This Privacy Policy applies to you if you are one of our clients, leads, service providers or partners, a user of our DSP or of our website displayce.com, a candidate applying for a position at Displayce, or if you were in the surroundings of a digital-out-of-home advertising panel inventoried in our DSP.
It explains how we at Displayce process your personal data, in compliance with the European Union General Data Protection Regulation (GDPR).
Who is the data controller for your data?
The data controller in the context of this Privacy Policy is Displayce SAS, a French company incorporated under EU VAT no. FR83807603626, with its head office at Hangar 15, Quais des Chartrons – 33000 Bordeaux (France).
As the data controller, Displayce is your contact for any question relating to this policy and the processing of personal data described herein.
You can contact us by email at contact@displayce.com. You can also contact our Data Protection Officer (DPO) by email at dpo@displayce.com.
Which personal data is collected about you, and for what reasons?
Depending on the nature of your relationship with Displayce, we may collect different data regarding you, for different purposes. The following sections explain this further depending on your specific situation.
- You were in the surroundings of a panel inventoried in our demand-side platform (DSP)
We own and publish a demand-side platform (DSP), which is a platform used by advertisers to organize and manage marketing campaigns through on-street advertising panels.
Through that DSP, we provide advertisers with aggregated statistics regarding the audience of the various panels used to display their marketing campaigns.
To that end, we collect GSP data of mobile devices (smartphones) that come close to a panel, to measure the number of persons who may have seen the ads displayed on the panel. We also collect the unique IDs of those mobile devices to count unique passers-by, and information regarding the concerned panel (ID and location of that panel).
We may use this data to perform our own research and development operations, to test new products and solutions based on the processing of such data.
Please note: This data is collected only in relation to users of mobile apps of our partners who accepted the tracking of their mobile device through these apps. You may oppose this tracking by modifying the settings of your smartphone.
Our processing of this data is justified in that it is necessary to fulfil Displayce’s legitimate interest in providing relevant information to advertisers in the context of their marketing campaigns (article 6.1.f) of GDPR).
- You are one of our clients or a user of the DSP
We collect and process personal data relating to our clients and their employees, including users of the DSP, to manage the business relationship with these clients and to comply with our bookkeeping, tax and social legal obligations.
This data includes identification data, contact details (phone numbers, postal and email addresses), payment data, financial and business data (payment means, invoices, bank details, etc), and written correspondence with data subjects.
In particular, the creation and management of DSP user accounts require that we collect names, surnames, email addresses, positions and company details of our users. We also give each user a unique internal user ID and username, and we keep logs of each action performed on the DSP. This data is used to allow the concerned user to access and use the DSP.
Our processing of this data is justified in that it is necessary to execute an agreement between Displayce and the client (where that client is a natural person) (article 6.1.b) of GDPR), or to fulfil Displayce’s legitimate interest in managing business relationships with its clients (where the client is a legal person) (article 6.1.f) of GDPR).
Certain processing operations (billing, bookkeeping) are also justified in that they are necessary for Displayce to comply with its legal obligations (article 6.1.c) of GDPR). We may also retain all and any relevant data to defend Displayce’s interests in the context of litigation (article 6.1.f) of GDPR).
Besides, DSP users are informed that Displayce use analytic solutions to measure the audience and performance of its website and DSP. Processing of personal data by these solutions is justified by Displayce’s legitimate interest in optimizing its website and the DSP (article 6.1.f) of GDPR).
- You are one of our service providers or partners (or an employee of such a service provider or partner)
We collect and process data regarding our service providers and partners (including publishers) and their employees to manage business relationships with those providers and partners and to comply with our bookkeeping, tax and social legal obligations.
This data includes identification data, contact details (phone numbers, postal and email addresses), financial and business data and written correspondence with data subjects.
Our processing of this data is justified in that it is necessary to execute an agreement between Displayce and the provider/partner (where the latter is a natural person) (article 6.1.b) of GDPR), or to fulfil Displayce’s legitimate interest in managing business relationships with its providers and partners (where the latter is a legal person) (article 6.1.f) of GDPR).
Certain processing operations (bookkeeping) are also justified in that they are necessary for Displayce to comply with its legal obligations (article 6.1.c) of GDPR). We may also retain all and any relevant data to defend Displayce’s interests in the context of litigation (article 6.1.f) of GDPR).
- You are a user of displayce.com
We collect and process data relating to users of displayce.com to manage the technical aspects of the website (hosting, detection of errors and cyberattacks), to measure the audience of the website and to process messages received through the contact form.
This data includes connection and browsing data (including IP addresses) and written correspondence with users (messages received through the contact form and subsequent correspondence).
Our processing of this data is justified in that it is necessary to fulfil Displayce’s legitimate interest in optimizing the visibility, outline and relevance of the website and the answer messages received through the contact form (article 6.1.f) of GDPR).
- You are one of our leads (or an employee of one of our leads)
We collect and process data relating to our leads and their employees to promote our products and services, and to invite them to our events.
This data includes identification data, contact details (phone numbers, postal and email addresses), financial and business data and written correspondence with data subjects.
Our processing of this data is justified in that it is necessary to fulfil Displayce’s legitimate interest in finding new clients and promoting its activities, products and services (article 6.1.f) of GDPR).
- You are applying to a position at Displayce
When you submit an application to a position at Displayce, we collect and process all and any data contained in your application and attachments (resumes, cover letters, etc), to assess your ability to fulfil the position and to answer your application. Our processing of this data is justified by precontractual measures implemented at your request (article 6.1.b) of GDPR).
We may also retain some data regarding your application where we have rejected that application, to offer you other positions in the future. This long-term retention is justified by Displayce’s legitimate interest in managing its recruitment processes on a long-term basis (article 6.1.f) GDPR).
- Other cases
Besides the cases above, we collect and process personal data in the following situations.
- We collect email addresses of subscribers to our newsletter for the purpose of sending them this newsletter. We also collect certain statistics regarding the opening and reading of the newsletter to measure its audience and the preferences of subscribers. This processing is based on your consent, which you express when you subscribe to the newsletter (article 6.1.a) of GDPR).
- We use a third-party solution to organize webinars periodically. This solution involves the collection and processing of personal data, i.e. identification data and images of participants. Such collection and processing are justified by the consent of the participant, as expressed by subscribing to the webinar (article 6.1.a) of GDPR).
- We collect and process data relating to press contacts (identification data and contact details) to manage our communication in medias. This processing is justified by Displayce’s legitimate interest in promoting its activities (article 6.1.f) of GDPR).
We may also collect data relating to any person (other than those mentioned above in that section 2) linked to a case of litigation to which Displayce is a party. The nature of the data collected in those cases depends on that of the case itself and its circumstances. This processing is justified by Displayce’s legitimate interest in defending its rights and interests, including before courts (article 6.1.f) of GDPR).
For how long is your data retained by Displayce?
We retain your data as long as necessary to fulfil at least one of the purposes described above.
In most cases, the retention period is either the duration for which Displayce is required to retain the data to comply with a legal obligation (e.g. bookkeeping records must be kept 10 years due to French law), or the duration during which the data may be necessary as a proof for Displayce to defend itself in a context of litigation.
Below is a table that sums up the maximum retention periods we may apply to the different categories of personal data we hold.
| Data subjects | Types of personal data | Maximum retention period |
| Persons in the surroundings of a DOOH panel | Unique ID and GPS data of your mobile device and of the panel | The data is anonymized within 24 hours at most after its collection by Displayce |
| Users of the DSP | Information linked to your user account (name, surname, email address, account ID, activity logs, etc) | 5 years counting from the deactivation/deletion of your account |
| Clients, service providers, partners and their employees | Invoices, credit notes and other bookkeeping records | 10 years counting from the end of the concerned tax period |
| Other data: contact details, copies of agreements, other information necessary to manage the business relationship (bank details, etc) | 5 years counting from the end of the business relationship | |
| Users of displayce.com | Connection and browsing logs | 12 months |
| Messages received through the contact form and subsequent correspondence | 3 years counting from the last contact received from you | |
| Leads | Identity and contact details, written correspondence with leads | 3 years counting from the last contact received from you |
| Candidates | Accepted applications | Until the end of the onboarding process |
| Rejected applications | 2 years counting from the rejection of the application | |
| Subscribers (newsletter) | Identity and contact details, individual statistics regarding opening and reading of the newsletter | Duration of your subscription to the newsletter (with a maximum of 3 years counting from your last opening of the newsletter) |
| Persons linked to a case of litigation to which Displayce is a party | Any data relevant to manage the case | Limitation period applicable to the case |
Who may access your data? With whom is it shared?
- Displayce’s employees
Our employees may access your data and process it in the context and within the limits of their duties at Displayce.
2. External service providers
We rely on external service providers for the purposes listed below. These providers may access and/or store your data, to the extent necessary to fulfil their mission for Displayce.
- The hosting service provider and maintenance service provider of our website displayce.com and of the DSP, the provider of our single sign on solution;
- Our Internet Service Providers and the hosting service provider of our mailboxes and internal management tools, the provider of our internal instant messaging service and the provider of our internal document management tools;
- The provider of our CRM solution, the provider of our electronic signature solution, the providers of our invoicing, accounting and financial tools;
- The mailing service provider we use for the newsletter, the provider of our shared calendar solution, the provider of our VoIP solution;
- The providers of our web audience measurement tools (used in relation to our website and DSP), the provider of our online form creation tool;
- Service providers who assist us in recruiting new employees in France and abroad.
Some of these service providers may transfer your data to and/or access it from countries which are not members of the European Union, in particular the USA. In such cases, we have ensured that appropriate guarantees are implemented to protect your data throughout and after the transfer:
- Either the provider is self-certified under the Data Privacy Framework, which is an instrument recognized as adequate by the European Commission to govern EU-US personal data transfers;
- Or the provider has implemented the standard contractual clauses adopted by the European Commission on June 4th 2021 with additional security measures such as data encryption. A copy of the implemented contractual clauses will be provided upon request.
3. Other data recipients
We may also share certain data with the following entities and persons, for the following purposes:
- Our bank(s) and payment service provider(s);
- Our auditors and financial and legal counsels;
- In case of litigation, all and any parties to the litigation, their counsels, and the employees of the relevant jurisdictions and authorities.
Those entities and persons are all based in the European Union. If not, then we will implement appropriate measures to protect your data when they are transferred to them, using in priority standard contractual clauses adopted by the European Commission and, where applicable, data encryption.
Does this website use cookies or similar tracking technologies?
We use Matomo cookies on this website. These cookies allow us to measure the audience of the website and to optimize its content and outline. These cookies are stored on your device only when you have given your consent; you may give and withdraw such consent easily using the button below.
[Refuse Matomo cookies]
If you accept the use of these cookies, we will be able to monitor your interactions with this website and to infer statistics on your preferences regarding your use of the website. Conversely, if you refuse the cookies, we will not be able to analyse your use of the website.
This website also has a session cookie, the purpose of which is to maintain your connection to the hosting server of the website as long as you use that website. As this cookie is strictly necessary to provide you with access to the website, your consent is not required for it to be stored on your device.
What rights do you have to control your data?
You have a certain number of rights determined by applicable laws and regulations. You will find details for each of those rights below. A summary table is provided at the end of this section.
You may exercise those rights by sending us an email at dpo@displayce.com.
Please make sure you clearly mention the nature of the right you wish to exercise and the reasons which justify your request, as applicable.
- Right of access
You have the right to request a copy of all personal data we have that relates to you, in a legible, understandable format, and a copy of this Privacy Policy.
- Right of rectification
You have the right to ask us to rectify, complete or update personal data we have that relates to you, in case it appears inaccurate, incomplete or obsolete.
In such case, please make sure you provide us spontaneously, as possible, with all information necessary to proceed with the requested rectification, completion or update.
- Right to withdraw consent
You may withdraw your subscription to the newsletter or to a webinar at any time, without having to provide any justification.
- Right to object
You have a right to object to those processing activities above that are based on Displayce’s legitimate interests (see under section 2) on grounds relating to your particular situation.
In other words, you may ask Displayce to stop processing your personal for a given purpose that is based on a Displayce’s legitimate interest, by explaining the particular reasons that justify this objection.
It is possible however that we refuse to comply with your request if the processing of your data is still necessary, according to us, for compelling reasons that override the grounds relating to your particular situation (e.g. use of said data as proof in an actual dispute).
If it is grounded and no compelling reason goes against it, your objection will result in us ceasing the respective processing activities, but not necessarily deleting the data; to obtain deletion of your data, you must exercise your right to erasure (see below), which also comes with a series of conditions and limitations.
- Right to erasure (right to be forgotten)
You may ask us to delete all or part of the data we have that relates to you, where one at least of the conditions below is met:
- You have withdrawn your consent to the processing of your data in relation to the newsletter, and you wish that Displayce delete that data.
- You objected to the processing of your data and you wish that Displayce delete the respective data.
- It is not necessary anymore for Displayce to retain the respective data for the purposes described in this Privacy Policy.
- You consider that Displayce collected and/or processed the data in an unlawful manner.
- Deletion of the data is imposed as a legal obligation.
- The respective data was collected when you where less than 15 years old.
Please be aware that Displayce may refuse to delete certain data where it is required to retain it for important reasons such as defending Displayce’s interests before a court.
Also, please note that we may choose to anonymize the data instead of deleting it. In this case, we will be able to retain the data in a format that does not allow to identify you anymore (for instance for statistical purposes).
- Right to limitation of processing
You may ask us to limit the processing of your data, i.e. to retain it without using it (except for legal obligations). You may especially ask this instead of asking for deletion of that data.
You may exercise this right where one at least of the following conditions is met:
- The concerned data appears inaccurate and you prefer that we stop using it for the time necessary to verify and rectify it as applicable.
- You objected to the processing of your data as explained above, and you wish that we stop using it for the time necessary to verify the grounds for that objection.
- You consider that Displayce collected and/or processed your data in an unlawful manner, but still you prefer that we retain that data instead of deleting it.
- It is not necessary anymore for Displayce to retain the respective data for the purposes described in this Privacy Policy, but still you wish that we retain that data for you to be able to use it before a court.
In such cases, we will stop using the respective data and will retain it for the appropriate duration.
- Right to data portability
You may ask us to give you a machine-readable copy of your personal data where its processing is based on your consent or contractual necessity (see under section 2 above) so that you may reuse that data yourself or with another service provider.
This right to data portability is not the same as the right of access above, as it is about obtaining not a legible copy of the data, but a machine-readable copy that may be reused by you or another service provider.
- Right to provide directives regarding your data after your death
You may provide us with directives as to how you want Displayce to proceed with your data after your death.
For instance, you may ask that we delete all of your personal data (except as needed for Displayce to defend its rights before a court) or to transfer it to a recipient of your choice.
You may also designate any person of your choice to control our respect of those “last wishes”. That person does not need to be your heir or your testamentary executor.
► Summary table
| Your rights | What they allow you to obtain | Concerned processing/data | Conditions, exceptions and limitations |
|---|---|---|---|
| Right of access | A legible and understandable copy of all personal data we have that relates to you, and a copy of this Privacy Policy | All personal data | None |
| Right to rectification | Rectification, update or completion of the personal data we have that relates to you | All personal data | Clearly identify data which needs rectification, update or completion and provide the appropriate additional/new data |
| Right to withdraw consent | To stop the processing of your personal data | Your subscription to our newsletter and/or webinars | None |
| Right to object | To stop the processing of your personal data | Processing operations based on Displayce’s legitimate interest (see section 2 above) | Clearly state the grounds relating to your particular situation which justify the objection |
| Right to erasure | Erasure or complete anonymization of your personal data | All personal data | See explanations above (under section 5.e) |
| Right to restriction of processing | Retention of your personal data by Displayce without using it | All processing operations | See explanation above (under section 5.f) |
| Right to data portability | A reusable, machine-readable copy of your personal data | Processing based on consent or contractual necessity (see section 2 above) | As applicable, clearly state the identity and contact details of the person or organization to which you wish your data be transferred |
| Right to provide directives regarding your personal data after your death | Respect of your “last wishes” regarding the retention, use, transfer or deletion of your personal data | All personal data | Clearly state the identity and contact details of the persons who will control the respect of your directives after your death |
► You consider that we did not provide a satisfactory answer to your request or that we process your personal data in an unlawful manner?
We invite you to first contact us so that we discuss the issue together and try to find a way to solve it efficiently.
If you wish, you have the right to lodge a complaint with the competent data protection supervisory authority, such as the French Commission Nationale de l’Informatique et des Libertés (CNIL), through its website cnil.fr or by postal mail at CNIL – 3, place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 (FRANCE).
This right to lodge a complaint may be exercised at any time and free of charge, except for (as applicable) postal fees and legal counsel fees (if you choose to get assistance from a legal counsel).