Privacy policy

Data controller

BECI SAS
SIRET: 07615001000056
20 CD 916, 59380 Bergues, France
Email: dpo@groupebeci.com

Data collected

Through the request form, we process only: your name, your company (where provided), your email address, your telephone number, the type of request (meeting-room booking or site viewing), the details of that request — preferred date, time slot, rental duration, space required, preferred fit-out and expected term — the free-text message, and confirmation that you have read this policy.

For the anti-robot check, technical data is also processed by Cloudflare (see “Anti-robot protection”).

No account is created, no profile is built and no automated decision is taken about you.

During your visit: visit statistics (pages viewed, duration, device and browser type, country, referring page), by Matomo and, if you accept, by Google Analytics (see “Cookies and audience measurement”).

Purposes

Your data is processed in order to: receive and handle your request; reply to you; arrange a meeting-room booking or a site viewing at your request; direct your request to the relevant contact; follow up the relationship with you as a prospect; protect the form against abuse; and ensure the security and maintenance of the site.

The information you send is not used for general direct marketing unrelated to your CREANOR enquiry.

Visit statistics are used to measure the site’s audience and to improve it.

Legal bases

Processing is based on: the pre-contractual steps taken at your request to answer an enquiry about the site; the legitimate interest of BECI SAS in security, abuse prevention and the defence of its rights; and, only if general direct marketing were added, your separate and specific consent for that purpose. The box acknowledging this policy does not, on its own, constitute the legal basis for the processing.

Audience measurement by Google Analytics is based on your consent, given in the banner and withdrawable at any time; measurement by Matomo, which is exempt from consent, is based on the legitimate interest of BECI SAS in knowing how its site is visited.

Recipients

Your data may be accessible to the authorised teams of BECI SAS, to the EUROCAP teams in charge of the CREANOR site, to the sales team responsible for replying to you, and to authorised technical service providers, including the hosting provider and the email delivery provider.

Data is neither sold nor rented. It is disclosed only to authorised recipients and to the providers necessary to process the request.

Google Analytics statistics are processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on behalf of BECI SAS; Matomo statistics stay with Groupe BECI.

Hosting and processors

Technical hosting of the site is provided by:

OVH SAS
2 rue Kellermann
59100 Roubaix, France

OVH SAS acts as a hosting provider, under the services taken out by BECI SAS. The site and its data are hosted in France by OVH SAS. Site backups are also kept in France.

Anti-robot protection

The request form is protected by Cloudflare Turnstile, a service of Cloudflare, Inc. On the page that carries the form, Turnstile processes technical data — IP address and browser signals — to tell people from robots. The site sends Cloudflare only the verification token and your IP address, never the content of your request.

This processing is based on the legitimate interest of BECI SAS in protecting the form against abuse. Cloudflare acts as a processor to provide the service, and as a controller to improve its bot detection. See the Turnstile privacy policy.

Retention period

Prospect data is kept for the time needed to handle the request, then for a maximum of three years from collection or from the last contact initiated by the prospect, unless a legal obligation or the establishment, exercise or defence of legal claims requires otherwise.

At the end of that period, data is deleted from operational tools, in particular mailboxes and any customer relationship management tool. Copies held in backups disappear progressively in accordance with the documented backup rotation and overwriting cycle.

Security logs are kept for a short, defined and documented period. Emails follow the same retention policy as requests. Requests to exercise rights are kept for the time needed to process them and to evidence the reply given.

Visit statistics are kept for at most 14 months in Google Analytics and at most 25 months in Matomo; measurement cookies expire after at most 390 days.

Your rights

You have a right of access, rectification, erasure, restriction, objection and, where applicable, portability of your data. Where processing is based on your consent, you may withdraw it at any time. You also have the right to lodge a complaint with the CNIL.

To exercise your rights, contact:

Email: dpo@groupebeci.com
Postal address: For the attention of the DPO, BECI SAS, 20 CD 916, 59380 Bergues, France.

BECI SAS acknowledges receipt of your request and replies within the time limits set by the applicable regulations. Proof of identity will be requested only in the event of reasonable doubt as to your identity, and in a proportionate manner.

For audience measurement, you can withdraw your consent at any time using the “Cookies” link at the bottom of the page, and object to Matomo in the “Cookies and audience measurement” section.

CNIL

Commission nationale de l’informatique et des libertés
3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
www.cnil.fr

Cookies and audience measurement

The site uses no advertising or social-network cookies. The chosen language is carried by the page address, and fonts are served from our own server. On the form page, the anti-robot check runs in a frame served by Cloudflare, under its own policy (see “Anti-robot protection”).

Matomo, without prior consent. The site counts its visits with Matomo, hosted by Groupe BECI at OVH in France. It is configured according to the criteria of the CNIL (the French data protection authority) that exempt it from consent: IP address truncated by two bytes before anything is stored, anonymous statistics specific to this site, never combined with other data or passed on to third parties. Cookies: _pk_id (random identifier, 390 days), _pk_ses (30 minutes) and, if you arrive from another site, _pk_ref (referring site, 6 months). You can object here:

Google Analytics, only with your consent. If you click “Accept” in the banner, Google Analytics 4 measures your visit through Google Tag Manager and sets the _ga and _ga_C1HY5PJ8HX cookies (390 days). Advertising features are disabled. Until you accept, and after you decline, Google is never contacted.

Without JavaScript, no measurement tool is loaded.

Change my choice

Your choice is kept in your browser for 6 months, without a cookie, and you are then asked again. You can also change it at any time using the “Cookies” link at the bottom of every page.

Maps and external links

No mapping service is loaded automatically on this site. The “Directions” button is an ordinary link that opens a mapping service in a new window, and only if you click it. From that point on, the third-party site applies its own policy.

Security measures

The site is served over HTTPS with a strict content security policy. The form is protected against automated abuse by an anti-replay token, a decoy field, a timing check, an arithmetic check, the Cloudflare Turnstile check and a limit on the number of submissions per connection. Requests are sent by email and are not stored in the site database.

International transfers

Data is hosted in France. Two processing operations may involve a transfer to the United States: the technical data of the anti-robot check, processed by Cloudflare, Inc., and, if you accept, Google Analytics statistics, processed by Google LLC. Both companies are certified under the EU–US Data Privacy Framework, found adequate by the European Commission on 10 July 2023, and their data processing terms incorporate the European Commission’s standard contractual clauses. Should a third-party service activated at the user’s request involve an international transfer, it would be governed by the safeguards provided for by the applicable regulations.