Personal data protection
DELUKEY, the trading name of Astorg Immobilier, is an estate agency and a 100% subsidiary of Banque DELUBAC & CIE.
As part of our relationship, your personal data is subject to special care when being processed. This information notice on the processing of your personal data describes the commitments made by DELUKEY, as data controller, to ensure the protection of your personal data. The purpose of this document is also to inform you of how your personal data is collected and used throughout your relationship with DELUKEY.
Are you affected by this notice?
This information notice, which complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”), applies uniformly to all the services we offer and concerns any natural person in connection with DELUKEY.
This applies to you if you are a customer, agent, legal representative, prospect, beneficial owner, partner (notary, lawyer), seller of the property involved in the transaction or visitor to our website.
What personal data is processed?
DELUKEY only collects personal data that is strictly necessary for the purpose for which it is processed.
DELUKEY processes personal data that have been provided voluntarily or obtained in the following ways:
| With you | Third-party organisations | Third-party organisations | Via your business |
|---|---|---|---|
| The personal data you send us | Such as the Banque de France | For example, your solicitor | Your navigation on our website |
The various types of data that DELUKEY usually processes in the course of its business include the following:
- Identification data: first name, surname, gender, maiden name, country of residence, place and date of birth, nationality, identity document, signature, and any other information that may be useful when the relationship is established;
- Contact details: postal and e-mail addresses, telephone numbers;
- Details of your professional situation: occupation ;
- Economic and financial information: income, bank details, etc;
- Biometric data: where applicable, as part of a remote contact, using a facial recognition system. The use of this data makes it possible to prevent fraud and the usurpation of your identity by a third party. These biometric recognition systems are an alternative to other control mechanisms and are subject to specific security measures to guarantee the security and confidentiality of personal data;
- Connection data linked to your browsing on our sites: IP address, identification and authentication data for your connected areas, logs, cookies, browsing data. See our policy on cookies for more details on how we use them;
- Data resulting from correspondence and communications between you and us: telephone calls, electronic messages, communications on social networks or any other type of communication, voice when telephone calls are recorded, video surveillance images on our premises;
- Data relating to products and services subscribed to: type of product, method of payment ;
- Data required to comply with current regulations.
More generally, any information contained in forms that you may complete, in documents that you may send to us or information that you may send to us
Why does DELUKEY process your personal data?
The purpose of processing personal data is defined as the objective pursued, the need to which it responds for DELUKEY. The processing carried out meets an explicit, legitimate and specific purpose, which is based on the proposal, implementation or performance of a contract, compliance with a legal or regulatory obligation, your consent or the legitimate interest of DELUKEY.
| Goals | Treatments concerned |
|---|---|
| Commercial prospecting | Canvassing Marketing operations |
| Meeting our legal and regulatory obligations | Combating money laundering and the financing of terrorism Fighting fraud Internal Control and Operational Risk Management Exercising your rights concerning your personal data. |
| Monitoring our exchanges | Signature of the sale or search mandate Fulfilment of our contractual obligations Possibly, for the exercise of our rights, for example in the case of our defence in the event of a claim against us. |
To whom do we pass on your personal data?
The personal data collected by DELUKEY may be communicated, for the purposes mentioned above, to the following recipients:
| Category of recipients | Goals |
|---|---|
| Banque Delubac et Cie | Commercial prospecting Anti-money laundering and terrorist financing controls Opening the escrow wallet. Data hosting IT support Document management Customer relationship management (CRM, switchboard) Electronic signature Website management |
| Partner estate agencies | Partner estate agencies |
| Case management platform | As part of the processing and follow-up of files (collection of documents, preparation of legal acts) |
| Authorised administrative, supervisory and judicial authorities (such as the DGCCRF, competent courts, etc.) | Inspections, litigation |
| Notaries, lawyers | Carrying out the transaction |
Your personal data will not be transferred for purposes other than those described above, except with your express consent, which may be withdrawn at any time. Your personal data will never be sold.
How does DELUKEY secure your data?
Your data is protected by organisational, technical and physical security measures in order to preserve its integrity, confidentiality and availability (e.g. partitioning, encryption, access restriction, etc.). DELUKEY endeavours to protect personal data, taking into account its sensitivity and the purpose for which it is processed.
Your data is stored on information systems that meet high security standards and access is restricted to authorised persons only. They are trained and specifically authorised.
DELUKEY ensures that all its employees as well as all persons involved in the processing of data on its behalf (and in particular its subcontractors) comply with measures for the protection and confidentiality of the data processed in accordance with the regulations in force and its requirements. Data transfers are carried out within a strictly defined confidentiality and security framework.
In the event of a personal data breach presenting a high risk to your rights and freedoms, DELUKEY will inform you as soon as possible of the nature of the breach and the measures taken to remedy it.
How long is your personal data kept?
Your personal data is kept for the period necessary for the purposes for which it is to be processed, in accordance with the conditions and limits laid down by the regulations in force. At the end of the retention period, the personal data concerned is deleted.
By way of exception, your personal data may be archived in order to manage ongoing claims and disputes and to respond to requests from authorised authorities.
In addition, certain personal data may be stored and anonymised for statistical analysis purposes.
The main retention periods for personal data are as follows:
| Purpose | Legal basis | Shelf life |
|---|---|---|
| Commercial prospecting for prospective customers | Your consent | Duration of your consent and maximum 3 years from the date of your last contact |
| Managing our contractual relationship | Pre-contractual study or performance of a contract | 5 years from the end of the commercial relationship |
| Combating money laundering and the financing of terrorism | Compliance with a legal or regulatory obligation | 5 years from the end of the commercial relationship |
| Compliance with accounting and tax standards in accordance with current legal provisions | Compliance with a legal or regulatory obligation (article L.123-22 of the French Commercial Code) | 10 years from the end of the relevant financial year |
| Litigation management | Legitimate interests of DELUKEY | Until such time as the ordinary and extraordinary remedies are no longer available against the decision rendered |
| Monitoring requests to exercise individual rights (data processing and civil liberties); receipt, processing, monitoring, archiving and statistics | Compliance with a legal or regulatory obligation | The calendar year of the application, plus 5 years |
How is your data processed outside the European Union?
The above-mentioned processing operations may involve transfers of personal data to countries outside the European Union, whose legislation on the protection of personal data differs from that of the European Union (for example in the case of subcontractors or partners domiciled outside the European Union).
In this case, DELUKEY takes the necessary steps with its subcontractors and partners to guarantee a level of protection for your data that is appropriate and compliant with the regulations in force. Your data may also be communicated to official bodies and the authorised administrative and judicial authorities of the countries concerned, in particular as part of the fight against money laundering and the financing of terrorism, the fight against fraud and the determination of tax status
What are your rights and how can you exercise them?
Your data belongs to you: you retain control of your data at all times
In accordance with the regulations in force, you have the right to access, rectify, delete, limit or object to the processing and portability of your data. These rights may be exercised under the conditions and within the limits set out in the regulations in force.
You may also, at any time and free of charge, without having to justify your request, object to this data being used for commercial canvassing purposes. In the case of processing based on your express consent, the withdrawal of consent does not compromise the lawfulness of the processing based on consent carried out prior to such withdrawal.
You can also organise what happens to your personal data after your death.
How can you contact us to exercise your rights regarding the processing of your personal data?
By e-mail to dpo@delubac.fr;
By post to: DELUKEY – Data Protection Officer – 16 Place Saléon Terras 07160 Le Cheylard.
All requests must enable you to be identified (via your e-mail address, surname, first name, ….). If it is not possible to identify you, you may be asked to provide additional information, if necessary accompanied by a photocopy of proof of identity, failing which the request will not be processed.
You will receive a reply within one month of receipt of your duly documented request. This period may be extended by two months in the event of a complex request or a large number of requests in progress. DELUKEY will then inform you within one month of receiving your request.
DELUKEY will do its best to answer all your questions about the processing of your personal data.
If you believe that the processing of your personal data does not comply with the regulations in force, you may at any time lodge a complaint with the Commission Nationale Informatique et Libertés (CNIL) in accordance with the procedures indicated on its website.
Right of rectification
You can ask for :
- inaccurate information about you is amended
- incomplete information to be completed.
To do this, you will be asked to provide us with any supporting documents we may need to respond to your request.
Right to erasure (“right to be forgotten”)
You may request the deletion of your personal data. DELUKEY may comply with your request in accordance with Article 17 of the GDPR if:
- the data is no longer necessary for the purposes for which it was collected or processed;
- there is no legal basis requiring them to be kept;
- you have withdrawn your consent to their processing;
- you have objected to their processing and there is no compelling reason for DELUKEY to continue;
- the data has been processed unlawfully ;
- this data must be deleted to comply with a legal obligation under European Union law or French law to which DELUKEY is subject.
Right of access
You can ask for :
- confirmation that personal data concerning you are or are not being processed
- and, when they are, access to said data.
Right to limitation
Under certain conditions, you may request that we limit the processing of your personal data.
Right to object
You may object to the processing of your personal data for your own reasons. However, such opposition may make it impossible for DELUKEY to provide the proposed service.
Right to object to commercial prospecting
You may also object, free of charge and without giving any reason, to your data being used for commercial prospecting purposes or communicated to third parties for this purpose.
Right to portability
You have the right to receive personal data concerning you, which you have provided to us and which is processed with your consent or which is necessary for the performance of a contract.
Right to withdraw consent
Where the processing of your personal data by us is based on your consent, you may withdraw it at any time under the conditions and within the limits provided for by the regulations in force. We will then cease to process your personal data without the previous operations for which you had given your consent being called into question.
Rights when faced with an automated decision
You have the right to obtain human intervention, to express your point of view and to contest the decision taken in your respect.
Right to organise what happens to your personal data after your death
Pursuant to Law 2016-1321 of 7/10/2016 for a Digital Republic, individuals have the right to define general and specific directives defining how they intend their rights concerning their personal data to be exercised after their death
Changes to the data protection policy
DELUKEY may make changes to this personal data protection policy, in particular due to changes in regulations, technology or the purpose of processing.
The applicable version is that in force on the date of access to the DELUKEY website.