Personal data management policy
Context and purpose of this policy
Within the framework of this website and its associated websites, we may process certain personal data.
What constitutes personal data? Any information that allows a natural person to be identified, directly or indirectly.
What qualifies as data processing? Any action based on personal data, such as collecting, recording, retrieving or deleting.
These processing operations are carried out in accordance with the French Data Protection Act of 1978, as amended, and the European General Data Protection Regulation (hereinafter referred to as the GDPR) which came into application on May 25th, 2018.
The main objective of the GDPR is to enable people concerned by processing operations to have better control over their personal data. Thus, transparency as to the processing carried out with your data, your rights and the ways in which these rights can be exercised, is essential. The purpose of this personal data management policy is to explain to you how we manage your personal data (what type of processing we do, for what purpose, what administrative services have access to it, when we delete the data, how we protect the data) and what your rights are.
The City and Eurometropolis of Strasbourg’s obligations
Communication about the processing controller
The controller of the processing operations carried out on this website is:
The City and Eurometropolis of Strasbourg
1 parc de l'Etoile
As controller, the Eurometropolis of Strasbourg must fulfil several obligations imposed by the GDPR.
Appointment of a data protection officer (DPO)
The GDPR has introduced as a new obligation for the controller to appoint a Personal Data Protection Officer. This Officer is currently Mr KOEGLER.
For any questions concerning personal data, you can contact the Data Protection Officer at the following e-mail address: firstname.lastname@example.org.
Implementation of security measures / Protection of your data
The Eurometropolis implements technical and organisational measures to ensure the security of the personal data it processes.
Access to information
The Eurometropolis commits to make available to the people, whose data are processed by its services, all information useful for a proper understanding of their use and the rights they hold over such data. This allows people to make an informed decision as to whether or not they wish to provide us with this personal data.
Understanding the processing of your personal data
Precisely informing you while collecting your data
To ensure that information about the processing of your data is understandable and readable, the information is provided to you at the time and place where we collect your personal data, through the use of this website.
Information provided in the privacy statement at the time of collection covers several issues:
- The purpose of data collection
- What authorizes us to collect and process your personal data (i.e. the legal ground for the processing of your data)
- The department(s) or entity(ies), internal and/or external to the local government, which may have access to this data (i.e. the recipient(s) of the data collected)
- The length of time we keep your data in the institution
- The existence of data transfer outside the EU
- The rights you have with regard to these data as well as the terms and conditions for exercising these rights
The rights of data subjects
The regulations relating to the protection of personal data (French Data Protection Act of 1978, as amended, and the General Data Protection Regulation of April 27th, 2016) recognize certain rights to the person whose personal data are processed.
To exercise your rights, listed below, you can do so in 4 ways:
- Either by e-mail the Data Protection Officer at email@example.com (attaching a copy of your ID or proof of identity if there may be any doubts about your identification)
- Or via the online application form dedicated to the exercise of your rights (by attaching a copy of your ID or proof of identity if there may be any doubt about your identification)
- Or by mail to the Administrative Centre, 1 Parc de l'Etoile, 67000 Strasbourg, (attaching a copy of your ID or proof of identity if there is any doubt about your identification)
- Or by contacting the reception desk of the Administrative Centre directly.
In theory, we will reply to you within a month of receiving your request. However, by exception, this period will be extended to 3 months in case your request is complex or if there is a large number of requests in progress. We will inform you during the month period of the reasons for the possible extension of the deadline.
You will find below a list of your personal data protection rights.
The right of access
You may ask us to provide you with any of your personal data that we hold.
It is possible for us not to respond favourably to your request in several cases:
- Your request is "unfounded".
- Your request is "excessive".
- Your request limits the rights of other individuals (for example, copyright or if the disclosure of personal data about a third party is not avoidable).
The right of rectification
You may ask us to change your personal data that is inaccurate or incomplete.
The right of erasure
You may ask us to delete your personal data, provided that you are in one of the following situations:
- Your data are no longer necessary for the purpose of the processing operation originally established,
- You withdraw your consent to the use of your data (in cases where the processing is based on your consent)
- You object to the processing of your personal data (in cases where this right is recognized, see The right to object)
- Your data are unlawfully processed
- Your data must be deleted to comply with a legal obligation
When you request deletion, it is important you specify which data you wish to have deleted.
The right to object
This right allows you to object to processing that is carried out for a specific purpose, provided that you can justify "reasons relating to your particular situation".
We may refuse your request for opposition in certain circumstances, including:
- There are legitimate and compelling reasons to process your data
- Your data are necessary for the establishment, exercise or defence of legal claims
- A legal obligation requires us to process your data
The right to data portability
This right allows you to receive part of your personal data in a machine-readable format.
But this right is limited since it only applies to:
- The data you provided us,
- the processing of which is automated and
- whose processing is based on your consent.
Moreover, the exercise of this right must not infringe the rights and freedoms of third parties.
The right to choose the fate of your data after your death
In accordance with article 40-1 of the French Data Protection Act, "any person may define guidelines for the storage, erasure and communication of his/her personal data after his/her death".
A person may be appointed to carry out these instructions.
- If the instructions are general, i. e. they cover all the deceased's data, they may be given to a trusted third party certified by the CNIL.
- If the instructions are specific, i. e. they relate only to certain data processing operations, they may be entrusted to the controllers. In this case, the data subject must give specific consent and accept the general conditions for the use of the processing operation.
If these conditions do not apply, the deceased's heirs have the right to access and enforce the instructions. The heir must prove his/her identity and provide proof of his/her status as heir by producing an affidavit or a family record book.
The right to lodge a complaint with a supervisory authority (CNIL)
If you believe that your rights are not respected, you can lodge a complaint to the French Data Protection Authority (CNIL).