1. Introduction

LOXO is particularly attentive to the protection of your personal data. Regarding the personal data you entrust to us, we inform you transparently about our personal data protection policy. 

LOXO is committed to processing your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) 2016/679 of the European Parliament and Council of April 27, 2016, and the French Data Protection Act No. 78-17 of January 6, 1978, as amended, concerning data processing, files, and individual freedoms (the “Informatique et Libertés” law), which define the conditions under which personal data processing can be implemented. 

Any information collected through the website that can identify you, either directly or indirectly, is considered personal data and will be processed in accordance with this policy. 

We invite you to regularly review this section, as LOXO may modify it at any time. 

This Privacy Policy was last updated on September 24, 2024.

2. “Data Controller” and “Data Protection Officer (DPO)”

The data controller for the data collected and processed on our website is LOXO, located at 34 Chemin de Jeandey, 33360 LATRESNE (hereinafter referred to as the “Data Controller”).

The Data Controller has appointed a Data Protection Officer, or “DPO,” whom you can contact at the following address: info@loxo-france.com

3. Personal Data

For the purposes of the GDPR, personal data refers to any information related to an identified or identifiable natural person. 

The personal data collected varies depending on the purpose of the collection and the service you wish to benefit from. 

You agree to provide up-to-date and valid personal data and guarantee that no false declarations or incorrect information will be given.

4. Purposes of Processing, Legal Bases, and Retention Periods

4. Purposes of Processing, Legal Bases, and Retention Periods Purpose of Processing: 

Managing newsletter subscriptions 

Legal Basis: Consent (B2C) / Legitimate interest (B2B) (Information sharing via the newsletter) 

Retention Period: For as long as the person is subscribed to the newsletter 

Purpose of Processing: Managing job applications through the dedicated section on the website 

Legal Basis: Consent Retention Period: 2 years from the last contact with the candidate 

Purpose of Processing: Handling requests received through the contact form 

Legal Basis: Legitimate interest (Responding to contact requests) 

Retention Period: For clients: 3 years from the end of the business relationship 

For prospects: 3 years from the collection of personal data or the last contact initiated by the prospect

Purpose of Processing: Managing cookies 

Legal Basis: Consent 

Retention Period: 13 months

5. Your Rights

Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

Your Rights In accordance with the provisions of the GDPR, you can exercise the following rights: 

Right of Access: The right to obtain confirmation as to whether or not your personal data is being processed and to receive a copy of it. 

Right of Rectification: The right to request the correction of inaccurate personal data or to complete incomplete data. 

Right to Erasure: The right to request the deletion of your personal data when possible. 

Right to Object: The right to object at any time to the processing of your personal data when it is based on our legitimate interest. 

Right to Withdraw Consent: When the processing of your data is based on your consent, you have the right to withdraw it at any time, without needing to provide any justification. 

Right to Restriction of Processing: The right to request that the processing of your data be paused for a specific period. 

Right to Data Portability: The right to receive the personal data you have provided in a structured, commonly used, machine-readable format and to transmit it to a third party. 

Right to Lodge a Complaint: The right to file a complaint with the CNIL if you believe your rights are not being respected. You can exercise these rights at any time by sending us an email at info@loxo-france.com. 

Right to Lodge a Complaint with the CNIL: If, after contacting us, you believe that your “Informatique et Libertés” rights are not being respected, you may file a complaint with the CNIL: [https://www.cnil.fr/fr/plaintes](https://www.cnil.fr/fr/plaintes).

6. Protection of Your Personal Data

To ensure the security of your personal data, we have implemented security measures, including access controls, firewalls, and secure servers. 

These measures are designed to protect your personal data against loss, misuse, unauthorized disclosure, alteration, interference, damage, and unauthorized access.

7. Access to Your Personal Data

Your personal data is intended for the personnel of the Data Controller authorized to process it, including the marketing, sustainability, IT, sales, quality, and administrative departments.

8. Sharing of Your Personal Data

In accordance with regulations, when we share your personal data with subcontractors for certain purposes described in this Privacy Policy, we ensure that their data security and storage practices are at least as robust as those of our organization. We also ensure that they comply with data protection laws in conditions at least equivalent to those we uphold. 

Furthermore, since subcontractors may process your personal data on our behalf and under our instructions, we are committed to ensuring that your personal data is not shared or disclosed for purposes other than those described in this Privacy Policy. However, we may be required to transmit your data for purposes other than those outlined in the Policy when such communication is mandated by law and governmental authorities.

9. Transfer of Your Data Outside the European Economic Area

In principle, we ensure that your personal data is retained within the European Union. However, it is possible that your data may occasionally be transferred to subcontractors or business partners located in other countries, provided they offer an adequate level of protection recognized by the European Commission. In the event of transferring your data to a country that has not been recognized as having an adequate level of protection, we implement standard contractual clauses approved by the European Commission to ensure sufficient protection of privacy and the fundamental rights of individuals.

10. Third-Party Websites

The website of the Data Controller may be linked to third-party websites. Websites hosted by third parties are outside our control. When you provide personal data on a third-party website, the processing of that data does not take place on our website but on the relevant third-party site. Any personal data you provide will be collected and processed in accordance with the privacy policy of the respective third party. Therefore, we assume no responsibility for the practices of these third parties regarding data protection.

11. Governing Law

This Privacy Policy is governed by and will be interpreted in accordance with French law