The SCPP (Société Civile des
Producteurs Phonographiques) is particularly committed to ensuring that the
collection and processing of your personal data complies with the applicable
laws on personal data protection (GDPR, French Data Protection Act...).
The purpose of this policy is to provide you with transparent information on the processing of personal data carried out by the SCPP according to the relationship that binds you to the latter. This policy also informs you of your rights, how to exercise them and your right to lodge a complaint with the CNIL.
Below, the term "You" or
"Your" refers to any data subject affected by the processing of
personal data covered by this privacy policy.
In order to know:
-
Who are the people involved
-
Why your data is being processed and what data we have
-
To whom your data is disclosed
-
How long we keep your data
-
And what are your RIGHTS (access,
rectification, etc.) on your data
Please read the information below:
DATA SUBJECTS
Any natural person who is a
contact for legal entities that are SCPP members and for legal entities that
are users (partners and suppliers) is a data subject covered by this
confidentiality policy.
WHY IS YOUR DATA PROCESSED?
Your data is mainly processed for
the purposes of:
-
Communicating amounts of sound recording
rights
-
Managing requests for "creation
grants"
-
Sending newsletters, occasionally
emailing information or organizing events (subject to your consent)
The lawfulness of the processing
is based on the SCPP’s legitimate interest in properly managing the
relationship.
In any event, we limit the
collection of your personal data to data that is appropriate, relevant, and
strictly necessary for processing. Failure to provide the data we request from
you may result in it being impossible to enter into or perform said
mandate/contract.
WHO DO WE DISCLOSE YOUR PERSONAL DATA TO?
Your personal data may be
disclosed to various SCPP departments depending on the level of authorization
granted to each person. It may also be communicated to SCPP associates and
certain partners.
Please note that we can send you a
complete list of recipients of your data.
HOW LONG DO WE KEEP YOUR DATA?
Your personal data is kept for the
duration of the relationship with the SCPP which is extended by the statute of
limitations (five years unless interrupted), without prejudice to any legal or
regulatory provisions specific to certain categories of data requiring a
specific storage period or the deletion of this data.
For data processing concerning the
newsletter or sending informative emails, the data is kept for 3 years from the
last contact.
2. What are your rights ?
The right of rectification makes
it possible to correct inaccurate data concerning you (incorrect age or
address) or to complete data (address without the apartment number) in
connection with the purpose of the processing.
To find out more:
https://www.cnil.fr/fr/le-droit-de-rectification-corriger-vos-informations
Article 16 GDPR
Articles 40 to 42 French Data
Protection Act
Pour en savoir plus : Article 15 RGPD ; Articles 39, 40-1 à 43 Loi Informatique et Libertés
https://www.cnil.fr/fr/le-droit-dacces-connaitre-les-donnees-quun-organisme-detient-sur-vous
- The Right of Rectification
Exercising the right of access makes it possible to know if your data is being processed and to obtain its communication in an intelligible format.
It also makes it possible to check
the data’s accuracy and, if necessary, correct it or delete it.
The organization from which you
request your "right of access" must be able to send you a copy of the
data it has about you and inform you about:
-
The purposes of using this data
-
The categories of data collected
-
The recipients or categories of
recipients who have been able to access this data
-
The data retention period or the criteria
which determine this period
-
The existence of other rights (right
of rectification, erasure, restriction, opposition)
-
The possibility of referring the matter to the
CNIL
-
Any information relating to the source of the
data collected if it has not been directly collected from you
-
The existence of automated
decision-making, including profiling, and the underlying logic,
importance, and consequences of such a decision for you
-
The possible transfer of your data to a
third country (non-EU member) or to an international organization
You have the right to request
access to your personal data and rectify inaccurate data.
YOU CAN REVOKE CONSENT AT ANY TIME
for processing related to sending newsletters, informative emails, or
invitations to events by sending an email to contact@scpp.fr.
To find out more : Article 16 RGPD
https://www.cnil.fr/fr/le-droit-de-rectification-corriger-vos-informations
- The Right to Erasure or the Right to Be Forgotten
The data subject shall have the
right to obtain from the controller the erasure of personal data concerning him
or her without undue delay and the controller shall have the obligation to
erase personal data without undue delay where one of the following grounds
applies:
a) The
personal data is no longer necessary in relation to the purposes for which it
was collected or otherwise processed.
b) The
data subject withdraws consent on which the processing is based according to
point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no
other legal ground for the processing.
c) The
data subject objects to the processing pursuant to Article 21(1) and there are
no overriding legitimate grounds for the processing, or the data subject
objects to the processing pursuant to Article 21(2); d) the personal data has
been unlawfully processed.
d) The
personal data has to be erased for compliance with a legal obligation in Union
or Member State law to which the controller is subject.
e) The
personal data has been collected in relation to the offer of information
society services referred to in Article 8(1).
To find out more: Article 17 GDPR
You can request the erasure of your data if the legal
conditions to exercise this right are met.
To find out more : Article 17 RGPD
https://www.cnil.fr/fr/le-droit-leffacement-supprimer-vos-donnees-en-ligne
- The Right of Restriction of Processing
1. The data
subject shall have the right to obtain from the controller restriction of
processing where one of the following applies:
a)The
accuracy of the personal data is contested by the data subject for a period
enabling the controller to verify the accuracy of the personal data.
b) The
processing is unlawful and the data subject opposes the erasure of the personal
data and requests the restriction of their use instead.
c) The
controller no longer needs the personal data for the purposes of the
processing, but they are required by the data subject for the establishment,
exercise, or defense of legal claims.
d) The
data subject has objected to processing pursuant to Article 21(1) pending the
verification whether the legitimate grounds of the controller override those of
the data subject.
To find out more: Article 18 GDPR
You may request the restriction of
processing in the cases and within the limits provided for by applicable law.
- The Right to Data Portability
The data subject shall have the
right to receive the personal data concerning him or her, which he or she has
provided to a controller, in a structured, commonly used and machine-readable
format and have the right to transmit that data to another controller without
hindrance from the controller to which the personal data have been provided,
where:
a) The
processing is based on consent pursuant to point (a) of Article 6(1) or point
(a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1)
b) and
the processing is carried out by automated means.
To find out more: Article 20 GDPR
You have the right to the
portability of the personal data that you have provided to us under the conditions
provided for by applicable law.
- The Right to Set Guidelines After your Death
The implementation of this right
is subject to a decree which has not yet been issued.
You have the right to set
guidelines for the storage, erasure, and communication of your personal data
after your death in accordance with the applicable laws and regulations.
To find out more: Article 40-1 French Data Protection Act
- The Right not to be Subject to Automated Decision-Making
1. The
data subject shall have the right not to be subject to a decision based solely
on automated processing, including profiling, which produces legal effects
concerning him or her or similarly significantly affects him or her.
Paragraph
1 shall not apply if the decision:
a) Is
necessary for entering into or performance of a contract between the data
subject and a data controller.
b) Is
authorized by Union or Member State law to which the controller is subject and
which also lays down suitable measures to safeguard the data subject's rights
and freedoms and legitimate interests; or
c) Is
based on the data subject's explicit consent.
To find out more: Article 22 GDPR; Article 10 French Data Protection
Act
You have the right not to be the
subject of a decision based exclusively on automated processing in the cases
and within the limits provided for by applicable law.
UNDER WHAT CONDITIONS CAN YOUR DATA BE TRANSFERRED OUTSIDE THE
EUROPEAN UNION?
For certain processing operations
relating to the management of your sound recording rights, data transfers
outside the EU may take place. In this case, we agree to comply with the
applicable regulations and to only transmit this data to a country recognized
as having "adequate protection" by the European Commission or in the
context of standard contractual clauses adopted by the European Commission, or
under the umbrella of binding corporate rules or, in the case of the United
States, in the context of the “Privacy Shield”.
3. How to exercise your rights ?
- Contact the data controller :
- Or by sending a letter to the following
address:
SCPP, Personal Data Protection
14 Boulevard du Général Leclerc
92527
Neuilly-sur-Seine Cedex
- Our data protection officer :
- We have appointed an external data
protection officer:
ON-X Groupe
Isabelle Thomas
15 Quai de Dion Bouton, 92800 Puteaux
Your request will be processed as soon as possible, subject to proving your identity by attaching a copy of your official identity document to your email or letter.
4. Filing complaints with the CNL
You can file a complaint
concerning the processing of your personal data with the French Data Protection
Agency (CNIL) - www.cnil.fr - 3 place de Fontenoy 75007 Paris.
For more information on complaint
methods: https://www.cnil.fr/fr/cnil-direct/question/844