Last update : 31.05.2019

Consultation of Colas Group Stakeholders

Dear Colas Group stakeholders,

We are pleased 4 share with you our personal data protection policy concerning personal data protection policy concerning personal data that we may need to process in the context of our consultation of Colas stakeholders, implemented through the Cap Collectif platform https://myopinion.csr-colas.com.

This policy is presented in a question-and-answer format.

It briefly describes the personal data concerning you in our possession and the uses that we make of such data.

It also reminds you of your specific rights in terms of personal data and explains how to exercise them.

Your questions - your rights

Who acts as Data Controller as regards my personal data?
Why do you need my personal data?
On what legal basis do you use my personal data?
How did you collect my personal data?
What categories of personal data do you collect about me?
Are you using a service provider (data processor) to process my personal data?
Do you share my personal data with other entities?
Do you hold any sensitive data about me?
Are my personal data transferred outside the European Union?
Where are my personal data stored geographically?
How long will you keep my personal data?
Will my personal data be used to make automated decisions or profiling?
What are my rights concerning my personal data?
What happens if I object the processing of my personal data or if I withdraw my consent?
How can I exercise my rights and who should I contact?

1. Who acts as Data Controller as regards my personal data?

The Data Controller is :

Colas SA
1, rue du Colonel Pierre Avia
75015 Paris, France

Registration number: RCS Paris (France): 552 025 314

Colas' Chief Privacy Officer (CPO) is your contacts person as regards any information you may have on this document.

You can contact our CPO by email using this address: dataprivacy@colas.com.

2. Why do you need my personal data?

We need these personal data to communicate with you as part of our stakeholder consultation, to enable you to use the Cap Collectif platform and to process the results.

The use of personal data intended to enable managing user participation and quantitative and qualitative analysis of contributions to the https://myopinion.csr-colas.com,
To identify you on these systems and terminals,
Managing your user account on the platform including authentication procedures and forgotten password, as well as processing possible requests you may have (to finalize registration, your email address must be confirmed, and it will not be made public. On your request, we can also send you our newsletter.

These data will also enable us to keep you informed of developments at Colas and within the Colas Group.

3. On what legal basis do you use my personal data?

We use your data within the consultation on the basis of your consent. Thus, by participating in the consultation, you consent to the processing of your personal data under the conditions set out in this personal data policy.

You can withdraw your consent at any moment by deleting your user account through the Cap Collectif platform or by contacting the Chief Privacy Officer of Colas at the address indicated under Question 1.

4. How did you collect my personal data?

The personal data concerning you that we process are collected as follows:

Personal data you may communicate to us with within the consultation;
Technical data relating to your use of the Cap Collectif platform (IP addresses, cookies, connection and usage logs, etc.);
Your contact data may have been provided to us by Coals employees who are in contact with you.

5. What categories of personal data do you collect about me?

We process the following categories of personal data:

registration data and information required for participation: in order to register, you must provide a name or a username and an email address, and create a password. Optionally, you can also indicate your status ( I am a client – prospect / a Bouygues group employee (except Colas)/ a competitor / an elected representative / a student - a teacher / a supplier – subcontractor / a journalist - blogger / a resident near a Colas facility / a road or rail user / I work in an administration - state agency or instance / in a consulting company / in a NGO / association / in a financial organization / in a scientific organization / in a union) and your geographical area (list: Africa, America, Asia/Oceania, Europe, France). Finally, to register, you will be asked to confirm that you are not a robot (reCaptcha technology).
your public profile data (your name or selected username indicated at the time of registration will be visible both on the platform and on your profile presentation page, which you are welcome to expand. Should you wish so, you can edit and customize your profile by adding a profile photo, a biographical note, your location, your website and links to your profiles on the social networks)
whenever you use the Cap Collectif platform, the technical connection and navigation data (IP addresses, connection and usage logs, etc.) are automatically collected on the platform;
contributions: Personal data that you may provide as part of your responses to the consultation. You are welcome to participate in the platform's activity by posting personal contributions. Such contributions will shed light on the positions of the platform's participants. Unless otherwise specified – their content, date and time are made public, and are linked to your profile.
cookies. Please refer to our cookie policy.

6. Are you using a service provider (data processor) to process my personal data?

Yes. In order to carry out their tasks, our service providers need to access some data concerning you.

These service providers include:

our supplier Cap Collectif, the designer and operator of the consultation platform;
our data hosting provider OVH.

The Colas IT subsidiary, which provides and supports the IT resources of Colas.

7. Do you share my personal data with other entities?

Yes. Our supplier and IT service providers have access to the processed personal data as part of the consultation.

We provide these persons only with data that are necessary for them to carry out their duties.

We do not use your personal data for commercial purposes.

8. Do you hold any sensitive data¹ about me?

The consultation is not intended to collect sensitive data concerning you.

9. Are my personal data transferred outside the European Union²?

No. We do not transfer your personal data outside of the European Union.

10. Where are my personal data stored geographically?

Your personal data are stored within the European Union.

11. How long will you keep my personal data?

We keep your personal data until the earliest of the following dates:

deletion of account; or
withdrawal of your consent; or
3 years.

We may also keep your personal data (without effectively using them) to exercise our rights in legal actions as claimants or defendants until the expiry of the statute of limitations.

12. Will my personal data be used to make automated decisions or profiling³?

No.

13. What are my rights concerning my personal data?

Your rights concerning your personal data are the following:

right of access. This means that you can ask us directly whether we hold personal information about you; and to be informed of all these personal data. This right of access allows you to check the correctness of the data, and, if necessary, to ask us to correct or delete them, if they are inaccurate or outdated.
right to rectification. You can ask us to correct inaccurate information concerning you. Based on this right, you can prevent us from distributing or processing incorrect information about you.
right to erasure. You are entitled to request the deletion of some of your data, under certain conditions, listed in Article 17 of the Regulation.
right to object to the processing of your data. You are entitled to object, for legitimate reasons, that your personal data should be distributed, transmitted or stored.
right to restriction of processing. This right entitles you to request that only the necessary data should be processed by the data controller.
right to data portability. You can recover some of your data in an open, machine-readable format (electronic format).Your data can thus to be easily stored or transmitted from one information system to another for reuse.
right to withdraw at any moment your consent to the processing of your data (if your data are processed based on your consent);
port-mortem rights. You are entitled to give instruction as regards what will happen to your personal data after your death. You may modify these instructions at any time.

Note: These rights are not absolute; you can exercise them within the prescribed legal framework and the scope of these rights.

In some cases, we will not be able to grant your request (legal obligation, public interest, etc.). In this case, we will inform you of the reason(s) for such refusal.

For more information about your rights please contact the French data protection authority (CNIL). You may find information (in French) on their website.

14. What happens if I object to the processing of my personal data or if I withdraw my consent?

Since the processing of your personal data within the Colas stakeholders’ consultation is based on your consent, upon the withdrawal of your consent:

your Cap Collectif account will be deleted;
the personal information provided in response to the consultation will be deleted or anonymized;
your personal data will be removed from our list of stakeholders;
we will no longer contact you in connection with the stakeholder consultation or its conclusion;
your participation in the consultation will be anonymized or deleted.

15. How can I exercise my rights and who should I contact?

To exercise your rights, please contact Colas' Chief Privacy Officer (CPO)

By email: dataprivacy@colas.com or

By mail to our headquarters:

Colas SA
To the attention of the Chief Privacy Officer
1, Rue du Colonel Pierre Avia
75015 Paris, France

If, after contacting us, you consider that your rights regarding the protection of personal data have not been observed, you can file a complaint with the National Commission for IT and Freedoms (CNIL).

In France, the competent authority is the CNIL (https://www.cnil.fr/fr/agir).

¹ Within the meaning of the Regulation, sensitive or special data are:

Personal data relating to the racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union affiliation, genetic personal data, biometric data used for uniquely identifying a natural person, personal health data or personal data on the sex life or sexual orientation of a natural person; and
Personal data relating to criminal convictions and offenses.

² As at 05/17/2019, the European Union countries include the following: Germany, Austria, Belgium, Bulgaria, Cyprus, Croatia, Denmark, Spain, Estonia, Finland, France, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Poland, Portugal, Netherlands, Czech Republic, Romania, United Kingdom, Slovakia, Slovenia and Sweden.

³ Profiling means any form of automated processing of personal data consisting in the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

Business ethics