1.    Policy objective and scope of application

opper attaches the utmost importance and care to the protection of privacy and Personal Data and compliance with the applicable Legislation.

Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to Personal Data Processing and on the free movement of such Data (hereinafter “GDPR”) states that Personal Data must be processed lawfully, fairly and transparently. Accordingly, the purpose of this privacy policy (hereinafter the “Policy”) is to provide clear and simple information on the Processing of Personal Data concerning you, in the context of your browsing and any operations carried out on our website.

2.    Data Controller

In the context of its activity, opper advertising, a company governed by French law, registered in the Nanterre Trade and Companies Register under number 414 135 384, having its registered office at 20 rue Rouget de Lisle, 92130 Issy-Les-Moulineaux, France (hereinafter “opper”), processes personal data through the creation and provision of the andzup database to Communication players (hereinafter the “Clients”).

In this respect, opper acts as Data Controller for processing concerning the creation, hosting, enrichment, updating and availability of the database within the meaning of Personal Data Regulations, notably Regulation (EU) 2016/679 on the protection of individuals with regard to Personal Data Processing and on the free movement of such Data, while its Clients act as Data Processors for all processing concerning the use of the database (extraction, commercial communication, etc.).

3.    What data do we process, how, and who are the data subjects?

andzup lists the marketing and communication decision-makers at the main advertisers and advertising agencies present in France, Benelux, Germany, Switzerland, Italy and Spain, hereinafter “Decision-makers”. As indicated above, the platform is made available to Communication players that are opper Clients.

There are two categories of persons concerned: the Decision-makers appearing in the andzup database and the users of the platform on Clients’ sites:

• As regards Decision-makers in the andzup database

To create the andzup database, opper collects data indirectly, including via the Internet, from professionals only (Decision-makers). In this respect, in accordance with the GDPR and the recommendations of the CNIL (French data protection authority), it is unnecessary to obtain the consent of the data subjects. The legal basis for processing is therefore legitimate interest.

Once the data have been collected, opper contacts the decision-makers concerned or their company (by phone) to confirm the data thus collected, provide them with the information required under Article 14 of the GDPR, and inform them of their right to object to their integration into the database. Then, once the Decision-makers who have not objected are included in the database, opper will send them, in writing, the information previously provided by phone as well as a means for them to refuse to be included in the database.

In addition, to enable Decision-makers to control their data, we send them a newsletter every two months informing them of their inclusion in the database, and making it possible for them to view, modify, add to or delete their data.

The categories of data collected from Decision-makers and included in the andzup database are as follows:

• Identification data such as surname, first name, e-mail address and phone number
• Professional data such as the name of the Decision-maker’s company and their position
• With regard to users of the Andzup platform on Client sites

By using andzup, you provide us with a certain amount of information about yourself, some of which may identify you (“Personal Data”). This is the case when you browse the andzup site, fill in online forms, etc.

The main categories of data collected are as follows: 

• Identification data: this includes all information that enables us to identify you, such as your surname, first name, e-mail address and phone number, in the context of creating and managing your user account.

• Professional data: When an account is created, we collect your job title, the name of your company and the sector in which you operate.

• Login details: the information we need to access your personal account, such as your password and other information required for authentication and access to an account.

• Browsing data: when browsing the platform, you interact with it. Consequently, certain information concerning your browsing is collected, such as your IP address.

• Financial Data: Banking Data such as your credit card details, your purchases (when you order a subscription to andzup for example), or your bank details.

4.    Why do we collect your Personal Data and for how long are they kept?

We collect your personal data for specific purposes and on different legal grounds.

In the context of setting up and making the andzup database available, opper uses personal data as follows:

Purpose	Personal data collected	Legal basis for processing	Retention period
We use these data to create, host, enrich and update the andzup database.	– Identification data – Professional data	Legitimate interest	Decision-makers appear in the andzup database as long as they have not expressed their objection to appearing there and in any event for 3 years after the last contact between opper and them.

In order to manage the use of andzup by its clients, opper uses personal data as follows:

Purpose	Personal data collected	Legal basis for processing	Retention period
We use these data for the following purposes: – Creating user accounts – Managing payments – Managing client relations	– Identification data – Professional data – Financial data – Login details – Browsing data	Execution of the contract	The data collected as part of our relationship are kept for 5 years from the end of the relationship.
We use these data for the following purposes: – Handling demo requests – Handling requests to subscribe to our news	– Identification data – Location data – Professional data	Consent	The data are kept for as long as is necessary to process your demo request and for no longer than 3 years from the last contact.
We use these data for the following purposes: – To monitor and improve our platform and applications; – To secure our website/applications and protect you and ourselves against fraud.	– Identification data – Login details – Browsing data	Legitimate interest	Your browsing data on our website are kept for a maximum period of 13 months

5.    Do we share your Personal Data?

Your Data are intended for authorised opper employees in charge of managing and performing contracts and legal obligations, depending on the purposes for collection and within the limits of their respective responsibilities. 

Your Data may be transmitted for certain tasks linked with the purposes, and within the limits of the employees’ respective assignments and accreditation, to the following recipients:

• opper advertising entities;
• Our service providers, suppliers, agents and representatives, including but not limited to payment organisations, subcontractors, client service, e-mail service providers and IT service providers, so that the necessary data can be processed according to our instructions and in compliance with this privacy policy and any other applicable confidentiality and security measures.
• Duly authorised public authorities (judicial, supervisory, etc.), in the context of our legal and regulatory obligations;
• Regulated professions (lawyers, bailiffs, etc.) involved in the implementation of guarantees, debt collection or litigation;

When your Data are communicated to our service providers and subcontractors, the latter are also asked not to use the Data for purposes other than those initially intended. We make every effort to ensure that these third parties maintain the confidentiality and security of your Data.

In all cases, only the necessary Data are provided. We make every effort to ensure the secure communication or transmission of your Data.

6.    Are your Personal Data transferred to Third Countries?

opper endeavours to store Personal Data in France, or at least within the European Economic Area (EEA).

However, it is possible that when the andzup database is set up and updated, your Data may be transferred to other countries. This is the case, for example, if some of our service providers are located outside the European Economic Area.

In the event of a Transfer of this type, we guarantee that it will be made:

• To a country ensuring an adequate level of protection, i.e. a level of protection equivalent to that required by European Regulations;
• Within the framework of standard contractual clauses.

7.    How long do we keep your Personal Data?

We only keep your Personal Data for as long as is necessary to fulfil the purpose for which we hold the Data, in order to meet your needs or to fulfil our legal obligations (see Article 4).

Retention periods vary according to several factors, such as:

• The needs of opper activities;
• Contractual requirements;
• Legal obligations;
• Recommendations from supervisory authorities.

8.    How do we guarantee the security of your Personal Data?

opper undertakes to protect the Personal Data we collect or process from loss, destruction, alteration, unauthorised access or disclosure.

Accordingly, we implement all appropriate technical and organisational measures, depending on the nature of the Data and the risks their Processing entails. These measures must make it possible to preserve the security and confidentiality of your Personal Data. They may include practices such as limited access to Personal Data by persons authorised by virtue of their duties, or pseudonymisation or encryption.

In addition, our practices, policies and/or physical and/or logical security measures (secure access, authentication process, back-up copy, software, etc.) are regularly checked and updated if necessary.

9.    What are the cookies we use on our site?

9.1     What are cookies?

Cookies are computer files that are automatically deposited on the hard drive of your computer, tablet or mobile phone when you browse our Website. They are managed by your web browser (Internet Explorer, Firefox, Safari or Google Chrome).

9.2     Are cookies deposited when you browse opper websites?

On your first visit to the opper Websites, if cookies requiring your consent are deposited, a banner informs you of the presence of these cookies and asks you to indicate your choice. Cookies requiring your consent in accordance with the regulations are deposited only if you accept them. You can find information about cookies at any time and configure them for acceptance or refusal by clicking on “configure my cookies” at the bottom of each page of the Site or by configuring your browser.

9.3     What data are collected through cookies?

Cookies can be used to collect all data concerning a terminal at a given time, including:

Cookie name	Publisher	Categories	Purpose	Retention period
CONSENT	youtube.com	Necessary	Used to detect whether the visitor has accepted the marketing category in the cookie banner. This cookie is necessary for the website to comply with the GDPR	2 years
elementor	andzup.com	Necessary	Used in the context of the website’s WordPress theme. The cookie enables the website owner to implement or modify the website’s content in real time.	Persistent
ppms_webstorage	andzup.containers.piwik.pro	Necessary	The cookie is used in the context of the local storage function in the browser. This function enables the website to load faster by preloading certain procedures.	Persistent
stg_debug	andzup.com	Necessary	Checks whether a technical debugging cookie is present.	Session
pll_language	andzup.com	Preference	This cookie is used to determine the visitor’s preferred language and, if possible, sets the site language accordingly.	1 year
_pk_id#	andzup.com	Statistics	Collects statistics on users’ visits to the website, such as the number of visits, the average time spent on the site and which pages were viewed.	1 year
_pk_ses#	andzup.com	Statistics	Used by Piwik Analytics Platform to track visitor page requests during the session.	1 day
ppms_privacy_#GUID#	andzup.com	Statistics	Determines whether the Internet user has accepted via the cookie consent box.	1 year
LAST_RESULT_ENTRY_KEY	youtube.com	Marketing	Used to track user interaction with embedded content.	Session
nextId	youtube.com	Marketing	Used to track user interaction with embedded content.	Session
remote_sid	youtube.com	Marketing	Necessary for the installation and operation of You Tube video content on the website.	Session
requests	youtube.com	Marketing	Used to track user interaction with embedded content.	Session
ServiceWorkerLogsDatabase#SWHealthLog	youtube.com	Marketing	Necessary for the installation and operation of You Tube video content on the website.
stg_externalReferrer	andzup.com	Marketing	Records how the user reached the site to enable payment of referral fees to partners.	Session
TESTCOOKIESENABLED	youtube.com	Marketing	Used to track user interaction with embedded content.	1 day
VISITOR_INFO1_LIVE	youtube.com	Marketing	Attempts to estimate user bandwidth on pages with embedded You Tube videos.	180 days
YSC	youtube.com	Marketing	Registers a unique identifier to keep statistics on the You Tube videos viewed by the user.	Session
YtIdbMeta#databases	youtube.com	Marketing	Used to track user interaction with embedded content.	Persistent
yt-remote-cast-available	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Session
yt-remote-cast-installed	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Session
yt-remote-connected-devices	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Persistent
yt-remote-device-id	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Persistent
yt-remote-fast-check-period	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Session
yt-remote-session-app	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Session
yt-remote-session-name	youtube.com	Marketing	Stores the user’s video playback preferences for embedded YouTube videos.	Session

10.  What are your rights?

2. You may exercise the following rights concerning the personal data we collect/process:

• Right of access (Article 15 of the GDPR): you have the right to request access to personal data concerning you that we hold, and request a copy of those data (find out more);
• Right of rectification: you can request the rectification of any inaccurate data concerning you;
• Right of deletion (Article 17 of the GDPR): you can request the deletion of your personal data in certain circumstances (find out more);
• Right to portability (Article 20 of the GDPR): under certain conditions you can receive all the personal data concerning you that you have provided to us, in a structured format. You also have the right to demand that we transfer it, if this is possible, to another controller (find out more);
• A right to object to processing on the grounds of legitimate interests (Article 21 of the GDPR – find out more);
• A right to withdraw consent at any time (Article 7-3 of the GDPR – find out more);
• A right to restrict processing (Article 18 of the GDPR): you have the right to restrict the processing of your data if:
  • You dispute the accuracy of your data, until we verify its accuracy;
  • The processing is unlawful but you do not want us to delete your data;
  • We no longer need your personal data for processing purposes, but you need them in order to bring, assert or defend yourself against legal claims;
  • You object to the processing on related grounds pending verification of whether our compelling legitimate grounds for continuing the processing override those interests;

If these personal data are subject to such restrictions, we will only process your data with your consent, or for the purpose of bringing, asserting or defending ourselves against legal claims (find out more);

• Right to determine what happens to your data after your death and to choose whether or not we pass on your data to a third party you have previously designated (2016 Digital Economy Act – find out more).

You can exercise all these rights by contacting the Data Protection Officer (DPO) at privacy@andzup.com.

When you send us a request to exercise a right, you are asked to specify as far as possible the scope of the request, the type of right exercised, the personal data processing concerned and any other useful information, to facilitate the examination of your request. In addition, if there is reasonable doubt about your identity, you may be asked to provide proof of identity.

If, after contacting us, you feel that your rights regarding your data have not been respected, you may submit a complaint to the French data protection authority (CNIL).

11.   Updates of this Policy

This Policy may be regularly updated to factor in changes to the Personal Data Regulations.

Date of last update: 30/12/2022.