1. Who processes your data?
The data controller responsible for the processing activities described in this policy is PROLUDIC, a simplified joint-stock company (SAS) with a share capital of €1,554,400, registered with the Tours Trade and Companies Register under number 347 839 193, whose registered office is located at 181 rue des Entrepreneurs, 37210 Vouvray, France. Telephone: +33 (0)2 47 40 44 44. Email: dpo@proludic.fr.
For any questions or requests concerning your personal data, you may contact dpo@proludic.com or write to PROLUDIC, for the attention of the Data Protection Contact, 181 rue des Entrepreneurs, 37210 Vouvray, France.
2. Who and what does this policy apply to?
This policy applies to website visitors, prospective customers, customers, representatives of business customers, suppliers, subcontractors, partners, contacts within public or private purchasing organisations, event participants, and individuals involved in an accident or incident or appearing in photographs or videos.
Personal data may be collected directly from you, your employer or organisation, a partner, a procurement platform, publicly available professional sources or, in the case of technical data, during your browsing activities.
Where personal data is collected indirectly, the relevant information is provided within the time limits set out in Article 14 of the GDPR, unless a legal exemption applies.
3. What personal data do we use?
- Identity, contact details and professional position;
- Enquiries, quotations, orders, contracts, worksites, deliveries, maintenance, warranties, complaints and correspondence;
- Invoices, payments, bank details and outstanding debts;
- Connection data, IP addresses, devices, browsers, logs and cookie preferences;
- Preferences and history of the business relationship;
- Information contained in tender and procurement documents;
- Photographs and videos;
- Information relating to accidents and incidents.
PROLUDIC limits the collection of personal data to information that is adequate, relevant and necessary for the intended purposes.
4. Why do we process your data, on what legal basis and for how long?
| Processing activity | Purpose | Legal basis | Main retention period |
|---|---|---|---|
| Enquiries, catalogues and quotations | Responding to enquiries and preparing projects | Pre-contractual measures or legitimate interests | 3 years after the last meaningful contact where no further action is taken |
| Customers, orders and worksites | Fulfilling orders, delivering, installing, invoicing, providing after-sales service and managing disputes | Contract, legitimate interests and legal obligations | Duration of the contractual relationship, followed by archiving in accordance with applicable limitation periods; accounting records: 10 years |
| Suppliers and partners | Managing selection, services, payments and disputes | Contract, legitimate interests and legal obligations | Duration of the contractual relationship, followed by archiving in accordance with applicable limitation periods; accounting records: 10 years |
| Marketing and prospecting | Providing information about products, services and events | Consent where required; legitimate interests where legally permitted | 3 years after collection or the last meaningful contact; records of objections retained for at least 3 years |
| Tenders and procurement contracts | Preparing bids, performing contracts and managing legal challenges | Legitimate interests, contract and legal obligations | Duration of the tender procedure or contract, followed by the period required to comply with legal obligations and applicable limitation periods; accounting records: 10 years |
| Accidents and incidents | Investigating incidents, ensuring safety, managing insurance matters and defending legal rights | Legal obligation or legitimate interests | Duration of the investigation, followed by the applicable limitation period and duration of any legal proceedings |
| Photographs and videos | Corporate and commercial communications | Consent, contract or legitimate interests following appropriate assessment | Duration of the authorisation granted or the period communicated |
| IT security | Preventing and managing security incidents | Legitimate interests and security obligations | Proportionate retention period, generally 6 to 12 months for logs, unless an incident requires longer retention |
Once the period of active use has ended, only personal data necessary to comply with a legal obligation or defend legal rights is archived, with restricted access.
Such data is subsequently deleted or anonymised. Specific statutory limitation periods and ongoing legal proceedings may justify different retention periods.
5. Is providing personal data mandatory?
Fields marked with an asterisk (*) are mandatory.
Without this information, PROLUDIC may be unable to respond to your enquiry, prepare a quotation, fulfil an order, arrange an intervention, handle a complaint or provide the requested service.
All other fields are optional.
6. Who receives your personal data?
Within the scope of their responsibilities, personal data may be accessible to authorised PROLUDIC departments and, where necessary, to group companies involved in the business relationship or service; hosting providers, software publishers, IT service providers, CRM, email and communication providers; suppliers, carriers, installers, subcontractors and inspection bodies; banks and payment service providers; insurers, experts, lawyers, judicial officers, auditors and statutory auditors; as well as authorised public administrations, authorities and courts. Data processors are governed in accordance with Article 28 of the GDPR. Certain recipients may act as independent data controllers. PROLUDIC does not sell personal data.
7. Is personal data transferred outside the EEA?
Where personal data is transferred outside the European Economic Area, PROLUDIC relies on an adequacy decision or, failing that, on appropriate safeguards such as Standard Contractual Clauses, supplemented by additional measures where necessary. A copy of these safeguards or information about them may be requested from the contact indicated in Section 1.
8. Cookies and other tracking technologies
Tracking technologies that are strictly necessary for the operation of the website or for a service expressly requested may be used without consent where they meet the legal exemption requirements. Other tracking technologies, particularly those used for non-exempt audience measurement, personalisation, advertising or third-party content, are only activated after you have given your consent. The cookie banner allows you to accept all, reject all or customise your preferences. Continuing to browse, taking no action or closing the banner does not constitute consent. You may change your preferences at any time using the permanent “Manage my cookies” link. A detailed and up-to-date list of tracking technologies, their providers, purposes and retention periods is available in this module.
9. How is personal data protected?
PROLUDIC implements measures appropriate to the risks, including access rights management, authentication, security of systems and communications, backups, logging, employee awareness, supervision of service providers and incident response procedures. Personal data breaches are documented and, where required by the GDPR, reported to the CNIL and communicated to the individuals concerned.
10. What are your rights?
Depending on the processing activity and subject to applicable legal conditions, you have the rights of access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent. You may object to direct marketing at any time. You also have the right not to be subject to certain decisions based solely on automated processing, to establish instructions regarding the handling of your personal data after your death and to lodge a complaint with the CNIL.
11. How can you exercise your rights?
Write to dpo@proludic.com or to PROLUDIC, for the attention of the Data Protection Contact, 181 rue des Entrepreneurs, 37210 Vouvray, France. Your request must contain sufficient information to identify you and understand which right you wish to exercise. Proof of identity will only be requested where there is reasonable doubt. PROLUDIC generally responds within one month. This period may be extended by a further two months depending on the complexity or number of requests, provided that you are informed within the initial period. Exercising your rights is free of charge, except where a request is manifestly unfounded or excessive.
12. Complaints to the CNIL
If, after contacting PROLUDIC, you believe that your rights have not been respected, you may lodge a complaint online at www.cnil.fr or write to: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
13. Updates
This policy may be amended to reflect legal, technical or organisational developments. Appropriate information will be provided in the event of substantial changes where necessary. Last updated: 12 October 2026.
