1. FOREWORD
Ardian France S.A. firmly believes that trust is key for developing successful and lasting relationships. In this respect, the protection of your personal data and privacy is no exception.
This is the reason why Ardian France S.A. puts great emphasis on collecting and processing your personal data with utmost care and in compliance with the applicable legal framework.
In order to inform you in the most transparent manner, Ardian France S.A. has prepared the privacy policy below, which explains in detail why and how your personal data are processed where you browse this website.
2. SCOPE AND PURPOSE OF THIS PRIVACY POLICY
This privacy policy (hereinafter the “Privacy Policy”) is intended to inform you, as a user of the Ardian website www.ardian.com (hereinafter the “Website”), about the way Ardian France S.A. (hereinafter “Ardian”) processes, as controller, information enabling to identify you either directly or indirectly (hereinafter “Personal Data”) in the context of your use of the Website.
3. CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING
Where you use the Website, Ardian processes your Personal Data for various purposes, each of them being duly legitimated by a valid legal basis.
First, Ardian collects and processes your Personal Data for managing and following up any questions and/or requests you may submit. As such, please note that this processing is only carried out in the event you submit a question and/or request. Otherwise, your Personal Data are not processed for this purpose.
This processing requires that Ardian collect and process the following categories of Personal Data: (i) identification data (i.e. your first name, your last name, and your contact details); (ii) data related to your professional life (i.e. the identity of your employer and your job position); and (iii) the content of the message(s) you sent to Ardian as part of your question/request.
While processing your Personal Data for this purpose, Ardian relies on its legitimate interest, which consists in duly managing its relationships with you.
Second, if you are an investor, you may have been granted by Ardian an investor account enabling you to access specific pages and contents through the Website.
For managing your investor account, and notably ensuring that you are entitled to access contents dedicated to investors only, Ardian needs to process and collect your identification data (i.e. your first name, your last name, your contact details as well as your login and password for accessing your investor account) as well as data related to your professional life (i.e. the identity of your employer).
The legal basis of this processing is the necessity for Ardian to perform a contract to which you are a party.
Third, if you are willing to subscribe to its newsletter, Ardian needs to collect and process your email address, which is a Personal Data, in order to properly manage your subscription.
Please note however that Ardian will only send you its newsletter and process your email address accordingly provided it has obtained your prior consent, which constitutes the legal basis of this processing.
Lastly, as Ardian is willing to understand how users interact with its Website, it needs to process various browsing information resulting from cookies which qualify as Personal Data. Thus, the fourth category of processing Ardian carries out with your Personal Data is the performance of analytic operation related to the Website traffic and use.
In this respect, the legal basis Ardian relies upon is its legitimate interest which consists in: (i) better understanding the way its Website is browsed by users (including you); and (ii) improving the Website where needed.
In any event, and disregarding the processing purpose at stake, please note that Ardian will comply with a strict data minimisation principle and will thus only collect and process Personal Data which is necessary for the above purposes.
Besides, for managing your questions/requests, your investor account as well as your subscription to the newsletter, the provision of your Personal Data is a contractual requirement. In this respect, sharing your Personal Data with Ardian is thus mandatory, otherwise Ardian will not be able to: (i) address your questions/requests; (ii) manage your investor account (including to give you access to content specifically dedicated to investors); and/or (iii) send you its newsletter.
4. DATA RECIPIENTS
Ardian shares your Personal Data with third-party service providers and suppliers which assist Ardian for fulfilling the purposes specified in this Privacy Policy.
For example, to manage your investor account, Ardian relies on the services of Intralinks, Inc., which notably administers the portal through which you can log in. Thus, Intralinks accesses your Personal Data, notably your login and password.
Another example is to be found with respect to cookies. Indeed, to perform the analytic operations regarding your use of the Website, Ardian relies on the services of Matomo, which thus access and processes your Personal Data resulting from the use of cookies.
To the extent this is necessary, Ardian also communicates your Personal Data to other entities of the Ardian group (e.g. the question you submitted to Ardian actually concerns another entity of the Ardian group and the latter will thus contact you directly to answer your question if relevant).
Furthermore, as the case may be, Ardian shares your Personal Data with competent courts and any other governmental and/or public authorities requesting access to your Personal Data, within the extent legally permitted.
In any event, Ardian communicates your Personal Data to the above recipients on a strict need-to-know basis and only as necessary for fulfilling duly identified processing purposes.
California disclosure
All terms used under this section shall have the same meaning as those defined under the California Consumer Privacy Act of 2018 and all related amendments and regulations (“CCPA”).
Ardian does not sell the Personal Information of California residents.
Under certain circumstances and if you are a California resident, you have the following rights:
- Right to know about the processing of your information by Ardian in the preceding 12 months, including (i) the categories and specific pieces of Personal Information Ardian has collected about you; (ii) the categories of sources from which Ardian has collected your Personal Information, and the business or commercial purpose for the collection; (iii) the categories of third parties with whom Ardian has shared your Personal Information and the business or commercial purpose for said sharing.
Please note that you may only make a ‘right to know’ request to Ardian up to two times in any twelve-month period.
- Right to deletion of your Personal Data (subject to Ardian’s right to maintain your Personal Data for specific purposes permitted under the CCPA).
- Right to opt-out of the sale of your Personal Data to third parties.
- Right to non-discrimination when exercising any of the rights listed above (and any other rights under the CCPA and all related amendments and regulations).
You may submit requests to exercise one of your rights by emailing dataprivacy@ardian.com, by registered mail at Ardian, Data Protection, 20 Place Vendôme, 75001 Paris, FRANCE, or by calling toll-free (within the U.S. only) 833-544-9273.
5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Ardian may need to transfer your Personal Data to other entities of the Ardian Group. Please note that some of these are located outside the EEA in countries that are not regarded by the European Commission (“EC”) as providing an adequate level of protection to Personal Data (e.g. China, Singapore, USA).
For transfers of your Personal Data to such countries, Ardian has implemented appropriate safeguards approved by the EC. This includes Binding Corporate Rules (“BCR”) between the various entities of the Ardian group or entering into Standard Contractual Clauses with the recipients of the Personal Data.
You can access a summary of the BCR by clicking here or by writing to our data protection officer by using the contact details specified below, in Section 7 (Contact details) of this Privacy Policy.
6. DATA RETENTION PERIODS
Ardian only retains your Personal Data for a retention period not exceeding what is necessary in light of the processing purpose at stake.
As a result, the data retention period implemented by Ardian depends upon the processing purpose as detailed below.
First, with respect to the management of your questions and/or requests, Ardian will not retain your Personal Data for more than five (5) years following the last contact on your initiative.
Second, regarding the management of your investor account, Ardian will retain your Personal Data until your investor account is closed. Nevertheless, if Ardian needs to retain your Personal Data for evidence purpose beyond the date your investor account is closed, the maximum retention period applicable will then be in line with the statute of limitation and will not exceed the period during which Ardian is required to retain evidence.”
Third, where Ardian processes your Personal Data for managing your subscription to its newsletter, your Personal Data will be retained by Ardian until you unsubscribe from the newsletter.
Lastly, the Personal Data processed by Ardian or on its behalf for performing analytic operations shall not be retained by Ardian after the analytic operations are finalized and the corresponding reports/summaries are completed.
Where the applicable retention period expires, Ardian either deletes your Personal Data or irrevocably anonymises it so that you can no longer be identified.
Where Ardian considers it does not need to retain your Personal Data in its active database, it will archive it and will ensure that access thereto is restricted to a limited number of persons who have an actual need to access your Personal Data.
7. YOUR RIGHTS AND OBLIGATIONS AS DATA SUBJECT
As a data subject, you benefit from various rights regarding the processing of your Personal Data. These are as follows:
1. right to request from Ardian access to and rectification or erasure of your Personal Data;
2. right to request from Ardian restriction of the processing concerning you;
3. right to object to the processing of your Personal Data;
4. right to portability of your Personal Data;
5. right to specify guidelines regarding the use of your Personal Data after your death;
6. with respect to the management of your subscription to Ardian’s newsletter, right to withdraw the consent you gave, at any time and without affecting the lawfulness of processing based on your consent before withdrawal thereof; and
7. right to lodge a complaint with the French Data Protection Authority (CNIL).
Ardian is committed to utmost care when it comes to protecting your Personal Data and complying with the applicable data protection legal framework.
This is the reason why Ardian requires your assistance to this end. Thus, you commit to inform Ardian in case the Personal Data you shared with Ardian would become obsolete or inaccurate.
In addition, in the event you would provide Ardian with information enabling to identify directly or indirectly any other natural persons (e.g. you sent a request to Ardian with the contact email address available on the Website and share personal data concerning another natural personal in your email), you represent and warrant that, prior to sharing this information with Ardian, such other natural persons have been provided with this Privacy Policy and, to the extent applicable, have consented to the processing of their data.
8. CONTACT DETAILS
Should you have any questions or requests regarding the processing of your Personal Data by Ardian, including the exercise of your rights specified in Section 6 (Your rights and obligations as data subject) above, please feel free to contact Ardian’s data protection officer (DPO) by using the following contact details: Ardian, Data Protection, 20 Place Vendôme, 75001 Paris - dataprivacy@ardian.com