Breadcrumb
Personal data management policy
Personal data management policy
Version updated in April 2020
Within the framework of this website and its associated websites, the City and Eurometropolis of Strasbourg process personal data.
This processing is carried out in accordance with current legislation, notably (EU) Regulation 2016/679 of the European Parliament and the Council of April 27, 2016, General Data Protection Regulation (GDPR), and Act no. 78-17 of January 6, 1978, French Data Protection Act (LIL), as amended.
Definitions
Personal data: any information making it possible to identify a natural person, directly or indirectly.
Processing: any operation or set of operations applied to personal data (for example: collection, recording, organization, consultation, extraction, erasure, destruction).
Data controller: the natural or legal person, public authority, department or other body that determines the processing purposes and means.
Data subject: person whose personal data is processed.
Obligations of the City and Eurometropolis of Strasbourg
Communication of the data controller's identity
The data controller is: the City and Eurometropolis of Strasbourg (Ville et Eurométropole de Strasbourg, 1 parc de l’Etoile, 67076 Strasbourg Cedex).
Designation of a data protection officer (DPO)
The data protection officer for the City and Eurometropolis of Strasbourg is Mr. Sélim-Alexandre Arrad.
His main task is to inform and advise the data controller. Any request regarding personal data protection may be sent by mail to the Data Protection Office: Délégation à la protection des données, Ville et Eurométropole de Strasbourg, 1 parc de l’Etoile, 67076 Strasbourg Cedex or by email to dpo@strasbourg.eu or using the designated form (in French).
Security measures
The City and Eurometropolis of Strasbourg have put in place technical and organizational security measures to protect the personal data processed.
Any security breach detected may be reported to the information systems security officer (ISSO) by email at rssi@strasbourg.eu.
Data subject information
During data collection, the City and Eurometropolis of Strasbourg shall inform you:
- Of the purpose of the collection
- Of the lawful basis of the data processing
- Whether the data collection is mandatory or optional
- Of the data recipients: Divisions and Departments of the City and Eurometropolis of Strasbourg and external entities
- Of the data retention period
- Of any transfer of data outside the EU
- Of your rights regarding your data and the right to lodge a complaint with the CNIL (French data protection agency)
Data subject rights
In accordance with (EU) Regulation 2016/679 of the European Parliament and the Council of April 27, 2016, General Data Protection Regulation (GDPR), and Act no. 78-17 of January 6, 1978, French Data Protection Act (LIL), as amended, you have the right to access, rectification, erasure, object, restrict processing, data portability, lodge a complaint with the CNIL, and give instructions regarding the disposition of your data after your death.
Right of access
You can ask for your personal data to be sent to you.
The City and Eurometropolis of Strasbourg may refuse to do so, particularly when your request is unfounded or excessive or infringes on third party rights.
Right to rectification
You can ask for your inaccurate or incomplete personal data to be corrected.
Right of erasure ("right to be forgotten")
You can ask for your personal data to be erased under one of the following circumstances:
- Your data is no longer necessary for the purposes for which it was originally processed
- You are withdrawing your consent to the use of your data (in cases where processing is based on your consent)
- Your data was collected when you were a minor as part of the information society
- Your data has been unlawfully processed
- Your data must be erased to comply with a legal obligation
- You object to your data being processed and there is no compelling legitimate grounds for the processing
It is important to precisely indicate the data that you are asking to be erased.
Right to object
You can object to processing that is carried out for a specific purpose. You must put forward "grounds related to your specific circumstances".
Your objection request may be refused, in particular when:
- There are compelling legitimate grounds to process your data
- Your data is required for the establishment, exercise or defense of legal claims
- A legal obligation requires your data to be processed
- You have consented — you must withdraw your consent rather than object
Right to restrict processing
You may ask for the use of some of your data to be temporarily stopped.
If you contest the accuracy of your data or you object to your data being processed, we are entitled by law to check or examine your request for a certain period of time.
Right to data portability
You can ask to recover some of your data in a machine-readable format.
This right applies to:
- Data that you have provided
- Whose processing is based on your consent
- Whose processing is automated
Exercising this right must not infringe on third parties' rights and freedoms.
Right to lodge a complaint with the CNIL
If after contacting us you believe that your rights have not been respected, you can lodge a complaint with the CNIL.
Right to choose the disposition of your data after your death
In accordance with article 85 of the French Data Protection Act, as amended: "any person may give instructions regarding the retention, erasure, and communication of their personal data after their death".
The instructions may be general or specific.
- General instructions relate to all the data subject’s personal data. They can be registered with a digital trusted third party certified by the CNIL.
- Specific instructions relate to processing the personal data mentioned in these instructions. They are registered with the data controllers concerned. The data subject must give their specific consent. Specific instructions cannot result from simply approving the terms and conditions of use.
Exercising your rights
Four means are at your disposal to exercise your rights:
- Either by email to the data protection officer's address dpo@strasbourg.eu (attaching scanned proof of identity)
- Or using the designated form - in French (attaching scanned proof of identity)
- Or by mail to the Data Protection Office: Délégation à la protection des données, Ville et Eurométropole de Strasbourg, 1 parc de l’Etoile, 67076 Strasbourg Cedex (attaching a copy of your proof of identity)
- Or by speaking directly to the Administrative center reception (presenting your proof of identity)
The City and Eurometropolis of Strasbourg will in theory reply to you within a one-month period on receipt of your request. However, this period shall be exceptionally extended up to 3 months in the event of a complex request or if there are a large number of requests pending. You will be informed during the one-month period of the grounds for any extension of the deadline.