Privacy policy

Pleyce provides rental, pay-per-use and purchase solutions for hot and cold beverage vending machines, as well as the rental and sale of mains-fed water dispensers. As part of these activities, Pleyce collects and processes personal data on its own behalf and on behalf of its customers and business partners.

Pleyce is strongly committed to ensuring that its systems and practices comply with the provisions of the European General Data Protection Regulation (GDPR).

The purpose of this Privacy Policy is to describe the principles implemented by Pleyce to comply with the GDPR and protect the privacy of individuals whose personal data is processed.

It also sets out the general framework governing the processing of personal data within Pleyce and aims to provide data subjects with the information required under applicable legislation.

1. How is personal data collected?

As part of its activities, Pleyce collects data, some of which may identify or make it possible to identify individuals.

1.1. Legal basis for collecting personal data

Applicable legislation sets out the lawful bases on which personal data may be collected and processed. These lawful bases are specified and/or referred to when Pleyce collects personal data.

Pleyce may process personal data on the following grounds:

Consent of the data subject: in France, the CNIL recognises two exceptions to the requirement for prior consent in relation to electronic marketing, as detailed in its guidance on electronic marketing.
Business-to-business communications: prior consent is not required for commercial communications sent to a professional email address where the communication relates to the recipient’s professional activity. This is commonly referred to as the “B2B exception”. As Pleyce’s activities are primarily business-to-business, data may therefore be collected and used following appropriate prior information.
Similar products or services: prior consent is not required for marketing communications sent to an existing customer concerning products or services similar to those they have previously purchased from the same organisation, subject to applicable legal requirements.
Performance of a contract: the collection of personal data relating to our customers and users may be necessary to perform a contract, for example a subscription or registration for a free or paid online service, and to provide the service or product requested by the data subject. In such circumstances, consent is not required where the processing is necessary for the performance of the contract.
Legitimate interests¹ of the data controller: in certain circumstances, the nature of the services provided by Pleyce requires the collection of personal data relating to customers and users and the sharing of this information with other individuals within the company. Such processing may be based on Pleyce’s legitimate interests where it falls within the reasonable expectations of the data subject in light of the service provided. Pleyce regularly assesses whether its legitimate interests are overridden by the interests, fundamental rights or freedoms of the data subject.
Compliance with a legal obligation: certain regulatory requirements may make the processing or transfer of data mandatory, for example in relation to invoicing for products or services or attendance records for training activities.

1.2. Methods of collection

1.2.1. Collection through forms

Accessing, using, downloading, purchasing or subscribing to certain services or products may require the collection of personal data relating to a prospect, customer or user.

When completing paper or electronic forms, individuals may therefore provide information about themselves. These forms systematically specify:

the identity of the data controller;
the purposes for which the data is collected;
whether the collection is necessary to subscribe to the relevant service or purchase the relevant product;
any other intended uses of the data and the lawful basis for the processing;
a reference to the relevant sections of this Privacy Policy concerning the exercise of data protection rights, DPO contact details, data retention periods and the procedure for lodging a complaint with the relevant supervisory authority.

1.2.2. Collection through cookies

The term “cookies” is used broadly in this Policy and includes trackers that may be stored and/or accessed, for example, when visiting a website, reading an email, or installing or using software or a mobile application.

File-based cookies may be stored on a user’s device while browsing. Their purposes may include making websites easier to use, for example through automatic authentication or personalisation of certain information, or personalising advertising displayed to users.

Some cookies are placed directly by Pleyce when users browse one of its websites. Users may manage or object to the use of these cookies through their browser settings, although doing so may affect access to certain products, content or services that require cookies to function.

Other cookies may be placed by third-party companies to collect browsing data as users navigate different websites. Pleyce works with some of these companies. For further information, users are invited to consult the privacy policies of the relevant companies and our GDPR register, including:

Google Analytics
Google Ads
Companeo
Facebook
LinkedIn
Bing
and others.

In accordance with applicable legislation, before placing or accessing a cookie on a user’s device, where required Pleyce:

informs users of the purposes for which the cookies are used;
obtains their consent where consent is required;
informs users how they can refuse or manage cookies.

Cookies and trackers that are strictly necessary to provide a service expressly requested by the user do not require prior consent. Examples may include:

shopping basket cookies for e-commerce websites;
session identifier cookies for the duration of a session, or in certain circumstances persistent cookies with a lifespan limited to a few hours;
authentication cookies;
session cookies created by multimedia players;
load-balancing session cookies;
certain audience measurement analytics solutions;
persistent cookies used to personalise the user interface, such as language or display preferences.

Other cookies require prior information and, where applicable, consent. These may include:

cookies used for advertising purposes;
social media cookies generated by social sharing buttons where they collect personal data;
certain audience measurement cookies.

In accordance with CNIL recommendations, consent may be collected through a clearly visible banner on the website containing information about:

the specific purposes of the cookies used;
the ability to refuse cookies and change cookie settings through a dedicated link;
the applicable conditions governing the placement of cookies on the user’s device.

Where a user shares a device with other people, they should ensure that cookie settings are appropriate for their use of that device.

1.2.3. Collection by telephone

Pleyce provides certain services by telephone and may collect personal data during these conversations.

Where possible, telephone communications may be confirmed by email, allowing the data subject to retain a written record of the conversation and exercise their rights at any time.

1.2.4. Indirect collection

Pleyce may obtain personal data from third parties where necessary. In such circumstances, Pleyce:

enters into an appropriate agreement with the third party in accordance with applicable data protection legislation;
informs individuals of the transfer of their data in accordance with applicable legislation;
records the source of the data in its systems to ensure traceability;
informs data subjects how they can exercise their rights.

2. What types of information are collected?

Some of the information collected constitutes personal data, meaning information relating to an identified or identifiable individual.

In accordance with applicable legislation, Pleyce applies the principle of data minimisation and only collects personal data that is necessary for the stated purpose, while ensuring that data subjects can exercise their rights.

Depending on the nature of the products or services provided, the personal data collected may include:

Primarily:

your name and contact details, including your email and postal addresses;
your job title or professional role;
your telephone and fax numbers.

Where relevant to specific products or services:

information about coffee equipment and water dispensers used within your business;
information relating to your professional background, such as your CV, professional training and qualifications;
location data;
connection and browsing data, including IP addresses and logs;
other information necessary for the relevant service.

3. How is the information collected used?

3.1. Use of collected data

Pleyce may use personal data in its possession to:

send commercial information relating to its products, promotions and offers, as well as other information concerning products or services that may be relevant to the interests of the data subject.

Personal data may be used by Pleyce to promote and market its own products and services and for sales prospecting purposes, strictly within the limits permitted by applicable legislation.

3.2. How information may be sent

Depending on the contact details collected, Pleyce may communicate information through:

electronic messages, including SMS, MMS, notifications, emails and other forms of electronic communication;
social media;
telephone;
post;
online advertising banners;
internet search engines;
newsletters.

3.3. Purposes of collection

The purpose for which personal data is collected is stated when the information is collected directly by Pleyce and, where appropriate, communicated when data collected by a third party is transferred to Pleyce.

Pleyce may process personal data for purposes including:

registering individuals on its websites and/or information systems and managing the delivery and invoicing of products and services provided by Pleyce, including responding to enquiries and requests for information concerning Pleyce, its products or services;
Example: processing an order or registration.
fulfilling its obligations under a contract with the data subject and managing that contractual relationship;
Example: managing user login credentials for software or access badges for an event.
complying with applicable legal obligations;
Example: maintaining attendance records for a training session.
monitoring, reviewing and improving its products and services;
analysing connection and browsing data to understand browsing behaviour and/or tailor content based on identified interests;
maintaining records for internal administrative purposes, including customer complaints and customer relationship management;
carrying out commercial prospecting on its own behalf or, where applicable, on behalf of its business partners and advertisers, subject to the conditions described above;
managing participation in competitions, prize draws or promotional activities.

4. How and for how long is personal data stored?

Data contained in Pleyce databases is processed in accordance with strict controls, appropriate technical standards and the recommendations of the competent supervisory authority.

4.1. Storage and security of personal data

Pleyce takes appropriate precautions to protect the security and confidentiality of personal data and, in particular, to prevent it from being altered, damaged or accessed by unauthorised third parties.

Recommendations issued by the French Data Protection Authority (CNIL) are taken into account as part of Pleyce’s information security practices.

4.2. Data retention and archiving

Retention periods depend on the activity concerned, the nature of the relationship with the individual, for example whether they are a customer or prospect, and applicable industry practices.

Pleyce retains certain mandatory documents, such as invoices, for the statutory retention period.
Unless another retention period applies, the default retention period for personal data within Pleyce is six years.
Certain categories of data are retained for shorter periods:
- cookies expire thirteen months after their most recent update;
- prospect data is deleted after three years where the prospect has not responded to any communications;
- candidate CVs are retained for two years.
In some cases, the retention period depends on the relevance or necessity of the processing. Customer data may, for example, be retained for the duration of the commercial relationship.

5. Which third parties have access to the personal data collected?

5.1. Working with third parties

Where personal data is transferred to a third party for any reason, for example in connection with outsourced services or services performed for a customer, Pleyce applies the requirements of applicable legislation, including informing data subjects of the transfer where required.

Pleyce ensures that appropriate contractual provisions are in place between Pleyce and the relevant third party to ensure that the third party:

uses personal data only for the specified purposes and in accordance with the purposes set out in this Privacy Policy;
implements appropriate security measures to prevent unauthorised or unlawful processing of personal data and accidental loss, destruction or damage.

6. Who can you contact for more information?

Pleyce has adapted its organisation to comply with the requirements of the GDPR and to provide individuals with information about the personal data collected about them and how that data is processed.

6.1. Exercising your rights of access, objection, rectification and erasure

Requests relating to the exercise of your data protection rights should be sent to contact@pleyce.com.

Please provide sufficient information for us to identify the relevant data and process your request. For example, you should specify the email address concerned by your request where applicable.

6.2. Exercising your right to erasure

Requests concerning the erasure of personal data should be sent to contact@pleyce.com and should specify the reason for the request where required.

Once Pleyce has processed a request to erase personal data, any request to remove or de-index an article from an internet search engine must be submitted directly to the relevant search engine by the data subject.

6.3. Data portability

Requests relating to data portability should be sent to Pleyce’s DPO, who will assess and respond to the request in accordance with applicable data protection legislation.

6.4. Data Protection Officer (DPO) and supervisory authority

Pleyce has appointed a Data Protection Officer, who can be contacted at contact@pleyce.com with any questions or concerns relating to the processing of personal data.

Individuals may also contact the Commission Nationale de l’Informatique et des Libertés (CNIL), the French Data Protection Authority.

7. Is personal data transferred outside the EU?

Where Pleyce transfers personal data to a third-party company located outside the European Union, appropriate measures are taken to ensure that the data receives a level of protection consistent with applicable EU data protection requirements.

Where applicable, Pleyce ensures that processing is carried out in accordance with this Privacy Policy and is subject to appropriate safeguards, including the European Commission’s Standard Contractual Clauses, where required, to protect the privacy and fundamental rights of individuals.

8. Are there any specific forms of processing?

Pleyce may combine information relating to businesses with information provided by individuals, under the conditions and for the purposes set out in this Privacy Policy.

Profiling methods used by Pleyce may involve manual or automated matching between company databases and contact databases containing information such as names, job titles and email addresses, based on objective criteria such as company size, business sector and equipment used.

9. Recruitment

As part of its recruitment activities, Pleyce collects and stores personal data relating to potential candidates.

Pleyce collects the information necessary to identify candidates whose profiles are best suited to available positions, in accordance with applicable legislation and the rights and freedoms of individuals.

Pleyce will not provide a candidate’s CV and contact details to a third party without the candidate’s consent.

Candidates who wish to amend or delete their personal data from our databases may contact contact@pleyce.com at any time, using “Personal Data” as the subject of the email.

Candidates are responsible for ensuring that any individuals provided as references have agreed to being contacted by Pleyce.

10. How will you be informed of updates to this Privacy Policy?

Pleyce may amend or update this Privacy Policy from time to time.

Updates will be published in appropriate locations so that users can identify when the Policy was last updated.

Significant changes may also be announced on the Pleyce website at www.pleyce.com, no later than when those changes take effect.

ANNEX 1: Browser settings

Changing your browser settings may affect your ability to access content and services that require cookies.

If your browser is configured to reject all cookies, access to some or all of the website may be restricted.

To manage cookies according to your preferences, you can adjust the relevant settings in your browser.

Internet Explorer

In Internet Explorer, click Tools, then Internet Options.
Under the General tab, go to Browsing History and click Settings.
Click View Files.

Firefox

Open the browser’s Tools menu and select Options.
Select Privacy and choose the option to view cookies.

Safari

In your browser, select Preferences from the relevant menu.
Open the privacy or security settings to view and manage cookies.

Google Chrome

Open the browser menu and select Settings.
Go to the privacy settings to view and manage cookies.

¹ Recital 47 of Regulation (EU) 2016/679: the legitimate interests of a controller may provide a legal basis for processing unless those interests are overridden by the interests or fundamental rights and freedoms of the data subject, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller. Such a legitimate interest may exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.

² Recital 48 of Regulation (EU) 2016/679: controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group for internal administrative purposes, including the processing of personal data relating to customers or employees.