Sopra Steria Group S.A., with a capital of € 20,547,701, registered with the Annecy Company Register under n° 326 820 065, with headquarters located at PAE Les Glaisins, 3 rue du Pré Faucon, Annecy Le Vieux, 74940 Annecy, France, (hereinafter referred to as "Sopra Steria" or "we" or "us") attaches great importance to the protection of Personal data of the users of its Website (hereinafter referred to as "Users" or "You").
Some of the services offered on certain pages of our Website require the processing of Your Personal data. The purpose of this Notice is therefore to give You information on the ways Sopra Steria, as Data Controller, processes Your Personal data through its Website, including the use of cookies. This statement does not cover details relating to job applicants which can be found on our Careers portal (please consult the Candidate Data Protection Notice relevant for the recruitment process) or employees which can be found on our intranet.
This Notice complies with applicable laws including with Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of Personal data and on the free movement of such data (“GDPR”).
Please note that this Notice may be updated from time to time by Sopra Steria. The date of the most recent update will appear on this page. We therefore invite You to consult it regularly.
Contents
- What kind of Personal data do we process about You?
- How is Your Personal data collected?
- What are the Purposes of the processing of Your Personal data?
- Marketing
- Who are the recipients of Your Personal data?
- How do we protect Your Personal data?
- How long do we retain Your Personal data?
- What rights are granted to You?
- Who should You contact to exercise Your rights or if You have any questions?
1 - What kind of Personal data do we process about You?
Depending on the circumstances we may process different categories of Personal data about You which we have grouped together as follows:
- Identification data (including first name, last name, job position etc.)
- Contact data (including email address, telephone number etc.)
- Technical Data including internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices You
use to access this Website
- Profile Data including Your interests, preferences, feedback and survey responses
- Usage Data including information about how You use our Website and Your interactions with marketing content
- Marketing and Communication Data including Your preferences in receiving marketing materials form us or our third parties and Your communication preferences.
2 -How is Your Personal data collected?
We use different methods to collect Personal data about You including through:
Direct Interactions. You may provide Your Personal data when You use one of the following Website features:
- the form to contact us;
- the form to subscribe to marketing communications or events;
- the form to download reports, articles or other online content;
- the platform to attend events run or sponsored by Sopra Steria;
- the form to enter a competition or survey.
Automated technologies or interactions. As You interact with our Website, we may collect automatically Technical Data about Your equipment, browsing actions and patterns which might be used with other identifying data to establish other Personal Information about You. We collect these Data by using cookies, servers’ logs and other similar technologies. Please see our Cookie Policy for further details.
3 -What are the Purposes of the processing of Your Personal data?
The table below describes:
- The Purposes for which we process Your Personal data;
- The Legal bases which legally authorise our collection and further processing of Your Personal data;
- The categories of Personal data We process for each identified Purpose.
| Purposes of the Processing | Legal basis | Categories of Personal Data |
| To reply to Your inquiries/requests for information | Your consent | Identity data
Contact data |
| To let You access and download online content such as whitepapers, reports, articles or other publications | Your consent | Identity data
Contact data
Marketing and communication data |
| To organize promotional activities and deliver marketing materials such as information about our products and services, events etc. | (a) If You are not a customer or prospect, Your explicit consent (opt-in consent) via a checkbox, or by taking a positive step during Your registration to receive this information or subscribe to these services
(b) If You are a customer or prospect (B2B), Your consent via soft opt-in (opt-out consent). | Identity data
Contact data
Marketing and communication data
Usage data
Profile data |
| To allow You to subscribe to our Newsletters | Your consent | Identity data
Contact data
|
| To enable the use of cookies and/or other trackers – provided You agreed to it (except for strictly necessary cookies) – and subject to the terms and conditions detailed under our Cookies Policy | Your consent | Technical data
Usage data |
| To use data analytics to improve our Website, products/services, marketing, customer relationship and experiences | Legitimate interest (to define types of customers for our products and services, to keep our Website updated and relevant, to develop our business and to inform our marketing strategy) | Technical data
Usage data |
| To ensure the security of this Website | Legitimate interest | Technical data
Usage data |
| To meet our legal obligations and defend our interests in the event of a dispute. | We may be subject to legal and regulatory obligations to disclose data and may also have a legitimate interest in using the data to defend ourselves in the event of a legal action | N/A.
It depends on the specific case |
| To allow You to register to an event or webinar etc. via our Website | Your consent | Identity data
Contact data
Marketing and communication data
Profile data
Usage data
|
| To organise competitions or conduct customer satisfaction surveys | Your explicit consent resulting from Your registration/ participation and the execution of the general terms/regulations governing these activities
| Identity data
Contact data
Marketing and communication data
Profile data |
4 -Marketing
4.1 Soft-Opt in & Opt-in
- We do not ask Your consent to send You marketing communications for the promotion of our activities, products or services if You are a customer or prospect (B2B). In this case we use soft opt-in under applicable laws to deliver content to You. This means we do not ask for You to ‘opt-in’ via a checkbox, and instead provide You with the ability to ‘opt out’ at any time.
- If You are not a customer or prospect, we use either Your explicit consent (via an opt-in checkbox), or another positive action, such as completing a registration form.
If you would like to know about Your marketing preferences, please contact contact-corp@soprasteria.com.
We retain Your data for 3 years after the end of the commercial relationship with You or after Your last digital interaction with our organisation after which Your records will be removed from our marketing database.
We may in some circumstances need to share Your Personal data with other Sopra Steria Group subsidiaries for marketing purposes.
However, we will not share Your Personal data with any company outside the Sopra Steria group of companies for marketing purposes without Your consent.
4.2 Opt-out
You can ask us to stop sending You marketing messages at any time by following the opt-out links on our marketing message sent to You, or by contacting us at contact-corp@soprasteria.com. If You opt-out of our communications, we will retain this instruction for a period of 18 months and will only retain Your email address for that period, after which Your data will be deleted.
5 - Who are the recipients of Your
Personal data?
5.1 Internal recipients
Depending on the
specific purpose, Your Personal Data may be processed by internal authorised
personnel (including marketing & communication, sales, administration, HR
and other support functions) of Sopra Steria.
Access to Your Personal
data is limited to the performance of the tasks and functions of authorised
personnel and is subject to an obligation of confidentiality.
5.2 External recipients
Your Personal
data may also be processed by third-party service providers acting on behalf of
Sopra Steria, such as our Website hosting provider or providers of marketing
services. Our Website also contains cookies placed by third parties, as set out
in our Cookie Policy. Please note that all our third-party service
providers are required to take appropriate security measures to protect Your
Personal information in line with our policies and requirements. We only permit
them to process Your Personal data for specified purposes and in accordance
with our instructions.
In addition, we may in some circumstances have to share Your
Personal data with other recipients such as:
- Other Sopra Steria Group subsidiaries;
- Other third parties in connection
with any merger, acquisition, partial sale of assets or other transaction
relating to Sopra Steria or one of the companies in its Group;
- To law enforcement authorities if
required by law, including under a court order, or if such disclosure is
necessary to defend our rights, to prevent fraud or computer crime, or to
ensure the security of Sopra Steria or any other person, where required or
permitted by applicable legal provisions.
Such
disclosure shall be limited to what is strictly necessary to the extent
permitted by applicable law.
5.3 Data sharing outside of the EU/EEA
Given the international dimension of the
Sopra Steria Group, Your Personal data may be transferred to recipients outside
the European Union/European Economic Area (EEA: EU Member States and Iceland, Liechtenstein and Norway),
to countries that do not offer a level of protection up to the EU standard of
essential equivalence. International transfers of Personal data may be
necessary for the performance of Sopra Steria’s business activities and for its
internal administrative management. Sopra Steria ensures that restricted
transfers take place lawfully, using the transfer tools provided for by
applicable regulations and providing appropriate safeguards and protection
measures. You can obtain a copy of these guarantees by sending an email to the
following email address: acces-cnil@soprasteria.com or support.privacy@soprasteria.com.
6 - How do we
protect Your Personal data?
We
have put in place appropriate security measures to prevent Your Personal Information
from being accidentally lost, used or accessed in an unauthorized way, altered
or disclosed. In addition, we have procedures to deal with any suspected or
actual Personal data breach.
Third
parties will only process Your Personal Information on our instructions and
where they have agreed to treat the information confidentially and to keep it
secure.
We
limit access to Your Personal Information to those employees, contractors and
other third parties who have a business need to know.
7 - How long do
we retain Your Personal data?
We will
retain Your personal information for as long as necessary to fulfil the Purposes
we collected it for, including for the Purposes of satisfying any applicable legal
requirements. This means that the retention period may be defined differently
depending on the Purposes pursued by the processing and the specific legal
obligations.
Some of the retention
periods applicable to Personal data collected on our Website are as follows:
- As long as Your User account remains
active,
- As long as we keep in touch with
You through our promotional activities and three (3) years after the last
interaction, unless You object to the processing of Your Personal data,
- As long as required by the
applicable law,
- Cookies and other trackers used on
our Website are retained according to our Cookies policy.
It is
possible that we may need to keep Your Personal data in intermediate archives with
restricted access for evidentiary purposes beyond the above-mentioned periods
to comply with legal obligations incumbent on us or, if necessary and in
consideration of the statute of limitations, to enforce our rights.
Once Your Personal
data is no longer required for the identified Purposes, to meet our legal
obligations or to comply with the applicable statute of limitations, we ensure
that it is completely destroyed or made anonymous.
8 -What rights are granted to You?
Sopra Steria recognizes the importance of data subject rights and
enables individuals to exercise them in the simplest and most effective way.
Accordingly, we are open to Your questions on the conditions of processing of Your
Personal data and to Your requests to exercise the following rights:
- Right
to access and obtain a copy of Your Personal data and
information on how Your Personal data is processed;
- Right
to rectify Your Personal data if it is incorrect and the
right to complete it if it is incomplete;
- Under
certain conditions, right to delete Your Personal data when it is no
longer required for the purposes for which it was collected or processed. You
also have the right to ask us to delete or remove Your Personal data where You
have successfully exercised Your right to object to processing. Please note,
however, that the right to erasure is not absolute. We may not always be able
to comply fully with Your request of erasure due to specific legal obligations
which will be notified to You at the time of Your request.
- Right
to object to the processing of Your Personal data on
grounds relating to Your particular situation, if the processing is based on
Sopra Steria's legitimate interest. You also have the absolute right to object
where we are processing Your Personal data for direct marketing purposes. In
some cases (with the exception of direct marketing), we may demonstrate that we
have compelling legitimate grounds to process Your information which override Your
rights and freedoms;
- Right
to restrict the processing of Your Personal data when You
have exercised Your right to object or rectify Your data pending a response from
Sopra Steria;
- Right
not to be subject to automated processing or profiling in
relation to Your Personal data. Typically, this means decision-making by
automated means, including Artificial Intelligence in order to make business
decisions. Here, You have the right to ask for a living person to be involved
in decision-making. You also have the right to ask us to review any decision
made by automated means.
- Right
to withdraw Your consent to the processing of Your Personal data if
such processing is based on Your consent.
- Right
to opt out of marketing communications. You have the
right to refuse or opt out of marketing communications sent by Sopra Steria,
regardless of whether Your data was
collected and processed based on legitimate interest or consent, by contacting
us contact-corp@soprasteria.com
or by unsubscribing within any email communication we may send to You (found at
the footer of each email).
9 - Who should You contact to exercise Your rights or if You have any questions?
If You wish to exercise any of Your rights, please contact us at: contact-corp@soprasteria.com.
If You have any questions about this Notice please contact us at: acces-cnil@soprasteria.com or support.privacy@soprasteria.com.
Last modified: 13/06/2024