Information notice clients

This document aims to inform you about how your personal data is collected and processed by us, in our capacity as data controller, when you interact with CIS, in accordance with the General Data Protection Regulation (Regulation (EU) No. 2016/679 of April 27, 2016, hereinafter “GDPR”) and French Data Protection Act No. 78-17 of January 6, 1978 (known as “Loi Informatique et Libertés”).  

1.       Identity and Contact Details of the Data Controller

The data controller of your personal data is CIS – Catering International & Services – 40, avenue de Hambourg – 13008 Marseille, France.

2.       Description of Processing Activities

CIS collects and processes the personal data of its contacts within its clients and partners (i.e. employees and collaborators of clients and partners) in the context of discussions and contracts entered into between CIS and its clients or partners. Personal data collected :

• Identity of the contact: first name, last name, and professional contact details;
• Data related to contract and client relationship management: commercial relationship tracking (including contracts, follow-ups, requests), accounting data related to the company (for invoicing purposes), monitoring of client development, meeting reports;
• Commercial prospecting management: email address, responses to satisfaction surveys, IP addresses, and click-through rates (newsletters).

Purposes of Processing :

• Client and contract management: conducting operations related to client management, including contracts, orders, service delivery, invoicing, accounting, and client relationship management (handling complaints, conducting surveys with local staff and on-site contacts);
• Accounting management;
• Commercial prospecting management: maintaining a client and contact database, carrying out prospecting operations such as contact management, business solicitations, tenders, satisfaction surveys, and sending newsletters and updates about CIS.

The provision of personal data required for contract management and accounting is both contractual and regulatory in nature, and is a condition for concluding a contract with CIS. If the necessary data is not provided, it will not be possible to conclude a contract with CIS.   Legal Bases :

• Performance of one or more contracts;
• Legal obligation (accounting);
• Legitimate interests of CIS in conducting its commercial activities.

  Data Retention and Archiving Periods : CIS retains personal data of its contacts for the following periods:

• Data related to contract management: retained for the duration of the contract, then archived for 5 years after the contract ends, on a separate medium for the purpose of exercising or defending legal claims;
• Accounting data: kept in the active database until the close of the current fiscal year, then archived for a maximum of 10 years;
• Data used for commercial prospecting: retained for 3 years from the last contact.

3.       Data Recipients

In compliance with the purposes described above and where necessary, personal data may be shared with:

• Internally: authorized CIS staff, including the sales department, communications department, regional directors, country directors, and general management;
• Externally, with processors acting on behalf of CIS: IT service providers (hosting, email services) and, occasionally, service providers handling commercial or communication activities (such as Brevo);
• Externally, with independent data controllers: relevant CIS subsidiaries, banks, legal advisors, consultants, and auditors.

Your data may be transferred outside the European Union, in particular to CIS subsidiaries or certain processors. In such cases, CIS implements appropriate measures with these recipients to ensure an adequate level of data protection in full compliance with applicable regulations. Details of these measures are available upon request.

4.       Data Subject Rights

You have the following rights regarding your personal data:

• Right of access: obtain confirmation of whether your personal data is being processed, and access related information;
• Right to rectification: request the correction of your personal data if it is inaccurate or incomplete;
• Right to erasure (“right to be forgotten”): request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or if you object to its processing. Please note that this right is not enforceable in the situations set out in Article 17.3 of the GDPR, including when a contract is still in force or data is archived for the establishment, exercise, or defense of legal claims;
• Right to restriction of processing: request the restriction of processing, particularly if you contest the accuracy of your data or if the retention period has expired but you still require the data for legal purposes;
• Right to data portability: receive your personal data in a structured, commonly used, and machine-readable format;
• Right to object: object at any time, on grounds relating to your particular situation, to processing based on CIS’s legitimate interests, unless compelling legitimate grounds override your objection;
• Right to withdraw consent: withdraw your consent at any time, where processing is based on consent. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal;
• Right to lodge a complaint: lodge a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés – CNIL) if you believe that the processing of your data violates your rights;
• Right to define post-mortem instructions: define directives regarding the retention, erasure, and communication of your personal data after your death.

You may exercise these rights at any time by contacting CIS at the following email address: privacy@cis-catering.com or by writing to the following postal address: Catering International & Services – DPO – 40C, avenue de Hambourg – 13008 Marseille, France.