Personal data protection policy

Your data controller: TOOTAK

Personal data is collected and processed by TOOTAK as data controller in connection with your access to and use of the App’. TOOTAK identification: RCS NANTERRE B 833 456 189, registered address c/o KEA & Partners, 3 rue Danton, 92240 Malakoff, France.

Your personal data and how TOOTAK collects it

Your personal data is collected when you sign in to the App’ and as you use it. We collect no data that is not necessary for the processing purpose stated at the time of collection or set out here.

Your personal data is never transferred outside the EU; however, should such a transfer occur on a one-off basis, it would only be to countries or companies covered by an EU adequacy decision, or to an entity that has accepted and signed the European Commission’s standard contractual clauses ensuring an equivalent level of protection.

The collection and processing of your personal data strictly complies with the minimisation principle with regard to the processing purposes below, of which you are informed.

Types of personal data collected and processed

TOOTAK may process the following personal data:

• surname, first name, phone number, address and date of birth;
• your e-mail address and login credentials;
• your podcast listening history in the App’ (volume, nature and subject of the podcasts listened to, listening dates), your listening history, and your interests and category and topic preferences.
• We may also collect personal data about you directly from your employer, with which TOOTAK has signed an App’ access licence for its employees. This data may concern your position, your role and your e-mail address.

How TOOTAK processes your personal data

TOOTAK processes your personal data for the purposes described below:

• creating your access to the App’ and making the targeted podcasts available to you;
• targeting podcasts and suggesting listening based on your preferences and listening history;
• communicating with you (information about the use of the App’ or of its content and podcasts, resolving technical issues);
• hosting through the App’ hosting partner;
• building your podcast listening journey, history and profile.

The legal basis for TOOTAK’s processing of your personal data

In accordance with applicable regulations, TOOTAK’s processing of your personal data is based on one of the following grounds:

• your consent to our processing of your data: you accept the processing of your personal data by express consent (a tick box, an “accept” or “confirm” click…). You may withdraw this consent at any time.or
• the existence of an agreement between TOOTAK and you, or between TOOTAK and the entity that has taken out a licence for your benefit: processing is then justified by the need to perform TOOTAK’s obligations, such as providing podcasts through the App’. For employees of beneficiaries, this agreement may result from an existing contract between TOOTAK and your employer where access to the App’ is through a licence TOOTAK has granted to the latter.or
• a legitimate interest of TOOTAK in processing your data, provided that this proportionate interest respects your fundamental rights and private life.or
• the law or applicable regulations where these require TOOTAK to process your personal data.

How and for how long your personal data is kept

TOOTAK keeps your personal data for as long as necessary for the purposes of their processing; in particular, it is kept for the duration of your registration with the App’. Accordingly, personal data is no longer held in the active database once your access to the App’ is removed for any reason (leaving an employer that holds the access licence granting you App’ access, termination of your access for breach…). TOOTAK may keep your personal data in an archived database, with restricted access, from the deletion of your user account under the conditions set out above, where needed as evidence in the event of legal proceedings; the data is then kept for the applicable statutory limitation period.

Withdrawing your consent to the collection or processing of your personal data

Consent given for the collection of your personal data may be withdrawn by writing to TOOTAK by e-mail at dpo@tootak.fr or by post to TOOTAK, 3 rue Danton, 92240 Malakoff, France, stating your surname, first name, e-mail and address together with the precise nature and subject of your withdrawal request.

You may also send us any comment about your personal data, TOOTAK being particularly attentive to respect for your rights.

Exercising your rights over your personal data

You have:

• a right of access, allowing you to obtain confirmation that data concerning you is or is not being processed, or a copy of all personal data held by TOOTAK;
• a right of rectification, allowing you to have information concerning you corrected where it is out of date or inaccurate, and to have incomplete information about you completed;
• a right to erasure, allowing you — subject to our legal retention obligations — to obtain the deletion of your personal data;
• a right to object, allowing you in particular not to be subject to commercial prospecting by TOOTAK or our partners;
• a right to restriction, allowing you to restrict the processing of your data in the event of unlawful use of your data, a need to retain the data to establish, exercise or defend your rights, or inaccuracy of your data. Your data is then no longer actively processed while your restriction right is exercised;
• a right to data portability, allowing you, subject to the regulatory conditions, to retrieve your personal data in a structured format or to request its transfer to a third party.

TOOTAK’s processors and partners

For employees of beneficiaries, TOOTAK may pass your personal data to your employer, in particular your podcast listening history, journey and profile data, the licence your employer has taken out with TOOTAK being part of the training of its employees.

TOOTAK does not pass your personal data to any other third party.

You may exercise the rights above by e-mail to dpo@tootak.fr or by post to TOOTAK, 3 rue Danton, 92240 Malakoff, France, stating your surname, first name, address and e-mail (and, where applicable, your customer references) together with the subject of your request in clear and legible terms.

TOOTAK undertakes to respond to your verified request within one month of its receipt.

If you have any difficulty, you may contact our data protection officer directly by e-mail at dpo@tootak.fr or refer the matter to the French data protection authority (CNIL).

In the event of any discrepancy between the French and English versions, the French version prevails.