Privacy Policy

Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person within the meaning of Article 4.1 of the GDPR.
• “Processing” means any operation or set of operations which is performed on Personal Data, whether or not by automated means, as defined in Article 4.2 of the GDPR.
• “Data Subject” means any natural person whose Personal Data is subject to Processing.

Who is responsible for processing the date collected?

Reforest'Action acts as the data controller for the collection and processing of Personal Data.

Reforest'Action – Simplified joint stock company – Share capital €1,161,561.83 – Nanterre Trade and Companies Register: 494 438 146 – VAT: FR53 494 438 146 – APE: 7022Z Registered office: 10, rue Jacques Daguerre, 92500 Rueil-Malmaison, France

A Data Protection Officer (DPO) has been appointed. He can be contacted at the following address:

• Name: CODPO
• Address: 49 rue de Ponthieu, 75008 PARIS
• Email: contact@codpo.fr
• Phone: +33 1 83 80 75 72

As the data controller, Reforest'Action ensures a high level of protection for the Personal Data of Data Subjects at all stages of processing (collection, storage, destruction, etc.).

What data is collected and for what purpose?

When you interact with Reforest'Action, certain Personal Data may be collected. No sensitive data within the meaning of Article 9 of the GDPR is collected via the website. The Personal Data collected relates exclusively to identification and contact details and, where applicable, professional data.

Reforest'Action collects the following Personal Data via the contact forms available on the website:

• “Company” form: company name, title (optional), last name, first name, cell phone number (optional), email address, country, solution of interest, department concerned, message;
• “Project Leader” form: title (optional), last name, first name, cell phone number (optional), email address, project location, status (NGO, individual, company, manager, forestry expert, etc.), type of request (project submission or information), message;
• “Other” form: company name (optional), last name, first name, mobile phone number (optional), email address, country (optional), subject of the message, message.

For the issuance of planting certificates, only the following Personal Data is collected: last name, first name, and professional or personal email address.

Personal Data that is collected automatically:

• Browsing data, in particular cookies collected automatically, whether technical cookies necessary for browsing the website, statistical cookies, and, based on consent, advertising cookies or those necessary for redirection to our social networks. This processing is carried out in accordance with the choices expressed by the Data Subject via the cookie management banner.

Certain Personal Data may be collected indirectly, in particular from partners, social networks, or legally authorized organizations.

For what purposes and on what legal basis?

In accordance with the principle of data minimization set out in Article 5 c) of the GDPR, only data necessary to achieve predefined objectives corresponding to the purposes below is collected.

The processing operations carried out pursue the following purposes:

• Management of requests for information via the “Company” and “Other” forms, on the basis of Reforest'Action's legitimate interest (Article 6 §1 f) of the GDPR), subject to compliance with the right of opposition of Data Subjects;
• Review of projects submitted via the “Project Leader” form, based on the performance of pre-contractual measures (Article 6 §1 b) of the GDPR);
• Issuance of planting certificates, based on the performance of a contract (Article 6 §1 b) of the GDPR);
• Sending of newsletters and information communications, based on consent (Article 6 §1 a) of the GDPR);
• Management of cookies, based on consent (Article 6 §1 a) of the GDPR).

No decisions based solely on automated processing, including profiling, are implemented.

How long is the data stored?

According to Article 5 d) of the GDPR, Personal Data collected and processed for the aforementioned purposes is retained for a limited period of time and only for as long as is strictly necessary to fulfill the intended purposes.

What types of measures are taken to protect the security, integrity, and confidentiality of data?

Reforest'Action undertakes to take all technical and organizational measures to ensure the protection and security of Personal Data, in particular against any loss, alteration, dissemination, or illegal use.

Reforest'Action ensures that such measures are implemented in all operations carried out as part of its processing activities, in particular when collecting, storing, and hosting Personal Data.

In this regard, Reforest'Action also ensures that any third parties it may use (technical service providers, suppliers, etc.) comply with this requirement to protect Data Subjects' Personal Data by implementing appropriate measures in accordance with the GDPR.

The website acts exclusively as a transmission interface. Personal Data entered into forms is encrypted in transit via the TLS/SSL (HTTPS) protocol and is not stored on the website's servers. It is transmitted securely to a customer relationship management tool used by Reforest'Action to manage requests and prospects.

Data storage, encryption at rest, and access management are carried out by the customer relationship management tool, acting as a processor within the meaning of Article 28 of the GDPR.

Reforest'Action urges you to exercise the utmost caution when communicating your Personal Data to third parties, as well as your personal identifiers and passwords that allow access to the website and the application.

Some messages or requests received may come from malicious individuals seeking to obtain personal information about the Data Subject for fraudulent purposes (phishing). If the Data Subject receives a message that appears to be a phishing attempt, they are advised not to respond to it and not to open any attachments, images, or links contained in the message.

Security measures are tailored to the level of risk, in accordance with Article 32 of the GDPR, and are updated regularly. These measures include access control, authentication, logging, backups and, where applicable, encryption of Personal Data, as well as internal procedures for managing Personal Data breaches.

Who are the subcontractors we use?

As part of the operation of the website and the management of requests, Reforest'Action may use technical service providers acting as processors, in particular:

• a hosting provider, ensuring the hosting and security of the website;
• a customer and prospect relationship management (CRM) tool, used to track requests, contacts, and business relationships;
• maintenance and technical support providers, who intervene to ensure the proper functioning and security of IT systems.

These service providers only act on the instructions of Reforest'Action and provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures to ensure the protection of Personal Data, in accordance with Regulation (EU) 2016/679 (GDPR).

Transfers outside the european union

When strictly necessary, certain Personal Data may be transferred outside the European Union. In such cases, Reforest'Action ensures that these transfers are subject to appropriate safeguards in accordance with the GDPR (European Commission standard contractual clauses, adequacy decisions).

What are the data subject’s rights?

You have, under the conditions provided for by applicable regulations, the right of access, rectification, erasure, objection, restriction of processing and data portability in relation to your Personal Data. Where the processing is based on your consent, you also have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out before such withdrawal.

You also have the right to define instructions regarding the retention, deletion and communication of your Personal Data after your death.

To exercise your rights, you may send your request to Reforest’Action:

• by post to the following address: REFOREST’ACTION – 10 rue Jacques Daguerre, 92500 Rueil-Malmaison, France; or
• by email to the following address: dataprivacy@reforestaction.com.

In order to process your request, Reforest’Action may ask you to provide the information necessary to identify you. In the event of reasonable doubt as to your identity, additional information may be requested.

Reforest’Action will respond to your request within one (1) month of receipt. Where necessary, this period may be extended by two (2) months, taking into account the complexity and number of requests. In such case, you will be informed of the extension and the reasons for the delay within one (1) month of receipt of your request.

Reforest’Action has appointed a Data Protection Officer, CODPO. The Data Protection Officer may be contacted for any question relating to the processing of your Personal Data or the exercise of your rights:

• by post: CODPO – 49 rue de Ponthieu, 75008 Paris, France;
• by email: contact@codpo.fr;
• by phone: +33 1 83 80 75 72.

In the event of an unresolved difficulty, you have the right to lodge a complaint with the competent supervisory authority, in particular the CNIL.

You also have the right to seek legal redress before the competent courts. These guidelines may be general or specific.

Use of cookies

A cookie is a small computer file that is stored and read when you visit a website or mobile application, regardless of the type of device used (phone, computer, tablet, etc.).

It allows information relating to browsing to be collected in order to ensure the proper functioning of the site and, where applicable, to offer tailored content. Only the issuer of a cookie can read the information it contains during its period of validity.

The storage of cookies that are not strictly technical is subject to obtaining the prior consent of the Data Subject, in accordance with applicable regulations. When configuring settings, it is possible to take into account the purposes of the cookies described below.

The website uses cookies for the following purposes:

• Cookies strictly necessary for the functioning of the site: these cookies enable the site to function optimally and securely, and to remember certain choices made by the user when they consent to them;
• Cookies linked to social networks: enabling verification of whether the user is connected to third-party services (such as Facebook, Twitter, Instagram, or LinkedIn) and facilitating content sharing;
• Cookies for communication and content distribution: these enable, subject to the consent of the Data Subject, the provision of tailored content or redirection to social networks.
• Cookies for audience measurement: these enable the analysis of website traffic and usage in order to improve its functioning, content, and performance.

Data Subjects may withdraw or modify their consent to the use of cookies at any time, without justification.

This withdrawal can be done via the cookie management module accessible at all times on the website, or by adjusting browser settings.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

However, refusing or withdrawing certain cookies may result in a deterioration of certain non-essential features of the site.

Through these cookies, third parties may collect and use your browsing data for their own purposes, in accordance with their privacy policies.

You may withdraw your consent at any time for cookies to be stored while you are browsing our website.

A consent banner allows Data Subjects to accept, refuse, or configure cookies when they first visit the website. Non-essential cookies are stored for a maximum period of thirteen (13) months.