Personal Data Protection Policy

BPCE-IT, in its capacity as data controller, is committed to ensuring that the collection and processing of personal data carried out through this website comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

BPCE-IT may request internet users, via forms, to provide mandatory personal information (indicated by an asterisk), such as their last name, first name, contact details, and email address, in order to process their request. Failure to provide this information will prevent the request from being processed or will delay its handling.

Each form limits the collection of personal data to what is strictly necessary (data minimization) and specifies in particular:

• The objectives of collecting this data (purposes);
• Whether the data is mandatory or optional for managing the request;
• Who will have access to it: BPCE-IT and, where applicable, its processors (unless specified on the form when transmission to a third party is necessary to manage the request);
• The user’s data protection rights and how to exercise them with BPCE-IT.

Personal data collected as part of the services offered on the website is processed using secure protocols, allowing BPCE-IT to manage the requests received within its IT applications.

The collected data is retained for the time necessary to process it. The stated duration covers the retention period both in the active database and in intermediate archives.

Process	Purpose	Legal Basis	Retention Period
All contact forms (unsolicited applications, contact or information requests)	Responding to an information request sent to BPCE-IT	Legitimate interest in responding to an inquiry	24 months after the request is closed
DPO contact form	Responding to a specific request	Legal obligation	5 years after the request is closed

Users are informed that they have the right to access, object to, rectify, and erase data concerning them. Regarding personal data processing managed by BPCE-IT, for any information or to exercise their rights, users may contact the Data Protection Officer (DPO) by sending an email to the following address: BPCE-IT_DPO_B@bpce-it.fr.

Notes :

• Requests made within the context of a banking relationship with one of Groupe BPCE’s banks must be addressed exclusively to the Data Protection Officer of the relevant institution, whose contact details can be found on their respective website.
• Data subjects have the right to lodge a complaint with a supervisory authority responsible for the protection of individuals with regard to the processing of personal data. In France, the supervisory authority is: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy TSA 80715 – 75334 PARIS Cedex 07.