Personal data protection policy

Last update: 14 April 2021

The carmacks.com website (hereinafter the “Website”) is the institutional website of VINCI Construction, and presents its business activities.

When you access, consult, browse and use the Website and its services, you send personal data to VINCI Construction.

Those data are protected by law. As a result, VINCI Construction, in its capacity as data controller, has adopted security measures to protect your personal data.

Please familiarise yourself with this policy, which explains how VINCI Construction uses your personal data. This policy supplements all documents and information that refers to the policy.

You may put any questions directly to VINCI Construction by sending an email to dpo@vinci-construction.fr.

1. What kinds of personal data does VINCI Construction process?

All data that you enter on the Website or when you communicate with VINCI Construction, i.e.:

  • Identification data, for example : First name, last name…
  • Contact details, for example : Email address, country…
  • Data relating to your interactions with VINCI Construction, for example : Questions, information requests, complaints, discussions with VINCI Construction departments

Some data are automatically collected by the Website via cookies/trackers, i.e.:

Connection and browsing data

  • Date and time of the Website visit, IP address, device, browser, operating system, system configuration data
  • These data are essential for the Website and its services to work properly in technical terms and for audience measurement purposes. For more information about the cookies/trackers used on the Website, please consult the Website’s Cookie policy.

Some of these data are required, others are optional to help you to benefit from all services offered by the Website. The Website’s forms state whether the personal data concerned are required or optional. If you decline to provide the required data requested, VINCI Construction will not be able to process your request (such as a request to sign up to the VINCI Construction newsletter or a contact request).

2. Why does VINCI Construction use your personal data?

VINCI Construction uses your personal data only for the following reasons:

Processing contact requests

  • to direct your contact request to the correct contact person
  • to respond to your contact request and get back to you
  • VINCI Construction’s legitimate interest in processing the contact requests it receives

Improving the Website and its services and your experience as a user of the Website

  • to assess and improve the Website and the services it offers
  • to make it easier for you to browse the Website
  • to ensure the Website is secure
  • VINCI Construction’s legitimate interest in improving the Website and its services and your experience as a user of the Website

Handling complaints and disputes

  • to deal with any identified violation
  • to manage any dispute or litigation
  • VINCI Construction’s legitimate interest in defending its rights and interests

Complying with statutory and regulatory obligations

  • to ensure that VINCI Construction complies with its statutory and regulatory obligations
  • to respond to your requests to exercise your rights
  • VINCI Construction’s statutory and regulatory obligations

3. Who can access your personal data?

When you access, consult, browse and use the Website and its services, your personal data may be sent to the following recipients:

VINCI Construction and its authorised personnel : Managing the Website and providing the services offered on the Website

VINCI group companies and their authorised personnel : Solely for technical, logistical or operational reasons

VINCI Construction subcontractors (Website host, IT maintenance provider etc.) :  Solely for technical, logistical or operational reasons

Administrative or judicial authorities : Only when they make an express request including reasons, or where there has been a breach of statutory or regulatory provisions

External advisors : Only in relation to managing disputes and any other legal matters

Other third parties : In relation or subsequent to any restructuring, reconstitution, acquisition, debt financing, merger or sale of assets by VINCI Construction or any similar transaction, and in the event that VINCI Construction becomes insolvent or bankrupt or its assets are seized, in which personal data, as VINCI Construction assets, are transferred to one or more third parties

4. Are your data transferred out of the European Economic Area?

As far as possible, your data are processed within the European Economic Area (EEA). However, since some VINCI group companies and some of VINCI Construction’s service providers are located in non-EEA countries, your personal data may be processed in those third countries.

Where the recipient country does not provide a level of personal data protection equivalent to that of the European Union, VINCI Construction undertakes, in the absence of an adequacy decision and after assessing the protection of your rights in the third country in which the recipient of your personal data is established, to take all necessary measures to ensure that your personal data are protected on the basis of appropriate guarantees (including standard contractual clauses). You can obtain information about these measures directly from VINCI Construction by sending an email to dpo@vinci-construction.fr.

5. How does VINCI Construction protect your personal data?

VINCI Construction has put in place technical and organisational measures to protect your personal data, particularly against possible violations that may lead, accidentally or unlawfully, to the destruction, loss, distortion or unauthorised disclosure of your personal data or access to your personal data. Those measures ensure an appropriate level of security for your data, and take into account the state of the art and the costs of implementation in relation to the risks and the nature of the data to be protected.

VINCI Construction also warrants that its staff members and any other person who may process your personal data will comply with internal rules and procedures relating to the processing of personal data and particularly technical and organisational security measures put in place to protect your personal data. VINCI Construction’s practices in this area are regularly reviewed and updated to ensure data confidentiality and to ensure that internal policies are complied with.

If you find a vulnerability or if you wish to report a security incident, please send an email to dpo@vinci-construction.fr.

6. How long are your personal data kept?

In general, your personal data are only kept for as long as is necessary to achieve the purposes for which the data were collected or to comply with statutory or regulatory requirements.

This is subject to the following exceptions:

  • data collected in relation to your contact requests are kept until those requests have been dealt with in full;
  • connection and browsing data are kept for thirteen (13) months.

After those periods, your data are kept for:

  • five (5) years for data kept for evidential purposes;
  • ten (10) years from the end of the accounting period for data kept for accounting purposes and commercial documents.

7. What are your rights regarding your personal data?

In accordance with personal data protection regulations, you have the following rights regarding your personal data:

  • a right of access to your personal data allowing you to obtain clear, transparent and comprehensible information about the way VINCI Construction uses your personal data and about your rights (as set out in this policy), as well as a copy of your personal data.
  • a right to rectification of your personal data, allowing you to have your personal data amended if they are obsolete, inaccurate or incomplete.
  • a right to object to the processing of your personal data where it is based on VINCI Construction’s legitimate interest. VINCI Construction will stop processing your personal data, except if there are compelling legitimate grounds that override your interests, rights and freedoms, such as compliance with a statutory obligation (such as the obligation to retain documents) or the establishment, exercise or defence of legal claims.
  • a right to restrict processing of your personal data temporarily, particularly with a view to carrying out checks, i.e.:
    • where you dispute the accuracy of your data, while we check their accuracy;
    • where the processing is unlawful and, rather than requesting their erasure, you prefer to restrict their use;
    • where VINCI Construction no longer needs the data for processing purposes but they remain necessary for you to establish, exercise or defend legal claims;
    • where you exercise your right to object to processing, while VINCI Construction carries out checks to confirm whether its legitimate grounds override your own.
  • a right to withdraw your consent at any time, in relation to the purposes for which we obtained your consent.
  • a right to data portability, allowing you to receive the personal data you have provided to us, in a structured, commonly used format, so that they can be sent to a third party where technically possible. This right cannot be exercised in all circumstances, and only applies if all the following conditions are met:
    • it only relates to your personal data, not anonymous data or third-party data;
    • it does not infringe the rights and freedoms of third parties, including those of VINCI Construction (particularly in relation to trade secrets and intellectual property);
    • it concerns personal data processed in an automated way (i.e. it does not relate to paper documents);
    • the processing is based on your consent or the performance of a contract with VINCI Construction (to check whether that is the case, see article 2 of this policy).
  • a right to erasure of your personal data (also known as the right to be forgotten) where any of the following grounds applies:
    • you object to the processing of your personal data and there are no overriding legitimate grounds for that processing to continue (such as VINCI Construction’s obligation to retain certain personal data);
    • you object to commercial prospecting operations;
    • you decide to withdraw the consent on which the processing is based;
    • your personal data are no longer useful for the initial purposes that justified their collection or for any other type of processing;
    • your data are being used in a way that does not comply with applicable legislative or regulatory provisions.
  • a right to give instructions, either general or specific, regarding your personal data in the event of your death (for example, you can ask for them to be erased or sent to any person of your choice). You can revoke your instructions at any time.

The exercise of these rights depends on the legal basis for the processing, as stated in the table below:

In certain circumstances, VINCI Construction may ask you for specific information to confirm your identity and to ensure you can exercise your rights. This is another appropriate security measure to ensure that personal data are not disclosed to anyone not entitled to receive them.

If you have any questions and to exercise your rights, you can contact VINCI Construction directly by sending an email to dpo@vinci-construction.fr.

If necessary, you can file a complaint with the Commission Nationale Informatique et Libertés (CNIL) via its website or by post: 3, place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07. You can exercise this right at any time and free of charge, except for any postage costs and any assistance or representation costs if you seek assistance from a third party in relation to this procedure.

8. UPDATES OF THIS PERSONAL DATA PROTECTION POLICY

The personal data protection policy has a precise date and may be modified and updated by VINCI Construction at any time, including when changes are made to the Website or to the applicable regulations. We therefore recommend that you consult this policy each time you access the Website.