Personal data policy

NOTIFICATION REGARDING PERSONAL DATA PROTECTION – BPCE LEASE

Updated on April 1, 2019

This notification is provided for you as an individual concerned by the personal data processing operated by /

BPCE LEASE a limited company with share capital of 354,096,074.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 379 155 369

And its subsidiaries, listed hereinafter:

BATILEASE a limited company with share capital of 9,366,900.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 468 501 507

BPCE CAR LEASE, a simplified joint-stock company with share capital of 5,184,440.00 euros and headquarters located at 8 rue Vidailhan, 31130 Balma, registered in the Toulouse Trade and Company Register under no. 977 150 309

CICOBAIL, a limited company with share capital of 103,886,940.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 722 004 355

CO ASSUR CONSEIL ASSURANCE COURTAGE,a limited company with share capital of 40,000.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 351 825 146

BPCE ENERGECO, a limited company with share capital of 8,320,000.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 322 828 484

INTER COOP,a simplified joint-stock company with share capital of 4,856,280.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 444 253 355

LEASE EXPANSION,a simplified joint-stock company with share capital of 1,580,000.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 352 613 103

BPCE PERSONAL CAR LEASE a limited company with share capital of 8,000,000.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 440 330 876

BPCE BAIL, a limited company with share capital of 154,868,220.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 309 112 605

BPCE LEASE IMMO, a limited company with share capital of 62,029,232.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 333 384 311

SUD OUEST BAIL, a limited company with share capital of 5,000,040.00 euros and headquarters located at 7, promenade Germaine Sablon, 75013 Paris, registered in the Paris Trade and Company Register under no. 401 403 142

BPCE LEASE REUNION, a limited company with share capital of 7,999,915.00 euros and headquarters located at 32 boulevard du Chaudron 97490 Sainte Clothilde, registered in the Saint Denis La Réunion Trade and Company Register under no. 310 836 614

BPCE LEASE NOUMEA, a limited company with share capital of 262,534,400.00 South Pacific Francs and headquarters located at 224 rue Jacques Iékawé – PK6 – BP 31 260 – 98895 Nouméa, registered in the Nouméa Trade and Company Register under no. 000 020 107

BPCE LEASE TAHITI, a limited company with share capital of 341,957,000.00 South Pacific Francs and headquarters located at rue Cardella – BP 90, 98713 Papeete, registered in the Papeete Trade and Company Register under no. TPI 74 39 B (041 848)

It is hereby specified that the term BPCE LEASE used hereinafter in this notification may refer to BPCE LEASE and/or one or several of its subsidiaries, depending on the entity with which the data subject has entered into relations.

This notification sets out the purpose for which BPCE LEASE needs to collect your data, how your data will be used and protected, how long it will be kept and the rights you may exercise.

This information is hereinafter referred to as “Personal data” or “Data”.

BPCE LEASE gathers and processes information that identifies you and may concern both your private and working lives (such as your name, date of birth, family status, profession, income and charges).

BPCE LEASE considers that data protection is essential for building a relationship of trust with its clients and constantly monitors compliance with the general data protection regulation[1]. It seeks to ensure responsible governance of its data files, together with the complete transparency of its data processing.

BPCE LEASE has appointed a Data Protection Officer (DPO). This person ensures that personal data processing performed by BPCE LEASE complies with applicable regulations.

Whose Data is collected?

This notification is intended for all individuals acting in a personal capacity or with direct and indirect links (such as legal representatives, proxies, agents or beneficial owners, contact persons – if, for example, you are a member of their family, or a co-borrower or guarantor), with a company that is already a client or wishes to enter into contractual relations with BPCE LEASE.

For what purpose is your Data collected and used?

In the context of its business relations with its clients, BPCE LEASE needs to collect specific data concerning you for the following purposes:

1. Pre-contract measures and/or contract performance

We process your Data with a view to providing you with products and services. Data is processed as it is necessary for pre-contract measures following your application and/or performance of the contract, such as:

–       Subscribing to a product or service;

–       Analyzing your application for lease financing (Lease agreement, Lease with or without purchase option, Long-term rental), Project financing or Loan;

And this, in particular by means of a credit score.

–       Analyzing your Operating lease

–       Managing and providing a product or service, particularly the management of your lease financing

–       Managing your claims;

–       Managing and tracking debt recovery (amicable recovery, cases of excessive debt and litigation);

–       Managing guarantees and bonds.

If BPCE LEASE does not have this data, it will be unable to conclude or perform the contract.

2. To meet our legal and regulatory obligations

We are subject to a range of legal obligations and we process data in order to meet these obligations. This includes:

–       Having knowledge of our clients;

–       Combating money laundering and the financing of terrorism;

–       Consulting the National Database on Household Credit Repayment Incidents held at the Banque de France;

–       Requesting registration in the National Database on Household Credit Repayment Incidents held at the Banque de France if the client is an individual;

–       Identifying and protecting fragile clients, in cases of individual clients.

3. The legitimate interests of BPCE LEASE to process data

BPCE LEASE pursues a number of legitimate interests, including:

–       Improving its knowledge of clients (for example, via the Datanéo file: http://www.dataneo.fr/divers/PolitiqueConfidentialiteDataNeo.pdf)

–       Improving our products and services;

–       Improving our risk management.

–       Preventing fraud

This processing is performed taking your interests and basic rights into account. As such, it is accompanied by measures and guarantees that ensure your interests and rights are protected, whilst maintaining a balance with the legitimate interests pursued by BPCE LEASE.

Processing of your data may be justified by the nature of these legitimate interests, such as:

–       Selecting and targeting our clients, communication marketing

–       Client satisfaction surveys and measurements;

–       Proposing customized and tailored services:

        – in the context of developments in technology;

        – by improving your client experience;

        – or to adapt to your requirements;

–       Market profiling, including compiling data for the purpose of analysis or anonymization;

–       Recording telephone calls for the purposes of training, assessing and improving the quality of our products and services;

–       Producing statistics, models and tests in the context of modeling credit scores or research and development actions;

–       Preventing fraud and managing risks;

–       IT network and data security.

As regards financing, BPCE LEASE may assess the risks relating to applications for financing on the basis of automated decision-making, including human intervention, leading to a decision on whether to grant financing. You have the right to appeal against the decision taken as a result of this process and to submit your comments.

4. Purposes subject to your consent

If legally required, BPCE LEASE will subject specific data processing to obtaining your consent, such as:

–       Sales canvassing if you are not a client of BPCE LEASE or if you are a client of BCPE LEASE, but in cases where the canvassing involves products that are not similar to those to which you have already subscribed;

–       Transferring your data to third-party partners other than those mentioned below

To this effect, you will be specifically asked to consent to your data being collected and processed for explicit purposes.

5. Cookies and other trackers

Cookies or other trackers include tags, instruments and tracking tools that are placed on your device and read when consulting a website, reading an email or installing and using software or a mobile application.

When you visit BPCE LEASE websites, cookies and trackers may be placed on your devices (such as computers, smart phones and computer tablets).

Our Cookies policy is available on each website involved.

What data do we collect? And where does it come from?

We collect data directly from you that is strictly necessary for your identification, enabling us to contact you, as well as data regarding your family status, work, economic status, together with financial and banking data. This data may be directly collected during interviews with an adviser, using paper or electronic media.

You are informed on the document used to collect your data that your declarations are compulsory and the fact that, in certain cases, failure to respond to a request for information may affect the processing of your application.

When you use our products and services, we collect data about you, including data about your behavior, habits and preferences 

Your personal data may also come from third-party service providers or suppliers, partners or subcontractors, if their personal data protection policies allow this or if you have authorized them to share this data. We may also need to collect public personal data about you.

To enable us to examine your application or to manage subscribed services, your bank may need to send BPCE LEASE information about your civil status, family status, assets, financial situation and bank account operations, together with your score for applying the banking regulation.

When examining your financing application, BPCE LEASE, in cases where it is subject to the credit institution regulation as a lender or lessor, has the duty to consult, with respect to any legal representatives, proxies, agents or beneficial owners, borrowers, co-borrowers, lessees, co-lessees or guarantors, for example, the National Database on Household Credit Repayment Incidents (FICP), the National Check Database (FCC) and the Company Bank Database (FIBEN). Similarly, in the event of repeated payment incidents, BPCE LEASE shall be bound to request the registration of information concerning you in this Database. You have the right to access information concerning you held on the National Database on Household Credit Repayment Incidents by contacting the Banque de France (by post or in person).

In specific cases, we may have also collected personal data about you, even though we have not entered into direct relations. This may occur if your contact details have been communicated to us by one of our clients, if, for example, you are one of their legal representatives, a family member, a co-borrower or personal guarantor, or a proxy (holding a power of attorney).

Who has access to your Data?

BPCE LEASE takes all necessary measures to guarantee professional secrecy and ensure the security and confidentiality of your data, which includes ensuring that only authorized persons have access to the data.

Only persons accredited on account of their duties within the relevant departments of BPCE LEASE, in charge of the corresponding processing, have access to your data, within the limit of their accreditations.

Similarly, our service providers or partners may have secured access to all or part of your data within the framework of performing their service or of our partnership.

As such, we share your data within the BPCE Group with:

–      BPCE S.A.;

–      Any BCPE Group entity with whom you are a client or with whom you enter into contractual relations for the purpose of updating data collected by these entities;

–      Any BPCE Group entity (including NATIXIS and its subsidiaries) with a view to presenting products or services managed by these entities to you or for examining or drawing up any type of contract or operation;

–       The General Inspectorate of BPCE

–       BPCE Group entities in the event of sharing technical resources, in particular IT or data governance resources. To this effect, your personal data may be pseudonymized or anonymized for the purpose of research and creating statistical models.

We will also share your data with third parties, such as:

–      Companies that insure or guarantee the financing of our clients (insurance firms, for example);

–      Debt recovery agencies;

–      The service providers or subcontractors to which BPCE LEASE assigns operational tasks, services, the performance of surveys or compiling of statistics;

–      Third-party companies in the event of assigning debts or securitization transactions;

–      Legal and financial authorities, or other government bodies;

–      Certain regulated professions, such as lawyers, bailiffs, notaries or auditors.

–      Business introducers approved by BPCE LEASE;

For how long is your Data kept?

BPCE LEASE only retains your data in accordance with the purpose of processing and in compliance with legal and regulatory obligations.

The period for which your data is kept varies, depending on the purpose of the processing:

What rights do you have over your Data?

You have various rights over your data, subject to the limits and conditions authorized by the regulation, including the right to:

–      Access all your data: you can obtain information about the processing of your data, together with a copy of your data;

–      Correct and update your Data: if you believe your personal data to be inaccurate or incomplete, you are entitled to have your Data amended accordingly;

–      Delete: you can ask for your personal data to be deleted;

–      Request that we limit the processing of your Data;

–    Request the portability of your data: you are entitled to request recovery of the data you have provided for us or ask us to send the data to a third party, if technically possible;

–      Withdraw your consent at any time for the processing of the data subject to your consent;

–      Oppose the processing of your data: on legitimate grounds relating to your specific situation, you can oppose the processing of your personal data, as well as, at any time, opposing the processing of your data for the purpose of canvassing, including profile processing related to said canvassing;

–      File a complaint with a supervisory authority (in France, the CNIL: www.cnil.fr).

Furthermore, you have the option of sending us instructions regarding the retention, deletion and communication of your data after your death. These instructions may also be registered with a certified “digital trusted third party”. These instructions, also known as a “digital will” can appoint an executor. If no such person is specified, your heirs will be the executors.

For electronic communications for canvassing purposes: An unsubscribe link (for emails) or number (for SMS/MMS) is also provided on all electronic communications from BPCE LEASE.

How to exercise your rights

To exercise your rights, you can contact our Data Protection Officer by post or by email, specifying your last name, first name and contact details, and including a photocopy of your ID document.

How will you be kept informed of any changes made to this notification?

Changes may be made to this notification in order to increase protection of your personal data.

We will keep you informed of any major changes we make to this notification, via one of our standard communication channels, and we will invite you to acknowledge the changes on our website www.lease.bcpe.fr