Data Confidentiality

Data Policy

MAS Seeds 

Updated on 25/08/01 V.06

General principles

This Personal Data Charter (“PDC”) sets out the terms and conditions under which MAS Seeds (the Company) (Legal Notice) processes personal data (“Data“) (i) of any visitor to the website www.masseeds.fr (“Website“) and/or customers, collected when visiting the Website, placing orders or purchasing Products from the Company and/or any interaction with the Company’s services, in the context and for the purposes of its commercial management and (ii) from any supplier of goods and/or services to the Company, collected in the context and for the purposes of its purchasing management. All visitors, customers and/or suppliers are referred to indiscriminately as “Data Subjects” in the DPC. It is the responsibility of the Data Subject to familiarise themselves with the CDP. Any questions on this subject may be addressed to [email protected].

Interactions between the Company and Group Maïsadour

The Company is part of the SEEDS division of Maïsadour, an agricultural cooperative with variable capital, registered in the Mont de Marsan Trade and Companies Register under number 782 092 290 (approval no. 11967) and located at Route Saint-Sever, 40280 Haut-Mauco (https://www.maisadour.com/). A committed player in France and internationally in the agroecological and food transition, Maïsadour brings together nearly 70 companies, each dedicated to a specific activity in the sector and working to achieve a common goal. With this in mind, the companies of the Maïsadour Group may be required to pool certain Data necessary for the fulfilment of their mission (sales promotion, customer support, pooling of resources, various statistics, etc.), with Maïsadour ensuring that each of them complies with the terms of the CDP.

Modification of the CDP

The Company reserves the right to modify the Privacy Policy at any time, in particular to take into account changes in its business, the Website, the applicable legislative and regulatory environment, or for any other reason. These modifications, indicated by a change in the version date at the top of the Privacy Policy, will be applicable as soon as they are published on the Website.

What data is collected?

  • Administrative data – This Data refers to any information transmitted at the initiative of the Data Subject when consulting the Website and/or as a result of their interactions with it and/or the relevant departments of the Company, and includes in particular:
    • Identity: (i) for customers and/or prospects, surname, first name, telephone number, email address, delivery address, billing address if different from the delivery address, internal customer code, copy of identity card for the purposes of exercising the rights of the Data Subject or combating/preventing fraud, date of birth (optional), (ii) for suppliers, business contact details;
    • Professional life: (i) exclusively in the context of submitting an application to the Company via the Website or the Company, the information contained in CVs/cover letters and/or provided during job interviews (current/desired position, past or current professional experience, personal achievements in previous positions, training courses taken, school/university education, diplomas obtained, work certificates), (ii) in the case of suppliers, the entity concerned (name, registered office or contracting establishment, SIREN number, VAT number) and position within that entity;
    • Economic and financial information: (i) exclusively in the context of an application submitted to the Company via the Website or to its departments, the information contained in CVs/cover letters and/or provided during job interviews (current annual salary and/or salary expectations), (ii) for suppliers, bank details (IBAN, RIB/RIP);
    • Personal life: exclusively in the context of submitting an application to the Company via the Website or to its departments, the information contained in CVs/cover letters and/or provided during job interviews (family situation, children, hobbies, type of driving licence, honorary titles, languages spoken) ; 
    • Goods/services viewed/ordered:(i) with regard to customers and/or prospects, product information requests (exchanges with customer service prior to any order), products ordered (quantity, amount, frequency, date/content/amount/order/invoice references, delivery terms, purchase history), after-sales service, product preferences, product reviews/comments, (ii) with regard to suppliers, order numbers, details of goods/services concerned, discounts granted, payment terms, invoice numbers, dates of receipt, due dates and payment dates, deductions/objections, date of receipt of goods and/or performance of services, delivery notes with or without reservation;
    • Complaints: handling complaints regarding products, delivery or other matters; handling requests from Data Subjects regarding the exercise of their rights under applicable personal data protection regulations;
  • Connection data – The Website implements automatic information processing procedures that do not allow for the immediate and direct identification of the Data Subject, some of which use cookies or similar tracking technologies implemented on the Data Subject’s device (Cookie Policy):
    • Technical data, enabling the connection source and/or terminal characteristics to be identified (e.g. IP address, MAC address, data subject identification number, browser and/or network characteristics, etc.);
    • Traffic and location data, such as technical characteristics, date, time and duration of each session, pages viewed, geographical location, etc.

On what legal basis and for what purposes are the Data collected?

  • For the purposes of performing the contract concluded between the Company and the Data Subject and/or taking preliminary measures at the request of the Data Subject, in particular for the purposes of:
    • Responding to requests for information from customers and/or prospects regarding products, prior to any orders being placed;
    • Manage orders from customers and/or prospects, issue invoices;
    • Manage orders for products/services from suppliers, their receipt, related invoices and payment.
    • Manage product deliveries to the customer following order confirmation;
    • Manage any complaints from customers and/or prospects regarding their access to/use of the Website and/or the fulfilment of an order or its consequences;
    • Exclusively in the context of applications submitted to the Company, sorting, selecting and analysing applications, scheduling interviews, assessing the suitability of candidates for the position to be filled, and responding to applications (rejections or job offers).
  • With the consent of the Data Subjects, in particular for the purposes of: 
    • With regard to customers and/or prospects, recommending products or product promotions to them by email and/or post, telephone and/or text message, in accordance with the applicable legal provisions on commercial prospecting. For example, once a customer has placed an order for products, the Company may send them emails about similar products, which the customer may opt out of using the mechanisms provided for this purpose.
    • Send them newsletters, when requested by them;
    • Invite them to participate in promotional games or competitions.
    • Conducting product quality studies and/or satisfaction surveys on the Website or in the Shop, in particular for the purposes of improving and optimising features or organisation/layout;
    • Track their activities and browsing habits in order to personalise the content offered via the Website, and create a profile enabling us to offer them, via the Website or social networks, advertisements targeted to their interests and, in the case of geolocation, to their region, county, or city;
    • Identify how they interact with the Site, providing statistical data on the pages visited, the time spent and any errors that may have occurred during their browsing;
    • Offering them the opportunity to share the editorial content of the Website or their opinions about it on social media;
    • Passing on their Data to business partners;
    • Exclusively in the context of an application submitted to the Company, where applicable and on an exceptional basis, verify information contained in the CV with current or former employers and/or retain the candidate’s CV in the event of a negative response from the Company;
    • In accordance with applicable legal provisions, the Company may seek the prior consent of Data Subjects for the processing of their Data for purposes other than those set out above. Such consent may be requested on a case-by-case basis and shall in any event be subject to clear and comprehensive information regarding the context and implications of the proposed operation.
  • For the purposes of the Company’s compliance with its legal obligations, in particular for the purposes of: 
    • Fulfilling one’s accounting and tax obligations;
    • Where applicable, maintain a list of treatments to which Data Subjects have objected or for which they have subsequently withdrawn their consent.
    • Manage any request from a Data Subject regarding the exercise of any of their rights under applicable personal data protection regulations.
  • For the purposes of the Company pursuing its legitimate interests, provided that these interests do not override the rights of the Data Subject, in particular for the purposes of: 
    • The exercise of his advisory activities and tasks related to professional activities
    • Ensuring the security of the Website and remembering the preferences of the Data Subject (e.g. choice of language, presentation of a service)
    • Create and maintain a list of customers and/or suppliers;
    • Compile anonymised statistics on sales and visitor numbers for the Website and shops, as well as financial statistics and turnover figures by supplier.

Who are the Data intended for?

  • Internally: The Data is accessible by the Company departments responsible for relations with the Data Subject (sales department, customer service, after-sales service, accounting, technical support, purchasing department, HR department in the event of job applications). 
  • Externally: The Data is (i) stored by the Company’s service providers responsible for hosting and managing the Website (management, administration, maintenance of systems and networks), (ii) transmitted to commercial partners such as other companies in the Maïsadour Group and/or the Company’s marketing/advertising agencies (commercial prospecting, personalisation of the Website’s editorial content, targeted advertising, management of customer reviews, etc.). Details of the service providers, partners and/or subcontractors concerned are available on request from the relevant department of the Company.
  • Disclosure of Data for Legal Requirements: The Company reserves the right to use and disclose Data when required by law, in connection with legal proceedings, or if it believes that such disclosure is necessary to protect its rights or legitimate interests.
  • Data Communication and Asset Transfers: The Data constitutes an asset covered by transfer operations in the event of a merger, acquisition, partial contribution of assets or change of control concerning the Company. This transfer, as well as the alternatives offered to the Data Subject regarding the fate of the Data (e.g. prior anonymisation), will be notified.

How long are the Data retained?

  • Contractual relationship: Administrative data relating to the contractual relationship with a customer and/or supplier is retained for a period of 5 years from the date of termination for any reason, except in notable exceptions (e.g. deletion of the copy of the identity document following completion of the verification operations that justified its collection), where applicable, plus any applicable limitation periods (e.g. for invoices, 10 years from the end of the financial year in which they were issued), and then archived in accordance with the legal provisions in force.
  • Commercial prospecting: Data necessary for marketing communications (product offers, newsletters, etc.) carried out in strict compliance with the applicable legal provisions in force shall be retained, unless the Data Subject objects, (i) for a customer, for a maximum period of 3 years from the termination of their contractual relationship with the Company, (ii) for a prospect, for a period of 3 years from the date of collection or the last contact, on their initiative, with the Company. At the end of these periods, the Company may contact the Data Subject to determine whether they wish to continue receiving marketing communications. If not, the Data will then be archived in accordance with the applicable legal provisions in force, including those relating to the statute of limitations.
  • Application submission:(i) if the application is unsuccessful, CVs/cover letters are kept for a maximum of two years, unless the applicant expressly agrees to a longer period; (ii) if the application is successful, CVs/cover letters are kept for the period strictly necessary to complete the recruitment process.
  • List of objections to processing (lack of consent or exercise of the right to object) : the Data concerned are kept for 3 years from the exercise of the right to object or the withdrawal of consent from the active database.
  • Connection data: The Data concerned is retained for the periods specified in the Cookie Policy.    

What are the rights of the Data Subject and how can they be exercised?

  • Right of access: Request from the Company (i) confirmation that it holds personal data relating to the Data Subject, (ii) a copy of such data, and (iii) any information relating to the processing operations carried out.
  • Right of rectification: Request that the Company correct any Data that is inaccurate and/or incomplete.
  • Right to object: Request that the Company cease using the Data, it being specified, however, that in such a case, the Company reserves the right not to comply with this request, particularly if it considers that there are legitimate and compelling reasons to process the said data, or that the said data is necessary for the performance of a task carried out in the public interest. the Company reserves the right not to comply, in particular if it considers that there are legitimate and compelling reasons to process the said data, or that the data is necessary for the establishment, exercise or defence of a legal claim, or that the processing results from a legal obligation.
  • Right to restriction of processing: Request that the Company restrict the processing of the Data, particularly in the event that it has not complied with a request for rectification and/or objection from the Data Subject within 30 days of receipt. The freezing of the use of the Data shall be effective for the time necessary for the Company to carry out its verification operations, unless, in particular, the Data Subject has consented to such use, or the Data is necessary for the establishment, exercise or defence of a legal claim, or the processing is required by law.
  • Right to be forgotten: Request that the Company erase the Data, once it is no longer necessary for the purposes for which it was collected and/or the Data Subject has exercised their right to object. However, the Data Subject is informed that the Company may be required, under applicable legal provisions and/or for the purposes of establishing, exercising or defending legal rights, to retain all relevant Data in its archives for the duration of the applicable limitation period. Upon expiry of the limitation periods, the Data concerned will be completely removed from the Company’s archives and destroyed. The right to be forgotten also entitles the Data Subject to issue general and/or specific instructions to the Company regarding the fate of Data concerning them after their death.
  • Portability of personal data: Request from the company, for any automated processing based on consent and/or the performance of the contract, the retrieval of eligible Data from the Data Subject and/or its possible transfer to a third party in a structured, commonly used and machine-readable format.
  • Procedures for exercising rights: Any exercise by the Data Subject of any of the above rights shall be carried out:

MAS Seeds SAS 

Service Marketing / Protection des données 

Route de Saint-Sever 

40280 – HAUT-MAUCO 

including (i) the detailed subject of the request and (ii) where applicable, attached proof of identity, which will be destroyed immediately after verification. Any incomplete request will result in the Data Subject being notified and asked to provide the missing information. Upon receipt of a complete request, an acknowledgement of receipt will be sent in electronic form and the Company will make every effort to respond as soon as possible, and at the latest within 30 days of receipt. This period may be extended by two months depending on the complexity and number of requests, it being specified that any extension will be notified to the Data Subject within the initial 30-day period.

  • Right to lodge a complaint with the CNIL: In the event that the Company is unable to meet the expectations of a Data Subject in relation to the exercise of any of their rights, the Data Subject has the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (“CNIL”) located at 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07 (Telephone: +33 (0)1 53 73 22 22 – https://www.cnil.fr/fr/particulier).

How are data security and confidentiality ensured?

The Company continuously implements, in accordance with the principles of data protection by design and by default, all appropriate technical and organisational measures available on the market to ensure the security, integrity and confidentiality of the Data and to protect it against any unauthorised access, use, alteration, destruction, loss or unauthorised disclosure. The Company ensures compliance with applicable regulations on the protection of personal data by the recipients of such data, in particular at the contractual level. Any questions regarding the measures taken by the Company to ensure the security, integrity and confidentiality of the Data may be addressed to the relevant department of the Company.

Are the Data transferred outside the European Economic Area?  

Where applicable, Data may be transferred to companies located in countries outside the EEA, particularly in connection with the processing operations identified in the Cookie Policy. Details of transfers made by the Company are available on request ([email protected]), it being specified that for processing operations specifically concerning the Company, the Company ensures, prior to any transfer, that the safeguards required under applicable personal data protection regulations are implemented. specifically, the Company ensures, prior to any transfer, that the safeguards required under applicable personal data protection regulations are in place.