Privacy policy

Document updated on 22 November 2024.

This English translation is provided for information only. In the event of any discrepancy, the French version prevails.

Phyling (“Phyling”, “our”, “we” and “us”) and our partners respect your privacy. Please read this privacy policy carefully to understand how your personal data is collected, processed and stored when you use this website.

“Personal data” means any information relating to a natural person that makes it possible to identify them, directly or indirectly, from a single piece of data or by combining several pieces of data.

All personal data collected on this website is processed under the responsibility of Phyling, a simplified joint-stock company (SAS) with share capital of €11,854, registered under RCS Évry 844 217 471, whose registered office is at 14 rue du Ruisseau, 91400 Orsay, France, in accordance with French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as currently in force, and with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Within the meaning of the applicable regulations, Phyling is therefore the data controller.

This privacy policy describes:

1. how Phyling uses your personal data;
2. how Phyling shares your personal data;
3. how Phyling protects your personal data;
4. where Phyling hosts and transfers your personal data;
5. how you can exercise your rights over your personal data;
6. updates to this privacy policy;
7. how to contact us.

1. How Phyling uses your personal data

Phyling may use your personal data for the following purposes:

1. taking the actions required to manage contracts, invoices and customer relations;
2. publishing and managing the reviews and/or comments you leave on the website;
3. sending you our newsletter, if you have subscribed to it;
4. answering a contact request made from our website;
5. setting up a loyalty programme;
6. offering you suitable advertising and content;
7. building a file of users, prospects and customers;
8. producing sales and traffic statistics;
9. managing unpaid invoices and possible disputes;
10. complying with our legal obligations.

Your personal data is processed as part of pre-contractual contact; this processing is based on your consent to be contacted to discuss our offers and obtain a quote. You may withdraw this consent at any time and ask us to delete your information and stop contacting you.

When you voluntarily provide us with personal data, its collection is based on the following legitimate interest: better answering your requests for information.

The processing of your personal data to send you our newsletter, on the other hand, is based solely on your consent to receive our newsletter, which you may withdraw at any time.

2. How Phyling shares your personal data

Within Phyling, and for each processing purpose, your personal data is collected, processed and stored by authorised Phyling staff, only within the scope of their respective duties, in particular the customer service and IT departments.

We do not share personal data with other companies, organisations or individuals unless one of the following circumstances applies:

• Sharing with prior consent: after obtaining your consent, Phyling will share the information you have authorised with the specific third parties or categories of third parties indicated when your consent was collected.
• Sharing with our service providers: Phyling may disclose your information to companies that provide services for us or on our behalf: IT services (in particular our hosting provider or our email delivery provider), delivery of our products, or marketing activities on our behalf. These providers may only use your information to provide services to you on behalf of Phyling.
• To comply with a legal obligation: Phyling may share your information as required by laws and regulations, to resolve legal disputes, or as requested by judicial or administrative authorities under the law.

Phyling ensures that any sharing of personal data is lawful through data processing clauses with the companies concerned, requiring them to comply with this privacy policy and to take appropriate security and confidentiality measures when processing personal data.

3. How Phyling protects your personal data

Phyling attaches great importance to the security of your personal data and has adopted common industry practices to protect it and to prevent unauthorised access, disclosure, use, modification, damage or loss of this information. We have also taken the necessary precautions to preserve, through our hosting provider, the security and confidentiality of the data, and in particular to prevent it from being distorted, damaged or disclosed to unauthorised persons.

Phyling also applies the following organisational measures:

• we take reasonable and practicable measures to ensure that the personal data collected is minimal and relevant to the purposes for which it is processed;
• we keep your personal data only for as long as strictly necessary for the purpose of the processing, unless its retention is required or permitted by law. For example, we keep the data related to the fulfilment of your orders for the period required by law for keeping accounting records, i.e. a maximum of 10 years from the financial year concerned;
• we use access control mechanisms so that only authorised staff can access your personal data.

In the event of a personal data breach, Phyling will comply with the applicable legal and regulatory requirements for notifying breaches to the competent supervisory authorities and/or the persons concerned.

4. Where Phyling hosts and transfers your personal data

Your personal data is hosted on the infrastructure of our hosting provider, OVH, located in France.

5. How to exercise your rights over your personal data

You have the right to access, rectify, erase, restrict and object to the processing of your personal data, as well as the right to set guidelines on what happens to your data after your death and the right to data portability.

You also have the right to lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL) in France, and with a competent supervisory authority in any other Member State according to your habitual residence, your place of work or the place where the infringement of your rights allegedly occurred, if you consider that the processing of your data does not comply with the applicable texts. This complaint may be made without prejudice to any other administrative or judicial remedy.

You can contact us at any time at the addresses below to exercise your rights, stating the right you wish to exercise and all the details we need to answer your request. These rights are exercised under the conditions set by the applicable regulations:

• right of access: you may ask us at any time whether we process personal data about you and, if so, which data, as well as the characteristics of the processing carried out;
• right to rectification: you may ask for your personal data to be corrected when it is inaccurate, or completed when it is incomplete;
• right to erasure: you may ask for your personal data to be erased, in particular when its retention is no longer necessary, when you withdraw your consent and no other legal basis justifies the processing, when you have objected to the processing, when your data has been processed unlawfully, or when it must be erased to comply with a legal obligation;
• right to restriction: you may ask for the processing of your data to be restricted, for example while its accuracy or your objection is being verified; the processing is then limited to storing the data;
• right to object: you may object to the processing of your data based on Phyling’s legitimate interest, on grounds relating to your particular situation;
• post-mortem guidelines: you may give instructions on the retention, erasure and disclosure of your data after your death;
• right to data portability: you may ask to receive your personal data in a structured, commonly used and machine-readable format, or to have it transmitted to a third party where possible.

When we process your data on the basis of your consent, you may withdraw it at any time by writing to us or by clicking the unsubscribe link included in each of our communications. Withdrawing your consent does not affect the lawfulness of the processing carried out before the withdrawal.

6. Updates to this policy

Phyling reserves the right to modify or update this privacy policy, at any time and in whole or in part, due to changes in the applicable regulations or in the data processing carried out. Any substantial change will be notified to you by email if you have given us a valid address, and will be published on the website.

7. How to contact us

For any question, comment or suggestion, write to us at contact@phyling.fr or by post at 14 rue du Ruisseau, 91400 Orsay, France.

If you are not satisfied with our answer, or if you wish to report a breach of the applicable data protection regulations, you can lodge a complaint with the CNIL by post (CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France) or on its website (www.cnil.fr), or with the data protection authority of the country where you usually live or work.