PERSONAL DATA PROTECTION CHARTER

BARNES SAS (hereinafter 'BARNES') attaches great importance to the protection and respect of the privacy and personal data ('Personal Data') of users of its website (hereinafter the 'Site').  

BARNES agrees to implement appropriate measures for the protection, confidentiality and security of Personal Data in accordance with the regulations in force in France and in the European Union, in particular the General Data Protection Regulation EU 2016/679 of 27 April 2016 and the rules of national law adopted for its application.   

Users are informed by this charter (the 'Charter') of the practices and processing necessitated by the collection and use of Personal Data by BARNES as data controller.  

Accordingly, BARNES invites users to read this document carefully to know and understand the processing operations relating to Personal Data.  

It is specified that by browsing the Site, users accept this Charter as well as the general terms and conditions of use.  

ARTICLE 1.           PERSONAL DATA COLLECTED

Users are required to provide their Personal Data in digital format when using the Site.  

1.1   Principles applicable to the collection of Personal Data

In general, users can browse the Site without necessarily having to necessarily communicate Personal Data to BARNES.  

BARNES collects only the Personal Data necessary for the processing it implements ('privacy by design') and ensures such Personal Data a high level of protection ('privacy by default'). In this respect, the processing operations that require the collection of data are as follows:  

• Responding to inquiries (contact forms for requests for visits, estimates, information and/or additional photos of a property);  
• Acting upon a mandate given by the users;  
• Participating in surveys for improving the customer relationship and customer experience of BARNES’ clientele;  
• Sending newsletters, informational or commercial email alerts;  
• Applying for job offers.  

In this case, the personal information at least collected from users are: (i) Last Name(s), (ii) First Name(s), (iii) E-mail Address, (iv) Telephone Number, (v) Mailing Address, (vi) Country.

This Personal Data is then kept for the time necessary to complete the users' request. In the absence actual implementation, it is deleted within the timeframes recommended by the CNIL after three years from its collection by the Site, subject to the legal options and obligations with regard to archiving, obligations to retain certain data and/or anonymization. 

1.2   Site browsing information

When using the Site or certain services linked to the Site, certain data is automatically collected, such as: (i) IP address, (ii) the browser used, (iii) browsing data (date, time, content accessed, search terms used, etc.) and (iv) operating system.  

Among the technologies used to collect this information, BARNES may use 'php' sessions that store each user's data using a unique session ID. These php sessions retain the data in memory only for the duration of the user’s browsing.  

The data collected during browsing is thereby deleted when the user's browser closes or, if applicable, within a maximum period of thirteen months from its collection.  

ARTICLE 2.           LEGAL BASIS FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA

Personal Data is processed by BARNES in the cases authorized by the regulations in force and under the following conditions:  

• Obtaining a free, specific, informed and unambiguous consent from users to the processing of their Personal Data (it is specified that for minors under 18, consent must be given by the legal representative);  
• Collection of Personal Data necessary for carrying out the users' request;  
• Compliance with the legal and/or regulatory obligations to which BARNES is subject (such as anti-fraud and corruption);  
• Protection of BARNES' legitimate interests (such as the protection of the security of its computer network).  

ARTICLE 3.           RECIPIENTS OF THE PERSONAL DATA COLLECTED

Only the authorized personnel of the BARNES group and service providers employed by Barnes may have access to the Personal Data collected and process it, without prejudice to its possible transmission to the bodies in charge of a control or inspection mission in accordance with the legislation and/or regulations in force or for the purpose of responding to a judicial or administrative order. 

Authorized personnel are bound to a duty of discretion.  

BARNES agrees not to sell the Personal Data collected to third parties.  

ARTICLE 4.           TRANSFER OF PERSONAL DATA

Personal Data collected from users of the Site will be stored exclusively in France and will not be transferred outside the European Union.  

In the event that BARNES uses affiliates or service providers located outside the European Union, BARNES agrees to verify that appropriate measures have been put in place to ensure that the users' Personal Data benefits from an adequate level of protection.  

ARTICLE 5.           DATA SECURITY  

BARNES collects and processes users' Personal Data with the utmost confidentiality and in compliance with applicable laws. Users are protected against unauthorized access, modification, disclosure or destruction of their Personal Data.  

When the disclosure of Personal Data to third parties is necessary and authorized, BARNES ensures that such third parties provide the same level of protection to the Personal Data concerned as is offered by BARNES, and requires contractual safeguards to ensure that the Personal Data is processed exclusively for the purposes accepted by users, with the required confidentiality and security (in particular through the standard clauses used by the European Commission, the Binding Corporate Rules ('BCR') or the EU-US Privacy Shield). 

BARNES implements technical and organizational measures to ensure that the retention of Personal Data is secure, and this, for the duration necessary to carry out the specific purposes pursued.  

Users should note that no transmission or storage technology is totally foolproof. 

Therefore, in the event of a proven breach of Personal Data that is likely to create a high risk for the rights and freedoms of users, BARNES will inform the competent supervisory authority of this violation in accordance with the terms and conditions provided by applicable regulations. 

It is the users’ responsibility to exercise caution to prevent any unauthorized access to their Personal Data and particularly to their computer and digital terminals (computer, smartphone, tablet in particular).  

ARTICLE 6.           LINKS TO OTHER WEBSITES

The Site may occasionally contain links to third-party or partner websites that have their own data protection charter.  

BARNES exercises no control over the content of these sites and waives any liability for the use made of the information collected when users click on these links.  

BARNES therefore invites users to acquaint themselves with the data protection policies implemented by the operators of these sites before transmitting any personal information concerning them.  

ARTICLE 7.           RIGHTS OF USERS

Users are reminded that they have the following rights, subject to the limitations provided for by the legislation in force:  

7.1. Right to information on the processing of Personal Data

BARNES agrees to use its best efforts to provide concise, transparent and accessible information on the conditions for processing users' Personal Data. 

7.2. Right of access to Personal Data

Each user may access the Personal Data that is processed by BARNES and has the right to receive a copy in electronic form (for any additional copy, BARNES will be entitled to charge a fee based on the administrative costs incurred).  

7.3. Right to erasure ('right to be forgotten') and to the rectification of Personal Data

Each user has the right to request the deletion and/or rectification of the Personal Data concerning him/her when this is erroneous or obsolete.  

It is specified that BARNES may retain certain Personal Data when required by law or for a legitimate reason.  

7.4. Right to object

Users may object at any time for legitimate reasons to:  

• the use of their Personal Data for direct marketing purposes; or  
• the re-use of their Personal Data for processing other than that agreed to, except if BARNES is performing one of its legal obligations.  

7.5. Right to restriction of processing of personal data

Users have the right to request that the processing of their Personal Data be restricted to what is necessary. This right is applicable only:  

• if the user disputes the accuracy of his or her Personal Data;  
• if the user can establish that the processing of his or her Personal Data is unlawful and requests that its use be restricted rather than deleted;  
• if BARNES no longer needs the user's Personal Data but this is still necessary for the user to establish, exercise or defend legal claims;  
• if the user objects to the processing based on the controller’s legitimate interest, pending the verification whether the legitimate grounds of the controller override those of the user.  

7.6. Right of complaint to a supervisory authority

If users consider that the efforts made by BARNES to preserve the confidentiality of Personal Data do not guarantee the respect of their rights, they may file a complaint with the competent supervisory authority (CNIL or any other authority mentioned on the list available from the European Commission).  

7.7. Right to the portability of Personal Data

Users have a right to the portability of their data, authorizing them to obtain from BARNES their Personal Data in a structured, commonly used and machine-readable format and to request that this Personal Data be transmitted to another controller.  

7.8. Right to decide the fate of Personal Data after death

Users also have the right to determine how their Personal Data should be handled after their death by adopting general or specific directives that BARNES agrees to respect.  

In the absence of such directives, BARNES recognizes that successors may exercise certain rights, in particular the right of access, if it is necessary for the settlement of the estate of the deceased, and the right to object.  

7.9. Conditions for exercising rights

To exercise their rights, users are kindly invited to contact BARNES’ Personal Data Protection Officer, as described below in Article 10.  

It is specified that to assist them in the exercise of their rights, the CNIL makes available letter templates on its website (www.cnil.fr).  

Before processing the request(s) of users, BARNES may verify their identity by requesting proof of identity.  

The Personal Data Protection Officer will respond to their request(s) as soon as possible and in any event one (1) month from the proof of identity. 

If necessary, this period may be extended by an additional two (2) months, given the complexity and number of requests, in which case BARNES agrees to inform users of the extension and the reasons for the postponement.  

ARTICLE 8.           MODIFICATION OF THE PERSONAL DATA PROTECTION CHARTER 

BARNES reserves the right to make changes to this Personal Data Protection Charter at any time to comply with legislative and regulatory changes and/or to improve its policies for the processing and protection of personal data. 

In case of modification, a new version will be updated and put online with the date of when it was 'Last updated'.  

ARTICLE 9.           APPLICABLE LAW AND JURISDICTION

This Charter is subject to French law, including the provisions applicable to the rules of private international law.  

FAILING AMICABLE AGREEMENT, JURISDICTION IS GIVEN TO THE COURTS WITHIN THE JURISDICTION OF THE PARIS COURT OF APPEALs NOTWITHSTANDING THE PRESENCE OF SEVERAL DEFENDANTS AND/OR IMPLEADING A THIRD PARTY AS A GUARANTOR (APPEL EN GARANTIE)/ THE INTRODUCTION OF THIRD PARTIES TO HEAR ANY DISPUTE RELATING TO THE USE OF THE SITE AND/OR THE VALIDITY, PERFORMANCE AND INTERPRETATION OF THIS CHARTER.   

ARTICLE 10.        CONTACT

For any question relating to this Charter for the purposes of rectification, additional information or updates, users are invited to contact BARNES:  

• by sending an email to the Data Protection Officer at dpo@barnes-international.com;  
• or by completing the online contact form at https://www.barnes-international.com/fr/contact.html;  

or by letter to the following address: BARNES - Attention: Délégué à la Protection des Données - 22 rue de l'hotel de ville - 92200 NEUILLY – France