Decide AI confidentiality policy
1. Preliminary remarks
1.1 Decide AI is a consultancy, technology and digital marketing services company which provides Professionals with Personal Data processing obtained through their Services.
1.2 In particular, Decide AI enables Professionals to optimize their targeting and effectiveness of their marketing and advertizing campaigns for Professional Services by the generation of marketing action recommendation(s) (hereinafter “Insights”) automatically generated on the basis of the most commonly used marketing and/or service purposes for the Professional.
1.3 Insights are recommendations made by the Professional and do not produce any legal effects and shall not have any significant impact upon the latter.
1.4 Decide AI, through its significant expertise in data marketing, shall be qualified as a data processor relating to the generation of these Insights insofar as it determines, according to its own expertise, the “essential processing” methods, i.e., the type of Personal Data processed ("which data is processed?"), the processing duration ("for how long will the data be processed?"), the recipient categories ("who shall have access?") and the data subject categories ("what Personal Data shall be processed?"), etc., and, in particular, with regard to the V.2.0. guidelines adopted by the European Data Protection Board (EDPB) on July 7, 2021 and concerning the concepts of data controller and sub-contractor within the meaning of the GDPR.
1.5 Decide AI is not in direct relation with the Data Subjects for which it processes their Personal Data, as the latter is communicated through the intermediary of a Professional.
1.6 The purpose of Decide AI’s confidentiality policy is to inform the Data Subjects of the means of Decide AI’s processing as data controller, after having first been obtained by the Professional in the context of the Services and in accordance with the Professional’s confidentiality policy, and, finally, the Data Subjects’ rights with regard to this processing, such as defined hereafter.
2. Definitions
2.1 The following terms, whether they are used in the singular or plural herein, shall have the following definition:
Decide AI : Shall mean the company Decide AI, a simplified joint-stock company with a share capital of 89,900 euros, registered with the Bobigny Registry of Trade and Companies under the number 850 958 422 and with its registered office located at 3 Rue Henri Rol Tanguy 93100 Montreuil (France).
Confidentiality Policy: Shall mean this confidentiality policy and Personal Data protection for the Data Subjects implemented by Decide AI.
Data subject: Shall mean the individual for whom the Personal Data is collected by the Professional in the context of the Services and processed by Decide AI as data controller in order to generate Insights.
Personal data: Shall mean the Data Subject’s personal data, within the meaning of the Personal Data Regulations.
Professional(s): Shall mean Decide AI’s client company(ies) which exploit Services through which they collect Personal Data from Data Subjects and make such data available to Decide AI with a view to its processing under the conditions herein.
Services: Shall mean interchangeably, the Websites, social networks, electronic messaging services, customer services, exploited by the Professional and, in which, he collects the Personal Data from the Data Subjects.
Specific Rights: Shall mean the rights granted under the Personal Data Regulations to the Data Subject concerning the processing of its Personal Data.
Personal Data Regulations: Shall mean the Law no.78-17 dated January 6, 1978 relating to I.T., files and liberties, in accordance with the EU Regulation dated April 27, 2016 published in the Official Journal of the European Union on May 4, 2016 relating to the protection of individuals with regard to the personal data processing and the free flow of such data (called “GDPR”, for General Data Protection Regulation).
Terminal(s): Shall mean the physical equipment (computer, tablet, smartphone, telephone, etc.) used by the Data Subject to consult or use the Services and/or any other digital support edited by a third party.
3. The statutory bases for the processing
3.1 In accordance with the Personal Data Regulation, the processing designated herein is based on a specific statutory basis.
3.2 Nevertheless, as Decide AI is not at the origin of the Personal Data collection, only the Professional shall be liable for providing a sufficient statutory basis.
3.3 The Data Subject granted its Personal Data processing for one or several specific purposes.
3.3.1 In the context of the use of the Services, the Professional shall obtain the Data Subject’s express consent in order to enable Decide AI to realize specific processing, in particular for the Professional’s marketing prospection and advertising purposes. As the case maybe, the Data Subject must contact the Professional in order to withdraw its consent or contact Decide AI under the conditions of paragraph 9 – Specific Rights.
3.4 The processing is necessary for the purposes of the legitimate interests pursued by Decide AI or that of a third party, in particular, that of the Professional.
3.4.1 In the context of the use of the Services, the Professional may have a legitimate interest, in particular, economical, justifying the Personal Data processing for the Data Subject, such as, for example, to enable him to understand his clients/prospects’ preferences to be able to propose products and services which best correspond to the latter’s requirements.
3.4.2 In such situation, Decide AI shall only carry out the processing necessary for the realization of the Professional’s legitimate interest and shall evaluate the consequences of this processing for the Data Subject, in particular, by taking into account the nature of the Data Processing processed, and the means of such processing.
3.4.3 Decide AI shall ensure that it does not breach the interest or fundamental rights and liberties, in particular, by enabling the Data Subject, at any time, to object, to all or part of the processing defined herein, and to implement its Specific Rights, under the conditions of paragraph 8 – Specific Rights. As the case maybe, the Data Subject must contact the Professional in order to object to such processing or contact Decide AI under the conditions of paragraph 9 – Specific Rights.
4. The processing purposes
The Data Subject’s Personal Data is necessary to enable Decide AI to do the following:
- Generate Insights for the Professional to enable the latter to carry out operations relating to the prospection, optimization for targeting advertizing and marketing campaigns disseminated in the context of his Services and, more generally, relating to commercial solicitation operations;
- Decide AI’s establishment of commercial statistics, analyses and marketing tools, on its own behalf and/or for the Professional (in particular, classification, score, etc.)
- The management of requests for the exercise of Specific Rights under the conditions of paragraph 9 – Specific Rights;
5. Personal data storage
5.1 The Personal Data, upon availability for Decide AI by the Professional, is hosted and retained by Decide AI solely for the duration of the processing (with such period being of a maximum period of a few hours) then deleted, and as the case maybe, communicated to the Professional after processing and prior to deletion thereof (for example, for the Insights).
5.2 All the precautions were taken by Decide AI to store the Data Subjects’ Personal Data in a secure environment and prevent any destruction, damage or unauthorized third parties having access thereto. The information collected by Decide AI shall never be transferred to third parties other than the Professional for commercial purposes nor shall it be sold or exchanged.
6. The processing of Personal Data by Decide AI
6.1 Decide AI shall process the Personal Data made available by the Professional and which may vary depending on the Professionals. Such Personal Data may be behavioral data and/or transactional data and/or declarative data collected by the Professional. In any event, Decide AI shall not collect other Personal Data than that collected by the Professional and, which, in theory must be defined in the Professional’s confidentiality policy (or privacy policy).
6.2 The nature, quality and volume of the Personal Data collected shall exclusively depend on the Professional, who shall be solely responsible for obtaining such data and, accordingly the legality of the latter.
6.3 Decide AI nonetheless carried out audits in order not to process minors’ Personal Data and/or Personal Data which would be of a racial or ethnic origin, relating to political opinions, religious or philosophical convictions or trade union membership, health data, data concerning sexual activity or sexual orientation data and genetic data, biometric data in order to exclusively identify a Data Subject, unless one of the exceptions provided by the Personal Data Regulations is applicable.
7. Recipients or recipient categories, if applicable
7.1 For the purposes of the processing, Decide AI shall store the Personal Data on servers located in the European Union for Google, which shall operate as a Sub-contractor.
8. Specific Rights
8.1 In accordance with the Personal Data Regulations, the Data Subject may, in theory, at any time, benefit from the following Specific Rights:
- access,- rectification,
- deletion,
- limitation of processing,
- portability,
- objection,
- post-mortem directives,
8.2 Nevertheless, in practice, and in accordance with paragraph 5 above, the Data Subject is informed that Decide AI shall not retain and shall delete the Personal Data upon completion of the processing, but also that numerous Personal Data is communicated pseudonymously and is not directly identifiable, which may complicate, or even render impossible, in certain cases, the Data Subjects’ exercise of their Specific Rights.
9. The Data Subjects’ exercise of their Specific Rights
9.1 The Specific Rights may be exercised by the Data Subject with the Professional who shall revert the request to Decide AI which shall respond only within the threshold of the Personal Data being processed and its technical capacities.
9.2 The Data Subject may also exercise his Specific Rights with Decide AI’s data protection officer:
By email, at the following address: dpo@ydes.com.
By post at the following address:
Cabinet YdèsCyril Fabre
Attorney and Decide AI’s external data protection officer
12, Cours Albert 1er
75008 Paris
9.3 In order to assert his rights according to the conditions referred to above and in the event whereby Decide AI would have doubts on the originator of the request, Decide AI may request the latter to justify his identity by mentioning his name, first name, email address and to accompany his request with a copy of a valid identity document.
9.4 A response shall be sent to the Data Subject within a maximum period of one (1) month following the date of receipt of the claim.
9.5 If necessary, this period may be extended by two (2) months by Decide AI, which shall inform the Data Subject, and given the complexity and/or number of claims.
9.6 In the event of a request by the Data Subject for the deletion of his Personal Data and/or in the event of the exercise of his right to request the deletion of his Personal Data, Decide AI may nonetheless retain the latter in the form of intermediate archiving, and for the duration necessary to meet its statutory obligations, or for probationary purposes during the applicable statutory period.
9.7 The Data Subject may also file a claim before the Data Protection Authority (the CNIL).
