Privacy
1. Introduction
The controller is the company VOUTE SAS simplified joint stock company with capital of 92 004,60 € registered at the RCS Montpellier under the number 790 373 815, located at 650 rue Becquerel 34000 Montpellier France, authorized as a distributor of the payment solution MANGOPAY, by MANGOPAY SA. Limited liability company under Luxembourg law, with a capital of 27 201 000 €, with registered office at 2 Avenue Amélie, L-1125 Luxembourg and registered in the Luxembourg Trade and Companies Register under number B173459, authorized to provide payment services and electronic money as an electronic money institution approved by the Financial Sector Supervisory Commission (CSSF).
For the management of your Personal Data, you can contact us at:.support.c-lest@voute-sas.fr.2. Are you affected by this privacy policy?
When you subscribe to the services of VOUTE, you may also be required to subscribe to services provided by MANGOPAY, to allow you to transfer funds or receive payments via the Partner’s website. In this case, MANGOPAY collects and processes your Personal Data for the provision of its services. This Privacy Policy applies if you have benefited from the services of C-LEST as a natural person.
You may also be affected by this Privacy Policy if you are a natural person related to a Customer of VOUTE, or to a legal person having subscribed to or benefited from the services of C-LEST. In fact, any beneficiary of a payment, natural or legal person, as well as any legal entity that subscribes to the services, is required to transmit information relating to natural persons (its legal representatives, natural persons having the power to use the services for the account of the legal person, or the beneficial owners1 of the legal person, in accordance with the regulations).
Regarding the Personal Data relating to Internet users browsing the website www.clestclinical.com/, please refer to the page: www.clestclinical.com/cookies3. Which Personal Data is processed by C-LEST or VOUTE? How are they collected?
If you have subscribed to C-LEST services
When you subscribe to the services of C-LEST, or if you are a beneficiary of reimbursements and / or compensation for coercion suffered, as a participant in a clinical study, you agree that your Personal Data necessary for the provision of these services be treated by C-LEST / VOUTE. This concerns mainly and / or possibly, your identifiers on the C-LEST application (allowing you to access the C-LEST services), as well as your identification data (including your surname, first name, address, date and place birth certificate, and if applicable your identity document and any supporting documents that may be required for the use of the services). This data may be transmitted to MANGOPAY from the MANGOPAY API, or stored in C-LEST, depending on your role and / or your rights in the payment process.
If you refuse to provide the Required Data, the subscription to the services may be refused or the services may be suspended.
In addition, MANGOPAY processes the payment data and operating data of your account (this data is generated when you use the services), as well as data related to the management of payment fraud.
Thus, the Personal Data about you are collected and processed from time to time: subscription to C-LEST services and opening of the account (payment account or electronic money account); use of services and account management; authentication to access your account or send a payment instruction; processing of your requests for assistance or claims; the fulfillment of obligations in the fight against money laundering and terrorist financing; fraud management.
The beneficial owners are natural persons who hold, directly or indirectly, more than 25% of the capital or voting rights of the company, or exercise, by any other means, a power of control over the company.
4. For what purposes are your Personal Data treated?
Your Personal Data is processed as part of the performance of the contract you entered into with C-LEST / VOUTE (or to take action related to a contract, if you are the recipient of a payment). This includes the following purposes:
– Subscription to the services and the opening of your account (payment account or electronic money account) in the books of MANGOPAY;
– The management of this account and the execution of the payment transactions;
– The management of payment orders;
– The treatment of your questions and your possible claims;
– The terms of online access to your account (and the management of any authentication procedures);
C-LEST / VOUTE also processes your Personal Data in the context of legitimate interests, deemed necessary for its distribution activities of the application of a payment service provider.
This includes the following purposes:
– The fight against identity fraud;
– the fight against external fraud;
– Preserving the security of the MANGOPAY API and services in general
Finally, C-LEST / VOUTE & MANGOPAY process your data for purposes that are required by law. This includes for example:
– Compliance with the legal and regulatory obligations imposed on him as a payment service provider, or as a distributor and particularly in the fight against money laundering and terrorist financing;
– The consultation of the RNIPP for inactive accounts;
– Co-operation with the public authorities or any law enforcement or prudential supervisor, as part of a control or investigation.
5. How long are your Personal Data kept?
MANGOPAY retains your Personal Data for the duration of the contractual relationship. As soon as you terminate the services, all of your Personal Data is permanently deleted, with the exception of those to be kept by MANGOPAY under legal obligations. The following retention periods will apply in particular:
– As part of its obligations in the fight against money laundering and terrorist financing, MANGOPAY keeps for 5 years from the termination of services the documents and information relating to your identity. MANGOPAY also keeps for 5 years from the date of their execution, the documents and information relating to the payment transactions, as well as the documents recording the characteristics of the transactions identified as particularly complex or of an unusually high amount or not appearing to have any economic justification or lawful object.
– The data necessary for the management of any disputes or disputes are kept for a period of 5 years, in accordance with the legal provisions in force (including but not limited to those provided by the Commercial Code, the Civil Code and the Consumer Code).
– The contractual documents are kept for a period of 5 years from the end of the contract.
– In case of opposition to a payment instrument, the notification of the opposition is kept for a period of 18 months from the opposition.
– Communications with customer support can also be recorded. If necessary, they will be kept for a period of 5 years from their receipt or registration.
C-LEST / VOUTE keeps your data for 10 years. With regard to the preservation of elements allowing accounting, fiscal and contractual justification.
6. Where are your Personal Data stored?
The servers used by C-LEST / VOUTE to store your personal data related to payments in the context of a clinical study are located in France, at a health data host.
Certain purely contractual or administrative management data of the company VOUTE are stored in Switzerland and Hungary. No participant data is stored on these sites.
C-LEST / VOUTE does not transmit any information related to the pathology object of the study to MANGOPAY, only the strict information allowing the payment are transmitted to it.
The servers used by MANGOPAY to store your Personal Data are located in Luxembourg.
Moreover, MANGOPAY transmits some of your Data to its subcontractors, providing services necessary for the execution of the services. Some of these subcontractors host your Data on servers located outside the territory of the European Union (in particular in the United States). In this case, MANGOPAY ensure that the third country or entity in question has been the subject of a decision of the European Commission noting an adequate level of protection of personal data (Privacy Shield membership). Otherwise, MANGOPAY implements appropriate safeguards to ensure the protection of your Data, such as the use of standard clauses adopted by the European Commission.
7. Who are the recipients of the Personal Data? Are they transmitted to third parties?
7.1 The authorized services of C-LEST / VOUTE
Only specifically authorized C-LEST / VOUTE employees can access your Personal Data, as part of the exercise of the tasks entrusted to them.
Any employee of C-LEST / VOUTE who has access to your Data is subject to strict confidentiality obligations, as well as professional secrecy regarding payment data.
7.2 The competent authorities
C-LEST / VOUTE / MANGOPAY may be required to transmit Personal Data to the competent authorities, such as public authorities, anti-money laundering and terrorist financing organizations, or bank supervisory authorities, or health.
7.3 Mangopay’s subcontractors
MANGOPAY uses the services of subcontractors for the purposes of carrying out its payment service provider activities and for providing the service that is requested. (This concern, for example, the hosting of the information system, the Partner credit institutions for the protection of funds or the execution of payment transactions, etc.). Subcontractors perform processing of your Data only on the instructions of MANGOPAY, and exclusively within the framework of the activities of the latter. Unless expressly agreed by you, subcontractors are not permitted to use your Personal Data for their own account.
MANGOPAY contractually imposes on its subcontractors to respect the obligations of security and confidentiality, and to implement the appropriate technical and organizational measures in such a way that the treatments carried out comply with all the applicable regulations and guarantee the protection of your rights. You can obtain on request from MANGOPAY a detailed list of the categories of subcontractors involved in the processing of your Data.
8. What are your rights to your Personal Data?
8.1 Right of access
You have the right to access the Data about you. If you exercise this right, C-LEST / VOUTE will provide you with a copy of the characteristics of the treatments performed on your Data (the purposes of the processing, the categories of Data concerned, etc.). This information will be provided on a commonly used electronic medium. You may, however, request that this information be provided to you in another form, provided that C-LEST / VOUTE is technically able to send you the information in the requested format.
You are informed that C-LEST / VOUTE may require the payment of fees based on the administrative costs generated by any request for an additional copy.
8.2 Right of rectification
If you find that the Data concerning you is inaccurate or incomplete, you may request the correction or updating of this Data.
8.3 Right to oblivion
In accordance with the applicable regulations, you may request the deletion of your Data in the following cases: when they are no longer necessary for the purpose for which they were collected or processed; when your Data has been subjected to unlawful processing or when it must be erased to comply with a legal obligation provided for by European Union law or by French law.
However, you will not be able to obtain the erasure of your Data when the processing is necessary for the exercise of the right to freedom of expression and information, the recognition, the exercise or the defense of rights in justice, or to fulfill a legal obligation imposed on C-LEST / VOUTE & MANGOPAY.
8.4 Duty to the limitation of a treatment
You have the right to obtain the limitation of a treatment in the following cases: if you dispute the accuracy of your Personal Data; if the processing is illegal and you wish to obtain the limitation of this treatment in place of the erasure of your personal data; if C-LEST / VOUTE no longer needs your Personal Data but they are still necessary for you to find, exercise or defend a right in court.
8.5 Due of opposition to a treatment
If you have a legitimate reason, you can object to your data being processed. Since you oppose the treatment, your Data will no longer be processed for these purposes.
8.6 Right to portability of Data
You have a right to the portability of the Data you have transmitted. You can receive this Data in a structured, commonly used and machine-readable format. You also have the right to request that this Data be transmitted to another controller, where technically possible.
9. How to exercise your rights?
You can exercise your rights by contacting the investigating doctor if you are the beneficiary of a refund or the payment of a compensation or C-LEST / VOUTE with which you are in relation according to the modalities indicated on our Internet site, or on the C-LEST application or by contacting C-LEST / VOUTE directly: support.c-lest@voute-sas.fr.
For any request to exercise your rights, C-LEST / VOUTE may ask you to send an official identity document to verify that you are the person concerned by the Data that is the subject of the request.
The answers to your requests will be communicated to you electronically, unless you ask otherwise. In this case, you will have to accompany your request with the desired response modalities.
C-LEST / VOUTE is committed to responding to any request as soon as possible. You will receive an answer within a maximum of one month from the receipt of your request. However, we inform you that this period may be extended by two months if your request is particularly complex or given the number of requests. In this case, you will be informed of such an extension and its reasons within a maximum of one month from the receipt of your request.
If C-LEST / VOUTE can not respond to your request, you will be informed at the latest within one month from the receipt of your request, stating the reasons. You will then be able to lodge a complaint with the CNIL https://www.cnil.fr/ and to form a judicial appeal.
You are informed that in the case of requests that are manifestly unfounded or excessive, in particular because of their repetitive nature, we may refuse to respond to your requests or charge fees to cover the administrative costs incurred in responding to your requests.
10. How is the security of your personal data insured?
C-LEST / VOUTE implements all the appropriate security measures in order to guarantee the protection and the confidentiality of your Data, and in particular to prevent the destruction, the loss, the alteration, the unauthorized disclosure of Data, or the unauthorized access to such Data. These security measures include encryption of the Data or pseudonymization thereof, as well as the implementation of means to ensure the ongoing confidentiality, integrity, availability and resilience of the processing systems and services. Any breach of security affecting your Data and likely to generate a risk removed for your rights and freedoms will be notified to you as soon as possible.
11. What is the relationship between MANGOPAY and its Partners for the management of your Personal Data?
C-LEST / VOUTE assumes jointly with MANGOPAY the responsibility of the data processing carried out within the framework of the following activities:
– Subscription to the services and the opening of your account (payment account or electronic money account) in the books of MANGOPAY;
– The management of payment orders;
– Customer relationship management (for example, the provision of transaction records):
– The treatment of your questions and your possible claims.
– How to access your payment account online (and how to manage any authentication procedures);
– The execution of card payments (when you make a card payment on a Partner’s website);
– Compliance with legal and regulatory obligations in the fight against money laundering and the financing of terrorism.
This joint liability regime is contractually regulated between C-LEST / VOUTE and MANGOPAY. For any request of exercise of your rights or any claim in connection with the aforementioned treatments, you can address first directly to C-LEST / VOUTE with which you are in relation according to the modalities indicated on our site. MANGOPAY cooperates with C-LEST / VOUTE to ensure the protection of your Personal Data, you are informed that each party, in its capacity as controller, is required to comply with the regulations applicable to the protection of your Data. In addition, MANGOPAY cooperates with C-LEST / VOUTE to ensure the highest level of security of your Data and to respond as efficiently as possible to each of your requests.
12. Modification of the Privacy Policy
Changes to the Privacy Policy are published on the C-LEST / VOUTE website, with the date of last update. Changes to the treatments for which responsibility is assumed jointly with MANGOPAY will also be communicated to you according to the terms and conditions.
