Privacy Policy
/
Customers, prospective customers and website
This privacy and personal data protection policy (the ‘Privacy Policy’) sets out how Energy Pool Développement SAS (as identified in the legal notice) and its subsidiaries (hereinafter collectively referred to as ‘Energy Pool’) collect, use, store and transfer the personal data of individuals interacting with its website (‘You’).
For the record, personal data is any information that enables a natural person to be identified or made identifiable (such as a photograph, a name, an IP address, a telephone number, etc.) (hereinafter “Personal Data” or “PD”).
Energy Pool undertakes to comply with the legislation in force regarding the protection of personal data, in particular Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, known as the ‘Data Protection Act’, and the European Regulation (EU) No. 2016-679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the ‘GDPR’).
Energy Pool reserves the right to amend this Policy at any time without notice. We therefore recommend that you check this page regularly.
When you agree to contact Energy Pool, in particular via a contact form, you will be redirected to this Privacy Policy, which informs you of your rights and how your personal data is processed.
For information on the processing of personal data in connection with recruitment by Energy Pool Développement, please visit https://careers.smartrecruiters.com/ENERGYPOOL.
If you have any questions or requests regarding the processing of your personal data, you can contact the Data Protection Officer (DPO) using the following contact details:
Energy Pool Développement SAS
For the attention of the DPO
Savoie Technolac – 20, rue du Lac Majeur – Parc Ouragan, Building C
73370 Le Bourget-du-Lac
Or by email: DPO@energy-pool.eu
I. Energy Pool's quality in the processing of your Personal Data
Energy Pool acts as the data controller, which means that we determine the methods used in the processing of your personal data, as well as the purposes for which it is processed.
We are therefore the ‘lead controller’ for the processing of your personal data and are responsible for the conditions under which it is collected, for its security and for ensuring your rights are respected.
II. Categories of data subjects
The Privacy Policy applies to your personal data if you fall into one of the following categories:
Employees of Energy Pool's partners, service providers, customers or prospects;
Visitors to Energy Pool's premises;
Users of Energy Pool's website (the "Website") and social media.
III. Categories of personal data collected
We undertake to collect only data that is strictly necessary for the purposes for which it is collected, namely:
Identification details (surname, first name),
Professional life (company, position),
Work contact details (email address, phone number),
Images (videos, photographs),
Voice for content (articles, videos) on the Website,
IP address, unique identifier, Customer Portal usage data, as defined below (optional – only if you accept cookies placed on our Customer Portal).
No sensitive data within the meaning of the GDPR is collected by Energy Pool.
For contact forms, mandatory fields are marked with an asterisk. If any of the mandatory fields are not filled in, your request may not be processed or its processing may be delayed.
IV. Treatments implemented
Under the GDPR, processing refers to any action taken on personal data, such as storage, consultation, access, deletion, transfer, etc. This answers the question of how your personal data is used.
We process your personal data in several ways:
Collection (see Section VII),
Consultation,
Organisation (for example, they can be compiled in an Excel file),
Use for fulfilling our purposes,
Extraction (e.g., from one document to another),
Transfer (between Energy Pool teams or to subcontractors, as defined in Section VIII),
Registration on our servers,
Deletion after use.
V. Purposes of processing
Personal data is only collected by Energy Pool to the extent necessary for:
The preparation and publication of content (articles, videos) on the Website,
Analysing the performance and usage of the Website,
Monitoring the performance of email campaigns (Energy Pool and Mailchimp use trackers (tracking pixels) to determine whether you open emails and the date on which you do so, in order to compile delivery statistics and take the necessary actions (adjusting the frequency or stopping mailings) to manage mailing lists);
Organising webinars and events for prospective and/or existing customers,
To manage requests for information or electricity consumption reports,
Managing newsletters,
Commercial prospecting,
The performance of the contract or pre-contractual measures necessary for the conclusion of the contract,
Managing outstanding payments and the debt recovery process,
Managing visitor reception at Energy Pool’s premises,
Improving the performance of our Software and the user experience it offers, which requires an understanding of user behaviour on the Software.
Under no circumstances will data be processed in a manner incompatible with these purposes.
VI. Legal basis for processing
The processing of the data collected is based, depending on the case, on one of the legal grounds provided for by law:
| Purpose | Legal basis for processing |
|---|---|
| The preparation and publication of content (articles, videos) on the Website | Consent |
| Newsletter management | Consent |
| Analysis of the performance and use of the Website | Consent |
| Business Development and marketing | Legitimate interest: contacting individuals who may be interested in Energy Pool’s services, subject to an opt-out right |
| The performance of the contract or of pre-contractual measures necessary for the conclusion of the contract | Contract Legitimate interest: to ensure the conclusion and proper performance of contracts |
| Management of unpaid invoices and the collection process | Contract Legitimate interest: to ensure the payment of Energy Pool’s receivables |
| Managing visitor reception at Energy Pool's premises | Legitimate interest: welcoming visitors in a favourable and lawful manner, in particular in accordance with the ISO 27001 standard |
| Improving the performance of our Customer Portal and the user experience it offers, which requires an understanding of user behaviour on the Customer Portal. | Consent |
| Handling requests for information or electricity consumption reports | Consent |
| Organising webinars and events for prospective and/or existing customers | Consent |
VII. Data sources
We have access to your personal data in two ways:
Data provided directly by you (via contact or online registration form, email, social media platforms, visitor register signature or business card);
Data provided by the staff of the (future) co-contractor on (pre-)contractual documents (contact details for invoicing, operational monitoring and any other contact details necessary for the conclusion or performance of the contract).
VIII. Recipients of the data
Your personal data is intended for Energy Pool, the data controller, companies within the Energy Pool group, and service providers and subcontractors when their involvement is strictly necessary for the processing of this data.
Your personal data appearing in content published on the Energy Pool website is intended for anyone visiting the site.
Your personal data is not transferred to third parties for commercial purposes.
Below is a list of our main subcontractors (the full list can be provided on request):
| Name of subcontractor | Data location | Mission | More information | Adequate protective mechanism |
|---|---|---|---|---|
| United States | Google Analytics Service for analysing the performance and usage of the website and the Customer Portal | https://support.google.com/analytics/answer/6004245?hl=fr | Adequacy Decision – Data Privacy Framework | |
| Clarity (Microsoft) | United States | Analysis of website and Customer Portal performance and usage | https://www.microsoft.com/fr-fr/privacy/privacystatement#mainwherewestoreandprocessdatamodule | Adequacy Decision – Data Privacy Framework |
| Mailchimp | European Union / United States (may transit) | Sending emails | DPA Mailchimp | Standard contract terms |
| Microsoft | European Union / France | Internal collaborative office automation tool | https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA | N/A |
| PipeDrive | European Union | Customer relationship management (CRM) software | https://www.pipedrive.com/en/privacy | N/A |
| WordPress | European Union / United States (may transit) | Website management system | https://automattic.com/fr/privacy/ | Standard contract terms |
IX. Data retention period
Energy Pool undertakes to retain personal data collected only for the time strictly necessary for the purposes of processing:
| Purpose | Shelf life |
|---|---|
| Management of content (articles, videos) on the Website | Duration specified in the signed authorisation (video) or duration of the employment contract (photo) |
| Analysis of the performance and use of the Website | 13 months for trackers 25 months for tracker content |
| Improving the performance of our Software and the user experience it offers, which requires an understanding of user behaviour on the Software. | 13 months for trackers 25 months for tracker content |
| Newsletters management | Kept until deregistration |
| Implementation of commercial prospecting | 3 years from the last contact |
| Management of pre-contractual measures necessary for the conclusion of the contract | Duration of the (pre)contractual relationship + 5 years |
| Management of unpaid bills and the collection process | 10 years |
| Managing visitor reception at Energy Pool's premises | The current calendar year, plus one year (deleted on 31 December of year N+1) |
| Organising webinars and events for prospective and/or existing customers | 3 years from the date of the webinar or event |
| Tracking the performance of email campaigns | 2 years |
X. Cookies
Energy Pool’s Cookie Policy is available at the following address:
As part of its Services, Energy Pool may place cookies on the Everest portal to which Customers have access, in order to better understand their use of the portal, as well as user behaviour and preferences.
We use the following cookies:
| Cookies | Typology | Purpose | For more information |
|---|---|---|---|
| Google Analytics | Analyse | Google Analytics tracks traffic on our website. | Check this link |
| Clarity (Microsoft) | Analyse | Logging and review platform enables tracking of user experience (UX) issues and analysis of bug causes for correction. | Check this link |
When you visit the Energy Pool website for the first time (or if you have previously refused cookies or are browsing in incognito mode), a banner will appear to seek your consent to the use of cookies (excluding functional cookies).
You can choose to block all cookies, or just some of them.
As a reminder, you can configure your browser settings so that cookies are automatically blocked or deleted:
Google Chrome:
https://support.google.com/chrome/answer/95647?hlrm=enMozilla Firefox:
https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computerMicrosoft Edge:
https://support.microsoft.com/en-gb/help/4468242/microsoft-edge-browsing-data-and-privacy-microsoft-privacy
Please also note that you can disable certain third-party cookies via the issuer’s website, such as Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=fr.
Cookies are stored for a maximum of 13 months from the date they are set.
Personal data stored in cookies is retained for a maximum of 25 months from the date of collection.
XI. User rights regarding personal data concerning them
In accordance with applicable legal and regulatory provisions, users have the right to request:
access to your personal data and clear information about the use and processing of your data and your rights;
the verification and rectification of inaccurate personal data;
an objection to or restriction on the processing or use of your personal data;
the erasure (right to be forgotten) of personal data;
the portability of personal data concerning him or her;
the removal or dissociation of a name and surname from content visible in a search engine.
Please note, however, that these rights are subject to limitations and, in some cases, conditions of applicability. Energy Pool has one (1) month to process your request and provide you with a detailed response, whether or not your request is granted (in whole or in part).
These rights may be exercised at any time by sending a letter or email to the following address:
Energy Pool Developpement
For the attention of the DPO
Savoie Technolac – 20, rue du Lac Majeur – Parc Ouragan, Bât. C
73370 Le Bourget-du-Lac
And by email: DPO@energy-pool.eu
Users also have the right to lodge a complaint with the CNIL, particularly via its website, by following this link: https://www.cnil.fr/fr/adresser-une-plainte.
XII. Security measures
Throughout the entire period during which personal data is stored, Energy Pool shall implement all necessary measures, including appropriate technical and organisational measures, to ensure its confidentiality and security, so as to prevent its damage, erasure or access by unauthorised third parties. In particular, Energy Pool shall endeavour to use secure servers, firewalls and access rights management systems.
Access to personal data is strictly limited to company employees who are authorised to process it due to their duties and who are subject to a confidentiality obligation, as well as to its subcontractors. Energy Pool will ensure that the Personal Data processed is adequate, relevant and limited.
XIII. Data transfer – Storage
Your personal data contained in content published on the website and in social media posts and exchanges is accessible outside the European Union due to its presence on the Internet. However, we host this data on servers located within the European Union.
It may also be transferred outside the European Union in the context of our relationship with our subcontractors, if necessary. If such a transfer of data outside the European Economic Area is implemented, we undertake to ensure that this transfer is accompanied by sufficient and appropriate security guarantees, in accordance with the regulations in force, in particular by means of Standard Contractual Clauses (these are an appendix to the contract with our subcontractors reinforcing the rules applicable to the transfer of personal data with said subcontractor).
However, Energy Pool undertakes not to transfer your personal data for commercial reasons, in particular, without your prior consent.
XIV. Automated decision-making
The processing does not involve automated decision-making.