Privacy Policy Terms under General Data Protection Regulation (EU) 2016/679

Politique de Confidentialité relative au Règlement Général sur la Protection des Données (UE) 2016/679

Termini della Politica sulla Privacy ai sensi del Regolamento Generale sulla Protezione dei Dati (UE) 2016/679

Условия Политики Конфиденциальности в соответствии с Общим регламентом по защите данных (ЕС) 2016/679

Версия на русском языке доступна здесь.

Preamble and Definitions

1.1. Preamble

CL CORPORATE AFFAIRS CONSULTING (also referred to as “the Company” or “we” in this policy) is a French company with a single shareholder registered in the French Business and Establishment Directory under number 902 992 189, whose registered office is located at 1 avenue de l'Observatoire, 75006 Paris, France, with a representation office in Brussels, Belgium, located at Avenue de Tervueren 103, B-1040 Brussels, tel.: +33 1 82 28 00 30 / +32 2 886 00 68, email address: cl@cl.eu.com.

As part of its activity, the Company may be required to collect and process personal data concerning you.

In this regard, the Company applies the principles defined by the legal and regulatory provisions applicable to it regarding the protection of personal data, in particular in Regulation (EU) 2016/679 of April 27, 2016 relating to the protection of individuals with regard to the processing of personal data (known as "GDPR") or Law 78-17 of January 6, 1978 relating to information technology, files and freedoms (known as the "Information Technology and Freedoms Act") and its implementing decrees.

This personal data protection policy (hereinafter the “data protection policy”) describes the information about you that the Company, as data controller, is required to process and how it uses it.

This data protection policy also specifies the rights you have over your personal data in accordance with applicable legal and regulatory provisions.

If you have any questions regarding this policy, you can of course contact us using the contact details provided below in the paragraph “What are your rights and how can you exercise them?”.

1.2. Definitions

In addition to the terms defined elsewhere in this Policy, the following terms, whether used in the singular or plural in this Policy, have the following meanings:

“recipient”: means the natural or legal person, public authority, service or any other body which receives communication of personal data, whether or not a third party.
“personal data”: means any information relating to an identified or identifiable natural person (see “data subject”); an “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“data controller”: means the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing.
“processor”: means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“processing”: means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Why and How Do We Use Your Data?

As a preliminary point, it is specified that your data may be collected by the Company directly from you (as part of your exchanges and/or interactions with us), or indirectly from third parties.

When your data is collected from third parties, we specify that the sources may be the following:

via the websites or publications of the entities (institutions, organizations, administrations, etc.) to which you are attached;
in newsletters or publications or via any other source of information accessible to the public (e.g.: Lettre A, Lettre de l'Expansion, Contexte, Politico, Euractiv the Daily Bulletin, etc.);
in professional databases (e.g. lesbiographies.com, Acteurs publics, le Guide du Pouvoir, etc.) or in public service directories (e.g. Who'sWho maintained by the European Commission);
in the press, on all websites or on social networks (e.g.: writing by you of an article in the press revealing some of your personal data, personal data deliberately communicated by you to a journalist as part of an interview intended to be published or on social networks, particularly professional ones (e.g.: LinkedIn), etc.);
through our customers.

Generally, we process and use your personal data for the purposes of managing and monitoring our public affairs and interest representation activities.

2.1. To Understand the Positions, Expectations, and Scope of Action and/or Influence of Stakeholders

Purpose of processing: we may process your personal data as part of our activities aimed at understanding the positions, expectations, and scope of action and/or influence of stakeholders on certain subjects (e.g.: creation of stakeholder maps and/or biographies, monitoring notes, reports and reports, anticipation of crisis communication procedures, etc.).

Legal basis for processing: The processing of your personal data in this context is necessary for the purposes of our legitimate interests in carrying out our business.

Data processed: identity (title, surname, first name), functions / mandates / positions, affiliated organization, positions taken, centers of interest, areas of expertise, subjects covered or preferred, information relating to your biography (e.g.: information relating to your training (studies, diplomas, etc.), your experience and your professional / political career, etc.)

Existence of automated decision-making: No

Data retention period: we keep personal data in an active database for the period necessary to carry out our mission/project plus one year and then, at the end of the active database retention period, we keep them in archived form until the expiry of a period of 6 years from the end of the mission/project for administrative and/or evidentiary purposes, subject to other retention periods that may apply if your personal data are processed for other purposes under the conditions and procedures set out in this paragraph 2.

2.2. To Build and Maintain a Dialogue Between the Entities Whose Interests Are Represented and the Relevant Stakeholders

Purpose of processing: we may process your personal data as part of our activities aimed at building and maintaining a dialogue between the entities whose interests are represented and the relevant stakeholders, and developing relevant communication and messages / likely to meet the expectations of said stakeholders (e.g.: development of engagement plans and contact programs, making contacts to communicate information or request an appointment, production of biographies, monitoring notes and briefing notes, organization, management and follow-up of interviews / appointments, reports and reports, and more generally communication actions, interest representation actions, lobbying operations, etc.).

Legal basis for processing: The processing of your personal data in this context is necessary for the purposes of our legitimate interests in carrying out our business.

Data processed: identity (title, surname, first name), functions / mandates / positions, affiliated organization, positions taken, centers of interest, areas of expertise, subjects covered or preferred, contact details (postal address, email address, telephone numbers, fax numbers, etc.), information relating to your biography (e.g.: information relating to your training (studies, diplomas, etc.), your experience and your professional / political career, etc.), monitoring of our exchanges and interactions.

Existence of automated decision-making: No

Data retention period: we keep personal data in an active database for the period necessary to carry out our mission/project plus one year and then, at the end of the retention period in the active database, we keep them in archived form until the expiry of a period of 6 years from the end of the mission/project for administrative and/or evidentiary purposes, subject to other retention periods that may apply if your personal data are processed for other purposes under the conditions and procedures set out in this paragraph 2.

2.3. To Maintain Our Professional Relationships, Monitor Our Contacts and Maintain Our Expertise and Experience

Purpose of processing: we may process your personal data as part of our activities aimed at maintaining our professional relationships, monitoring our contacts and maintaining our expertise and experience (e.g.: writing monitoring notes, sending messages, news, information, documents, invitations, organizing meetings or events, reports and reports, and more generally communication, solicitation, prospecting actions, etc.).

Legal basis for processing: The processing of your personal data in this context is necessary for the purposes of our legitimate interests in carrying out our business.

Data processed: identity (title, surname, first name), functions / mandates / positions, affiliated organization, positions taken, centers of interest, areas of expertise, subjects covered or preferred, contact details (postal address, email address, telephone numbers, fax numbers, etc.), information relating to your biography (e.g.: information relating to your training (studies, diplomas, etc.), your experience and your professional / political career, etc.), monitoring of our exchanges and interactions, monitoring of your participation in meetings or events and data necessary for the organization of these meetings or events.

Existence of automated decision-making: No

Data retention period: we retain personal data in an active database until the end of the data subject's expertise activity on subjects of interest to the Company as a public affairs professional, or until the end of the relevance in the "institutional" world of the data subject or the subject they are dealing with, then, at the end of the retention period in the active database, we keep them in archive form for 6 years from the last contact for administrative and/or evidentiary purposes, subject to other retention periods that may apply if your personal data are processed for other purposes under the conditions and procedures set out in this paragraph 2.

2.4. To Comply with the Legal and Regulatory Obligations Incumbent Upon Us Relating to Public Affairs Professions

Purpose of processing: in order to comply with the legal or regulatory obligations incumbent on public affairs professionals (see, for example, reporting obligations to the French High Authority for Transparency in Public Life or HATVP, or the EU Transparency Register), we process your personal data for the pursuit of this purpose.

Legal basis for processing: the processing of your personal data in this context is necessary to comply with the legal or regulatory obligations incumbent on us. Furthermore, it is specified that with regard to data processed for the purposes of making the declarations incumbent on us to the HATVP, we retain them once the declarations have been made, on the basis of our legitimate interest in ensuring that we can respond to requests from the HATVP that may be addressed to us as part of the exercise of its supervisory powers.

Data processed: identity (title, surname, first name), functions / mandates / positions, parent organization

Additional information on processing: the processing of the aforementioned data for this purpose is imposed by the applicable legal or regulatory provisions incumbent on public affairs professionals and by the HATVP (failure to collect and retain such data could result in sanctions);

Existence of automated decision-making: No

Data retention period: we retain personal data in an active database for the current accounting year plus three months and then in archived form for 5 years from the end of the accounting year following the one during which the interest representation activity was carried out for administrative and/or evidentiary purposes, subject to other retention periods that may apply if your personal data are processed for other purposes under the conditions and procedures set out in this paragraph 2.

2.4.1 To Comply with Obligations Related to the European Union Transparency Register

Purpose of processing:
In order to meet our disclosure obligations under the European Union Transparency Register, we may process certain personal data concerning you, particularly in the context of our interest representation activities before European institutions.

Legal basis for processing:
This processing is necessary for compliance with a legal obligation to which we are subject (in accordance with the Interinstitutional Agreement of 20 May 2021 on the Transparency Register, OJ C 229 of 17.06.2021), and, where applicable, also based on our legitimate interest in ensuring transparency with respect to the European institutions.

Data processed:
Identity (first name, last name, position), affiliated organization, subject matter of exchanges, and the date and nature of the institutional contacts declared.

Data retention period:
Data is retained for as long as necessary to fulfill our registration obligations, and, once the declaration has been completed, it is archived for a period of 5 years to enable ex post verification or to respond to potential requests from the European institutions.

Disclosure to third parties:
Such data may be made publicly accessible via the EU Transparency Register, under the responsibility of the European institutions.

2.5. For the Management of Requests to Exercise Their Rights by the Persons Concerned

Purpose of processing: in order to enable the Company to comply with its various legal and regulatory obligations regarding the protection of personal data (e.g., responses to requests by data subjects to exercise their rights, consideration of the resulting consequences, in particular management of requests for opposition or erasure, etc.), the Company may be required to process personal data concerning you in connection with this purpose.

Legal basis for processing: such processing is in principle necessary for compliance with the aforementioned legal and regulatory obligations incumbent on us.

Data processed: identity (title, first name, last name), contact details (email address, telephone number, postal address, etc. depending on the information provided by the applicant), content of the request, exchanges and response, additional information or copy of an identity document but only when the situation requires it (see in the event of reasonable doubts as to the identity of the applicant), and possibly all data that may be processed for the other purposes referred to in this paragraph 2 (for example, to respond to a request to exercise your right of access).

Existence of automated decision-making: No

Data retention period: we keep personal data in an active database until the request is responded to* and then we keep them in archived form for a maximum of 6 years from the response to your request (depending on the type of request), it being specified, however, that when a copy of an identity document is collected in this context, it is:

immediately deleted when it has been communicated by you but the request does not require the transmission of such an identity document;
deleted immediately after verification of the identity of the person making the request when the situation requires such verification, or kept in archive form for 6 years for the purpose of establishing evidence in certain exceptional cases for which a high risk of litigation is identified.

*If you object to the processing of your personal data for prospecting purposes, your identity and/or contact details may be kept in an active database for 3 years to take your request into account (see keeping an opposition list).

Furthermore, in the context of some of these processing operations, personal data considered “sensitive” or “specific” (see data concerning political opinions, religious or philosophical beliefs or even trade union membership of the persons concerned, for example) concerning you may be processed for the aforementioned purposes, subject to the necessity of processing this data in relation to the purpose pursued, and subject to (i) your express consent for this purpose having been previously obtained, or (ii) such information having clearly been made public by you.

Please note: with regard to all active database retention periods referred to above in paragraph 2, you are informed that these are the periods applied "in principle", unless you exercise your right to erasure, opposition or withdrawal of your consent, in the situations and in accordance with the details referred to in paragraph 4 below. Indeed, in the latter case, following the exercise of such rights, your data will only be kept in archived form for the period referred to in paragraph 2.5.

Who Are the Recipients of Your Personal Data?

3.1. In Principle

Only authorized persons within the Company may access your personal data when such access is necessary for the performance of their duties and/or missions.

3.2. Persons Outside the Company

In limited and specific circumstances, persons outside the Company may also receive communication of your personal data or have access to it, namely:

the services or entities responsible for monitoring the Company (ie. auditor, services or entities responsible for internal or external monitoring procedures, bodies authorized to carry out monitoring, High Authority for Transparency in Public Life, etc.);
advice (legal, financial, accounting, etc.) to the Company and/or its clients;
the Company's partners and/or its clients, including in particular current or potential service providers and suppliers, including technical or other service providers involved in activities or missions for which access to personal data is necessary and/or justified.

This category of recipients may include, for example, any publisher of applications, computer programs or tools that would be used in the context of our activities and/or those of our clients], or any IT or maintenance provider of applications, computer programs and/or tools used by the Company and/or by its clients and in which your personal data could be processed;

the Company's customers and prospects.

3.3. Disclosure to Public Authorities

The Company may also be required to disclose your personal data in the event of legitimate requests from public or authorized authorities, on the basis of legal or regulatory provisions applicable to it. Your personal data may therefore be disclosed to any authority authorized to process it, in particular in the event of a requisition from judicial, police or administrative authorities.

3.4. Limited Access

It is specified that the recipients referred to above are not necessarily recipients of all of your personal data, but only of those necessary for the purpose involving such communication.

What Are Your Rights and How Can You Exercise Them?

4.1. Your Rights

You benefit, according to the terms and conditions and within the limits defined by the legal and regulatory provisions regarding the protection of personal data, from the following rights with regard to the processing of personal data concerning you carried out by the Company:

Right of access: you can obtain confirmation as to whether or not personal data concerning you are being processed, and where appropriate, when they are, access to said personal data, as well as certain information relating to the processing of your personal data and the characteristics of such processing;
Right of rectification: you can request the correction of your personal data that you consider incomplete or inaccurate;
Right to erasure: you may, in certain circumstances provided for by the applicable provisions, request the erasure of your personal data (except, for example, if they are necessary for the performance of your contractual relations with the Company, or if they are necessary for the Company to comply with its legal or regulatory obligations or to establish or exercise its rights);
Right to restriction of processing: you can request restriction of the processing of your personal data, i.e. request in certain cases the marking of your personal data in order to limit future processing;
Right to the portability of your personal data: you have the right in certain cases and under certain conditions provided for by the applicable provisions to request to receive the personal data concerning you that you have provided to us or, where technically possible, to have them transferred to a third party, in a machine-readable form (it being specified that this right to data portability only applies to processing based on the consent of the persons concerned or on the execution of contractual relationships, and provided that the processing of the data is carried out using automated processes);
Right to withdraw consent: you can withdraw your consent if the processing is carried out on the basis of your consent, without the withdrawal of such consent affecting the lawfulness of processing based on consent given before its withdrawal;
Right to define guidelines relating to the retention, deletion or communication of your personal data after your death. In this regard, in the event of death which is brought to the attention of the Company, please be aware that your personal data will be deleted (except where retention is necessary for a specific period for reasons relating to our legal and regulatory obligations and/or the statutory limitation and/or mandatory retention periods referred to above in paragraph 2 in the details of the characteristics of the processing), after having been communicated, where appropriate, to a third party designated by you.

Furthermore, you benefit, in certain cases and under certain conditions provided for by the applicable provisions, from a right of opposition which allows you to oppose the processing of your personal data for reasons related to your particular situation, it being specified that with regard to prospecting operations, including profiling operations which would be linked to such prospecting, you have an absolute right of opposition, which can be exercised at any time, without having to provide a reason or justification.

4.2. How to Exercise Your Rights

These rights can be exercised with the Company by email at the following email address: cl@cl.eu.com or (ii) by post to the following address: 1 avenue de l'Observatoire, 75006 Paris.

If such a request is received, it will be responded to as soon as possible and in any event within a maximum of one month from receipt of the request. If necessary, this period may be extended by two months, taking into account the complexity and number of requests received, in which case the applicant will be informed.

In the event of reasonable doubt as to the identity of the person concerned by such a request to exercise the aforementioned rights, he or she may be asked to provide additional information necessary to confirm his or her identity and may be asked for this purpose, where the situation so requires, for a photocopy of an identity document bearing his or her signature. In such a case, the aforementioned response times will be suspended pending receipt of the additional information necessary to identify the person concerned.

The request may be submitted by the person concerned or by a person specifically authorized for this purpose by the person concerned, provided that this authorized person provides proof of his or her identity and that of the principal, his or her mandate, and the duration and precise purpose thereof. The mandate must also specify whether the agent may be made the recipient of the response.

4.3. Right to Lodge a Complaint

In any event, you have the right to lodge a complaint with the competent Supervisory Authority (in France, this is the Commission Nationale de l’Informatique et des Libertés known as “CNIL”: 3 place de Fontenoy – TSA 80715 – 75334 Paris cedex 07; tel.: 01 53 73 22 22) if you believe that the processing of your personal data is not carried out in accordance with the legal and regulatory provisions relating to the protection of personal data.

To understand your rights, you can also refer to the explanations provided by the CNIL here: https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles.

Is Your Personal Data Transferred Outside the European Union?

No data transfer is carried out outside the European Union.

5.1. Data Processed in the European Union

Your personal data is processed preferentially in the European Union and in the following countries benefiting from an adequacy decision issued by the European Commission within the meaning of Article 45 of the GDPR44: none

5.2. Data Transferred Outside the European Union

However, within the framework of the aforementioned purposes, some of your personal data may be transferred to third-party entities established in countries outside the European Union (e.g.: subcontractors involved in the aforementioned processing, etc.).

These are the following countries: none

Last Updated

19/03/2025