Personal Data Protection

BPCE SA, acting as data controller, is committed to ensuring that the collection and processing of personal data carried out from this website comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

BPCE SA may require users to provide mandatory personal information through forms, indicated by an asterisk, such as their first name, last name, contact details, and email address, in order to process their request. Failure to provide this information may prevent the request from being processed or delay it.

Each form limits the collection of personal data to what is strictly necessary (data minimization) and specifies in particular:

• the purposes for which this data is collected;
• whether this data is mandatory or optional for managing the request;
• who will have access to it (BPCE SA and, where applicable, its processors/subcontractors, unless otherwise specified on the form when transmission to a third party is required to manage your request);
• the user’s data protection rights and how to exercise them with BPCE SA.

Personal data collected within the framework of the services offered on the website is processed using secure protocols and enables BPCE SA to manage the requests received in its IT applications.

The collected data is retained for the time necessary for its processing. The indicated duration covers the retention period both in the active database and in intermediate archives.

Process	Purpose	Legal Basis	Retention Period
All contact forms	Répondre à une demande d’information auprès de BPCE	Intérêt légitime à répondre à une sollicitation	24 mois après la clôture de la demande
DPO contact form	To respond to a specific request	Legal obligation	5 years after the request is closed
Document orders	To send the ordered document	Legitimate interest in responding to an inquiry	24 months after the request is closed

For any information or to exercise your Data Protection rights regarding your personal data managed by BPCE SA, you may contact its Data Protection Officer (DPO):

• By mail:

BPCE – Site AI, Digital & Payments

To the attention of the Data Protection Officer

7, promenade Germaine Sablon

75013 PARIS

• By email at: delegue-protection-donnees@bpce.fr with the subject line “Site AI, Digital & Payments”

If you believe, after having contacted us, that your rights regarding your data are not being respected, you may file a complaint with a national supervisory authority, namely in France the Commission Nationale de l’Informatique et des Libertés (CNIL), whose postal address is as follows:

CNIL

3, place de Fontenoy

TSA 80715 75334 – PARIS CEDEX 07