Privacy policy at Cosma Technology website

Policies

This privacy policy (hereinafter referred to as “Privacy Policy”) describes how Cosma technology and its Affiliates, as defined in Article 1 below, collect, use, transfer and, more generally, process Personal Data as defined below.

This policy may change, notably to meet the requirements of the regulations relating to personal data protection. You are therefore encouraged to periodically review this page of our website to stay informed of potential updates.

1. Definitions

Each of the following terms, used in the singular or in the plural, shall have the same meaning as in the following definitions:

The terms “personal data” (hereinafter referred to as “Personal Data”, “Categories of Data”, “Process/Processing,” “Data Controller” and “Data Processor” shall have the same meaning as in Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (General Data Protection Regulation, hereinafter referred to as “GDPR”) and the Law No.78-17 of January 6, 1978 relating to information technology, data files and civil liberties modified by decree No. 2019-536, published on May 30, 2019 (hereinafter collectively referred to as “Information Technology and Liberties”).
“Customer”: the organisation (for example your employer or any other entity or individual) that has entered into the contract with Cosma technology.
“Customer Content”: any content submitted to Cosma technology by the Customer, under their responsibility, in connection with the use of the Services.
“User Content”: part of the Customer Content constituting Personal Data transmitted to Cosma technology under the responsibility of the Customer.
“Customer Contract”: the contract that the Customer has entered into with - Cosma technology.
“Services”: tools and/or platforms and/or software made available and operated by Cosma technology, including any Cosma technology mobile applications.
“Third party services”: tools and/or platforms and/or software made available and operated by third parties and used in connection with the Services.
“Websites”: Cosmatechnology.com
“Affiliate”: any company controlled by, controlling, or under the same controlling entity as Cosma technology. Control extends to the holding of at least 50% of the equity or voting rights.
“Users”: employees, agents or subcontractors to whom a Customer grants access to the Services in accordance with the Customer Contract.
“Visitors”: any individual accessing the Websites.

2. Applicability of this privacy policy

This Privacy Policy applies to the Services and Websites as well as to other interactions (for example, requests made to customer service, forms, emails of all types addressed to prospects or existing customers) that you might have with Cosma technology.

If you do not agree with the content of this Privacy Policy, please do not access the Services and/or Websites and stop any interaction with Cosma technology.

This Privacy Policy does not apply to Third Party Services, as they have their own privacy policies to which you should refer.

3. Collection and reception of personal data

3.1 Personal Data provided by Cosma technology’s Customers and/or Users and/or Prospects

We collect Personal Data through the following:

Subscriptions to Cosma technology Services or when they are used (including but not limited to the following: to create a user account in order to access the Services; when Users submit Customer Content; when Cosma technology provides Customers with support in connection with the Services)
Subscriptions to newsletters
Marketing campaigns of all kinds, as well as satisfaction surveys
Registration for events (webinars, etc.)
Letters, if you contact us through a contact form on our Websites, by email or by any other means, notably to obtain information on Cosma technology products;
Job applications
Participation in a discussion group, a competition or when you interact with Cosma technology’s social network accounts or otherwise communicate with Cosma technology.
This Personal Data may be added to through other means such as those listed below.

3.2 Passive data collection

When you visit our Websites and use our Services, some Personal Data are automatically collected, in particular:

Metadata: when Users access the Services, metadata is generated to provide additional information on the way users work and to facilitate access to and use of the features offered.
Connection and usage data: Cosma technology’s servers automatically collect and store information when you access the Websites and Services provided via the Internet. This data may include your Internet Protocol address (IP address), the address of the web page you visited before using the Website or the Services, the type of browser you used and information about its configuration and plugins, the date and time of your use of the Services, your language preferences and cookie data (for more details, please refer to our Policy regarding cookies).
Device data: Cosma technology collects device data, including device type, operating system, device settings, application IDs, unique device IDs, and shutdown data.
Interaction data: Cosma technology may also collect data about your interactions with Cosma technology, through emails, notably to find out whether you have opened, forwarded, or clicked on a message.
Cookies: Cosma technology collects data through cookies and similar technology on its Websites and through its Services. The Websites and the Services may also include cookies and similar tracking technologies, which may collect data about you through Third Party Services.

3.3 Personal data from other sources

Personal data may also be collected through the following means:

Third Party Services: Third Party Services may be integrated into the Services. Third Party Service providers may share data with Cosma technology. For example, if a Cloud storage application is used to import files to your user account, your username and email address may be transferred to Cosma technology, as well as any additional information made available to Cosma technology by the application to improve integration. Users should check the settings and privacy policy governing these Third Party Services to find out what Personal data may be disclosed to Cosma technology.
Third Party Data: Cosma technology may receive Personal Data such as identification data or professional data from its Affiliates, its partners or other parties used by Cosma technology to improve data quality and relevance. It can also be more precise data, such as data used to analyze the performance of an online marketing campaign, a satisfaction survey, a recruitment or an email campaign.

4. Use of personal data

4.1 As a data controller

Cosma technology, as a Data Controller, as defined by the Information Technology and Liberties Regulation, may use Personal Data for the following purposes and according to the following legal bases :

Purpose	Legal basis	Retention period
For the management of customer accounts and other administrative tasks such as invoicing	Fulfilment of Customer Contract	Duration of the contract and legal retention period
For marketing purposes (campaigns, online events or at trade fairs, customer satisfaction surveys)	Consent or legitimate interest	Withdrawal of consent or duration of the event or end of Customer Account activity
For communication purposes regarding new product features, promotions, or any other news about Cosma technology	Consent or legitimate interest	Withdrawal of consent or end of Customer Account activity or inactive data for 2.5 years.
As part of Customer relationship follow-up	Fulfilment of Customer Contract	Duration of commercial relationship
To conduct security investigations and help prevent security or fraud issues, as well as potential misuse	Legitimate interest and legal obligation	Time needed to undertake security or fraud investigations and their resolution. Extension possible in the event of litigation.
Management of requests from contact form or by any other means	Consent	Withdrawal of consent or processing of the request
Job applications	Consent	Withdrawal of consent or end of recruitment process
Participation in a competition	Consent	Withdrawal of consent or end of competition
Statistics and reporting of Website visitors	Consent and legitimate interest	Different retention periods not exceeding 13 months

Personal Data will be used by Cosma technology in accordance with current regulations.

4.2 As a data processor

Personal Data is used by Cosma technology (in its role of Data Processor according to the definition provided by the Information Technology and Liberties Regulation) in accordance with the instructions received, including the terms applicable to Customer Contract and to the use of the Services by the Customer, if applicable, and in compliance with the current regulations. The legal basis is therefore the fulfilment of the Customer Contract.

Customers control their instance of the Services, the accounts and the User Content associated with them. If you have any questions regarding Customers’ specific settings and privacy practises, please contact the entity or individual who, within your organisation, manages the Customer Contract.

As a Data Processor, Cosma technology uses Personal Data for the following purposes:

To provide, maintain and improve its Services;
To meet a legal or regulatory obligation;
To communicate with you and respond to your requests, comments, and questions;
To develop and deliver research, learning and productivity tools, as well as additional features;
To send emails and other communications. Cosma technology may send you service or technical and administrative emails, messages and other types of communication relating to the status of the Services. Cosma technology may also contact you to inform you of changes related to the Services and send you important notices related to the Services, such as security and fraud notices. These communications are considered part of the Services and you may not be able to opt out of them;
To produce dashboards and statistics relating to the use of the applications provided under the Customer Contract for the needs of the Customer and/or Cosma technology;
To conduct security investigations and help prevent security issues or fraud, as well as potential misuse.

5. Data retention

5.1 As a data controller

Cosma technology, in its role of Data Controller, stores Personal Data relating to associated processing operations in compliance with legal or regulatory obligations, if any, for all its activities. When no legal or regulatory obligation is available, Cosma technology defines the retention periods for Personal Data relating to associated processing operations in compliance with the current regulations (Article 5, paragraph 1.e) of the GDPR).

5.2 As a data processor

Cosma technology, in its role of Data Processor, may store your Personal Data for as long as necessary for the fulfilment of the Customer Contract and/or to comply with current regulations. Cosma technology therefore stores Customer Content in accordance with Customers’ instructions.

The deletion of User Content and any trace related to the use of the Services by the Customer may result in the deletion and/or anonymization of the Personal Data associated with it.

6. Data sharing and disclosure

Cosma technology ensures, for each activity, that only authorised individuals can access your data. Cosma technology may thus share information with its Affiliates if this is necessary for the fulfilment of the Customer Contract, to comply with a legal obligation and/or for its legitimate interest.

6.1 As a data controller

This section describes how Cosma technology may share and disclose Personal Data in its role of Data Controller, notably to:

Use aggregated or anonymized data. Cosma technology may transmit, disclose, or use aggregated data if it does not identify the individuals to whom it relates or anonymized data for any purpose whatsoever. For example, Cosma technology may share aggregated or anonymized data with other corporate clients or partners for commercial or research purposes.
Enforce Cosma technology's rights, prevent fraud and ensure security. Protect and defend the rights, property, or safety of Cosma technology or of third parties, including in the fulfilment of Customer Contracts, during investigations and to prevent fraud or security issues.
Comply with a legal or regulatory obligation following a request from an administrative or judicial authority.

6.2 As a data processor

This section describes how Cosma technology can share and disclose Personal Data as a Data Processor, as defined by the Information Technology and Liberties Regulation. Customers choose their own policies and practices regarding Personal Data sharing and disclosure. Cosma technology does not control how its Customers or other third parties choose to share or disclose their Personal Data. Cosma technology may share and disclose Personal Data, notably to:

Follow Customers’ instructions. Cosma technology will only share or disclose Customer and User Content in accordance with Customers’ instructions, including all applicable conditions defined in the Customer Contract.
Display the Services. When Users send information containing Personal Data, they may be disclosed to other Users.
Allow Customer access. Owners, administrators, Users and other Customer representatives and employees can access and modify Personal Data or restrict their access.
Use Third Party Service Providers and Cosma technology partners. Cosma technology may hire Third Party companies or individuals as service providers or business partners to process information and allow Cosma technology to carry out certain activities. These third parties may notably provide virtual computing and storage services, manage authentication systems, or send emails.
Interact with Third-Party Services enabled by Customers. Customers may, if necessary, enable Third Party Services or allow Users to do so. When these are enabled, Cosma technology may share information with Third Party Services, transfer information and data from its Services to a Third-Party Service, but its Services may also receive information and data from a Third-Party Service. Third-Party Services are not the property of Cosma technology and third parties that were granted access to this information may have their own policies and practices regarding Personal Data. Please check the privacy settings and policies of these Third-Party Services or contact the provider for any questions.
Make a change in Cosma technology’s activities. If Cosma technology is involved in a merger, acquisition, bankruptcy, dissolution, reorganisation, sale of part or all of its assets or shares, financing, public offerings of securities, the acquisition of part or all of its activities, or a similar transaction or procedure, or steps towards such activities (for example due diligence), certain Personal Data may be shared or transferred, subject to customary confidentiality provisions.
Enforce Cosma technology’s rights in the fulfilment of the Customer Contract, prevent fraud and ensure security. To protect and defend the rights, property, or safety of Cosma technology or of third parties, including the fulfilment of the Customer Contract, during investigations and to prevent fraud or security issues.

7. Security

The security of your Personal Data is a major concern for Cosma technology. Cosma technology therefore implements technical and organisational measures to guarantee the security of your Personal Data and prevent any risk of loss or misuse and any unauthorised access or disclosure. These measures consider the sensitivity of the information that Cosma technology collects, processes and stores and the state of the art. These measures are valid, in whole or in part, for certain processing of Personal Data, whether Cosma technology acts as a processor, or as a Data Processor, as defined by the Information Technology and Liberties Regulation.

7.1 Technical security measures

1. Personal Data encryption: depending on the processing implemented and the sensitivity level of the Personal Data, Cosma technology, both in its quality of Data Controller and Data Processor, as defined by the Information Technology and Liberties, may use Personal Data encryption, both when storing data in databases (at rest) and in transit.

2. Ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services: all the processing operations implemented by Cosma technology, whether as Data Controller or Data Processor, as defined by the Information Technology and Liberties Regulation, are defined in compliance with the obligations prescribed by the GDPR, and by the interpretation made by Cosma technology, in particular with regard to the assessment of the risks surrounding the Personal Data collected. These means can be managed by Cosma technology itself or delegated to Third Party hosting providers meeting high security standards.

3. Ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident: all the processing operations implemented by Cosma technology, whether as Data Controller or Data Processor, as defined by the Information Technology and Liberties Regulation, are defined in compliance with the obligations prescribed by the GDPR, and by the interpretation made by Cosma technology, in particular with regard to the assessment of the risks surrounding the Personal Data collected. Regarding the Services, guarantees of availability of service and incident handling may be set in the Customer Contract, depending on the Services concerned.

4. A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of data processing: the IT Security Policy (ITSP) describes the organisation and the means implemented to define these measures applicable to Cosma technology’s Internal Information System, which may contain Customer data and Personal Data. Regarding the Services, Cosma technology relies on Third-Party hosting providers meeting high security standards. Other tests carried out by independent external bodies on a regular basis make it possible to check the efficiency of existing technical and organisational measures, leading, in the event of weaknesses identified, to a dedicated remediation plan.

7.2 Organisational security measures

1. Information security policy: Information security is a pillar of our company’s organisation, both for our internal processes as well as regarding our customers. As such, information security in the way Cosma technology’s employees conduct business is supported at management level, in accordance with business requirements and the current laws and regulations.

2. Information security organisation: a management framework to initiate and then verify the implementation and operation of information security within the organisation is established, documented, and monitored.

3. Security in human resource management: ability of employees and contractors to understand their responsibilities. All employees and contractors are subject to confidentiality clauses in the performance of their duties. In addition, an awareness program on information security and good practises when handling Personal Data is being implemented on a regular basis to ensure that both employees and contractors understand their responsibilities and the issues at stake.

4. Asset management: the organisation’s assets (human or technical resources such as applications and infrastructure) dealing with Customer and Personal Data have been identified, and responsibilities are clearly defined, in terms of organisational and human resources, as well as in terms of technical means, to provide appropriate guarantees regarding data protection. In addition, access to these assets is strictly controlled and restricted.

8. Data transfer

Cosma technology may transfer your Personal Data to countries other than the one in which you reside. If Cosma technology transfers Personal Data outside the European Union to countries that do not provide a comparable level of protection of Personal Data, Cosma technology will ensure that the requirements of Art. 44 et seq. of the GDPR are met, for example by signing the applicable European Union’s Standard Contractual Clauses, in accordance with current regulatory requirements.

8.1 As a data controller

Affiliates located outside the European Union may consult information about their respective Customers that is stored in France or in the European Union for the sole purpose of fulfilling the Customer Contract.

Cosma technology’s suppliers may consult or store information within their respective scope, and, as such, Cosma technology has implemented the guarantees specified in Paragraph 8.

8.2 As a data processor

As part of the provision of its Services, Cosma technology guarantees the localization of Personal Data in a country of the European Union with suppliers contractually bound to Cosma technology, by default for all Customers in the European Union, subject to the GDPR and the Information Technology and Liberties Regulation. Failing this, Cosma technology undertakes to sign Standard Contractual Clauses with potential subcontractors located outside the European Union or in a country that does not provide a comparable level of protection of Personal Data.

9. Rights of users and visitors

Data subjects have the right to request access to their Personal Data, as well as the updating, deletion, correction, and portability of their Personal Data, and in certain cases, to withdraw their consent and oppose or limit the processing of their Personal Data.

As part of the Services, Cosma technology acting as a Data Processor, you can exercise your rights by contacting the Customer to obtain the necessary assistance.

In other cases, when Cosma technology acts as a processor, you can contact Cosma technology directly using the contact details provided in Article 11, specifying your Last Name, First Name, Email address and/or Postal address.

10. Contact Cosma technology

Anyone can contact Cosma technology regarding this Privacy Policy or Cosma technology's Personal Data practises, or to exercise their rights.

In addition, if you wish to contact Cosma technology's Data Protection Officer (DPO), please contact us

Commercial office:

Address: 7 Temasek Boulevard, #43-01A Suntee Tower One, Singapore 038987

Tel: +84 28 397 38 661 - 662 - 663

Mail: [email protected]

Other Models