Privacy policy
1. The data Controller
SPI&CO undertakes to ensure the confidentiality of data and that the processing of personal data carried out in the context of its activity complies with the European Regulation. n° 2016/679, General Data Protection Regulation (RGPD) and the French Data Protection Act of January 6, 1978.
SPI&CO has appointed a Data Protection Officer (DPO), who can be contacted at the following address: dpo@spigroup.fr
2. The processing of personal data carried out by SPI&CO
By using our website, you may be required to send us information, some of which may identify you and therefore constitute personal data.
In accordance with Article 4 of the RGPD, personal data means any information relating to an identified or identifiable natural person. A person is “identifiable” whenever he or she can be identified, directly or indirectly, in particular by reference to one or more factors specific to him or her.
As the Data Controller, SPI&CO determines the purposes and means of processing within the meaning of the General Data Protection Regulation.
3. Data transfer
Some of our service providers, who receive personal data, may be located outside the European Union for the purposes of managing our website.
Nevertheless, these data transfers will be carried out subject to appropriate guarantees, in particular contractual, technical and organizational guarantees, in compliance with applicable regulations on the protection of personal data.
4. Personal data security
SPI&CO ensures that your data is properly protected and that technical and organizational security measures are in place to protect your data and guarantee its availability, confidentiality and integrity.
5. Exercising individual rights
In compliance with Articles 12 to 22 of the GDPR, any natural person whose personal data has been collected by the data controller has the right to exercise the following rights:
- The right of access: you have the right to obtain access to your information in a clear and understandable format. The purpose is to ensure that you are fully aware and can verify that we are using your information in accordance with data protection laws.
- The right of rectification: you have the right to have your information corrected if it is inaccurate or incomplete.
- The right to erasure: this right is also known as the “right to be forgotten” and allows you to request the erasure of your data when there is no reason for it to be retained.
- The right to restrict processing: you have the right to “block” or delete any further use of your information. When processing is restricted, we may store your information, but we cannot use it. We keep a list of people who have requested that further use of their data be blocked, to ensure compliance with the restriction.
- The right to data portability: you have the option of receiving the data you have provided to us, in a structured, commonly used and machine-readable format, for your personal use or to transmit it to a third party of your choice. This right only applies when the processing of your data is based on your consent or on a contract to which you are a party, and when this data concerns you.
- The right to object: you may object at any time to the processing of your data if it is based on a public interest mission or the legitimate interest of the data controller. This right is not absolute, and we reserve the right not to respond favorably to your request in the event of a legitimate interest on the part of the data controller.
- The right to withdraw your consent: if you have given your consent to the processing or use of your personal data, you may withdraw it at any time (although doing so does not mean that everything we have done with your consent up to that point was illegal). This includes your right to withdraw consent to the use of your personal data for commercial purposes.
- The fate of your data: In accordance with Article 40-1 of the French Data Protection Act of January 6, 1978, you may issue instructions regarding the storage, erasure, and communication of your personal data after your death.
Below is a table provided by the CNIL (French Data Protection Authority) setting out the rights you can exercise over your data depending on the legal basis used for the processing concerned by your request. You can check the legal basis in section “2. Processing of personal data by SPI&CO” of this privacy policy.
You can exercise your rights directly with SPI&CO at the following email address: dpo@spigroup.fr.
SPI&CO undertakes to respond to you within one (1) month of receiving your request to exercise your rights.
If you do not receive a response within the specified time frame or if you are not satisfied with the response you receive, you may file a complaint with the data protection authority, namely the CNIL, via the link: https://www.cnil.fr/fr/plaintes
6. Cookie Policy
1. What is a cookie?
A cookie is a text file stored on the hard drive of your device (computer, tablet, or any other mobile device with Internet connectivity) that identifies the device on which it is stored. It can have several purposes, such as the functioning and accessibility of the site, the generation of statistics and the evaluation of the site’s performance, the measurement of browsing activity on the site, or commercial and marketing purposes.
2. What types of cookies are used?
As part of SPI&CO’s commitment to protecting your personal data, the organization details the use of data processed through cookies and trackers applied on this website: https://spigroup.fr
2.1. Functional cookies
To ensure the functioning and efficiency of the technical and visual components of the site, the relevant cookies are stored on the user’s terminal equipment
as soon as they visit the site. These cookies ensure navigation on the Site and their non-application leads to malfunctions. These cookies only identify the user’s terminal equipment in order to recognize it among all the browsing sessions carried out on the Site, but are not able to directly identify the user or track their activity on other websites.
SPI&CO uses the reCAPTCHA tool in its contact forms. This testing service offered by Google automatically distinguishes between human users and robots. The tool collects various hardware and software data, which is why it is subject to user consent. As a result, users must give their consent in order to use the contact forms on the site
| Name | Supplier | Purpose | Type | Retention period | Data collected | Legal basis |
|---|---|---|---|---|---|---|
| wp-wpml_current_language | spigroup.fr | Store the current language of the site | Functional HTTP cookie | Session | Preferred language | Legitimate interest |
| axeptio_all_vendors | axept.io / www.spigroup.fr | Management of cookie consent preferences | HTTP cookie | 6 months | List of authorized or refused suppliers | Legal obligations (GDPR) |
| axeptio_authorized_vendors | axept.io / www.spigroup.fr | Store the list of suppliers authorized by the user | HTTP cookie | 6 months | Accepted suppliers | Legal obligations (GDPR) |
| axeptio_cookies | axept.io / www.spigroup.fr | Save cookie consent status | HTTP cookie | 6 months | Session token, date, cookie version, preferences | Legal obligations (GDPR) |
2.2. Audience measurement cookies
These cookies generate statistical data on how visitors use the site. They are used to measure the site’s audience and performance, detect navigation issues, optimize technical performance, estimate the power of the servers required, and analyze the content viewed, exclusively on behalf of the publisher.
SPI&CO uses the Matomo audience measurement tool, for which there is an exemption from user consent. The tool has been configured so that data exports are disabled, it does not collect personal data, and the IP address collected is anonymized.
SPI&CO uses the Google Analytics audience measurement tool, which is a web analytics service provided by Google Inc., to measure and analyze traffic on its website. Google Analytics uses audience measurement cookies that collect anonymous information such as your IP address, the type of browser you use, the pages you visit, and the time you spend on the site.
This data helps us understand how users interact with the site and identify any navigation issues. The information collected by these cookies is transmitted and stored by Google on servers located in the United States.
Google is committed to complying with applicable data protection rules, and an adequacy decision was adopted on July 10, 2023, granting the US a level of protection substantially equivalent to that of the European Union, subject to certain conditions.
| Name | Supplier | Purpose | Type | Retention period | Data collected | Legal basis |
|---|---|---|---|---|---|---|
| _ga, _ga*, _gid | Google Analytics | Audience measurement and traffic analysis | HTTP Cookies | 13 months | Unique identifiers, browsing data | Consent |
2.3. Marketing cookies
These cookies aim to identify individuals in order to deliver specific advertising messages based on their individual characteristics and preferences. They are not mandatory, and users can refuse them if they want to.
| Name | Supplier | Purpose | Type | Retention period | Data collected | Legal basis |
|---|---|---|---|---|---|---|
| c_user, datr, fr, sb, xs | facebook.com | User authentication, personalization, and advertising tracking (Facebook Pixel) | Third-party HTTP Cookies | Variable (2-year session) | Account identifiers, login information, browsing | Consent |
| _fbp | Meta (Facebook) | Advertising and retargeting | HTTP Cookie | 3 months | Unique visitor identifier | Consent |
| hubspotutk, __hstc, __hs_do_not_track | axept.io (HubSpot) | Site usage analysis and contact tracking, CRM, and tracking Advertising | HTTP Cookie | 13 months | User ID, tracking preferences | Consent |
| _ttp | spigroup.fr | Conversion tracking, audience measurement, and advertising tracking (TikTok) | HTTP Cookie | 1 year | Unique visitor ID | Consent |
| ttcsid, ttcsid_* | TikTok | Session tracking and audience measurement | HTTP Cookie | 1 year | Session ID | Consent |
3. Storing cookies
Users are free to accept or refuse cookies on their device. They can also choose their preferences for each type of cookie by going to the bottom of the page. Their choice is stored for six months.
You can refuse, accept, or remove cookies at any time through your Internet browser settings. You can configure your Internet browser to notify you when a new cookie is about to be stored on your computer so that you can decide whether to accept or reject it.
Please consult the help section of your browser for further information.
7. Changes to this policy
We may occasionally modify this policy, in order to comply with regulatory, jurisprudential, editorial, or technical developments.
If necessary, we will change the date of the privacy policy update and indicate the date on which the changes were made. When necessary, particularly but not exclusively in the event of a substantial change or a specific event requiring the modification of this policy, we will inform you and/or seek your consent. We advise you to check this page regularly to be aware of any changes or updates to our policy.