Data Protection

Data Protection Notice

Introduction

The protection of your personal data is important to the BNP Paribas Group, which has adopted strong principles in this respect in its Personal Data Protection Charter.

As data controller, BNP Paribas SA – 16 boulevard des Italiens, 75009 Paris (hereinafter “We”), publishing the fondation.bnpparibas website, is responsible for the collection and processing of your personal data in connection with BNP Paribas Foundation’s activities.

The purpose of this Data Protection Notice is to inform you about the personal data we collect about you, the purposes for which we use and share that data, how long we keep it, your rights and how you can exercise them.

The purpose of this Privacy Notice is to explain how we process your personal data and how you can control and manage them.

1. ARE YOU SUBJECTED TO THIS NOTICE?

This Privacy Notice applies to you if you are (“You”):

• A person interested in our content, our newsletter, who interacts directly or indirectly with us (through the contact form on our website or our social networks), or who consults our websites or participates to an event organized by the BNP Paribas Foundation.
• A user of social networks, who may post a publication related to the activity of the BNP Paribas Foundation.
• A journalist in contact with the BNP Paribas Foundation’s Communication team or the BNP Paribas press teams.
• A candidate interested in job offers published by the BNP Paribas Group including for the Foundation, subscribing to the alerts via email.

When you provide us with personal data related to other people, please make sure that you inform them about the disclosure of their personal data and invite them to read this Privacy Notice. We will ensure that we will do the same whenever possible (e.g., when we have the person’s contact details).

2. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?

You have rights which allow you to exercise real control over your personal data and how we process them. In accordance with the applicable regulations, you may exercise the following rights:

• Right of access: you can obtain information about the processing of your personal data and a copy of these personal data.
• Right of rectification: if you believe that your personal data is inaccurate or incomplete, you may request that the personal data be amended accordingly.
• Right to erasure: you may request the deletion of your personal data, where permitted by law.
• Right to restriction: you can request the restriction of the processing of your personal data.
• Right to object: you can object to the processing of your personal data for reasons related to your particular situation. You have the absolute right to object to the processing of your personal data for the purpose of marketing, including profiling in connection with such marketing.
• Right to withdraw your consent: if you have given your consent to the processing of your personal data, you have the right to withdraw your consent at any time.
• Right to data portability: where applicable, you have the right to obtain the personal data you have provided to us or, where technically possible, to transfer it to a third party.

To exercise these rights, you can contact us if applicable:

• By sending us your request by email to the following address: Data Subject Rights
• Or by typing in a new email:
  • Email address: group.fondation@bnpparibas.com
  • Subject: [RGPD-DSR] Fondation BNP Paribas

In accordance with the applicable regulations, in addition to your rights listed above, you also have the right to lodge a complaint with the competent control authority (CNIL).

3. WHY AND ON WHICH LEGAL BASIS DO WE USE YOUR PERSONAL DATA?

In this section we describe how and why we use your personal data and draw your attention to some data processing we consider could be more impactful for you and, in some cases, may require your consent.

3.1 Managing your consent

We use your personal data on the basis of your consent given in the context of registering for our newsletter.

3.2 To fulfil our legitimate interest

For example, we use your personal data to:

• Provide a personalised and appropriate response to your requests;
• improve the quality of our products and services;
• for security reasons and computer system performance;
• to inform you about our products and services.

In all cases, our legitimate interest remains proportionate and we check against a balancing test that your interests or fundamental rights are safeguarded. If you would like more information about this balancing test, please contact us using the details provided in section “9. How to contact us” below.

We will retain your personal data for the period of time required to comply with applicable laws and regulations or for the period of time required to meet our operational requirements related to the BNP Paribas Foundation’s activities.

3.3 Your personal data are processed if you have given your consent

For some processing of personal data, we will give you specific information and ask for your consent. Of course, you can withdraw your consent at any time.

Especially, we ask for your consent for:

• Sending email notifications and newsletters if you have subscribed to them (e.g., BNP Paribas Foundation newsletter)
• Administering contests or other similar marketing campaigns.

You may be asked for further consent to process your personal data where necessary.

4. WHAT TYPES OF PERSONAL DATA DO WE COLLECT?

We collect and use your personal data, meaning any information that identifies or allows to identify you, to the extent necessary in the framework of our activities. We collect various types of personal data about you, including:

• Contact information (private or professional): e-mail address
• Information related to your devices and digital activities (e.g., PC, mobile phone, tablet, IP address, browsing activity, geolocation)
• Data relating to your habits and preferences in connection with the use of our products and services:
  • Data collected from our interactions with you: e.g., your comments, suggestions, needs collected during our exchanges with you online or during phone communications (conversation), your voice and your image during videoconferences, discussion by e-mail, chat, chatbot, exchanges on our websites, applications, social media pages and your latest complaints
  • Connection and tracking data such as cookies and trackers on our websites, our online services, our apps, and our social network pages

We never ask for any other sensitive personal data such as data related to your racial or ethnic origins, political opinions, religious or philosophical beliefs, trade union membership, genetic data or data concerning your sex life or sexual orientation, unless it is required through a legal obligation.

5. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will retain your personal data over the period required to comply with applicable laws and regulations or another period with regard to our operational requirements, such as proper account maintenance, facilitating client relationship management, and responding to legal claims or regulatory requests.

In that respect, we will retain your data for the lenght of time necessary for the pursuit of the processing’s purpose.

6. WHO DO WE SHARE YOUR PERSONAL DATA WITH AND WHY?

6.1 With BNP Paribas Group’s entities

As a member of the BNP Paribas Group, we work closely with the Group’s other companies worldwide. Your personal data may therefore be shared between BNP Paribas Group entities, where necessary, to:

• Comply with our various legal and regulatory obligations described above.
• Fulfil our legitimate interests as describe above.

6.2 With other recipients

We may, where necessary, share your personal data with:

• Processors which perform services, such as material or technical tasks, on our behalf, in order to fulfil some of the purposes described in this Privacy Notice.
• Judicial or financial authorities, public authorities or institutions, upon their request and to the extent permitted by the regulation.
• Certain regulated professions such as lawyers, notaries, or auditors.

7. International transfers of personal data

In case of international transfers originating from the European Economic Area (EEA) to a non-EEA country, the transfer of your personal data may take place. Where the European Commission has recognized a non-EEA country as providing an adequate level of data protection, your personal data may be transferred on this basis.

For transfers to non-EEA countries where the level of protection has not been recognized as adequate by the European Commission, we will either rely on a derogation applicable to the specific situation (e.g., if the transfer is necessary to perform our contract with you, such as when making an international payment) or implement one of the following safeguards to ensure the protection of your personal data:

• Standard contractual clauses approved by the European Commission;
• Binding corporate rules.

To obtain a copy of these safeguards or details on where they are available, you can send a written request as set out in section 2 above.

8. HOW CAN WE CHANGE THIS DATA PROTECTION NOTICE?

In a world of constant technological change, we may need to update this Privacy Policy regularly.

We invite you to review the latest version of this Notice online and we will notify you of any significant changes via our website or other regular communication channels.

9. HOW TO CONTACT US?

If you have any questions relating to the use of your personal data under this Data Protection Notice, you can contact us if applicable:

• By sending us your request by email to the following address: Information request
• Or by typing in a new email:
  • Email address: group.fondation@bnpparibas.com
  • Subject: [RGPD-INFO] Fondation BNP Paribas

If you would like to know more about cookies, please read our cookie policy.