OranoBox platform data privacy notice

 

This notice has been addressed to you as someone whose personal data is processed by the Orano Group.

It explains why the Orano Group (the data controller) needs to collect your data, how your data will be used and protected, how long your data will be kept for, and what your rights are.

 

1/ Purpose(s) of the processing and legal basis

Orano and its Marketing and Sales Support Department have decided to set up a mobile and web platform (OranoBox) for Orano’s employees and the employees of its clients, partners, and certain professional or regulatory organizations. The purposes of this are as follows:

  • To manage access to the platform by Orano’s Group employees and the authorized employees of its client companies, partners, and certain professional or regulatory organizations;
  • To prepare and manage solution datasheets and the associated documentation, and to allow access to information for authorized Orano Group employees;
  • To enable sales representatives to contact the Orano Group if a client has a technical query or a sales enquiry;
  • To provide materials and waste management support for companies that have signed up for this service with the Orano Group;
  • To analyze anonymized user feedback to establish whether users have been able to find the information they need, and to enhance and further develop the platform, keywords, interface, and user’s experience;
  • To select and monitor updates to specific datasheets by authorized employees of its client companies, partners, and certain professional or regulatory user organizations.

The legal basis for processing

the data is:

  • The Orano Group’s legitimate interest in the accessibility of the platform for the employees concerned;
  • Contractual fulfillment regarding access to the application and its features for employees of user companies and organizations;
  • Consent for the user feedback analysis.
  • 2/ Data collected

The application uses the following data:

  • For Orano Group employees: surname; first name; username (work email); password; and optionally, if the employee chooses to provide it, country and department.
  • For employees of companies and organizations that use the OranoBox application: surname; first name; company; department or job title (optional); country (optional); email; password.
  • For all users (if consent is obtained): details of browsing history (i.e. pages visited, number of pages viewed, time spent, browser used, etc.).
  • The phone number will also be requested (optional) from users asking questions or requesting additional information in support requests.

The personal data are collected:

  • Directly from the data subject for Orano Group employees.
  • Directly from the data subject for employees of companies and organizations using the OranoBox application.

 

2 – Recipient(s) of the data

The personal data collected by the Orano Group is intended solely for internal use. It will not be communicated, transferred or disclosed to unauthorized third parties without the express written permission of the data subject, unless required by law or court order.

In the event of a question being submitted via the platform, the personal data and contact details of the company employee and/or employee of the OranoBox user organization will be sent directly to the relevant Orano Group sales and technical representatives so that they can get in touch. OranoBox does not share its representatives’ details directly with the companies and organizations that use the platform.

Users’ data may also be accessed by employees of the company in charge of maintaining and developing the application.

 

3 – Data hosting

The personal data collected by the Orano Group are hosted in France by the Orano Group and are not transferred outside the European Union.

 

4/ Personal data and applicable legal framework

The Orano Group complies with the applicable legislation, and specifically the following personal data protection laws:

  • French Data Protection Act No. 78-17 of January 6, 1978, as amended by Act No. 2004-801 of August 6, 2004, and Act No. 2018-493 of June 20, 2018 on the protection of personal data;
  • The “Lemaire” law for a digital republic of October 7, 2016;
  • GDPR: Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, applicable since May 25, 2018.

The Orano Group has appointed a Data Protection Officer (Hélène LEGRAS - DPO@orano.group). The DPO ensures that the Orano Group processes personal data in accordance with applicable regulations. This processing is recorded by the Orano Group DPO in its register of data processing activities.

5/ Employee rights

You have rights in relation to the collection and processing of your personal data:

  • Right to access and query your data;
  • Right to rectification if your data is inaccurate, incomplete or incorrect;
  • Right to withdraw consent if the processing is based on this (which you may exercise at any time and which does not affect the legality of the processing previously carried out)
  • Right to erasure/to be forgotten (except in certain conditions, such as where a legal obligation exists);
  • Right to object, provided it is legitimate;
  • Right to restrict processing;
  • Right to data portability;
  • Right to make advance directives on what will happen to your personal data if you die.

These rights can be exercised with the Orano Group DPO subject to proof of identity. In case of doubt about your identity (e.g. suspected identity theft, account hacking, etc.), you may be asked for a copy of an identity document. You can contact the DPO:

  • either by email at the following address: DPO@orano.group
  • Or by phone on+33 (0) 1 34 96 07 28

 

6/ Period of retention of personal data

In accordance with Regulation (EU) 2016/679 of April 27, 2016 (General Data Protection Regulation – GDPR) and the “Lemaire” law No. 2016-1321 for a digital republic of October 7, 2016, you are informed that your personal data will not be kept for longer than is necessary for the purposes for which the data are processed.

The personal data of Orano Group employees will be kept for the duration of their employment contract. The data will be deleted at the latest one year after the end of the employment contract, except for solution datasheets and presentations completed/created by Orano Group sales and technical representatives.

The personal data of employees of OranoBox user companies and organizations will be retained for a period of three years from the last login to the OranoBox platform or from the user’s request to delete the account.

At the end of the retention period, the data will be deleted from the systems by Altitude and will form the subject of a destruction report for the Orano Group DPO.



7/ OranoBox cookie policy

In accordance with the recommendations of the French Data Protection Authority (CNIL), when you first log on to the OranoBox site, you will be expressly asked to accept cookies from the site.

This consent is valid for a maximum of 13 months in accordance with CNIL Resolution No. 2019-093 of July 4, 2019.

By clicking on “I accept”, you authorize the Orano Group (the data controller) to collect information known as “cookies” from your device. We use this information to measure the audience and usage of OranoBox and to improve the user experience.

 

The data we collect may include information about your device, and in particular your IP address or device ID (PC, tablet or smartphone), location (country, region or city), and browsing history (webpages visited, number of pages viewed, time spent, browser used, etc.).

 

These data are not shared with third parties outside the Orano Group, except for subcontractors in charge of maintaining the application, and are stored within the European Economic Area.