Personal Data Protection Policy

1. PURPOSE

This Policy informs you about how your personal data is collected and used by HAVAS PARIS, a public limited company with a board of directors, with capital of €160,528, headquartered at 29/30 quai de Dion Bouton, 92800 Puteaux (hereinafter referred to as “the Agency”), in its capacity as data controller, through the use of the NEWDEAL website available at www.newdealhavas.com.

This Policy is accessible from our homepage and at the bottom of each page of the website.

For more information about our Group’s data protection approach, we invite you to consult our Group Privacy Policy.

You may also review our website’s Terms of Use.

2. DEFINITIONS

The terms below have the same meaning whether used in singular or plural:

“Personal data”: any information relating to an identified or identifiable individual, directly or indirectly, as defined by regulation;
“Data subject”: the individual whose personal data is being processed by Havas Paris;
“Regulations”: the regulations in force in France applicable to the processing of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”) and the amended French Data Protection Act No. 78-17 of 6 January 1978 (“Informatique et Libertés”)
“Data controller”: the person or entity that determines the purposes and means of processing personal data in connection with a product or service. “Processor”: the person or entity that processes personal data on behalf of the controller;
“Site”: the NEWDEAL website, available at URL’s address newdealhavas.com (the “site”);
“Processing”: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. HOW DO WE PROCESS YOUR PERSONAL DATA?

While you browse and interact with the Site, we may collect and process data about you for the management of activities carried out on our own behalf, in our capacity as data controller.

Our agency is committed for respecting each individual’s rights to privacy and data protection—be they clients, suppliers, partners, applicants, prospects, or visitors. We comply with the following regulatory principles:

Process your personal data in a fair, lawful, and transparent manner.
Collect your personal data for explicit, specified, and legitimate purposes, and not process it further in a way that is incompatible with those purposes.
Ensure that the personal data collected is relevant, proportionate, and not excessive in relation to the purposes for which it is collected and processed. Personal data may be anonymized where possible and appropriate, depending on the nature of the data and the associated risks of the intended use.
Keep your personal data accurate and up to date, where necessary. We will take reasonable steps to rectify or delete any inaccurate or incomplete data.
Personal data will be retained only for as long as necessary for the purposes for which it was collected and processed.
The processing of personal data will be carried out with respect for individuals’ rights.
Technical, physical, and organizational measures are in place to secure your data and prevent unauthorized access, unlawful processing, and accidental or unauthorized loss, destruction, or damage.
Process your personal data in compliance with the legal bases for processing, including obtaining your consent where required.

4. WHAT TYPES OF PERSONAL DATA DO WE COLLECT?

As data controller, we process personal data only after properly informing you. This may include:

Identification data: first and last name, email address;
Connection data: IP address;
Browsing data and expressed preferences: traffic history, cookies, and trackers.

We do not collect sensitive personal data or special categories of data.

Generally, access to our website is reserved for adults, except under exceptional circumstances.

5. PURPOSE, LEGAL BASIS, AND RETENTION OF YOUR DATA

In accordance with applicable regulations, the personal data we collect is used solely for the purposes for which it was collected and for the duration specified in the table below.

The processing activities we carry out have the following purposes, legal bases, and retention periods:

Purpose	Legal Basis	Retention Period
Subscribe to New Deal news & events	Consent	Duration of your subscriptionto New Deal
Manage website cookies & trackers	Consent / Legitimate interestHAVAS PARIS (technical cookies)	Durations specified in the website’s cookie policy
Handle contact requests	Legitimate interest of HAVAS PARIS	As long as needed to process the request
Reporting and securing access to websites	Legitimate interest of HAVAS PARIS	6 months to 1 year
Exercising your rights regarding personal data	Legal obligation	1 to 6 years depending on the request

In the event of a dispute or legal proceedings, particularly judicial ones, initiated before the end of the above-mentioned retention periods and requiring the preservation of personal data – particularly for the establishment, exercise, or defense of legal claims – such data will be retained for the duration of the proceedings and until all legal avenues of appeal have been exhausted.

6. WHO HAS ACCESS TO YOUR DATA?

Your personal data may be disclosed, based on the roles and authorizations of recipients and only when necessary for the performance of their duties, to staff in the following departments, depending on the specific purposes pursued:

Internal recipients: Communication, Digital, and IT departments.

External recipients: The Site’s hosting provider and any duly authorized service providers we may engage to carry out our activities, as well as public authorities, legal representatives, and judicial officers where applicable.

7. DATA TRANSFERS

We prioritize the transfer of personal data within Europe. However, your personal data collected and processed for the purposes described above may, in certain cases, be transferred to companies outside the European Union.

Some of these countries offer an adequate level of data protection.

In other cases, please note that transfers of your personal data to entities outside the European Union are governed by the implementation of appropriate safeguards to ensure the confidentiality and security of the data during transfer. In this context, we may enter into contractual clauses with the recipients of such data, in line with the recommendations of the European Commission, to ensure that appropriate safeguards are in place for the protection of said data.

8. SECURITY & PROCESSORS

Particular importance is given to the security of personal data.

To this end, appropriate technical and organizational measures have been implemented, tailored to the nature of the personal data, in order to ensure its integrity and confidentiality, and to protect it against malicious intrusion, loss, alteration, or disclosure to unauthorized third parties.

When a data processor is engaged, personal data is only shared after obtaining assurances of their ability to meet required security and confidentiality standards, and after entering into a written contractual agreement.

9. SOCIAL MEDIA

The Site may provide links to social media platforms. If you follow these links, you will leave the Site. HAVAS PARIS does not control these social networks or their privacy and data protection practices, which may differ from our own. We disclaim any responsibility for their content and their handling of personal data.

Any personal data you choose to provide through these platforms, or that may be collected by third parties, is not covered by this Site’s Personal Data Protection Policy.

You are encouraged to review the privacy policies of those platforms. By using such links, information about you may be collected or shared. In any case, HAVAS PARIS cannot be held liable for any third-party use of your data that falls outside its responsibility. 10. COOKIE MANAGEMENT

The Site’s cookie usage is governed by a separate Cookie Policy, available on the Site.

10. COOKIE MANAGEMENT

The Site’s cookie management is governed by a cookie policy available on the Site.

11. WHAT ARE YOUR RIGHTS REGARDING PERSONAL DATA

HAVAS PARIS is particularly committed to respecting the rights granted to you in connection with the data processing activities it carries out, in order to ensure fair and transparent processing, taking into account the specific circumstances and context in which your personal data is processed.

Your Right of Access

You have the right to obtain confirmation as to whether or not your personal data is being processed, and where it is, the right to request a copy of your data as well as information concerning:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients, and where applicable, any international organizations to whom the personal data has been or will be disclosed—particularly recipients located in third countries;
where possible, the envisaged retention period for the personal data, or if not possible, the criteria used to determine that period;
the existence of the right to request from the data controller the rectification or erasure of your personal data, the right to request the restriction of processing, and the right to object to such processing;
the right to lodge a complaint with a supervisory authority;
information regarding the source of the data, if it was not collected directly from you;
the existence, if applicable, of automated decision-making, including profiling, and in such cases, meaningful information about the underlying logic, as well as the significance and the envisaged consequences of such processing.

Your Right to Rectification of Your Personal Data

You may request that your personal data be rectified or completed if it is inaccurate, incomplete, ambiguous, and/or outdated, depending on the circumstances.

Your Right to Erasure of Your Personal Data

You may request the erasure of your personal data in the cases provided for by applicable regulations.

Please note that the right to erasure is not an absolute right and may only be exercised if one of the conditions set out in the applicable legislation is met.

Your Right to Restriction of the Processing of Your Personal Data

You may request the restriction of the processing of your personal data in the situations provided for by the applicable regulations.

Your Right to Object to the Processing of Your Personal Data

You have the right to object, at any time and on grounds relating to your particular situation, to the processing of your personal data where the legal basis for that processing is the legitimate interest pursued by the data controller.

If you exercise this right to object, every effort will be made to ensure that your personal data is no longer processed in relation to the processing activity in question, unless it can be demonstrated that there are compelling legitimate grounds for continuing the processing. These grounds must override your interests, rights, and freedoms, or the processing must be necessary for the establishment, exercise, or defense of legal claims.

Your Right to Data Portability

You have the right to the portability of your personal data.

It is important to note that this is not a general right. Not all personal data from all types of processing are subject to portability. This right only applies to data that is processed by automated means, and does not apply to manual or paper-based processing.

Additionally, this right is limited to processing operations where the legal basis is your consent or the performance of pre-contractual measures or a contract.

Your Right to Withdraw Your Consent

When the processing of your personal data is based on your consent, you may withdraw that consent at any time.

Upon withdrawal, the processing of your personal data will cease, without affecting the lawfulness of any processing carried out prior to the withdrawal based on your previously given consent.

Your Right to Lodge a Complaint

You have the right to lodge a complaint with the data protection supervisory authority in your country of residence. This right may be exercised without prejudice to any other administrative or judicial remedy you may have.

Your Right to Define Post-Mortem Directives

In accordance with the amended French Data Protection Act of January 6, 1978, you have the option to define specific instructions regarding the retention, erasure, and communication of your personal data after your death. These instructions will be followed in accordance with the conditions outlined below.

How to Exercise Your Rights

You may exercise your rights by contacting the Group Data Protection Officer (DPO):

By email: [email protected]

Or by postal mail:

Data Protection Officer

Havas Group

29/30 Quai de Dion Bouton

92800 Puteaux, France

A response will be provided as soon as possible and, in any case, within a maximum period of one month from the date your request is received. If necessary—taking into account the complexity or number of requests—this period may be extended by an additional two months. You will be informed specifically if such an extension is required.

In the event of a complaint regarding the exercise of your rights, you may contact the competent supervisory authority (CNIL in France).

12. UPDATES TO THIS POLICY

HAVAS PARIS may update this Policy as needed, particularly in response to changes in law, agency practices, or regulatory requirements. The updated version will be published on the Site.

We recommend reviewing it regularly.

If you have questions or comments regarding this Policy, please contact our DPO (see Article 11 above).

Last updated: April 2024