Privacy policy

Respect for privacy and the protection of personal data are a priority for Laboratoire Phytocontrol.

This policy informs you how we collect, use, store and protect your personal data when you visit www.phytocontrol.com, use its forms or communicate with our teams.

It is drawn up in accordance with:

• Regulation (EU) 2016/679 of 27 April 2016, known as the “General Data Protection Regulation” or “GDPR”;
• French law No. 78-17 of 6 January 1978, as amended, known as the “Data Protection Act”.

1. Who is responsible for processing your data?

The controller for processing carried out via the site is:

Laboratoire Phytocontrol
Simplified joint-stock company with capital of EUR 1,000,000
Registered with the Nîmes Trade and Companies Register under number 490 024 049
SIRET: 490 024 049 00028
Parc scientifique Georges Besse II
180 rue Philippe Maupas
30035 Nîmes – France

Phone: +33 (0)4 34 14 70 00
Customer service: 0 800 900 775
Email address: service-clients@phytocontrol.com

Phytocontrol has appointed a data protection officer, who can be contacted at the following address:

dpo@phytocontrol.com

2. Who does this policy apply to?

This policy applies in particular to:

• site visitors;
• prospects;
• customers and professional contacts;
• people requesting an audit, consulting, an analysis or a demonstration;
• people pre-registering for a training course;
• subscribers to our newsletters;
• candidates applying for a job offer or sending a spontaneous application;
• journalists and press contacts;
• suppliers, partners and subcontractors;
• people using our contact or emergency forms.

Customer areas, online shops or external sites accessible from the Phytocontrol site may have their own privacy policy.

3. What personal data do we collect?

Depending on your use of the site and the nature of your request, we may collect the following categories of data.

3.1 Identification data

• title;
• surname;
• first name;
• role;
• signature, where applicable.

3.2 Contact details

• email address;
• phone number;
• postal address;
• country or geographic area.

3.3 Professional data

• company or organisation;
• role and department;
• sector of activity;
• department or business line concerned;
• customer number or professional references;
• needs and services sought.

3.4 Data relating to your requests

• subject and content of your message;
• request for an analysis, audit or consulting service;
• request for a demonstration;
• sales enquiry or quote request;
• information required to handle an emergency;
• chosen training course;
• availability or contact preference;
• history of exchanges with our teams;
• documents sent as attachments.

3.5 Data relating to job applications

• curriculum vitae;
• cover letter;
• qualifications and diplomas;
• professional experience;
• skills;
• availability;
• salary expectations, where applicable;
• any information provided voluntarily as part of the application.

Please do not send us any information that is not directly and necessarily related to the position sought.

3.6 Data relating to communications and marketing

• newsletter subscription;
• communication preferences;
• participation in a webinar, event or training course;
• history of communications sent;
• interactions with our emails, where permitted by law;
• unsubscribe requests or objections to marketing.

3.7 Technical and browsing data

• IP address;
• type of device;
• browser and operating system;
• pages viewed;
• date and time of connection;
• source of the visit;
• technical logs and security data;
• cookie identifiers or other trackers, depending on your choices.

For more information, please see our Policy on cookies and other trackers.

4. How is your data collected?

Your data may be collected:

• directly from you when you fill in a form;
• when you contact us by phone, email or post;
• when you sign up for a newsletter, an event, a webinar or a training course;
• when you apply for a job offer;
• when you create or use an account;
• automatically as you browse, depending on the cookies allowed;
• from your employer, your organisation or a professional contact;
• from a partner, an event organiser or a publicly available source, in accordance with the applicable regulations.

Where data is not collected directly from you, we inform you of its source under the conditions set out in the GDPR.

5. Why do we process your data?

Purpose	Data mainly concerned	Legal basis
Responding to general contact requests	Identity, contact details, organisation, message	Phytocontrol’s legitimate interest in responding to requests
Preparing a quote or a service	Identity, contact details, needs expressed, professional information	Pre-contractual measures taken at your request
Managing requests for audits, consulting or demonstrations	Identity, contact details, organisation, content of the request	Pre-contractual measures or legitimate interest
Handling urgent requests	Identity, contact details and information required to handle the request	Pre-contractual measures, performance of the contract or legitimate interest
Managing the customer relationship	Contact details, history of exchanges, contractual data	Performance of the contract
Managing pre-registrations and registrations for training courses	Identity, contact details, role, chosen training course	Pre-contractual measures and performance of the contract
Sending our newsletters and professional information	Identity, email address, preferences	Consent or legitimate interest, depending on the context and applicable regulations
Organising events and webinars	Identity, contact details, organisation, registration	Performance of the requested service or consent
Carrying out B2B marketing	Professional contact details, role, organisation, history	Phytocontrol’s legitimate interest in developing its business
Managing press and institutional requests	Identity, contact details, media outlet or organisation, request	Legitimate interest in managing our public relations
Managing applications and recruitment	CV, cover letter, background, qualifications	Pre-contractual measures and legitimate interest in recruiting
Securing the site and preventing fraud	IP address, technical logs, device information	Legitimate interest in ensuring the security of the site
Measuring audience and improving the site	Browsing data and technical identifiers	Consent, except where exempted by applicable regulations
Managing your cookie preferences	Choices and technical identifiers	Compliance with a legal obligation and legitimate interest in retaining evidence of choices
Handling requests to exercise rights	Identity, contact details, content of the request, supporting document if necessary	Compliance with a legal obligation
Managing complaints and disputes	Data required for the complaint or case file	Legitimate interest in defending our rights and complying with our obligations
Complying with our legal, accounting and tax obligations	Contractual, administrative and financial data	Compliance with a legal obligation

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Where processing is based on our legitimate interest, we ensure that it does not disproportionately affect your interests, rights or freedoms.

6. Is the information requested mandatory?

Fields marked with an asterisk in the forms are required in order to process your request.

If you do not provide this information, Phytocontrol may be unable:

• to respond to your request;
• to send you a quote;
• to contact you again;
• to handle an emergency;
• to register your pre-registration;
• or to review your application.

Other information is optional. However, it may help us provide you with a more precise response.

7. Who can access your data?

Your data is accessible, within the limits of their respective duties, to authorised Phytocontrol departments, including:

• customer service and customer relations;
• sales teams;
• marketing and communications teams;
• technical and analytical departments;
• training department;
• human resources;
• administrative, accounting and legal departments;
• IT department;
• management;
• the data protection officer.

It may also be disclosed to:

• our IT service providers and hosting providers;
• providers of email, CRM, form management or newsletter solutions;
• service providers involved in organising events or training courses;
• recruitment agencies, where necessary;
• our legal advisers, auditors or insurers;
• administrative or judicial authorities legally entitled to receive it;
• our partners or subcontractors where their involvement is necessary to process your request.

Our service providers may only use the data on our instructions and for the tasks assigned to them. Their obligations are contractually governed in accordance with the GDPR.

Phytocontrol does not sell your personal data.

8. How long do we keep your data?

Data is kept only for as long as necessary for the purpose for which it was collected.

Category or purpose	Indicative retention period
General requests with no contractual relationship	Time required to process the request, then up to 3 years from the last contact
Prospects and sales enquiries	3 years from collection or from the prospect’s last contact
Customers and customer contacts	For the duration of the contractual relationship, then for the applicable legal or limitation periods
Contractual and commercial documents	5 years from the end of the contractual relationship, unless a different legal period applies
Accounting records and invoices	10 years in accordance with accounting obligations
Newsletter	Until consent is withdrawn or unsubscription, and a maximum of 3 years after the last active contact
Marketing opt-out list	At least 3 years, solely to prevent any further solicitation
Pre-registration for a training course not taken	Time required to process the request, then a maximum of 3 years after the last contact
Data relating to a training course taken	For the duration of the relationship, then in accordance with applicable legal and certification obligations
Successful application	Added to the employee’s file, in accordance with the applicable staff policy
Unsuccessful application	Duration of the recruitment process, then up to 2 years after the last contact if retention in a talent pool has been indicated
Request to exercise a right	Time required to process the request, then archived for a period allowing proof of processing
Copy of proof of identity	Only for the time required to verify identity, unless specific evidentiary needs apply
Inactive online accounts	Period defined according to the department concerned; deletion after 2 years of inactivity is recommended
Technical and security logs	Period proportionate to security needs, generally between 6 and 12 months
Cookie choices	6 months
Cookies and browsing data	Periods specified in the Cookie Policy

At the end of these periods, data is deleted, anonymised or placed in intermediate archiving where a legal obligation or the defence of our rights so justifies.

9. Marketing and newsletters

Phytocontrol may send you information relating to its activities, services, events, training courses, regulatory news or professional content.

Where your consent is required, no communication is sent to you without your prior agreement.

In some cases, particularly for communications sent to professionals in connection with their activity or to customers regarding similar services, processing may be based on our legitimate interest.

You may object to these communications free of charge and at any time:

• by clicking on the unsubscribe link included in each email;
• by writing to us at dpo@phytocontrol.com;
• by contacting the department indicated in the communication.

Your objection will be recorded in a dedicated list to ensure that you are not contacted again. Information contained in this list will not be used for any other purpose.

10. Data transfers outside the European Economic Area

We give preference to service providers that process data within the European Union or the European Economic Area.

However, some technical service providers may process data in countries located outside this area.

Where such transfers take place, we ensure that they are based on a mechanism recognised by the GDPR, including:

• an adequacy decision by the European Commission;
• standard contractual clauses adopted by the European Commission;
• binding corporate rules;
• or any other appropriate safeguard.

Additional measures may be applied where necessary.

You may obtain further information on these safeguards by contacting our data protection officer.

11. How do we protect your data?

Phytocontrol implements appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• loss;
• alteration;
• disclosure;
• destruction;
• unlawful or fraudulent use.

These measures include, depending on the processing concerned:

• access rights management;
• restricting access to authorised persons only;
• user authentication;
• securing communications and infrastructure;
• data backup;
• logging of access;
• staff awareness training;
• contractual oversight of service providers;
• incident and data breach management procedures.

12. What are your rights?

Depending on the legal basis and nature of the processing, you may exercise the following rights:

Right of access

You may ask whether Phytocontrol processes data concerning you and obtain a copy of that data.

Right to rectification

You may request the correction or updating of inaccurate or incomplete data.

Right to erasure

You may request the deletion of your data under the conditions set out in the GDPR.

Right to restriction

You may request that the use of your data be temporarily suspended in certain situations.

Right to object

You may object to processing based on legitimate interest, for reasons relating to your particular situation.

You have an absolute, simple and free right to object to marketing.

Right to data portability

Where processing is based on your consent or on a contract and is carried out by automated means, you may receive the data you provided in a structured, commonly used format.

Right to withdraw your consent

Where processing is based on your consent, you may withdraw it at any time.

Right to set guidelines following your death

You may set guidelines regarding the storage, deletion and disclosure of your data after your death.

Right not to be subject to a decision based solely on automated processing

You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or significantly affects you, except in cases permitted by law.

Phytocontrol does not implement, via the site, any decision producing such effects that is based solely on automated processing.

13. How to exercise your rights?

You may exercise your rights by contacting the data protection officer:

By email:
dpo@phytocontrol.com

By post:
Laboratoire Phytocontrol
For the attention of the data protection officer
Parc scientifique Georges Besse II
180 rue Philippe Maupas
30035 Nîmes – France

Your request must specify the right you wish to exercise and provide sufficient means of identifying you.

Proof of identity may be requested only in the event of reasonable doubt as to your identity. It should not be sent unsolicited.

Phytocontrol will respond within one month of receiving your request. This period may be extended by two months due to the complexity or number of requests. In this case, you will be informed of this extension and its reasons.

14. Complaint to the CNIL

If, after contacting us, you believe that your rights are not being respected, you can submit a complaint to:

Commission nationale de l’informatique et des libertés – CNIL
3 place de Fontenoy
TSA 80715
75334 Paris Cedex 07

Website: www.cnil.fr

15. Links to other websites

The site may contain links to websites, spaces or services operated by third parties, including the customer area, the Eshop Waters or partner platforms.

Phytocontrol is not responsible for the processing carried out independently by these third parties. We invite you to consult their own privacy policy before sending them personal information.

16. Amendment to this policy

This policy may be amended to take into account:

• changes in law or regulations;
• recommendations from supervisory authorities;
• the evolution of our activities;
• the addition or modification of a form or service;
• changes concerning our service providers.

The date of the last update appears at the top of this policy.

In the event of a substantial change, specific information may be displayed on the site or communicated by any appropriate means.