Your personal data

At CNR, your private life is a priority

To ensure as much transparency as possible for you, this policy to protect personal data describes how the Compagnie Nationale du Rhône (“CNR”, “we”, “our”) uses your personal data collected from this site.

This policy gives you more information on:

• Who we are
• The data we collect
• The data sent by third parties
• How we use your data
• The recipients of your data
• The transfer of your data
• How we conserve your data
• Your rights
• Who you can contact

Our personal data protection policy

The processing of the personal data collected on this site is done by CNR, a joint stock company with a paid-up capital of €5,488,164, registered on the Trade and Companies Registry of Lyon under number 957 520 901, whose head office is located at 4 rue André Bonin 69004 Lyon – France.

What is personal data exactly?

They are data that can be used to identify you directly or indirectly.

The data we can collect from you directly are the following:

• Contact data (for sites with forms): name, first name, email address, telephone number.
• Contents (for sites providing the possibility of leaving a message): contributions, messages, questions, etc.
• Statistics and use data: your interaction with our website and our services, the pages and links consulted, information on the system configuration, the functions used and the queries submitted, and connection and timing data associated with the use of services,
• Information related to marketing and communication: Preferences regarding the newsletter, including any opposition that you may have expressed.
• Data resulting from your interaction with us: Technical information. Information linked to the device or browser that you use to access our website and services.

Some of the data listed above are mandatory to benefit from our services, and without which it will not be possible to access them. Mandatory data are indicated by an asterisk on our website. All the other data are optional.

Data obtained from third parties or from other sites

In addition to the personal data we obtain from you, we may obtain, in accordance with applicable law, certain personal data when you interact with:

• Us ;
• Our content via online advertisements;
• Social networks.

We receive information from your interaction with such advertising or content.

For example:

• Information you have agreed to share;
• Basic profile information;
• Content viewed
• Information about the advertisements you were shown or clicked on.

By interacting with our advertisements and social networks, you consent to our use of data from these networks in accordance with this privacy policy. To learn more about how your information from a third-party social network is obtained by CNR, or to opt-out of the sharing of such information, we invite you to visit the site of the relevant third-party social network.

Your data are essential for our services and your experience

We process your personal data for the following purposes:

Your data are in good hands

Your personal data are sent to each of the following people, services and organisations concerned by them:

• to persons authorised in CNR’s services: sales, accounting, marketing and information technology;
• to the companies of the CNR group (subsidiaries; shareholders)
• to service providers and subcontractors assigned by CNR to assist in the management of:
  – the website (hosting, maintenance, video integration);
  – its sales activities (emailing);
  – its day-to-day activities (consulting).
• to the purchaser of our company or its assets in the event of a purchase or in the case of a change of control.
• Your personal data can be disclosed to a third party if CNR is obliged by a law or a regulatory provision, a judicial order or if said disclosure is required in the framework of an investigation or procedure (judicial or administrative) in France or abroad, or necessary to recover unpaid invoices, investigate, prevent, or take measures regarding illegal activities or presumed frauds.

In accordance with Article 32 of the RGPD, CNR undertakes to:

• Implement appropriate technical and organizational measures in order to guarantee the security of your data (e.g.: Access under clearance, encryption of data/files, pseudonymization/anonymization, ensure proper backup of data…) ;

Impose the same level of security requirements on its subcontracting chain.

Protection in all countries

In the course of its business, CNR may use service providers, resources or servers located throughout the world, including the United States (or other countries).

Your personal data may therefore be transferred to countries outside the European Economic Area (EEA), where the level of data protection may not be considered adequate by the European Commission.

In such cases, your data is adequately protected by a transfer impact analysis, standard contractual clauses approved by the European Commission, or any other mechanism recognized by the applicable legislation. A copy of the transfer mechanism can be provided on request.

We never conserve your data for longer than necessary

The data collected via contact forms are archived for purposes of proof for 2 years counting from the processing of the demand.

The personal data used for sending the newsletter are kept for 3 years counting from their collection or from the last contact with you unless you object to such conservation.

Contributions to public surveys are conserved for as long as you do not make the request to delete your contribution or when such a decision has become definitive (exempt from any recourse).

Contributions to guest books are placed online until the request to delete them is made.

To know more about durations of conservation of the data stored via cookies, we invite you to consult our cookie policy accessible at the foot of the page of the internet site.

Your rights: access, rectify, oppose, etc.

Your rights as a data subject are:

• Right of access (Article 15 of the RGPD) to your data and to information on the conditions under which it is processed ;
• Right of rectification (Article 16 of the RGPD) of your data to correct/complete them ;
• Right to erasure (Article 17 of the GDPR) of your personal data;
• Right to limitation (Article 18 of the RGPD) of the processing of your personal data, where applicable ;
• Right to portability (Article 20 of the RGPD) of your personal data in a structured, common and machine-readable format ;
• Right to object (Article 21 of the RGPD) to the processing of your data necessary for the purposes of the legitimate interests we pursue ;
• Digital will: you have the right to provide us with specific instructions regarding the fate of your personal data after your death and in particular as to its retention or deletion.
• Right to withdraw consent (Article 7, para. 3 of the RGPD) at any time.
• Unsubscription and newsletter: You can opt out of receiving our newsletter at any time by using the unsubscribe link in each message. You can also notify us of your wish to unsubscribe by e-mail by contacting our Data Protection Officer (see below).

We inform you that we may not comply with any of your requests to exercise the above rights if the processing is necessary:

• To exercise the right to freedom of expression and information;
• To comply with a legal obligation;
• For reasons of public interest;
• For the establishment, exercise or defense of legal claims;
• For legitimate or compelling reasons.

To exercise these rights, please contact the Data Protection Officer (DPO) directly by post or email, stating your full name and email address:

CNR

Data Protection Officer, DARJE

2 rue André Bonin

69316 Lyon Cedex 04

donnees.personnelles@cnr.tm.fr

In the event of difficulties, you have the right to lodge a complaint with a competent supervisory authority (the CNIL for France, via the following link: https://www.cnil.fr/fr/plaintes or at the following address: CNIL – Complaint Service – 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07).

Updating and modification of the present personal data protection policy

The present personal data protection policy was updated in July 2025.

This policy may change at any time, in particular due to the introduction of new services or new technologies, or to changes in the legislative and regulatory framework. In the event of substantial modification of this policy, CNR undertakes to inform you.