Privacy Policy

VATES, a société par actions simplifiée (simplified joint-stock company), whose registered office is located at 10, esplanade Andry Farcy - 38000 GRENOBLE, registered with the Grenoble Trade and Companies Register under number 752 155 259 (hereinafter referred to as “VATES” or “we”), attaches particular importance to the protection of privacy and personal data, in particular those of its users, clients, prospects and partners. We undertake to comply with all applicable regulations relating to the protection of personal data (hereinafter collectively the “Applicable Regulations”), including: the French Data Protection Act of 6 January 1978, as amended; the General Data Protection Regulation (“GDPR” – Regulation (EU) 2016/679). The purpose of this privacy policy (the “Privacy Policy”) is to define the conditions under which your personal data are collected, processed and protected, as well as the rights you have in this respect. VATES reserves the right to amend and update this Privacy Policy at any time and without notice, in particular in light of changes to the Applicable Regulations and recommendations of the French Data Protection Authority (the “CNIL”). Updates will be published on VATES’ websites; we therefore invite you to consult the Privacy Policy regularly.

When does VATES process your personal data?

This Privacy Policy applies to all cases in which VATES collects or processes personal data, including in the following circumstances:

• when you visit one of its websites;
• when you fill in a contact or registration form;
• when you create a user account or request access to its solutions;
• when you send a request for information;
• when you subscribe to a newsletter or receive an information communication;
• when you purchase or register a product or service;
• when you apply for a job offer or send an unsolicited application.

It covers in particular the following websites: vates.tech, xcp-ng.org, xcp-ng.com, xen-orchestra.com, as well as any other website operated by VATES and referring to this policy.

When processing your personal data covered by this Privacy Policy, VATES acts as data controller. The terms applicable to such processing operations (categories of data collected, purposes, legal bases, retention periods, etc.) are detailed below.

Our commitments: the fundamental principles of data protection

When processing your personal data, VATES undertakes to comply with the fundamental principles laid down by the Applicable Regulations. These principles guarantee ethical, secure processing that respects your rights.

• lawfulness, fairness and transparency: personal data are processed lawfully, fairly and transparently;
• purpose limitation: personal data are collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes;
• data minimisation: we collect only the data strictly necessary for the intended purpose. No unnecessary data are requested or retained;
• accuracy: personal data are accurate, kept up to date and all reasonable measures are taken to ensure that inaccurate data, having regard to the purposes for which they are processed, are erased or rectified without delay;
• limited retention period: your data are kept only for the period necessary for the processing for which they were collected, then securely deleted or archived;
• integrity and confidentiality: we implement appropriate technical and organisational measures to ensure the security, confidentiality and protection of your data against any unauthorised access.

We apply the principles of “Privacy by Design” and “Privacy by Default”.

VATES contractually imposes the same level of personal data protection on its processors. We contractually require all our processors and service providers to comply with a level of protection equivalent to our own and to strictly comply with the Applicable Regulations.

What personal data are collected and for what purposes?

In compliance with the data minimisation principle laid down by the GDPR, VATES collects only the personal data strictly necessary to achieve the purposes described in this Privacy Policy.

In any event, VATES indicates on collection forms which data are mandatory.

Who is concerned?

Users of VATES’ websites, clients, prospects, business partners and job applicants may be concerned by the processing operations described in this Privacy Policy.

Categories of data that may be collected

Depending on the context, the following personal data may be collected:

• identification and contact data: first name, surname, position, professional e-mail address, professional telephone number, company address;
• account login and usage data: identifiers, passwords, usage logs and history of login events;
• data relating to requests: information entered in contact or registration forms;
• professional data relating to applications: curriculum vitae, cover letter, diplomas, experience, exchanges with VATES;
• contractual and commercial information necessary for the management of products or services, or for the management of the commercial or partnership relationship.

VATES collects personal data only when the user interacts with its websites or with its teams, in a strictly professional context.

Purposes of processing

The processing operations carried out by VATES are intended to enable the actions described above to be performed, including:

• responding to contact and information requests;
• managing access to online services, user accounts and newsletter subscriptions;
• ensuring the commercial and contractual management of the products, solutions and services offered by VATES;
• sending newsletters and information communications about VATES’ products, services, news and updates and its solutions, subject to consent or the existence of a legitimate interest;
• improving the operation and content of its websites;
• managing applications and exchanges relating to recruitment.

VATES may also use personal data in order to comply with its administrative, accounting or regulatory obligations.

On what legal bases are your personal data processed?

The processing of your personal data is based, depending on the relevant purpose, on different legal bases:

• consent: you agree to the processing of your personal data through your express agreement, expressed clearly (checkbox, acceptance banner, etc.). You may withdraw your consent at any time, without retroactive effect on the lawfulness of processing already carried out;

By way of example, with regard to the sending of newsletters and information communications about VATES’ products, services and news, you may unsubscribe at any time by clicking on the unsubscribe link included in each communication or by contacting us via the contact form.

• contract: certain processing operations are necessary for the performance of a contract to which you have subscribed or in order to take pre-contractual steps at your request;
• legitimate interest: VATES may also process certain data on the basis of its legitimate interest in managing its professional relationships, improving its products and services or ensuring the security of the operation of its websites. This interest is assessed so as not to infringe your rights and freedoms. You may object at any time to processing based on legitimate interest, under the conditions provided for by the Applicable Regulations;
• legal or regulatory provisions: the processing of your personal data may be required by law or by the Applicable Regulations.

How long are your personal data retained?

The retention period for personal data depends on the purpose for which they are collected and processed. VATES endeavours to retain data only for the period strictly necessary to achieve these purposes, and to archive or delete them once these purposes have been achieved, in accordance with legal and regulatory requirements.

By way of example:

• Data relating to commercial or contractual management (clients, partners, support): throughout the duration of the contractual relationship, then for five years.
• Data from contact forms or exchanges with VATES: three years from the last contact.
• Application data (CV, cover letter, etc.): duration of the recruitment process, then deletion or two years in a CV database with consent.

Who has access to your personal data?

Only authorised persons within VATES have access to your personal data, within the limits of their duties and in compliance with a strict confidentiality obligation.

In order to provide certain services, your data may be transmitted to service providers or processors duly selected by VATES and subject to confidentiality and security requirements equivalent to those of VATES. These partners act only on VATES’ instructions and may under no circumstances use your personal data for their own account.

Your personal data may also be shared:

• in the event of restructuring, legal operation, merger, transfer or change of control, subject to appropriate safeguards;
• if required by law, or in response to a request from a duly authorised judicial or administrative authority.

How are personal data protected?

VATES implements all appropriate technical and organisational measures to ensure the security of personal data and prevent any accidental or unlawful destruction, loss, alteration, disclosure, intrusion or unauthorised access to such data.

This includes in practice:

• the use of proven IT security systems (access control, firewalls, backups, securing of electronic exchanges, etc.);
• the use of pseudonymisation or anonymisation techniques, where possible or relevant;
• awareness-raising, training and supervision of persons authorised to access data.

These measures take into account the nature and sensitivity of the data processed, the context of the processing and the potential risks.

The security and confidentiality of personal data also depend on everyone’s good practices. We invite you to exercise caution when communicating your personal information, in particular via forms or in written exchanges.

In the event of detection of a personal data breach, VATES undertakes to notify such breach to the CNIL and, if it entails a high risk to your privacy, to inform you as soon as possible.

Are personal data transferred outside the European Union?

As a matter of principle, VATES does not transfer your personal data outside the European Union, unless required by law or in strictly regulated cases. The services, as well as the data collected, are hosted by service providers located in the European Union, selected for their reliability and compliance with the Applicable Regulations.

If a data transfer were to be made to a country located outside the European Economic Area, VATES undertakes to:

• put in place the appropriate safeguards provided for by the Applicable Regulations (European Commission standard contractual clauses, adequacy decisions, certification mechanisms, etc.);
• inform you transparently, via this Privacy Policy or by any other appropriate means.

These measures are intended to ensure that your data benefit from a level of protection equivalent to that provided under European Union law.

What are your rights and how can you exercise them?

VATES ensures that you are provided with clear, transparent and easily accessible information on the processing of your personal data.

Where VATES acts as data controller, and in accordance with the Applicable Regulations, you have the following rights:

• right of access: you may request confirmation that we process data concerning you and, where applicable, access them and/or receive a copy as well as information about their processing;
• right to object: you may, on grounds relating to your particular situation, object at any time to the processing of your personal data based on our legitimate interest; you may also object at any time to the use of your data for direct marketing purposes, including profiling related to such direct marketing;
• right to rectification: you may request the modification or rectification of your personal data that are inaccurate or incomplete;
• right to erasure: you may request the erasure of all your personal data under the conditions provided for by the Applicable Regulations;
• right to restriction of processing: in certain cases, you may request that the processing of your data be temporarily frozen, for example if you contest their accuracy or if you object to processing based on legitimate interest, pending verification of your request;
• right to data portability: where processing is based on your consent or on a contract and is carried out using automated means, you may retrieve your data in a structured and machine-readable format and/or request their direct transmission to another organisation.
• right to withdraw your consent: where processing is based on consent, you may withdraw your consent at any time, without retroactive effect on the lawfulness of processing already carried out.

These rights may be exercised by e-mail at the following address: dpo@vates.tech

In this context, we ask you to include with your request the elements necessary for your identification as well as any additional information enabling your identity to be confirmed.

You also have the right to lodge a complaint with the CNIL in the event of a breach of the Applicable Regulations.

Cookies

When you browse VATES’ websites, cookies or other trackers may be placed on your device (computer, smartphone, tablet). These small files, referred to generically as “cookies”, make it possible in particular to:

• ensure the proper functioning of the websites;
• improve your user experience;
• measure traffic or use of content;
• facilitate sharing on social networks.

The cookies placed may have different purposes:

• strictly necessary cookies: essential for the functioning of the websites (e.g. security, access to reserved areas, remembering preferences): exempt from consent;
• performance and audience measurement cookies: used to analyse the use of the websites, pages viewed, visit duration, etc.: may be exempt from consent if configured in accordance with CNIL requirements;
• cookies subject to your consent: intended to improve your browsing, personalise content or enable sharing on social networks: their placement requires your prior consent.

Cookies are placed for a maximum period of 13 months. Information collected via these cookies is retained for a maximum period of 25 months, in accordance with CNIL recommendations.

During your first visit to VATES’ websites (or after expiry of your consent), a banner allows you to choose:

• to accept all cookies,
• to refuse them,
• or to configure your choices by purpose.

At any time, you may modify or withdraw your consent by clicking on the appropriate button at the bottom of the browser window.

You may also manage your preferences directly in your browser.

Please note: blocking certain cookies may disrupt the operation of the websites or limit access to certain services.

Social networks

Cookies make it possible to share the content of VATES’ websites using sharing buttons. Activating this functionality triggers the placement of cookies.

VATES invites you to consult the dedicated cookie pages of the relevant social networks for more information on how they use cookies and other trackers.

Contact

If you have any questions relating to this Privacy Policy, the processing of your personal data or the exercise of your rights, you may contact us at dpo@vates.tech or via the contact form.