Data privacy

As a Data Controller, Eviden is responsible for the overall processing of your personal data on the EcoDesignCloud website to enable you to access and use the tool's services. As part of the protection of your personal data you have several individual rights, such as the rights of accessibility, portability, rectification, and deletion. To find out more about the management and the compliance of your data and your rights, please consult the " privacy policy ".

EcoDesignCloud is a trusted Cloud platform developed to help the organisation to eco-designed products by calculating the Eco Score and the environmental impact at each stage of the product life cycle, developed by Eviden (registered trademark of BULL SAS, a subsidiary of Atos SE, and adheres to the Atos group Privacy Policy).

To create an account and use the tool's services, EcoDesignCloud needs to collect and process some of your personal data.

As a data controller, Eviden recognizes the importance of protecting its customers' data. Eviden implements technical and organizational measures to ensure the security and conformity of data compliance for personal data processing, as well as the confidentiality of such data.

The protection of personal data is stated by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals regarding the processing of personal data and the free movement of such data (GDPR).

For more information about Eviden's practices, please refer to our privacy policy: Eviden | Privacy Policy.

This personal data management policy provides you with the information you need to understand the various processing operations we carry out to fulfil our mission and provide you with the most appropriate services.Definitions

• "Personal data" is any information that relates to an identified or identifiable living individual.
• "Processing" (collection, recording, organization, storage, adaptation, modification, extraction, consultation, use, communication by transmission or dissemination or any other form of making available, reconciliation) refers to either an operation or a set of operations which is performed on personal data.

These data processing operations are carried out under the responsibility of a "data controller". A data controller is a person who determines the purposes and means of a processing operation, in other words, the objective and how it is carried out.

Identity and contact details of the data controller

The data controller is Eviden, whose head office is located at 80 Quai Voltaire, Bezons, 95780.

Identity and contact details of the Data Protection Officer (DPO)

Eviden has appointed a Data Protection Officer whom you may contact at the following address:

80 Quai Voltaire, 95870 BEZONS, France

Notice the letter "to the attention of the Atos/Eviden Data Protection Officer."

Legal basis and purposes of processing

The legal basis for processing is what legally authorises its implementation, which gives an organisation the right to collect or use personal data.

The consent represents the free, informed, specific and unambiguous agreement of the data subject to the collection and use of his or her data.

The performance of a contract : Recourse to this legal basis presupposes that the processing is objectively necessary for the performance of a contract between the organisation processing the data and the data subjects.

Data subjects and categories of personal data collected by the EcoDesignCloud website of Eviden

There are two categories of individuals for whom the EcoDesignCloud website will collect data: users and suppliers.

For the users, to benefit from the platform's services, users must create an account. To do this, these personal data are collected:

• First and last name
• E-mail address
• Professional information (job title, geographical area, brands for which the user works)
• Bank details. When paying for a subscription to EcoDesignCloud, Stripe records the user's credit card details. No banking data is collected and recorded by the EcoDesignCloud website.

To obtain help and support, the EcoDesignCloud website uses Live Chat, we collect the following personal data:

• Email address
• Data subject name

Some suppliers will have to subscribe for their users. To do so, they must create an account and register for a subscription. For this purpose, we collect the following personal data:

• Company contact details
• Company bank details
• Contact information (surname, first name, e-mail address)

Suppliers must then create users. For each user created, we collect the following personal data:

• Last name
• First name
• E-mail address
• Professional information (job title, geographical area, brands for which the user works)

When paying for a subscription to EcoDesignCloud, our partner Stripe records bank details relating to the user's credit card. No banking data is collected and recorded by the EcoDesignCloud website.

Your personal data can be collected directly when you fill out the registration or contact form on the website, for instance.

EcoDesignCloud and Eviden undertake to keep the personal data communicated by the user only for as long as is strictly necessary for the purposes stated above, and in any event within the limits imposed by law.

Regarding data collected for the creation of accounts to sign up for a subscription, the processing period for personal data is defined, as a minimum, according to the duration of the subscription. In the event of inactivity, user accounts are automatically deleted after two years of inactivity.

Please note that the account used for the subscription will remain active as long as a user of the company remains active.

Users may request deletion of their account at any time.

Eviden and the EcoDesignCloud website do not keep bank details.

Data Recipients

Depending on usage, the personal data collected and processed may be transmitted to the following recipients:

Google: Data collected through the site is hosted in Western Europe.

Live Chat: Data collected through the chat is hosted in Frankfurt, Germany, at Eviden's discretion
Data Storage and Hosting Policy (livechat.com)

Stripe: Banking data is collected and processed by Stripe, a PCI Service Provider Level 1 certified solution.

Okta: Some data is stocked for the user base (login/password) in Western Europe.

Data transfer outside the European Union

Eviden stores personal data collected within the European Union. However, some data may be transferred to the United States through Eviden's partner Google.

Some tools such as Google Analytics, if consent has been established, may retrieve personal data, and transfer it to the United States.

In such cases, Eviden undertakes to implement appropriate safeguards to control any transfer of personal data.

Individual Data Rights

Following current European regulations, data subjects have the legitimate rights to:

• The right of access (to access their personal data).
• The right of rectification (to rectify inaccurate or incomplete information concerning them).
• The right to be forgotten (erasure) (they have the right to ask an organization to delete their personal data).
• The right of data portability (the possibility of recovering part of their data in a machine-readable format).
• The right to object (they have the right to object at any time to an organization's use of some of their data).
• The right to restrict the processing of your data (they have the right to ask an organization to temporarily freeze the use of some of their data).

The rights referred to in this paragraph may be exercised by contacting the Data Protection Officer at the following address:

80 Quai Voltaire, 95870 BEZONS

With the letter noticed: "to the attention of the Atos/Eviden Data Protection Officer."

In this case, data subjects must specify the concern of their request and provide proof of their identity.

If Eviden does not respond within one month of their request to exercise their rights, or if data subjects feel, after contacting us, that their rights regarding the data policies have not been respected, they may complain with the CNIL at the following address:

CNIL - Service des Plaintes - 3 place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

Do we use automated decision-making?

As a matter of principle, we do not use fully automated decision-making processes such as profiling. If this were to change, you would be informed.