Privacy Policy
The data collected are processed by the company EVY, SAS with a capital of 1,955.08 euros, registered in the Paris Trade and Companies Register under the number SIREN 902 019 819, whose head office is located at 38 rue des Mathurins 75008 Paris.
1. Preamble
This Privacy Policy is addressed to users of the products of Evy (hereinafter, the “Users”) and aims to inform them on how their personal information may be collected and processed.
Protection of personal data and respect of privacy are a paramount concern for Evy, which is why we undertake to process them in strict compliance with the applicable regulations on the protection of personal data (hereinafter the "Applicable Regulations"), in particular the French Data Protection Act (Loi Informatique et Libertés)of January 6, 1978 as amended and the General Data Protection Regulation of April 27, 2016 (hereinafter the "GDPR").
As such, Evy ensures:
To respect the protection of privacy by default and from the design of its applications ;
To process data in a lawful, fair and transparent manner for legitimate and specific purposes;
To allow, at any time, the exercise of Users' rights.
In addition, Evy undertakes to:
Under all circumstances, not to sell your personal data;
To apply a demanding process for the selection of its subcontractors and to ensure that they have an adequate level of protection of personal data through adequate organizational and technical measures;
To host data in a secure manner, in accordance with the recommendations of the protection authorities.
2. The data we collect
Partners' identification data
Details of personal data processed :
- Name, first name and email addresses of directors and/or managers
Persons concerned :
- Partners (Finance and Retail departments)
Categories of processing concerned:
- Management and use of the Platform
- Accounting and commercial management of the relationship with Partners
- Marketing operations
Customers' identification data
Details of personal data processed :
- identification and contact information and other Personal Information provided by you.
Persons concerned :
- Users
Categories of processing concerned:
- Management and use of the Platform
- Declaration of claims according to the subscribed offer
3. Use of the data
We only process your Data for specified, explicit and legitimate purposes.
The purposes are as follows:
- To process your complaints, according to the procedure we implement.
- To improve the service we offer you and to offer you new features.
- We also collect and process Data for other purposes:
- To inform you about changes to the service we offer, in particular about new Evy features or new partnerships.
- To facilitate your interactions with our services, in particular with our customer support, and to be able to help you in the best possible way.
- To improve your browsing experience on our website or the use of our applications and to ensure that the content we display is tailored to your needs.
- To allow you to give us feedback on the services we provide to you so that we can continually improve them.
- To provide you with offers of similar products or services, or those that may be of interest to you, offered by us or our partners.
- To ensure the security of your Data and your transactions.
- Subject to obtaining your prior consent, to allow you to automate certain tasks by connecting your Evy account to third party applications.
4. Recipients of the data
The Data collected is intended for us and, where strictly necessary, for our subcontractors and partners who are involved in the provision of our services.
The categories of recipients of the Data collected are the following:
- Insurers and reinsurers and other service providers
- Government authorities and regulators if required by law
- Legal and regulatory compliance, including compliance with laws outside your country of residence
- Web hosting providers and providers in charge of analysis and marketing (solicitation of prospects by email or telephone, contact with telephone solicitation, customer contact, tracking)
- Customer support and communication services
- Collaboration and productivity tools
- Auditors, attorneys, external legal counsel
- HR management partners (recruitment, health partner, mutual insurance company).
6. Security of storage and transmission to third parties
Storage
The Data we collect is stored on the servers of our provider Google Cloud Platform which guarantees a high level of security. These servers are located within the European Union.
Transmission to third parties
For the purposes of the service, we may transfer some of your Personal Information to our subcontractors, some of whom are located outside the European Union or the European Economic Area. In this case, we ensure that they are located in a country considered adequate by the European Union in terms of Data protection or we ask them to contractually commit to implement equivalent measures to ensure the protection of your Data (European Commission's standard contractual clauses and additional measures if applicable - copies of which are available from Evy's DPO).
Security
The transmission of your Data via the Internet is secured through an HTTPS connection protected by an SSL certificate (SHA-256/RSA Encryption).
7. Data retention period
We only keep your Data for as long as is necessary for the purposes for which it was collected.
8. Users' rights
Your Rights
In accordance with the applicable regulations, you have rights when your Data is processed.
Right of access
You have the right to obtain from us confirmation as to whether or not Data relating to you is being processed and to receive a copy of all the Data we hold about you under the conditions set out in Article 15 of the GDPR.
Right to portability
Where the processing is based on your consent or on a contract and is carried out using automated processes, you may, under the conditions provided for in Article 20 of the GDPR, receive from us the Data concerning you in a structured, commonly used and machine-readable format, for the purpose in particular of transmission to a third party. Where technically possible, you also have the right to have your Data transmitted directly to that third party.
Right to rectification
In accordance with Article 16 of the GDPR, you have the right to request the correction of the Data we hold about you if it is incomplete or incorrect. In this case, we may ask you to verify the new Data provided.
Right to erasure
If one of the grounds set forth in Article 17 of the GDPR so permits, you may request us to erase your Data. The applicable regulation provides for exceptions to the exercise of this right, including where processing is necessary to comply with a legal obligation that requires the processing of your Data, such as the fight against money laundering and terrorist financing.
Right to restrict processing
In the cases provided for in Article 18 of the GDPR, you may obtain from us the limitation of the processing of your Data.
Right to object
In accordance with Article 21 of the GDPR, you may object at any time on grounds relating to your particular situation to the processing of your Data based on our legitimate interest, including for profiling purposes, unless compelling legitimate grounds prevail or for the establishment, exercise or defence of legal claims. Where your Data is processed for canvassing purposes, you have the right to object at any time to such processing, including to profiling related to such canvassing.
Right to withdraw your consent
Where it constitutes the legal basis for the processing of your Data, you have the right to withdraw your consent to the processing of your Data at any time, which will not render unlawful the prior processing based on such consent.
Right related to automated decision making and profiling
You have the right not to be subject to a decision based exclusively on automated processing, including profiling, that produces legal effects concerning you or significantly affects you in a similar way. There are exceptions to this right as provided for in Article 22 of the GDPR, and in particular where the automated decision making or profiling is necessary for the conclusion or performance of a contract. In this case, the data subject retains the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Right to lodge a complaint
You can lodge a complaint with the supervisory authority located in the Member State in which you are located, in France this is the CNIL (Commission Nationale de l'Informatique et des Libertés).
Exercising your rights
You may exercise your rights by sending a request to our Data Protection Officer Protection Officer (DPO) or to our Customer Support at the addresses mentioned below. Any request to exercise a right must be accompanied by a photo of the applicant holding his/her identification. A reply will be sent to you within one month of receiving your request. To this end, we may ask you for additional information or documents.
9. Contact us
If you have any questions about the processing of your personal data, you can contact us:
- By sending an e-mail to our Data Protection Officer: dpo@evy.eu ;
- By calling us at +33 7 56 80 13 17
- By sending a letter to the following postal address
EVY
Att: Data Protection Officer
38 rue des Mathurins
75008 Paris