Privacy Policy

The Maximiles Programme (the “Programme”) has been designed to ensure the utmost confidentiality of your Personal Data. Information concerning you is processed in accordance with the terms of this Privacy Policy, which you are advised to read carefully.
We are committed to respecting your privacy, and we undertake to ensure that the processing of your Personal Data complies with Regulation (EU) 2016/679 of 27 April 2016, known as the “General Data Protection Regulation” (hereinafter the “GDPR”).
It is noted, as an initial matter, that all words commencing with a capital letter in this document which are not defined herein shall bear the meaning ascribed to them in the General Terms and Conditions of Use available on our website.

1. Identity and Contact Details of the Data Controller

The Data Controller is: Bilendi France, a société par actions simplifiée (simplified joint-stock company) with a share capital of €149,935, registered with the Paris Trade and Companies Register under number RCS PARIS 933 987 687, whose registered office is located at 4 rue de Ventadour, 75001 Paris, France.

2. Which Personal Data Do We Collect?

2.1 Personal Data Collected

2.1.1 Your Membership of the Programme

In the context of your Membership on the Website or the Application, the only information concerning you that we collect and process, in our capacity as Data Controller, is:

Your personal identity and contact details that you provide, at the time of your registration as a Member or subsequently, such as title, gender, first name, surname, date of birth, email address, telephone number, postcode, postal address, country, and nationality.
Your identification and authentication data enabling you to access the Website and the Application, such as username, password, security question, and its answer.
All the answers you have provided to the qualification questionnaires related to the establishment of your Member profile (concerning, for example, your personal situation, professional life, consumption habits, etc.), which may include Sensitive Data such as health data and/or the data of individuals whose data you provide to us (e.g., information relating to members of your household). The Member declares having obtained the consent of the individuals concerned or the person with parental authority.
Technical data relating to your connections to our services (Connection Data), such as IP address, logging data (logs of your connections to your user account, Points transactions, and profile updates, navigation data related to your interactions with the service, etc.).
Information concerning your subscription to the various services offered and your communication preferences, notably regarding newsletters or invitations via SMS.
Information concerning your Points statement and your Rewards, such as the number and source of accumulated Points and their conversion into Rewards.
Where applicable, your bank account details (IBAN) for you to receive your rewards via bank transfer, and other official documents (proof of address, identity document) to certify your status and residence.

2.1.2 Your Participation in Surveys

In the context of your participation in surveys, the only information concerning you that we process, in our capacity as Data Controller, is:

Your Connection Data, such as IP address and logging data (logs) related to the surveys (date and time you responded to the Survey, etc.), and navigation data related to your interactions with the service.
Your meta-data (paradonnées), i.e., data relating to your behaviour when responding to surveys, such as the process followed to answer the survey, response time, equipment used, browser, and operating system.
Your identification and Member data (unique number) for the attribution of Points.
The survey identification number (generated ID, sometimes referred to as SPM ID) which is specifically assigned to you for the survey.

We do not collect any other Personal Data concerning you in our capacity as Data Controller as part of your responses to surveys.

The surveys to which we invite you to respond are the responsibility of our Research Partners (Partenaires Études). For information on the processing of your Personal Data by our Research Partners, we recommend you consult their privacy policy; if this information is not apparent, you may also contact us.

Our Research Partners aim to process your responses in an aggregated manner for statistical analysis purposes. Consequently, we do not transfer your surnames, email addresses, or telephone numbers to them. However, we may communicate your survey identification number (generated ID) along with the answers you provided, noting that this number does not allow the Research Partner to identify you.

Unless you explicitly agree within the survey, the Research Partner should not collect any Personal Data. From time to time, Research Partners may, at the time you respond to their surveys, collect your IP address (which may constitute Personal Data) or other Personal Data. In this case, we require our Research Partners to first obtain your consent and provide you with all required information relating to the processing of Personal Data they carry out (nature of personal information collected, purpose(s) of the processing, etc.). Research Partners are solely responsible for the processing they carry out.

To protect the confidentiality and integrity of our Research Partners’ projects, you must not disclose the information contained in the surveys.

2.1.3 Audience Analysis (DAS) and Database Enrichment

We may be required to process your Personal Data on behalf of our Research Partners, and therefore in our capacity as a Processor, for the purpose of audience analysis. The only Personal Data processed in this context originates from cookies and trackers deposited by the Research Partner, acting as the Data Controller.

a) These analyses make it possible to determine, in particular, whether you have been exposed to a given advertisement, and then to transmit a statistical and anonymous study to the Research Partner (no non-anonymised Personal Data is communicated). These analyses may also be used to evaluate the effectiveness of online advertisements, track website traffic, and measure the audience.
b) They are also used for the development of audience segments and/or look-alike models as part of marketing campaigns aimed at optimising advertisements and other content. The Research Partners then exploit the results of the analyses to develop similar audience segments and target these segments. In this case, the Research Partner only receives statistical Personal Data of a socio-demographic nature (e.g., gender, age, region, profession, income bracket, etc.).

2.1.4 Complaint Management, Fraud Prevention and Combating

We may be required to process your Personal Data as part of managing your complaints, and preventing and combating fraud. In this context, we process, in our capacity as Data Controller, the following Personal Data:

All information exchanged with customer service, which may include surname, first name, postal address, telephone number, and email, proof of address, identity documents, or IBAN in the case of a request for clarification.
Your meta-data (paradonnées), i.e., data relating to your behaviour when responding to surveys, such as the process followed to answer the survey, response time, equipment used, browser, and operating system.
Your identification and Member data.

2.2 Cookies

In the course of your browsing and use of the Website and the Application, we collect information which may constitute Personal Data using cookies and similar technologies. For more information on the cookies used on the Website and Application, we invite you to consult our cookie policy accessible on our site.

2.3 Consequences of Failure to Provide Your Personal Data

If you refuse or fail to provide us with the information concerning your Membership (for example, your email address, surname, first name, date of birth, postcode) you cannot become a Member. All Personal Data collected concerning your Membership is conditional on the conclusion of the Contract. Following Membership, the provision of Personal Data concerning you is of a contractual nature.

3. What are the Purposes and Legal Bases for the Collection and Processing of Your Personal Data, and for How Long is Your Data Retained?

We are required to process your Personal Data, in our capacity as Data Controller, for the purposes and for the durations described in the tables below.
We always process your Personal Data based on one of the following legal grounds: (i) the performance of pre-contractual measures or the Contract, (ii) our legitimate interest (subject to not infringing your interests or your fundamental rights and freedoms), (iii) your consent, or (iv) compliance with a legal obligation.

3.1 In the context of your Membership in the Programme, we process Personal Data concerning you in order to:

Purpose	Legal Basis	Retention Period in Active Database
Enable you to register for the Programme	Performance of pre-contractual measures	If you finalise your registration for the Programme, we retain your data: (i) for the duration of the Contract (i.e., as long as you are a Member), (ii) then for 12 months after the closure of your account, and in any event (iii) for a period not exceeding 36 months after your last activity (i.e., in case of absence of points acquisition), (collectively defined as the “Extended Contract Duration”). At the end of this period, your data is anonymised. However, if an anonymisation request is made via an application (iOS – Android), the anonymisation occurs within one month. If you do not finalise your registration for the Programme, we retain your data for 12 months.
Identify you and allow you to access your user account and use the Programme	Performance of the Contract	Your identification and authentication data (username, password, etc.) are retained for the Extended Contract Duration. Your Connection Data (IP address, logs of your connections to your user account, etc.) are retained for twelve (12) months.
Provide you with the Programme services	Performance of the Contract	For the Extended Contract Duration.
Inform you of Programme updates (e.g., modification or addition of new services)	Legitimate Interest	For the duration of the Contract, or until you exercise your right to object.
Create and analyse your profile and/or your use of the Website and the Application (to select you to answer surveys, product tests from Research Partners, and send you relevant invitations and information)	Performance of the Contract, or Consent concerning your sensitive data	Your responses to qualification questionnaires are retained for the duration of the Contract or, for your sensitive data, until you withdraw your consent. Data related to your use of the Website and the Application are retained for the duration of the Contract. Logs of your profile updates are retained for twelve (12) months.
Offer you the opportunity to participate in surveys and product tests from our Research Partners, according to your profile, on your user account and by email	Performance of the Contract	For the duration of the Contract, or for the duration of your membership in the Panels service (if you deactivate the Panels service in the “My Subscription” tab).
Manage your communication preferences to receive invitations by SMS and/or via mobile push notifications	Consent	For the duration of the Contract, or until you withdraw your consent.
Process your requests and complaints	Performance of the Contract	For the Extended Contract Duration.
Administer, manage, and attribute Points, including communicating a Points transaction statement to you	Performance of the Contract	For the Extended Contract Duration. Logs of your Points transactions are retained for twelve (12) months.
Manage and dispatch Rewards	Performance of the Contract	For the Extended Contract Duration.
Monitor your satisfaction (Optional Satisfaction Questionnaire)	Legitimate Interest	For the Extended Contract Duration.
Send you our newsletters and our information, promotions, and offers, whether personalised or not, for products and services analogous to those to which you have subscribed	Legitimate Interest	For the duration of the Contract, or until you exercise your right to object.
Allow you to participate in the referral programme	Performance of the Contract	For the duration of the Contract.
Comply with legal, regulatory, judicial, or administrative obligations, notably in the context of (i) managing our general accounting and our tax obligations, and (ii) managing the data protection rights of the data subjects	Legal Obligation	For the Extended Contract Duration. Except for exchanges within the scope of customer service, your identity document and/or proof of address, if requested from you when exercising your data protection rights, are retained for 12 months.
Establish anonymous statistical data	Legitimate Interest	For the duration of the Contract, or until you exercise your right to object. Anonymous statistical data no longer allow you to be identified, so they do not constitute Personal Data and can be retained indefinitely.
Ensure the safety and security of the Programme, the Website, and the Application	Legitimate Interest	12 months from verification.

Profiling enables us to limit the number of emails we send you to ensure a positive user experience. In accordance with the regulations, you have the right not to be subject to a decision based solely on automated processing, including profiling. Please consult Article 7, “How Can You Exercise Your Rights Over Your Personal Data?” below on this subject.

3.2 In the context of your participation in the Programme surveys, we use the Personal Data concerning you in order to:

Purpose	Legal Basis	Retention Period in Active Database
Attribute the Points linked to the survey you have responded to you	Performance of the Contract	Extended Contract Duration.
Analyse your meta-data as part of the fight against fraud	Legitimate Interest	For 12 months from the survey.
Record your survey responses, in our capacity as Processor	Performance of the Contract and/or Consent	When we programme the survey (Full Services), the responses are recorded with the survey identification number (generated ID). These surveys are not supposed to contain Personal Data; if they do, your consent is required. This data is retained at Bilendi for 3 months from the end of the survey (13 months for trackers) and at our sub-processor for 3 months (36 months for non-personal data).
Detect and prevent fraud, including establishing files of people suspected of fraud	Legitimate Interest	For 12 months.
Avoid data deletion and exclusion, notably, to prevent the same person from performing the same survey more than once	Legitimate Interest	For the duration of the Contract.

3.3 Data Adequacy and Retention

We only collect Personal Data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed. These purposes are specific and legitimate and, under no circumstances, will your Personal Data be subsequently processed in a manner incompatible with these purposes, unless we obtain your prior consent. Your Personal Data is retained only for the time necessary to achieve the purposes pursued when we collect it. The retention periods applied to the data are proportionate to the purposes for which they were collected. For complete information on the processing of your Personal Data by all our Partners, we recommend that you consult their privacy policies available on their websites.

4. Who Can Access Your Personal Data?

Personal Data concerning you may be transmitted to the following persons:

Bilendi personnel or personnel of its subsidiaries who require access to it.
Personnel of certain service providers or Processors (including the chartered accountant, statutory auditor, IT development company, technology service company such as hosting and maintenance, and companies providing and ensuring the delivery of Programme Rewards services).
Public or judicial authorities for the purpose of fulfilling a legal or regulatory obligation or a judicial decision.
Our Research Partners, but only in pseudonymised form. Any information concerning your identity or your profile is removed before any data communication to our Research Partners. This means we will assign an identifier to your profile to which your data will be attached, thus allowing us to invite you to targeted surveys. Consequently, our Research Partners will not be able to link the data to your Personal Data such as surname, first name, physical, and electronic addresses that you provided during your Membership because we do not transmit this data.
A purchaser or acquiring entity of our company, in the event of a merger, acquisition, or absorption, or in the event of a transfer of our company's assets.

5. Where is Your Personal Data Hosted, and is it Transferred Outside the European Union?

The servers hosting the Personal Data concerning you are located in the Île-de-France region (France).

In certain cases, we may use service providers who may be located outside the European Economic Area (EEA), such as Bilendi Services Limited established in Mauritius, which notably intervenes in the context of sending gifts and managing complaints. As such, transfers of Personal Data outside the European Economic Area are likely to be carried out.

These transfers of Personal Data are carried out in compliance with the applicable regulations:

Either by transferring your Personal Data to a recipient located in countries recognised by the European Commission as ensuring an adequate level of protection.
Or in third countries not recognised as ensuring an adequate level of protection. In this case, we implement appropriate safeguards to ensure the protection of your Personal Data as provided for by the GDPR, notably by concluding the Standard Contractual Clauses adopted by the European Commission with our service providers.

6. Security Measures

We implement all appropriate rules and procedures to secure the access and consultation of your Personal Data, and in particular to prevent them from being distorted, damaged, or accessed by unauthorised third parties. More generally, we implement appropriate technical and organisational measures to ensure that the processing of your Personal Data is carried out in accordance with the Data Protection Act and the GDPR.

As a market research company, we respect the good practices of this market, notably the strict data protection rules of ESOMAR (European Society for Opinion and Marketing Research), which are set out in the "ICC/ESOMAR International Code for Market and Opinion Research". Furthermore, the various companies of the BILENDI group are members of national market research federations in several countries. These federations strictly regulate the protection and use of your data.

7. How Can You Exercise Your Rights Over Your Personal Data?

7.1 General Provisions

In accordance with the Data Protection Act and the GDPR, you have various rights in relation to the processing of your Personal Data: a right of access, a right to rectification, a right to erasure and objection, a right to restriction of processing, a right to data portability, a right not to be subject to an automated individual decision (including profiling), a right to erasure, and the right to define directives relating to the fate of your data after your death.

If, despite all the care we take in protecting your Personal Data, you believe that your rights have not been respected, you have the right to lodge a complaint with the competent supervisory authority for any failure on our part to comply with the legislation and regulations in force (in France, the competent authority is the CNIL and its contact details are as follows: 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07, Tel: +33 1 53 73 22 22).

7.2 Exercise Modalities

Access your Personal Data
To exercise your right of access and view the Personal Data we process, you can do so by clicking on the dedicated link.

Rectify your Personal Data
When you registered for the Programme, you completed a registration form and may have completed a qualification questionnaire. You can modify your answers at any time in accordance with applicable laws and regulations.

Stop receiving our newsletters
If, at any time, you wish to stop receiving our newsletters or any other service, or that we cease contacting you altogether, you may:

Use the link provided for this purpose in each newsletter and advertising email you receive.
Modify your profile in the “My Account” section of our Website.
Send your request by email to: personaldata@bilendi.com, accompanied by your email address and postal address.
Send your request by post to the address indicated in Article 10 below by registered letter with acknowledgement of receipt, accompanied by your email address and postal address.

Withdraw your consent, object to processing, restrict processing, delete your Account, or exercise any other right over your Personal Data
If you wish to withdraw your consent to the processing of your Personal Data, object to processing, restrict processing, and/or delete your Account, this will result in the termination of your Contract in accordance with Article 12.1 of the General Terms and Conditions of Use.

To exercise these rights or any other right over your Personal Data, you may:

Go directly to the Website.
Send your request by email to: personaldata@bilendi.com, accompanied by your email address and postal address.
Send your request by post to the address indicated in Article 10 below by registered letter with acknowledgement of receipt, accompanied by your email address and postal address.

Should we have reasonable doubts concerning your identity, we may be required to request your email address, postal address, and/or a copy of your identity document or proof of address.

8. Contact Details of the Data Protection Officer

The contact details of our Data Protection Officer are as follows:

Name: HARLAY AVOCATS – 83 Boulevard Haussmann, 75008 Paris, France
Email address: personaldata@bilendi.com

9. Modification of Our Privacy Policy

Our Website and Application are constantly improving and evolving. We may occasionally modify the Privacy Policy, notably to comply with any regulatory, judicial, editorial, or technical changes. In such a case, we will inform you of this modification by any means, the date at the top of the document will be updated, and we will seek your agreement according to the conditions provided in our General Terms and Conditions of Use.

10. Further Questions?

We aim for the utmost clarity regarding the confidentiality of your Personal Data. Should you still have questions, please do not hesitate to contact us:

Via our contact form.
By email at: personaldata@bilendi.com
By post to: Bilendi France SAS, 4 rue de Ventadour, 75001 Paris, France