Who We Are
2CRSi (hereinafter referred to as “2CRSi” or “we”) is a French public limited company (société anonyme), registered with the Strasbourg Trade and Companies Register under number 483 784 344, with its registered office at 32 rue Jacobi-Netter, 67200 Strasbourg, France. In the course of its activities, 2CRSi may process the personal data of its shareholders (“you”), whether they hold bearer or registered shares.
What Legal and Regulatory Framework Applies?
2CRSi may process certain personal data relating to you (i.e. any information concerning you that makes you directly or indirectly identifiable), in accordance with the applicable laws and regulations governing the protection of personal data in France and the European Union (the “Applicable Data Protection Regulations”), including in particular:
- French Data Protection Act No. 78-17 of 6 January 1978, as amended, and any subsequent updates thereto;
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the “GDPR”);
- Where applicable, legislation adopted within the European Union and local laws that may apply to personal data processed in connection with our relationship.
How Is Your Personal Data Processed?
Purposes and Lawfulness of Processing
The personal data collected in connection with our relationship is used solely for the following purposes, depending on your status as a shareholder, and on the corresponding legal basis:
Purpose of Processing | Legal Basis |
Subscription to press releases | Consent, at the shareholder’s request |
Management of requests for information and documents submitted to 2CRSi | Legal obligation or 2CRSi’s legitimate interest in responding to requests, as applicable. |
Management of General Meetings (preparation, attendance and voting):
| Legal obligations, in particular Articles L.225-96 et seq. and R.225-61 et seq. of the French Commercial Code. |
Maintenance of shareholder registers (registrations and amendments) | Legal obligation – in particular Articles L.228-1 and R.228-1 et seq., and R.225-106 of the French Commercial Code. |
Payment of dividends | Legal obligation – Article L.232-12 of the French Commercial Code. |
Categories of Personal Data
As part of our relationship, 2CRSi may process the following categories of personal data, depending on the processing activities applicable to you:
- Identification data: surname, first name, postal address, email address, tax address, mobile phone number, date and place of birth;
- Other data relating to shareholder status: number of shares held, number of voting rights, type of securities, value of securities, percentage of share capital held;
- Activity data: attendance at General Meetings, postal voting forms (voting instructions and voting choices in the event of postal voting).
How Long Is Your Personal Data Retained?
The personal data we collect is processed for no longer than is necessary for the purposes for which it was collected, taking into account applicable limitation periods and the principle of proportionality, including in particular:
- Until you withdraw your consent, for data required to maintain press release distribution lists;
- Other documents are generally retained for a period of ten (10) years, or five (5) years from the date on which they cease to be used (in particular, registers).
For more information about the data retention periods we apply, please contact us using the contact details provided below.
Who Is Your Personal Data Shared With?
Your personal data is disclosed to the following recipients, strictly for the purposes for which it is processed and depending on your status:
- Our internal departments (in particular, our Legal Department and 2CRSi’s Management);
- Actifin ;
- Our advisers (legal or otherwise);
- Shareholders attending General Meetings;
- Our banking services provider (BNP Paribas Securities Services);
- The competent authorities in the event of an offence and/or legal proceedings.
How Do We Protect Your Personal Data?
We are committed to ensuring the confidentiality, integrity, availability and security of your personal data. In accordance with Article 32 of the GDPR, we endeavour to implement all necessary and appropriate technical, logical and organisational measures to ensure a level of security appropriate to the risks associated with the processing of such personal data.
We also implement measures designed, as far as reasonably possible, to prevent any loss, accidental destruction, alteration or unauthorised access to your personal data. These measures include, in particular, storing your personal data in a secure operating environment (e.g. a secure data exchange platform with BNP Paribas Securities Services), accessible only to authorised persons who are required to maintain the confidentiality of your data.
No Automated Decision-Making
2CRSi informs its shareholders that it will not make any decision concerning them that is based solely on the automated processing of personal data and produces legal effects, including profiling.
Is Our Policy Subject to Change?
Yes – we reserve the right to amend our Privacy Policy at any time in accordance with the Applicable Data Protection Regulations. Any changes will take effect immediately and will be indicated at the beginning of the Privacy Policy together with the corresponding effective date. We encourage you to regularly review the latest version in effect.
What Are Your Rights?
In accordance with applicable law, depending on the processing concerned, you have the right to:
- To access and rectify your personal data (right of access and rectification);
- To object to the processing of your personal data on legitimate grounds (right to object);
- To withdraw your consent;
- Within the limits provided for by applicable law, to request that the processing of your data be restricted or that your personal data be erased (right to restriction of processing and right to erasure);
- To request the portability of your personal data (right to data portability);
You also have the right to lodge a complaint with the French Data Protection Authority (Commission Nationale de l’Informatique et des Libertés – CNIL) regarding the way in which we process your personal data, including through its website at www.cnil.fr.
How Can You Contact Us?
If you have any questions regarding the protection of personal data, you can contact us by post or email at the following addresses:
- 2CRSi – For the attention of the Data Protection Officer (DPO) – 32 rue Jacobi-Netter – 67200 Strasbourg, France;
- E-mail : dpo@2crsi.com
In order for us to verify your identity, any request must be accompanied by a copy of an identity document (national identity card, passport, driving licence, etc.), which will be deleted once the identity verification has been completed.