Privacy policy

1.1. Preamble

TADDEO (also referred to as “the Company” or “we” in this policy), a strategic consulting firm in communication and public affairs, is a simplified joint-stock company with a share capital of €71,808.5, registered with the Paris Trade and Companies Register under RCS Paris B 534 389 309. Its registered office is located at 93 rue de Richelieu in Paris (75002), VAT number FR51534389309, SIRET 53438930900012, phone: +33 (0)7 78 40 70 79,
email address: contact.taddeo@taddeo.fr.

As part of its activities, the Company may collect and process personal data concerning you.

In this regard, the Company applies the principles defined by the legal and regulatory provisions applicable to personal data protection, in particular the Regulation (EU) No 2016/679 of April 27, 2016, on the protection of individuals regarding the processing of personal data (known as the “GDPR”) and Law No. 78-17 of January 6, 1978, on information technology, files, and freedoms (known as the “Informatics and Liberties Law”) and its implementing decrees.

This personal data protection policy (hereinafter referred to as the “data protection policy”) describes the information concerning you that the Company processes and how it is used, either:

• As a data controller for activities carried out on its own behalf.
• As a data processor on behalf of its clients, who are themselves data controllers, for activities performed under their instructions.

This data protection policy also outlines the rights you hold over your personal data in accordance with applicable legal and regulatory provisions.

For any questions regarding this policy, you may, of course, contact us using the details provided in the section “What are your rights and how to exercise them?”.

This policy may be modified in response to changes in the processing activities carried out by the Company, legislative and regulatory developments, and European and French regulatory guidelines, particularly those of the CNIL. The date of the last update is indicated at the beginning of the document.

1.2. Definitions

In addition to the terms defined elsewhere in this policy, the following terms, whether used in singular or plural form in this policy, have the following meanings:

• “Recipient”: refers to the natural or legal person, public authority, service, or any other entity that receives personal data, whether or not it is a third party.
• “Personal Data”: refers to any information relating to an identified or identifiable natural person (the “data subject”). An “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
• “Controller”: refers to the natural or legal person, public authority, service, or any other entity that determines the purposes and means of processing.
• “Processor”: refers to the natural or legal person, public authority, service, or any other entity that processes personal data on behalf of the controller.
• “Processing”: refers to any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making data available, alignment or combination, restriction, erasure, or destruction.

As a preliminary note, it is specified that your data may be collected by the Company either directly from you (in the context of your exchanges and/or interactions with us) or indirectly from third parties.

When your data is collected from third parties, we inform you that the sources may include:

• Websites or publications of the entities to which you are affiliated.
• Newsletters, publications, or any other publicly accessible sources of information.
• Professional databases or public service directories.
• The press, websites, or social networks (e.g., an article you authored in the press revealing certain personal data, personal data deliberately shared by you in an interview published or on social networks).
• Through our clients.

In general, we process and use your personal data for the purposes of managing and monitoring our communication, public affairs, and advocacy activities.

More specifically, your personal data is processed for the following purposes:

2.1. To Understand the Positions, Expectations, and Scope of Action and/or Influence of Stakeholders

• Purpose of Processing: We may process your personal data as part of our activities aimed at understanding the positions, expectations, and scope of action and/or influence of stakeholders on certain topics (e.g., stakeholder mapping and/or biographies, monitoring reports, briefings and reports, crisis communication planning, etc.).
• Legal Basis for Processing: The processing of your personal data in this context is necessary for the purposes of our legitimate interests in conducting our activities.
• Data Processed: Identity (title, last name, first name), roles/mandates/positions, affiliated organization, public positions taken, interests, areas of expertise, topics of focus, biographical information (e.g., education, experience, professional/political background, etc.).
• Existence of Automated Decision-Making Exclusively Based on Automated Processing, Including Profiling, That Produces Legal Effects or Significantly Affects the Individual: No.
• Data Retention Period: We retain personal data in active records for the duration necessary to carry out our mission/project, plus one additional year. After this active retention period, we archive the data for up to six years from the end of the mission/project for administrative and/or evidential purposes, subject to other applicable retention periods if your personal data is processed for other purposes under the conditions set out in Section 2.

2.2. To Build and Maintain a Dialogue Between Entities Represented and Relevant Stakeholders, and to Develop Effective Communication and Messaging

• Purpose of Processing: We may process your personal data to build and maintain a dialogue between the entities whose interests we represent and relevant stakeholders, as well as to develop communication strategies and messages tailored to these stakeholders (e.g., development of engagement plans and contact programs, outreach efforts to share information or request meetings, creation of biographies, monitoring notes, and briefing notes, organization and management of interviews/meetings, meeting reports, and general communication and public affairs activities).
• Legal Basis for Processing: The processing of your personal data in this context is necessary for the purposes of our legitimate interests in conducting our activities.
• Data Processed: Identity (title, last name, first name), roles/mandates/positions, affiliated organization, public positions taken, interests, areas of expertise, topics of focus, contact details, biographical information (e.g., education, experience, professional/political background, etc.), tracking of exchanges and interactions.
• Existence of Automated Decision-Making Exclusively Based on Automated Processing, Including Profiling, That Produces Legal Effects or Significantly Affects the Individual: No.
• Data Retention Period: We retain personal data in active records for the duration necessary to carry out our mission/project, plus one additional year. After this active retention period, we archive the data for up to six years from the end of the mission/project for administrative and/or evidential purposes, subject to other applicable retention periods if your personal data is processed for other purposes under the conditions set out in Section 2.

2.3. To Maintain Professional Relationships, Track Contacts, and Enhance Our Expertise and Experience

• Purpose of Processing: We may process your personal data as part of our activities to maintain professional relationships, track contacts, and enhance our expertise and experience (e.g., drafting monitoring reports, sending messages, news, information, documents, invitations, organizing meetings or events, meeting reports, and more generally, communication, outreach, and networking activities).
• Legal Basis for Processing: The processing of your personal data in this context is necessary for the purposes of our legitimate interests in conducting our activities.
• Data Processed: Identity (title, last name, first name), roles/mandates/positions, affiliated organization, public positions taken, interests, areas of expertise, topics of focus, contact details (postal address, email address, phone numbers, etc.), biographical information (e.g., education, experience, professional/political background, etc.), tracking of exchanges and interactions, tracking of participation in meetings or events, and data necessary for the organization of these meetings or events.
• Existence of Automated Decision-Making Exclusively Based on Automated Processing, Including Profiling, That Produces Legal Effects or Significantly Affects the Individual: No.
• Data Retention Period: We retain personal data in active records until the data subject is no longer considered relevant in terms of professional expertise in public affairs and communication, or until their role or expertise in the institutional sphere is no longer applicable. After this active retention period, we archive the data for up to six years from the last contact for administrative and/or evidential purposes, subject to other applicable retention periods if your personal data is processed for other purposes under the conditions set out in Section 2.

2.4. To Comply with Legal and Regulatory Obligations Related to Public Affairs Activities, Including Lobbying Activities

• Purpose of Processing: To comply with legal or regulatory obligations applicable to public affairs professionals (such as declaration obligations with the Haute Autorité pour la Transparence de la Vie Publique – HATVP), we process your personal data to fulfill this requirement.
• Legal Basis for Processing: The processing of your personal data in this context is necessary for compliance with the legal and regulatory obligations applicable to us. Additionally, with regard to data processed for the purpose of fulfilling declaration obligations to the HATVP, we retain such data after the declarations have been made based on our legitimate interest in ensuring that we can respond to any inquiries from the HATVP in the exercise of its oversight powers.
• Data Processed: Identity (title, last name, first name), roles/mandates/positions, affiliated organization, topics addressed, tracking of exchanges and interactions.
• Additional Information on Processing: The processing of the aforementioned data for this purpose is mandated by the applicable legal or regulatory provisions governing public affairs professionals and the HATVP (failure to collect and retain such data may result in penalties).
• Existence of Automated Decision-Making Exclusively Based on Automated Processing, Including Profiling, That Produces Legal Effects or Significantly Affects the Individual: No.
• Data Retention Period: We retain personal data in active records for the current financial year plus three months, then in archived form for five years from the end of the financial year following the one during which the lobbying activity took place, for administrative and/or evidential purposes. This is subject to other applicable retention periods if your personal data is processed for other purposes under the conditions set out in Section 2.

2.5. To Manage Requests for the Exercise of Rights by Data Subjects

• Purpose of Processing: To enable the Company to comply with its various legal and regulatory obligations regarding the protection of personal data, the Company may process personal data concerning you in connection with this purpose.
• Legal Basis for Processing: This processing is, in principle, necessary to comply with the aforementioned legal and regulatory obligations applicable to us.
• Data Processed: Identity (title, first name, last name), contact details provided by the requester, content of the request, exchanges, and response, additional information or a copy of an identity document (only when required by the situation), and potentially all data processed for the other purposes outlined in Section 2.
• Existence of Automated Decision-Making Exclusively Based on Automated Processing, Including Profiling, That Produces Legal Effects or Significantly Affects the Individual: No.
• Data Retention Period: We retain personal data in active records until the request has been processed and then archive it for a maximum of six years from the response date (depending on the type of request). When a copy of an identity document is collected, it is:
  • Immediately deleted if it was provided but was not required for processing the request.
  • Deleted immediately after verifying the identity of the requester if identity verification was necessary, or retained in archived form for six years for evidential purposes in exceptional cases involving a high litigation risk.

Furthermore, in certain cases, sensitive or special category personal data (e.g., data concerning political opinions, religious or philosophical beliefs, or trade union membership) may be processed for the purposes mentioned above, provided that:
(i) Your explicit consent has been obtained in advance for this purpose, or
(ii) Such information has been manifestly made public by you.

Note: Regarding the active retention periods mentioned above in Section 2, please be aware that these are the standard retention periods unless you exercise your right to deletion, objection, or withdrawal of consent, as described in Section 4 below. In such cases, following the exercise of such rights, your data will only be retained in archived form for the period specified in Section 2.5.

3.1. As a general principle, only authorized persons within the Company may access your personal data when such access is necessary for the performance of their duties and/or missions.

3.2. External individuals or entities may also, under limited and specific circumstances, receive communication of or access to your personal data, namely:

• Services or entities responsible for auditing the Company and/or its clients (statutory auditors, internal or external control bodies, entities authorized to conduct audits, HATVP, etc.).
• Legal, financial, accounting, or other advisors of the Company and/or its clients.
• The Company’s and/or its clients’ partners, including service providers and suppliers, technical service providers, or other entities involved in activities or missions requiring and/or justifying access to personal data. This category of recipients may include, for example, any software provider, IT program, or tool used in our activities and/or those of our clients, or any IT or maintenance service provider for applications, IT programs, and/or tools used by the Company and/or its clients, in which your personal data may be processed.
• The Company’s clients and prospects.

3.3. Additionally, the Company may be required to disclose your personal data in response to legitimate requests from public or authorized authorities, based on applicable legal or regulatory provisions. Your personal data may therefore be disclosed to any authority authorized to access it, particularly in the case of requisitions from judicial, police, or administrative authorities.

3.4. It should be noted that the recipients mentioned above will not necessarily receive all of your personal data, but only the data necessary for the purpose justifying such communication.

4.1. You have the following rights regarding the processing of your personal data carried out by the Company, subject to the conditions, limitations, and modalities defined by applicable legal and regulatory provisions on personal data protection:

• Right of Access: You may obtain confirmation as to whether or not personal data concerning you is being processed and, if so, access said personal data along with specific information regarding the processing and characteristics of such processing.
• Right to Rectification: You may request the correction of your personal data that you believe to be incomplete or inaccurate.
• Right to Erasure: You may, under certain conditions provided by applicable regulations, request the deletion of your personal data (except in cases where the data is necessary for the performance of contractual relationships with the Company, compliance with the Company’s legal or regulatory obligations, or the establishment, exercise, or defense of legal claims).
• Right to Restriction of Processing: You may request the restriction of processing of your personal data in certain cases, meaning that your data will be marked to limit its future processing.
• Right to Data Portability: In certain cases and under conditions defined by applicable regulations, you may request to receive the personal data you have provided to us in a structured, machine-readable format, or, where technically possible, request its transfer to a third party. (This right to data portability applies only to processing based on your consent or on the performance of contractual relations, provided that the data processing is carried out using automated means).
• Right to Withdraw Consent: If the processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal.
• Right to Define Directives on the Retention, Deletion, or Communication of Your Personal Data After Your Death: In this regard, in the event of death and upon notification to the Company, your personal data will be deleted (unless it must be retained for a specific period due to legal or regulatory obligations and/or statutory retention requirements specified in Section 2). If applicable, it may be disclosed to a designated third party of your choice.

Furthermore, under certain circumstances and subject to specific conditions set forth by applicable regulations, you have the right to object to the processing of your personal data for reasons related to your particular situation. It should be noted that, regarding direct marketing activities, including profiling related to such marketing, you have an absolute right to object, which can be exercised at any time, without the need to provide any reason or justification.

4.2. How to Exercise Your Rights

You can exercise these rights by contacting the Company via email at: dpo@taddeo.fr or by sending a postal letter to the following address: TADDEO – 93 rue de Richelieu – 75002 Paris.

Upon receipt of such a request, we will respond as soon as possible and in any case within a maximum period of one month from the date of receipt. If necessary, this period may be extended by two additional months, depending on the complexity and number of requests received. In such a case, the requester will be informed accordingly.

If there is reasonable doubt regarding the identity of the individual making the request to exercise their rights, we may request additional information necessary to confirm their identity. If required, a copy of an identity document bearing their signature may be requested. In such a case, the response timeframe will be suspended until the required additional information is received.

The request may be submitted by the data subject themselves or by a duly authorized representative, provided that the representative proves their identity and that of the data subject, along with a mandate specifying its duration and purpose. The mandate must also specify whether the representative may receive the response on behalf of the requester.

You are also informed that the Company has appointed a Data Protection Officer (DPO), whose designation has been declared to the CNIL (designation no. 100940).

4.3. Right to Lodge a Complaint

In any case, you have the right to lodge a complaint with the competent Supervisory Authority (in France, this is the Commission Nationale de l’Informatique et des Libertés – CNIL) if you believe that the processing of your personal data is not compliant with applicable legal and regulatory provisions regarding data protection:

Commission Nationale de l’Informatique et des Libertés (CNIL)
3 place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07
Tel: +33 (0)1 53 73 22 22

For more information about your rights, you may also refer to the explanations provided by the CNIL here:
🔗 https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles

Your personal data is processed exclusively within the European Union and in countries that have received an adequacy decision by the European Commission under Article 45 of the GDPR.

Cookies and Other Trackers (for the Website)

We use different types of cookies on our website to measure audience engagement and integrate services that enhance the site’s interactivity.

– What is a cookie?

A cookie is a small text file that is stored by a website on your device when you visit it. Your web browser retains it for a certain period and sends it back to the website server each time you reconnect.

Cookies have multiple uses: they can be used to store your login credentials, keep track of your shopping cart contents, or collect navigation data for statistical or advertising purposes.

– What cookies are used on our website?

Only strictly necessary cookies are used to ensure the website functions properly.

These cookies allow the core services of the website to operate optimally. You may block them using your browser settings; however, this may degrade your user experience on the site.

Additionally, you have the option to opt out of audience measurement trackers that are strictly necessary for the website’s operation and administration via the cookie management window located at the top right of each page.