union are carried out in accordance with its Data Protection Policy. When the country outside the European Union to which the Personal Data is to be sent has not been officially recognised by the European Commission as offering an adequate level of protection, Arkhênum undertakes to supply the appropriate guarantees to protect its Customers’ Personal Data, in accordance with article 46 of the General Data Protection Regulation, in particular through the use of standard contract clauses approved by the European Union. In addition, Arkhênum will ensure that Customers always have enforceable rights and the legal means to exercise them.