1. INTRODUCTION

SPHINX Engineery, whose registered office is located at 363 Avenue de l'Armée des Alpes, 84260 Sarrians, France (hereinafter referred to as "the Company" or "We"), acting as an independent Data Controller, invites you to read the terms and conditions governing the processing of your personal data via this website (hereinafter referred to as the "Site") and the use of associated services (hereinafter referred to as the "Services"). These terms and conditions comply with applicable laws and regulations on the protection of personal data, in particular: (1) Law No. 78-17 of January 6, 1978, as amended, relating to information technology, files and freedoms, and Law No. 2018-493 of June 20, 2018 relating to the protection of personal data; (2) Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (General Data Protection Regulation, hereinafter "GDPR"), in force since May 25, 2018 ; and (3) any other regulation, decree, normative act, or provision issued by a national or European authority competent in matters of personal data protection, applying to the processing carried out by SPHINX Engineery, collectively referred to as the "Applicable Personal Data Protection Regulations".

Services may include, but are not limited to, estimating potential savings, providing telephone support to assess your needs, or assessing your photovoltaic electricity requirements, in the context of the installation of solar photovoltaic systems with or without storage, heat pumps, solar thermal/mixed systems or thermodynamic water heaters. In addition, the Services may also cover the sending of guides and information concerning the installation of solar photovoltaic systems, heat pumps or thermodynamic water heaters. Finally, the Services may also cover a referral program offered by SPHINX Engineery.

2. SCOPE OF CURRENT POLICY

The Company is responsible for processing personal data, i.e. any information relating to an identified or identifiable person, referred to as a "Data Subject", when you use the Site and the Services, in accordance with the terms set out in this Personal Data Protection Policy, hereinafter referred to as the "Personal Data Policy".

This Privacy Policy, together with the Cookies Policy available here, applies to all users, including those who access the Site and use the Services without being registered or subscribed to a specific service. Such users are collectively referred to as "Users".

3. TYPES OF PERSONAL DATA COLLECTED

The Company collects data in two ways: (1) data that you voluntarily choose to share with the Company and (2) navigation data related to your use of the Site and the Services. More specifically, the Company collects the following information:

1. Data you voluntarily share with the Company: When you submit a request via the online form on the Site or use our Services, the Company may collect personal data such as your first name, last name, title, address, postal code, city, state, telephone number and other relevant information.

2. Hotline service for your solar project - Energy: When you explore the hotline service for your solar project or energy production and saving via the Site, the Company may collect information such as your ownership status, the characteristics of your residence (roof and house surface, construction material, heating method, etc.), data on your electricity consumption, and other details relating to your home. If you enter into a contract with SPHINX Engineery and give your consent, audiovisual recordings (photos, videos, sound recordings) may also be made concerning you or your home, in strict compliance with the purposes defined in Article 4 of the Policy.

3. Sponsorship program: For the sponsorship program, SPHINX Engineery processes the following personal data: technical data relating to connections to the account of the beneficiary of the sponsorship program (IP address, type of terminal, browser used, connection logs, etc.), beneficiary identification information (surname, first name, e-mail address, telephone number, postal address, etc.), data supplied by beneficiaries when creating and editing their account, unique card number, etc.). ), beneficiary identification information (surname, first name, e-mail address, telephone number, postal address, etc.), data provided by beneficiaries when creating and editing their account, unique multi-brand card number (on request), data relating to the consumption of beneficiaries of the sponsorship program (volume, reason for subsidies, place and time of purchase, etc.).

4. Navigation data: When you access the Site or use the Services, the Company may collect information about your visit. For example, information about your computer, device and browser, including IP address, browser type, and other software or hardware information. If you access the Site or Services via a mobile device, the Company may also collect the device's unique identifier, geolocation data, and other identifiers associated with that device. In addition, information may be collected through the use of cookies and other tracking technologies, including browser cookies, retargeting cookies, audience measurement tools, web beacons, Adobe Flash technologies, and so on. These technologies may be used to collect and store information about your use of the Site and Services, such as pages viewed, online content viewed, searches performed, and advertisements seen. For more information, please consult our Cookie Policy available here.

In addition, SPHINX Engineery may also collect personal data about you indirectly, by obtaining information such as year of construction, type of roof, roof surface, building area, number of floors, height of house and floors, presence of a garden, photovoltaic panels or swimming pool from publicly accessible or paid sources.

In addition, please note that the Services may be linked to websites operated by third-party companies unrelated to SPHINX Engineery. These sites may contain advertising, online content, features, games, newsletters, contests, sweepstakes or applications developed by third-party companies. The Company is not responsible for the privacy practices of such third-party companies. Once you leave our Services or click on an advertisement, it is your responsibility to consult the personal data protection policy applicable to that third-party service.

4. PURPOSE OF (PERSONAL) DATA COLLECTED

We process personal data for the following purposes:

a) To provide access to and use of the Site and Services (including telephone support Services in connection with your solar project, in accordance with SPHINX Engineery's Terms and Conditions of Use).

b) To evaluate and improve our Services and related functionality.

c) To improve your experience of using the Site and Services..

d) To provide customer service and respond to your inquiries..

e) To protect our legitimate interests ; in some cases, we may disclose your personal data when we believe in good faith that such processing is necessary to (1) protect, exercise, or defend the rights, privacy, safety, property of the Company, its employees, agents and contractors (including the performance of our contracts and terms and conditions of use); (2) protect the safety, privacy and security of users of the Site, the Services or the public; (3) protect us against fraud or for the purpose of risk management.

f) To comply with our legal obligations, including those relating to the provision of Services and consumer information, and to respond to requests from public and governmental authorities.

g) To monitor your activities on the Site (subject to your prior consent) in order to offer you content corresponding to your areas of interest.

h) To carry out commercial prospecting operations by electronic means (e-mail and SMS) (subject to your prior consent), in accordance with your personal preferences and choices.

i) To send you our newsletters by electronic means (e-mail and/or SMS) (subject to your prior consent).

j) To record our telephone exchanges as part of our telephone assistance service for the purposes of training our staff (subject to your prior consent).

k) To ensure the follow-up of the commercial relationship when you have decided to benefit from our Helpline in the context of your solar project (including the enrichment of the customer and prospect database, the management of the execution of contracts, the management of after-sales service, satisfaction surveys, etc.).

l) To produce audiovisual reports where you have entered into a contract with SPHINX Engineery (subject to your prior consent).

m) With regard to the sponsorship program,personal data is processed by SPHINX Engineery for the following purposes: creation and management of sponsorship program beneficiaries' accounts, including management of requests for assistance and complaints related to their account, management of subsidy purchases and consumption, edition and delivery of multi-brand cards for sponsorship program beneficiaries who request them, sending of notifications and monitoring of consumption.

5. THE LEGAL BASIS FOR PROCESSING YOUR DATA

The purpose of the processing presented in section 4(a), 4(j) and 4(l) of this Personal Data Policy is based on the performance of the contract relating to the Services once you confirm your request to benefit from them.

The purpose of the processing presented in section 4(b) of this Personal Data Policy is based on the legitimate interest of the Data Controller for the purpose of operating the Site and improving the Services. However, please note that, with regard to certain cookies that may be used, processing is based on the consent of the Data Subjects. In addition, if you log in to a personal account or customer area on the Site as part of a service contract with the Company, the processing of data from this personal account is based on the contract between you and the Company.

The purpose of the processing presented in section 4(d) of this Personal Data Policy is based on your request for customer support or information.

The purpose of processing presented in section 4(f) of this Personal Data Policy is based on current legal and regulatory obligations.

The purposes of processing presented in sections 4(c), 4(g), 4(h), 4(i), 4(k) of this Personal Data Policy are carried out on the basis of your consent when requested.

6. HOW LONG WE KEEP YOUR DATA

The Company retains your personal data for as long as is necessary to achieve the purposes set out in section 4 of this Personal Data Policy. Your personal data is stored as follows:

• For the time strictly necessary to use the Site and Services in the absence of an order for Services from you.

• As part of our telephone assistance services, telephone recordings are kept for 3 months.

• In the event of the conclusion of a contract or an order within the framework of the Services or otherwise, the data is kept for the entire period of the contractual relationship and for a maximum of 5 years from the end of the contract. In addition, they are archived for a period corresponding to any warranty period, plus the applicable legal statute of limitations (5 years in most cases).

• If the Company is required to fulfil a legal obligation, your data will be processed for the time necessary to fulfil this obligation in accordance with the law.

• Until your consent is withdrawn, if processing is based on your prior consent.

• In the case of audiovisual reports in which you have agreed to participate, your data will be processed for a maximum of 5 years.

• Personal information and data collected via cookies is stored for a maximum of 13 months from the date of installation or creation of the cookie. In addition, your choice, consent and/or refusal concerning cookies are kept for a period of 6 months (after this period, we will ask you again to choose how you wish to manage your cookies on our Site). For more information, please consult our Cookie Policy available here.

7. YOUR DATA WILL BE PROCESSED AS FOLLOWS

Data is processed both manually and electronically, and is protected by appropriate security measures. The Company implements appropriate administrative, technical and organizational measures to protect personal data against theft, loss, unauthorized use, disclosure or modification. However, it is important to note that despite these security measures, it is impossible to guarantee total protection against all potential IT risks.

8. CONDITIONS OF ACCESS TO YOUR DATA

For the purposes set out in section 4 of this Privacy Policy, your personal data will be communicated internally within SPHINX Engineery, to the relevant departments, such as Customer Service, Marketing/Commerce and Communications, depending on the purpose.

The Company may also communicate your personal data to the following recipients:

• Other SPHINX Group entities, as appropriate.

• Third-party service providers, subcontractors, including IT service providers, service providers related to the Services (e.g. experts, consultants, lawyers, companies involved in potential mergers, demergers or other transformations), as well as SPHINX Engineery's business partners.

• Competent national authorities, in order to comply with applicable law and also to respond to any request or requirement of an administrative or judicial authority, in particular in the context of possible inspections or litigation.

9. ARE YOUR PERSONAL DATA TRANSMITTED ABROAD?

Your personal data may be transferred to other SPHINX Group entities and to service providers acting on its behalf who are located in France and/or within the European Union.

It is also possible that your personal data may be transferred outside the European Union. In this case, appropriate measures are put in place to guarantee a level of protection equivalent to that provided by the applicable regulations on the protection of personal data. This may include standard contractual clauses or other data protection mechanisms that comply with applicable legal requirements.

10. MINORS UNDER 15 YEARS OF AGE 

The Site is not intended for individuals under the age of 15, and the Company does not knowingly collect personal data from individuals under the age of 15 or from minors in general.

11. SAFETY MEASURES

SPHINX Engineery implements all appropriate technical and organizational security measures to ensure a level of personal data security appropriate to the risks. This includes measures to protect data against accidental or unlawful destruction, loss, damage, disclosure or unauthorized access.

The company contractually imposes the same level of data protection on all its subcontractors. In addition, any SPHINX Engineery employee who, in the course of his or her duties, may have access to your personal data, undertakes to treat it in accordance with the purposes for which it was collected and in a strictly confidential manner.

12. YOUR RIGHTS WITH REGARD TO PERSONAL DATA

In accordance with applicable regulations on the protection of personal data, you have the following rights:

• The right to access your personal data.

• The right to rectify any inaccuracies.

• The right to request their deletion.

• The right to data portability.

• The right to limit the processing of your data.

• The right to object to the processing of your data.

• The right to give us instructions concerning the fate of your data after your death.

• The right to withdraw your consent where processing is based on your consent.

You can exercise these rights by sending an e-mail to the following address: data-protection@sphinx-engineery.com.

However, please note that in certain situations, a request to erase your data, a request to object to processing or the revocation of your consent may affect your ability to provide information, register with or use the Site, or to perform the Services offered on the Site or ordered by you.

You also have the right to lodge a complaint with the competent national supervisory authority, such as the Commission Nationale de l'Informatique et des Libertés (CNIL), in the event of a breach of the applicable regulations on the protection of personal data, in particular the European General Data Protection Regulation n°2016-679 (RGPD) in force since May 25, 2018.

13. CHANGES AND UPDATES

The Personal Data Policy will be in force from the effective date indicated in the introduction. The Company reserves the right to modify or supplement this document, in particular in the event of changes in applicable regulations concerning the protection of personal data.

Any changes to this Privacy Policy will be posted on our Site as soon as they are published.

14. DATA PROTECTION OFFICER

SPHINX Engineery has appointed a DPO ( Data Protection Officer - DPO) whom you may contact for any questions relating to the processing of your personal data and to exercise your rights.

DPO contact details:

By email:
data-protection@sphinx-engineery.com

By post:
Data Protection Officer
363 Avenue de l'Armée des Alpes
84260 Sarrians
France