1.    Policy objective and scope of application

TBS Group attaches the utmost importance and care to the protection of privacy and Personal Data and compliance with the applicable Legislation.

Regulation (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to Personal Data Processing and on the free movement of such Data (hereinafter “GDPR”) states that Personal Data must be processed lawfully, fairly and transparently. Accordingly, the purpose of this privacy policy (hereinafter the “Policy”) is to provide clear and simple information on the Processing of Personal Data concerning you, in the context of your browsing and any operations carried out on our website.

2.    Data Controller

In the context of its activity, TBS Cobalt, a company governed by French law, registered in the Nanterre Trade and Companies Register under number 414 135 384, having its registered office at 235 Avenue Le Jour se Lève, 92100 Boulogne-Billancourt, France (hereinafter “TBS”), processes personal data through the creation and provision of the Andzup database to Communication players (hereinafter the “Clients”).

In this respect, TBS acts as Data Controller for processing concerning the creation, hosting, enrichment, updating and availability of the database within the meaning of Personal Data Regulations, notably Regulation (EU) 2016/679 on the protection of individuals with regard to Personal Data Processing and on the free movement of such Data, while its Clients act as Data Processors for all processing concerning the use of the database (extraction, commercial communication, etc.).

3.    What data do we process, how, and who are the data subjects?

Andzup lists the marketing and communication decision-makers at the main advertisers and advertising agencies present in France, Benelux, Germany, Switzerland, Italy and Spain, hereinafter “Decision-makers”. As indicated above, the platform is made available to Communication players that are TBS Clients.

There are two categories of persons concerned: the Decision-makers appearing in the Andzup database and the users of the platform on Clients’ sites:

• As regards Decision-makers in the Andzup database

To create the Andzup database, TBS collects data indirectly, including via the Internet, from professionals only (Decision-makers). In this respect, in accordance with the GDPR and the recommendations of the CNIL (French data protection authority), it is unnecessary to obtain the consent of the data subjects. The legal basis for processing is therefore legitimate interest.

Once the data have been collected, TBS contacts the decision-makers concerned or their company (by phone) to confirm the data thus collected, provide them with the information required under Article 14 of the GDPR, and inform them of their right to object to their integration into the database. Then, once the Decision-makers who have not objected are included in the database, TBS will send them, in writing, the information previously provided by phone as well as a means for them to refuse to be included in the database.

In addition, to enable Decision-makers to control their data, we send them a newsletter every two months informing them of their inclusion in the database, and making it possible for them to view, modify, add to or delete their data.

The categories of data collected from Decision-makers and included in the Andzup database are as follows:

• Identification data such as surname, first name, e-mail address and phone number
• Professional data such as the name of the Decision-maker’s company and their position
• With regard to users of the Andzup platform on Client sites

By using Andzup, you provide us with a certain amount of information about yourself, some of which may identify you (“Personal Data”). This is the case when you browse the Andzup site, fill in online forms, etc.

The main categories of data collected are as follows: 

• Identification data: this includes all information that enables us to identify you, such as your surname, first name, e-mail address and phone number, in the context of creating and managing your user account.

• Professional data: When an account is created, we collect your job title, the name of your company and the sector in which you operate.

• Login details: the information we need to access your personal account, such as your password and other information required for authentication and access to an account.

• Browsing data: when browsing the platform, you interact with it. Consequently, certain information concerning your browsing is collected, such as your IP address.

• Financial Data: Banking Data such as your credit card details, your purchases (when you order a subscription to Andzup for example), or your bank details.

4.    Why do we collect your Personal Data and for how long are they kept?

We collect your personal data for specific purposes and on different legal grounds.

In the context of setting up and making the Andzup database available, TBS uses personal data as follows:

In order to manage the use of Andzup by its clients, TBS uses personal data as follows:

5.    Do we share your Personal Data?

Your Data are intended for authorised TBS employees in charge of managing and performing contracts and legal obligations, depending on the purposes for collection and within the limits of their respective responsibilities. 

Your Data may be transmitted for certain tasks linked with the purposes, and within the limits of the employees’ respective assignments and accreditation, to the following recipients:

• TBS Group entities;
• Our service providers, suppliers, agents and representatives, including but not limited to payment organisations, subcontractors, client service, e-mail service providers and IT service providers, so that the necessary data can be processed according to our instructions and in compliance with this privacy policy and any other applicable confidentiality and security measures.
• Duly authorised public authorities (judicial, supervisory, etc.), in the context of our legal and regulatory obligations;
• Regulated professions (lawyers, bailiffs, etc.) involved in the implementation of guarantees, debt collection or litigation;

When your Data are communicated to our service providers and subcontractors, the latter are also asked not to use the Data for purposes other than those initially intended. We make every effort to ensure that these third parties maintain the confidentiality and security of your Data.

In all cases, only the necessary Data are provided. We make every effort to ensure the secure communication or transmission of your Data.

6.    Are your Personal Data transferred to Third Countries?

TBS endeavours to store Personal Data in France, or at least within the European Economic Area (EEA).

However, it is possible that when the Andzup database is set up and updated, your Data may be transferred to other countries. This is the case, for example, if some of our service providers are located outside the European Economic Area.

In the event of a Transfer of this type, we guarantee that it will be made:

• To a country ensuring an adequate level of protection, i.e. a level of protection equivalent to that required by European Regulations;
• Within the framework of standard contractual clauses.

7.    How long do we keep your Personal Data?

We only keep your Personal Data for as long as is necessary to fulfil the purpose for which we hold the Data, in order to meet your needs or to fulfil our legal obligations (see Article 4).

Retention periods vary according to several factors, such as:

• The needs of TBS activities;
• Contractual requirements;
• Legal obligations;
• Recommendations from supervisory authorities.

8.    How do we guarantee the security of your Personal Data?

TBS undertakes to protect the Personal Data we collect or process from loss, destruction, alteration, unauthorised access or disclosure.

Accordingly, we implement all appropriate technical and organisational measures, depending on the nature of the Data and the risks their Processing entails. These measures must make it possible to preserve the security and confidentiality of your Personal Data. They may include practices such as limited access to Personal Data by persons authorised by virtue of their duties, or pseudonymisation or encryption.

In addition, our practices, policies and/or physical and/or logical security measures (secure access, authentication process, back-up copy, software, etc.) are regularly checked and updated if necessary.

9.    What are the cookies we use on our site?

9.1     What are cookies?

Cookies are computer files that are automatically deposited on the hard drive of your computer, tablet or mobile phone when you browse our Website. They are managed by your web browser (Internet Explorer, Firefox, Safari or Google Chrome).

9.2     Are cookies deposited when you browse TBS websites?

On your first visit to the TBS Websites, if cookies requiring your consent are deposited, a banner informs you of the presence of these cookies and asks you to indicate your choice. Cookies requiring your consent in accordance with the regulations are deposited only if you accept them. You can find information about cookies at any time and configure them for acceptance or refusal by clicking on “configure my cookies” at the bottom of each page of the Site or by configuring your browser.

9.3     What data are collected through cookies?

Cookies can be used to collect all data concerning a terminal at a given time, including:

10.  What are your rights?

2. You may exercise the following rights concerning the personal data we collect/process:

• Right of access (Article 15 of the GDPR): you have the right to request access to personal data concerning you that we hold, and request a copy of those data (find out more);
• Right of rectification: you can request the rectification of any inaccurate data concerning you;
• Right of deletion (Article 17 of the GDPR): you can request the deletion of your personal data in certain circumstances (find out more);
• Right to portability (Article 20 of the GDPR): under certain conditions you can receive all the personal data concerning you that you have provided to us, in a structured format. You also have the right to demand that we transfer it, if this is possible, to another controller (find out more);
• A right to object to processing on the grounds of legitimate interests (Article 21 of the GDPR – find out more);
• A right to withdraw consent at any time (Article 7-3 of the GDPR – find out more);
• A right to restrict processing (Article 18 of the GDPR): you have the right to restrict the processing of your data if:
  • You dispute the accuracy of your data, until we verify its accuracy;
  • The processing is unlawful but you do not want us to delete your data;
  • We no longer need your personal data for processing purposes, but you need them in order to bring, assert or defend yourself against legal claims;
  • You object to the processing on related grounds pending verification of whether our compelling legitimate grounds for continuing the processing override those interests;

If these personal data are subject to such restrictions, we will only process your data with your consent, or for the purpose of bringing, asserting or defending ourselves against legal claims (find out more);

• Right to determine what happens to your data after your death and to choose whether or not we pass on your data to a third party you have previously designated (2016 Digital Economy Act – find out more).

You can exercise all these rights by contacting the Data Protection Officer (DPO) at privacy@andzup.com.

When you send us a request to exercise a right, you are asked to specify as far as possible the scope of the request, the type of right exercised, the personal data processing concerned and any other useful information, to facilitate the examination of your request. In addition, if there is reasonable doubt about your identity, you may be asked to provide proof of identity.

If, after contacting us, you feel that your rights regarding your data have not been respected, you may submit a complaint to the French data protection authority (CNIL).

11.   Updates of this Policy

This Policy may be regularly updated to factor in changes to the Personal Data Regulations.

Date of last update: 30/12/2022.