Data Protection Policy
1. Purpose of the data protection policy
- Given the relationship based on trust that exists between Addict Mobile, its customers and its partners, Addict Mobile wanted to define its personal data protection policy with regard to the data protection regulations by taking into account European Union standards in this area, and in particular the General Data Protection Regulation (GDPR)[1].
- With this data protection policy, Addict Mobile undertakes, in the context of its activities and in accordance with the regulations in force, to protect, in particular, the privacy of its prospects, customers and partners, as well as its customers’ users, (hereinafter the “data subjects”), by ensuring the protection, confidentiality and security of the personal data collected.
- Addict Mobile’s innovation policy is based on the fundamental principles of the personal data protection regulations.
- As such, Addict Mobile undertakes to provide itself with the financial, human and technical resources necessary to protect the human dignity, legitimate interests and fundamental rights of data subjects.
- The main objective of this data protection policy is to set out, in a single document, clear, simple and precise information on the processing of personal data carried out by Addict Mobile to enable data subjects to understand what personal information and data (hereinafter the “personal data”) are collected about them, how they are used and what their rights over such personal data are.
- Addict Mobile reserves the right, at its sole discretion, to modify this data protection policy at any time in order to take into account changes to the regulations regarding personal data protection.
2. Identity and contact details of data controllers
- As part of its business, Addict Mobile collects and processes personal data from people clicking on the advertising campaigns it conducts for its customers, as well as usage data of its customers’ mobile applications on its own behalf and on behalf of its customers, in its capacity as data controller.
- Addict Mobile needs to process personal data in order to provide access to its website and perform its services. In this case, the data controller is Addict Mobile Technology located at 128 Quai de Jemmapes, 75010 Paris, France.
3. The Data Protection Officer
- Addict Mobile has appointed a Data Protection Officer (DPO).
- His/her role is to ensure compliance with the data protection regulations and to liaise with the CNIL (the French data protection authority) and all data subjects whose personal data are collected or processed.
- The DPO may be contacted by any interested party at the following postal address: Addict Mobile Technology, 128 Quai de Jemmapes, 75010 Paris, France, or at the following email address: dpo@addict-mobile.com
4. Definitions
- “anonymization” means “the result of the processing of personal data in order to irreversibly prevent any identification”;
- “customer” means the Company or legal entity that has subscribed to Addict Mobile’s products and services;
- “collect” means the collection of personal data. This collection may, in particular, be carried out using questionnaires or online forms;
- “consent” means any freely given, specific, informed and unambiguous indication, by means of a statement or clear affirmative action, of the data subject’s consent to the processing of his or her personal data;
- “personal data” means any information making it possible to identify a natural person either directly (in particular a first name, surname, or telephone number), or indirectly (for example an IP address or identifier).
- “service providers” means, in the broad sense of the term, service providers such as advertising firms and subcontractors working in conjunction with Addict Mobile;
- “profiling” means “any form of automated processing of personal data consisting of using such personal data to evaluate certain personal characteristics of a natural person, in particular to analyze or predict information concerning their productivity, economic situation, health, personal preferences, interests, reliability, behavior, location or movements”;
- “products or services” means all products and services offered or that will be offered by Addict Mobile (including advertising campaigns);
- “prospect” means any person or entity that has contacted Addict Mobile to obtain information on a product or service offered by Addict Mobile;
- “controller” means the person or body which, alone or jointly with other bodies, determines how and for what purposes your personal data is processed;
- “processor” means a natural person, legal entity, department or other body which processes personal data on behalf of the controller;
- “processing” means any operation or group of operations applied to the data, regardless of the process used (in particular collection, consultation, retention and deletion);
- “website users” means users who have browsed a publisher’s website and clicked on an advertising campaign run by Addict Mobile on behalf of one of its customers;
- “users from advertising campaigns” means users who have downloaded a customer application;
- “Users” includes all users, both of websites and from advertising campaigns;
5. Context of the collection of personal data
5.1 Addict Mobile as data controller
- Personal data may be collected primarily in the context of:
- the management of job applications sent to Addict Mobile;
- entry into contact with Addict Mobile;
- the customer’s use of all Addict Mobile’s products and services, including technological services (website, application, and associated services);
- the relationship between Addict Mobile, its prospects, customers, and partners;
- the performance of contracts;
- clicks by users on advertising campaigns created by Addict Mobile for its customers;
- the installation and use by customers’ users of customers’ mobile applications;
- the fulfilment of legal obligations or those covered by regulations specific to Addict Mobile’s activities, and that affect the protection of personal data, such as tax, audit, anti-fraud obligations, etc.;
- and in relation to the management of the business relationship, particularly in the event of claims, etc.
6. Categories of data processed by Addict Mobile
- Personal data refer to any information pertaining to a natural person enabling him or her to be directly or indirectly identified.
- The following may thus constitute personal data: first name and surname, telephone number, postal address, email address, job, hobbies, location data, the IP address of an individual’s computer, an individual’s advertising identifier, the User’s agent in his/her browser.
- The data collected by Addict Mobile include the following main categories:
6.1 Personal declarative data
- Personal declarative data are those provided by data subjects and collected by Addict Mobile in the context of commercial or contractual relations.
- These data are mainly provided by data subjects and by persons authorized by data subjects to transmit them to Addict Mobile.
- The data subject may, for example, be required to provide Addict Mobile with his or her first names, surname, contact details and possibly personal data relating to his or her professional situation. These data may be collected via forms, either in electronic or paper form, or in response to questions asked by an Addict Mobile employee, for example.
- Addict Mobile will always make sure to specify on the data collection form whether the information is optional or mandatory, as well as the consequences of not filling in the information.
6.2 Personal data in connection with the operation of products and services
- Personal data be obtained from the interaction of data subjects with Addict Mobile’s advertising campaigns, or may concern operations carried out via the mobile applications of Addict Mobile’s customers.
- For example, clicks on advertising banners implemented by Addict Mobile and its partners are collected, as well as user connections to customers’ mobile applications.
6.3 Personal data provided by third parties
- Personal data may also be obtained from:
- employers of the data subject;
- partners of Addict Mobile, provided the data subjects are informed in advance of this transfer of their data and their consent obtained, where appropriate.
- other products or services provided by Addict Mobile customers to which data subjects have subscribed, provided the data subjects are informed in advance of this transfer of their data and their consent obtained, where appropriate.
- Please refer to the privacy policies of Addict Mobile’s partners for the processing they carry out as data controller.
6.4 Personal data calculated or inferred by Addict Mobile
- Addict Mobile may generate or calculate new personal data based on personal declarative data or operating data in connection with products and services and customers’ mobile applications.
- This approach is used by Addict Mobile, in particular, in order to get to know customers’ users, adapt its products and services, and customize the offers it makes to customers. It may thus define profiles, and commercial or marketing segments.
6.5 Special categories of data
- Special categories of personal data are data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic personal data, biometric personal data for the purpose of uniquely identifying a natural person, personal data concerning health, or personal data concerning a natural person’s sex life or sexual orientation.
- In principle, these special categories of personal data, which must be handled with particular care, are not processed by Addict Mobile. Should their processing be necessary, Addict Mobile undertakes to process them in accordance with the conditions laid down by the personal data protection regulations.
7. Personal data processed by Addict Mobile
- For customers and partners, Addict Mobile mainly processes the following data:
- first name, surname;
- email address;
- professional postal address;
- telephone number;
- position;
- employer;
- audience (Users’ email and advertising ID)
- For users from advertising campaigns, Addict Mobile mainly processes the following data:
- click-throughs;
- advertising ID;
- Installation of the customer’s mobile application;
- registration on the customer’s mobile application;
- connection to the customer’s mobile application;
- orders placed via the customer’s mobile application;
- IP address;
- mobile browser;
- geolocation (user’s city of connection);
- For website users, Addict Mobile mainly processes the following data:
- advertising ID;
- IP address;
- mobile browser;
- geolocation (user’s city of connection);
8. Recipients of data collected by Addict Mobile
- The personal data collected, as well as those collected subsequently, are intended for Addict Mobile in its capacity as data controller.
- Addict Mobile ensures that only authorized persons can access data subjects’ personal data and only where necessary for the performance of their duties.
- Certain personal data may be sent to third parties to meet legal, regulatory or contractual obligations, or in response to a request from a legally authorized authority.
- The categories of recipients of data collected by Addict Mobile include: the financial and accounting departments, the legal department, the sales department, the internal customer relations department, subsidiaries of the group to which Addict Mobile belongs, and subcontractors of Addict Mobile and its partners.
- Such personal data may, at data subjects’ request, be transmitted to official bodies and authorized administrative or judicial authorities, or to third parties.
9. Subcontracting and transfers of data
- The personal data is stored in Addict Mobile’s information systems or those of its hosting provider. Personal data is stored in data centers located in Europe and the United States, by a service provider adhering to the Privacy Shield.
- Addict Mobile is committed to selecting data processors and service providers that meet the best quality and security criteria and offer sufficient guarantees in terms of reliability, security and resources for the implementation of technical and organizational measures.
- Finally, Addict Mobile keeps a permanent track of the country in which its data are hosted in order to be able to provide the appropriate supervisory authorities with proof thereof.
- In the event of transfers to a country outside the European Union, the rules ensuring the protection and security of this information are put in place.
- Addict Mobile takes all necessary and appropriate measures to ensure the security of personal data.
10. Guiding principles with respect to personal data protection
- The GDPR has strengthened the duty to inform data subjects.
10.1 Lawfulness, fairness and transparency
10.1.1 Lawfulness
- Addict Mobile undertakes not to carry out any unlawful processing, pursuant to the conditions described below.
- Consent of the data subject. Addict Mobile may carry out processing where the data subject has consented to the processing of their personal data for one or more specific purposes.
- This consent may be given by means of a written declaration, including by electronic means, or an oral declaration.
- Performance of the contract or pre-contractual measures. Addict Mobile carries out certain types of processing on the basis of a contract, or pre-contractual measures.
- For example, Addict Mobile processes data for the purpose of managing the contractual relationship based on the performance of a contract.
- Legal and regulatory obligations. In this case, processing is necessary for compliance with a legal or regulatory obligation incumbent on Addict Mobile.
- For example, the regulations require that Addict Mobile implement processing to combat fraud.
- Legitimate Interests of Addict Mobile or its customers. Addict Mobile’s processing of the personal data of a data subject may be justified by the legitimate interests of Addict Mobile or a third party.
- The legitimate interests pursued by Addict Mobile are varied, but may include the following:
- improving knowledge of the needs of Addict Mobile’s customers and prospects;
- improving the products and services offered by Addict Mobile;
- This processing is carried out taking into account the interests and fundamental rights of the data subjects. As such, they are accompanied by measures and guarantees ensuring protection of the interests and rights of the data subjects, balancing them with the legitimate interests of Addict Mobile.
10.1.2 Fairness and transparency
- Addict Mobile undertakes to provide fair, clear and transparent information.
- Addict Mobile thus undertakes to inform data subjects of each processing it implements, through information notices.
10.2 Defined, explicit and legitimate purposes
- Personal data are collected and processed at all times by Addict Mobile for defined, explicit and legitimate purposes.
- Addict Mobile uses personal data in accordance with the conditions of this data protection policy, in constant consideration of ethics and the security of data subjects’ personal data.
- Addict Mobile uses all or some of the personal data for the following purposes in particular:
- managing contractual relations with its customers, suppliers and other partners;
- managing complaints;
- carrying out audits (internal and external)
- combating fraud;
- managing, protecting and ensuring the security of its website;
- measuring quality and satisfaction;
- analyzing customer and prospect data in order to improve the services provided;
- carrying out marketing operations;
- drawing up sales and marketing statistics;
- Tracking customers’ users acquired through Addict Mobile advertising campaigns;
- organizing events with its partners;
- managing requests to exercise rights;
- managing unpaid receivables;
- Managing litigation and pre-litigation.
10.3 Appropriateness, relevance and limitation
- Addict Mobile undertakes to ensure that each processing is appropriate, and to only collect and process data that are strictly necessary for the intended purpose.
10.4 Data accuracy
- Addict Mobile undertakes to ensure that the data collected are as comprehensive and up-to-date as the circumstances allow. As such, Addict Mobile regularly verifies that the data it collects are up-to-date.
- However, data subjects may exercise their right of rectification, under the conditions set out below, if they become aware of the existence of inaccurate data.
10.5 Data retention period and limitation
- Addict Mobile undertakes not to keep personal data for longer than is necessary for the purpose for which they were collected. Addict Mobile may, however, be required to retain data for longer where such retention is necessary for compliance with a legal obligation or for the defense, establishment or exercise of a legal right.
| No. | Categories of personal data | Active storage rules |
| 1. | Video surveillance | 1 month |
| 2. | Management of customer and prospect files | For customers, throughout the contractual relationship plus 3 years
For prospects, 3 years from the last contact from the lead |
| 3. | Contract management | Throughout the contractual relationship plus 5 years
For contracts signed electronically, throughout the contractual relationship plus 10 years |
| 4. | Order management | 10 years |
| 5. | Delivery management | 10 years |
| 6. | Billing management | 10 years |
| 7. | Accounting and in particular the management of customer accounts | 10 years |
| 8. | Audience measurement statistics | 13 months |
| 9. | Newsletter management | Until unsubscription |
| 10. | Supplier and service provider management | For contracts and purchase orders: duration of the contractual relationship plus the duration of the legal requirements, i.e. 5 years
For invoices: 10 years from the end of the financial year |
- After the end of the retention period, the data are destroyed in the Addict Mobile information system, or anonymized.
10.6 Security and confidentiality commitment
- Addict Mobile undertakes to implement security measures appropriate to the degree of sensitivity of the personal data, in order to protect them, in particular, against any malicious intrusion, loss, alteration, or disclosure to unauthorized third parties.
- All Addict Mobile premises where personal data are processed are protected electronically and/or manually against intrusion by unauthorized third parties.
- Addict Mobile has adopted internal policies and processes to implement measures that comply with the principles of personal data protection by design and personal data protection by default.
- In this respect, it may, for example, pseudonymize personal data where possible and necessary.
10.7 Personal rights
- Persons whose data are processed have the following rights:
- right of access;
- right to rectification;
- right to erasure, or the right to be forgotten;
- right to portability;
- right to restriction of processing;
- right to withdraw consent;
- right to establish instructions for the retention, erasure and communication of their personal data after their death.
- Where the processing is based on legitimate interests, persons whose data Addict Mobile processes have a right to object for reasons relating to their particular situation and at any time where the processing is for marketing purposes.
10.7.1 Procedures for exercising these rights
- In the event of a question or request relating to the processing of personal data by Addict Mobile, data subjects are invited to contact: dpo@addict-mobile.com, or at the following postal address: 128 Quai de Jemmapes, 75010 Paris, France.
- In most cases, Addict Mobile will only need a customer number to confirm your identity.
- However, Addict Mobile reserves the right to request additional information (such as proof of identity), if it has reasonable doubts as to the identity of the person making the request.
10.7.2 Right to recourse
- Data subjects may lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy.
- Data subjects may lodge this complaint with the French supervisory authority (the CNIL) or the competent authority in your country of residence.
10.8 Profiling and automated decision-making
- Addict Mobile may, based on an analysis of data subjects’ personal data, in particular their clicks, create statistics to improve its products and services, and send data subjects information and offers relating to its customers’ products and services.
- Data subjects may object to fully automated decision-making with respect to them, or to the profiling of their data, at any time where such operations are carried out for marketing purposes.
- When required, Addict Mobile undertakes to ensure that the data subjects’ consent is collected prior to carrying out this type of processing.
- When profiling or automated decision-making is based on consent, data subjects may withdraw the consent they gave at any time.
- In any event, Addict Mobile undertakes not to implement processing based on fully automated decision-making or profiling without taking appropriate measures in order to protect the rights and freedoms, as well as the legitimate interests, of the data subjects.
11. Special processing
11.1 Video surveillance
- As part of the implementation of security measures, Addict Mobile uses video surveillance systems in its premises in compliance with the applicable regulations.
- Data subject are informed that these images are recorded and stored and that they may lead to the identification of persons filmed, either by the systems used or by agents with access to the images.
- Signs in filmed areas indicate to data subjects the existence of this type of system, the manager responsible, and the procedures for exercising their right of access to visual recordings concerning them.
11.2 Cookies and other trackers
- When browsing the Addict Mobile website, cookies may be used. For more information, data subject may consult the Addict Mobile Cookies Policy.
[1] Regulation (EU) 2016/679 of 27 April 2016