PRIVACY NOTICE 

Publication/last update date:  26/02/2024

This privacy notice (the "Privacy Notice") applies to the processing of your personal data carried out by LEGRAND in the context of your access to LEGRAND services (the "Services"). The Services are provided through applications developed for your professional use (the "Application"), in the context of your installation, as a qualified installer, of products manufactured by LEGRAND or by other entities of its group.

For the avoidance of doubt, the Privacy Notice does not cover:

- the processing carried out by LEGRAND of personal data relating to end-customers using products manufactured by LEGRAND (or by other entities of its group): these processing activities are carried out under the exclusive responsibility of LEGRAND and are described in a separate document made available by LEGRAND directly to its end-customers through their dedicated application;

- your processing of the personal data relating to your customers (including end-customers for whom you have installed products manufactured by LEGRAND (or by other entities of its group): these processing activities are carried out under your exclusive responsibility and must be described in a separate document provided by yourself to the relevant data subjects.

For the purpose of this Privacy Notice, the term "Applicable Data Protection Regulation" means the European regulation no. 2016/679 of 27 April 2016 (the "General Data Protection Regulation" or "GDPR") as well as any data protection legislation or regulation that applies to the processing of personal data described in this Privacy Notice, including:

- with respect to the processing carried out by LEGRAND FRANCE, the French law no. 78-17 of 6 January 1978 and its application decree no. 2019-536 of 29 May 2019 (the "French Data Protection Legislation");

- with respect to processing carried out by BTICINO Spa, the Italian Legislative Decree no. 196 of 30 June 2003 (the "Italian Data Protection Code").

Any reference to the Applicable Data Protection Regulation shall be deemed to include any subsequent replacement of or amendment to the Applicable Data Protection Regulation (or part of the same). 

IDENTITY OF THE DATA CONTROLLERS

The processing of personal data described in this Privacy Notice are implemented under the joint responsibility of the following companies belonging to the LEGRAND group ("LEGRAND" or "we" (and its derivatives)):

LEGRAND FRANCE

128, avenue du Maréchal de Lattre de Tassigny

87045 Limoges Cedex (France)

BTICINO Spa (or "BTICINO")

Viale Borri 231
21100 VARESE (Italy)

For more information about the allocation of roles between the aforementioned joint controllers regarding the processing of your personal data, you can obtain the key points of the arrangement between the joint controllers on request regarding the concerned processing, by contacting us using the contact information provided in the "CONTACT US & CONTACT OUR DPO" section.

ACCOUNT CREATION

To benefit from our offer (e.g. to use the Application), you need to be registered by creating an account (the "Account").

When creating the Account, you will be asked to enter an email address and a password (hashed). Please note that these log-in details are both required and necessary to provide the Services that you are requesting. If a mandatory field is not filled in, your Account cannot be created and you will not be able to benefit from the Services.

COLLECTED DATA, PURPOSES OF THE PROCESSING AND LEGAL BASIS

The personal data that you provide to us

*The collection and processing of these personal data are mandatory and necessary for the creation of your Account and allow access to the relevant Service.

**The general terms of use of the Application are available for reference in the Application.

The personal data collected when you use the Application and/or the Services

*The general terms of use of the Application are available for reference in the Application.

Balancing of legitimate interests

When we indicate in the Privacy Notice that we are relying on our legitimate interests to process your personal data, this means that we consider that our legitimate interests are not overridden by your interests or fundamental rights and freedoms, in light of the circumstances and measures that we take to protect your privacy. You can obtain more information about this analysis (the "Balancing test") on request, by contacting us using the contact information provided in the "CONTACT US & CONTACT OUR DPO" section.

RECIPIENTS HAVING ACCESS TO THE DATA

Only the following recipients will have access to your personal data, within the limits set out below:

• The internal departments of LEGRAND FRANCE established in France and those of BTICINO in Italy:

- The Research and Development (R&D) teams responsible for the Application have access to: the personal data of your Account (email address only) and the personal data collected by third-party cookies and services necessary for the proper performance of the Application and audience measurements (see the COOKIES AND SIMILAR TECHNOLOGIES section for further details);

- The marketing teams, responsible for direct marketing and business prospecting operations, have access, where relevant, to: the personal data of your Account (email address, type of End-Customers Products you have installed);

- The teams from our customer service department have access to: the personal data of your Account, personal data used for support purposes when you request it, the type of End-Customers Products you have installed and the history of your conversations with our customer service department;

-     The administrators of LEGRAND's cloud which hosts all of your personal data;

-     The Research and Development (R&D) teams responsible for the Application have access to: the personal data of your Account (email address only), and the personal data collected by third-party cookies and services necessary for the proper performance of the Application and audience measurements (refer to the COOKIES AND SIMILAR TECHNOLOGIES section);

-     The marketing teams, responsible for direct marketing and business prospecting operations, have access, where relevant, to: the personal data of your Account (email address only), the personal data collected as part of the analytical profiling described above, the personal data collected through the use of cookies and third-party audience measurement services and by the advertising identifiers (refer to the COOKIES AND SIMILAR TECHNOLOGIES section);

-     The SBU quality teams, responsible for recall campaigns, which may access your email address and phone number.

• The service provider named Microsoft AZURE, responsible for hosting the LEGRAND cloud architecture and the personal data centers which are located in the Netherlands. For your information, your personal data may be transferred to Microsoft AZURE for hosting purposes in the United States of America;

• The service provider named SALESFORCE, supplier of the LEGRAND CRM client base management tool, in order to manage our commercial relationship with you. For your information, your personal data may be transferred to SALESFORCE for hosting purposes in the United States of America;

• The service providers named Creeo Studio s.r.l. and DM GROUP S.r.l., established in Italy, for the purpose of distributing our newsletter, where relevant;

• The service provider NTTData Italia S.p.A., established in Italy, for the purpose of analyzing technical support tickets;

• The service provider Ksenia S.p.A, established in Italy, responsible for developing certain applications on behalf of LEGRAND, as well as the hosting of the related personal data;

• GOOGLE which has access to the personal data relating to your browsing when you accept it through the Application or through our cookies banner on the web Application. For your information, your personal data may be transferred to GOOGLE for hosting purposes in the United States of America. To learn more, please refer to the "COOKIES AND SIMILAR TECHNOLOGIES" section below;

• The service provider CAPGEMINI, in charge of developing the Application;

• Borri S.p.a, which may contact you, if you have given your consent, to propose you maintenance services.

You are hereby informed that the aforementioned recipients of personal data are subject to a confidentiality obligation and have undertaken to use your personal data in accordance with our contractual arrangements. Where your personal data are transferred outside the European Economic Area ("EEA"), we have notably put in place security and confidentiality safeguards that are deemed appropriate in the light of the GDPR. For your information, you may obtain access to these safeguards, on request, by contacting us at the address indicated in the "CONTACT US & CONTACT OUR DPO" section.

DATA RETENTION PERIODS

We process your personal data for the durations described below:

Please note that the above durations remain subject to mandatory data retention requirements that may apply to us and, where relevant for the establishment, exercise or defence of legal claims, to the applicable statutory limitation periods.

Lastly, we draw to your attention that uninstalling our Application does not automatically imply the deletion of your personal data or withdrawal of your consent. To do so, you must send a voluntary deletion or consent withdrawal request to LEGRAND (see "CONTACT US & CONTACT OUR DPO" section) or make a request to unsubscribe (in accordance with the general terms of use of the Application).

THIRD-PARTY SERVICES PARTNERS

You may have the opportunity to subscribe for services provided by third-party partners that result from the sharing of our APIs (for example, services making it possible to make available some functionalities from another interface, etc.). When you decide to use these third-party services partners, you must grant a delegation for access to the personal data available on the LEGRAND cloud, since we do not make your personal data available to third-party services partner without your express consent. This subscription shall also be subject to acceptance of specific general terms of use from the third-party services partner. In this case, the user recognizes that LEGRAND does not possess and has no control over these third-party services partners and that it is not responsible for the processing of personal data implemented by these third-party services partners. For more information about how these third-party services partners process your personal data, we recommend that you refer to the concerned third-party services partner's privacy notice.

DATA SECURITY

We have implemented adequate physical, electronic and administrative protection security measures in accordance with applicable regulations to protect your personal data. However, we wish to draw users' attention to the potential risks regarding confidentiality of the personal data related to internet usage. In particular, users are responsible for putting in place or ensuring the existence of means securing their personal internet network, as well as for ensuring the proper configuration of the box connected to the internet access provider, and other wireless access means (e.g. WIFI, 4G, etc.).

USERS' RIGHTS

We intend to keep your personal data accurate, complete and up-to-date. In order to do so, you can visit the "MY ACCOUNT" section of your Application.

Pursuant to the Applicable Data Protection Regulation, you benefit from the following rights in relation to the processing of your personal data:

• Right of access: you can ask to obtain a copy of your personal data from us, as well as to receive information regarding the processing of your personal data (such as the categories of personal data that are processed, the purposes of the processing, the categories of recipients to whom the personal data is communicated, the retention period of the personal data);

• Right to rectification: you can ask us to correct, complete, update your personal data if it is inaccurate, incomplete, ambiguous and/or expired;

• Right to erasure: you can ask us to delete your personal data under certain circumstances (for example, in application of Article 17 of the GDPR, if your personal data is no longer necessary for the purposes for which they were collected or are processed; or if you have withdrawn your consent for processing your personal data, as long as the prior consent was the legal basis for their collection and processing and there is no longer any other legal basis justifying the latter);

• Right to restriction: you can ask us to limit the processing of your personal data under certain circumstances (for example, in application of Article 18 of the GDPR, when you contest the accuracy of the personal data, the time needed for us to verify this point);

• Right not to be subject to certain specific processing: you can ask us, in application of Article 22 of the GDPR, not to subject you to a decision based exclusively on automated processing, including profiling, producing legal effects concerning you or significantly affecting you in a similar manner;

• Right to object: you may object to the processing of your personal data for a reason relating to your specific situation (in accordance with, and within the limits of, Article 21 of the GDPR). Where personal data are processed for direct marketing purposes, you can object at any time to such processing, including where it includes profiling activities (to the extent that they relate to such direct marketing);

• Right to portability: you can ask to receive your personal data – when they are processed on the legal basis of your consent or if necessary for the performance of a contract – in a structured, commonly used and machine-readable format, and request that we transmit them to another data controller (for example, another service provider);

• Right to withdraw consent: you can withdraw your consent at any time, without providing a reason, for all of the processing activities described in the Privacy Notice for which the legal basis for processing is your consent;

• Right in case of death: pursuant to article 85 of the French Data Protection Legislation, you can define guidelines relating to the preservation, erasure and communication of your personal data by LEGRAND FRANCE after your death. These guidelines may be general or specific. The general guidelines relate to all of your personal data and can be recorded with a trusted digital third party certified by the French supervisory authority. The specific guidelines relate to the processing of your personal data described in this Privacy Notice, and can be recorded with us.

To exercise any of these rights, you may send your request at any time, using the contact information provided in the "CONTACT US & CONTACT OUR DPO" section of this Privacy Notice. Requests will be processed as long as you can validly prove your identity and the subject of your request is clearly identified. Requests will be processed promptly, and in any case within no more than one (1) month from receipt of the request. If needed, this period may be extended by two (2) months, depending on the complexity of the request and number of requests. In this case, we will inform you of the reasons for this extension. No payment will be required to exercise your rights, except in case of clearly unfounded or excessive request. In this case, we also reserve the right not to grant your request.

In addition to the rights described above, you may lodge a complaint at any time with a competent supervisory authority. For instance, under the GDPR, you may lodge such a complaint in the country in which you reside or work (if relevant) or where the alleged breach has occurred, if you feel that our processing of your personal data breaches the Applicable Data Protection Regulation. In France, the supervisory authority is the Commission Nationale de l'Informatique et des Libertés (the"CNIL"). In Italy, the supervisory authority is the Garante per la Protezione dei Dati Personali (the"GPDP").

COOKIES AND SIMILAR TECHNOLOGIES

When you use the Application via a web browser, we place cookies and similar technologies on your terminal (that is to say, the device that you use to browse on the Internet: computer, mobile phone, tablet), for various reasons. Our practices in this respect are outlined in our Cookies and Similar Technologies Policy.

MODIFICATION OF THE PRIVACY NOTICE

You can see the date of the last update to the Privacy Notice by referring to the "Last update" note at the top of the Privacy Notice.

When we are considering making substantial changes to this Privacy Notice (for example, a change to the processing purposes of the personal data, the identity of one or several data controllers, or the manner in which you can exercise your rights), we will inform you before these changes become effective, via email (and also, where possible, via an in-app notification). This information is accompanied by an "I understand" button, which we ask you to click on in order to confirm that you have understood the changes.

You are hereby informed that you can consult this Privacy Notice at any time on our website “myconnectedaccount”, which is accessible from your Application.

CONTACT US & CONTACT OUR DPO

By email:

Via the online form on the website

https://www.legrandgroup.com/en/data-privacy

By mail:

Service Consommateurs Legrand
128, avenue du Maréchal de Lattre de Tassigny
87045 Limoges Cedex - France

Our DPO:

Data Protection Officer – Julie Celma

128, avenue du Maréchal de Lattre de Tassigny
87045 Limoges Cedex – France

fr-sm-data-protection-officer@legrand.com