Introduction

[Company name] (hereinafter “Sell A Max”, “we”) attaches particular importance to protecting the privacy of users of its sellamax.fr website.

This policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and how you can exercise your rights.

It is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and French Act No. 78-17 of 6 January 1978 as amended, known as the “Data Protection Act”.

Data controller

[Company name], a [legal form] with share capital of €[amount] Registered office: [full address] SIREN: [number] — Trade and Companies Register of [city] Contact for any question relating to personal data: contact@sellamax.fr [Where applicable] Data Protection Officer: [name / e-mail]

Data collected and purposes

We collect only data strictly necessary for the purposes described below. Mandatory fields are indicated in our forms; without this information, we will not be able to process your request.

1. Contact form

Data: surname, first name, company, position, e-mail address, phone number, message content. Purpose: respond to your request, qualify your project and get back to you. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f)). Retention period: 3 years from the last contact where no further action follows, then deletion or archiving.

2. Job applications and recruitment

Data: surname, first name, contact details, CV, cover letter, professional background, qualifications, geographical mobility, position applied for, and any information you choose to send us. Purpose: review your application for a published vacancy or a speculative application, arrange interviews, build a talent pool. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b)); your consent for retention in the talent pool beyond the recruitment process (Art. 6(1)(a)). Retention period: 2 years from the last contact, if you consent to retention in the talent pool. Otherwise, deletion at the end of the recruitment process.

We collect no sensitive data within the meaning of Article 9 GDPR (racial or ethnic origin, political or religious opinions, health, sexual orientation). Please do not include such information in your CV or messages.

3. Website browsing

Data: IP address, browser type and version, operating system, pages viewed, connection date and time, referring website. Purpose: ensure the proper operation and security of the website, measure audience, improve content. Legal basis: legitimate interest for measures strictly necessary to operation and security (Art. 6(1)(f)); your consent for audience measurement and marketing trackers (Art. 6(1)(a)). Retention period: see the Cookie Policy.

4. Business relationship and prospecting

Data: identity, professional contact details, company, position, history of exchanges. Purpose: managing the client relationship, sending information about our services, commercial follow-up. Legal basis: performance of the contract (Art. 6(1)(b)) and legitimate interest in developing our business among professionals (Art. 6(1)(f)). You may object to such prospecting at any time. Retention period: the duration of the business relationship, then 3 years from the last contact; accounting and contractual documents are retained for 10 years in accordance with legal obligations.

No automated decision-making

No decision producing legal effects concerning you is taken solely on the basis of automated processing, including profiling.

Data recipients

Your data is processed only by authorised personnel within Sell A Max (sales, recruitment and administrative teams).

It may be disclosed to the following categories of recipients, strictly within the limits of their remit:

• our hosting provider OVH SAS (France);
• our transactional e-mail provider;
• our form management tools and, where applicable, applicant tracking tools;
• our website technical maintenance providers;
• administrative or judicial authorities, upon legal request.

We neither sell nor rent your data to third parties.

Transfers outside the European Union

Our data is hosted within the European Union. Should a provider process data outside the European Economic Area, such transfer would be governed by the appropriate safeguards provided for in Articles 44 et seq. GDPR (adequacy decision or European Commission standard contractual clauses). An up-to-date list of these providers is available on request at contact@sellamax.fr.

Security

We implement appropriate technical and organisational measures to preserve the security and confidentiality of your data: encryption of exchanges via HTTPS, access control and permission management, application firewall and intrusion attempt monitoring, regular security updates, periodic backups.

Despite these measures, no transmission over the Internet can be guaranteed as entirely secure. In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed in accordance with Article 34 GDPR.

Your rights

In accordance with Articles 15 to 22 GDPR, you have the following rights:

• right of access: obtain confirmation that your data is being processed and receive a copy of it;
• right to rectification: have inaccurate or incomplete data corrected;
• right to erasure: request deletion of your data in the cases provided for by the regulation;
• right to restriction of processing;
• right to object to processing based on our legitimate interest, and to commercial prospecting, at any time and without justification;
• right to data portability for the data you have provided to us, in a structured, machine-readable format;
• right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand;
• right to issue instructions regarding what happens to your data after your death.

How to exercise your rights Send your request by e-mail to contact@sellamax.fr or by post to [Company name] — [full address]. Proof of identity may be requested where there is reasonable doubt as to your identity.

We respond within one month of receiving your request, extendable by two months where the request is complex, in which case you will be informed.

Complaints. If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the CNIL (the French data protection authority) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — or online at www.cnil.fr.

Cookies

The use of cookies and other trackers on sellamax.fr is described in our Cookie Policy, where you can also change your choices at any time.

Changes to this policy

This policy may be amended to reflect legal or technical developments or changes to our processing activities. The version in force is the one published on this page. In the event of a substantial change, we will inform you by appropriate means.

This English version is a translation provided for convenience. In the event of any discrepancy, the French version shall prevail.

Last updated: [DD/MM/YYYY]