Innov’Hub

Privacy policy

SODEXO builds strong, lasting relationships with its customers, partners, consumers and associates, based on mutual trust: making sure that their personal data are safe and remain confidential is an absolute priority for SODEXO.

SODEXO complies with all French and European regulatory and legal provisions on the protection of personal data.

SODEXO enforces a very strict privacy policy to guarantee protection of the personal data of those who use its platforms and other applications:

Users remain in control of their own data. The data are processed in a transparent, confidential and secure manner.
SODEXO is committed to a continuing quest to protect its users’ personal data in accordance with the General (EU) Data Protection Regulation of April 27, 2016 (hereinafter the “GDPR”).
SODEXO has a dedicated personal data protection team comprising a Group Data Protection Officer registered with the CNIL (Commission Nationale de l’Informatique et des Libertés [French Data Protection Agency]) and a network of contact persons dedicated to personal data protection.

PURPOSE OF THIS POLICY

SODEXO takes the protection of your personal data very seriously.

We developed this policy to inform you of the conditions under which we collect, process, use and protect your personal data. Please read it carefully to familiarize yourself with the categories of personal data that are subject to collection and processing, how we use these data and with whom we are likely to share it. This policy also describes your rights and how you can get in touch with us to exercise these rights or to ask us any questions you might have concerning the protection of your personal data.

This policy may be amended, supplemented or updated, in particular to comply with any legal, regulatory, case law or technical developments that may arise. However, your personal data will always be processed in accordance with the policy in force at the time of the data collection, unless a compulsory legal prescription determines otherwise and must be enforced retroactively.

This policy forms an integral part of the Terms of Use of the platform.

IDENTITY AND CONTACT DETAILS OF THE CONTROLLER

The personal data controller is: Sodexo S.A, a corporation duly organized under the laws of France, located at 255, quai de la Bataille de Stalingrad, 92130 Issy-les-Moulineaux.

DEFINITIONS

“Personal data” means any information relating to an identified natural person or one that can be directly or indirectly identified by reference to an identification number or to one or more factors specific to this person.

“us” or “our” Sodexo S.A. (hereinafter “Sodexo”),

“you” any platform user/visitor.

“Platform” “Innov’Hub”, the innovation and collaboration platform available at the address: Innov’Hub.sodexo.com.

COLLECTION AND SOURCE OF PERSONAL DATA

We will most likely collect your personal data directly (in particular via the data collection forms on our platform) or indirectly (in particular via our service providers and/or technologies on our platform).

We undertake to obtain your consent and/or to allow you to refuse the use of your data for certain purposes whenever necessary.

You will be informed of the purposes for which your data are collected via the Registration Page.

TYPES OF PERSONAL DATA COLLECTED AND USED BY US

We may specifically collect and process the following types of personal data:

the information that you provide when you registered the first time to the platform;
the information that you provide when filling in the forms on the platform;
the information that you provide for authentication purposes;
via “posts”, comments or other content that you post on the platform.

Such Personal Data is collected directly from you when you decide on a voluntary basis to contribute to Innov’Hub. Personal data identified by an asterisk in the data collection forms are compulsory as these are necessary to fulfill any orders placed. In the absence of this compulsory information, these transactions cannot be processed.

PERSONAL DATA THAT WE AUTOMATICALLY COLLECT

We collect some information automatically when you visit the platform in order to personalize and enhance your experience. We collect this information using various methods such as:

Cookies

A “cookie” is a small information file sent to your browser when you visit our platform and stored on your computer. This file contains information such as the domain name, the internet access provider and the operating system as well as the date and time of access by the user. Cookies cannot damage your computer in any way.

Cookies are not used to determine the identity of an individual who visits our platform. Cookies allow us to identify, in particular, your geographic location and the display language in order to improve your online browsing experience. They also enable us to process information about your visit to our platform, such as the pages viewed and the searches made, in order to improve our platform content, to follow your areas of interest and offer you more suitable content.

If you do not want to receive cookies from our platform, you can adjust your browser settings accordingly. To manage your choices, each browser has a different configuration. These configurations are described in your browser’s help menu, which will explain how to change the settings to your desired cookies configuration.

We recommend, however, that you do not deactivate our cookies. Keep in mind that if you block, turn off or reject our cookies, some of our webpages will not display correctly or you will no longer be able to use some of the services we offer. In this case, we cannot be held liable for any consequences related to the reduced functionality of our services arising from our inability to store or consult the cookies required for its functioning and which you have declined or deactivated.

Lastly, by clicking on the dedicated icons of social networks such as Twitter, Facebook, Linkedin, etc., if these are displayed on our platform, and if you have agreed that cookies may be downloaded while you are browsing our platform, the social networks in question may also download cookies to your devices (computer, tablet or mobile phone). These types of cookies are downloaded to your device only on condition that you have given your consent by continuing to browse our platform. You can, however, at any time revoke your consent to these social networks downloading these types of cookies.

For more information, please consult our Cookie Policy.

IP addresses

An IP address is a unique identifier used by some electronic devices to identify and communicate with each other on the internet. When you consult our platform, we can use the IP address of the device used by you to connect you to the platform. We use this information to determine the general physical location of the device and to know in which geographical areas visitors are located.

Statistics

The platform uses Google Analytics to generate statistical reports. These reports tell us, for example, how many users consulted the platform, which pages were visited and in which geographical areas platform users are located. The information gathered via the statistics may include, for example, your IP address, the platform from which you arrived at our site and the type of device that you used. Your IP address is hidden on our systems and will only be used if necessary to resolve a technical problem, for platform administration and to gain insight into our users’ preferences. Platform traffic information is only accessible to authorized staff. We do not use any of this information to identify visitors and we do not share this information with third parties.

Analytics

Innov’Hub will use Google Analytics to create statistical reports. These reports will tell us, for example, how many users visited Innov’Hub, what pages have been browsed, and from what geographic regions users visited Innov’Hub. The information collected through the use of analytics may include, for example, your IP address, the website from which you visited us and the type of device you used. Your IP address is masked on our systems and will only be used on a need-to-know basis to resolve technical issues, to administer our Innov’Hub and to understand visitor preferences. Traffic information on Innov’Hub is accessed only by authorized personnel. We do not use any of this information to identify visitors and we do not share it with third parties.

PURPOSES FOR WHICH WE USE PERSONAL DATA

We use your personal data specifically for the following purposes:

to manage your registration process to Innov’Hub and support and manage the Sodexo Innovation Program implemented throughout Sodexo to encourage employees and external business partners to collaborate and contribute to its Innovation strategy;
to identify ideas teams;
to gather statistics
to personalize and enhance your experience on our platform

any other purpose of which we will inform you, if applicable, when we collect your data.

LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

We process your personal data as part of the performance and management of our contractual relationship with you, in our legitimate interest to improve the quality and operational excellence of the services we offer to you or in compliance with certain regulatory obligations.

Your personal data may also be processed based on your prior consent in the event that under certain circumstances, your consent would be requested.

DISCLOSURE OF PERSONAL DATA

The security and confidentiality of your personal data are of great importance to us. This is why we restrict access to your personal data only to members of our staff who need to have this information in order to process your orders or to provide the requested service.

We will not disclose your personal data to any unauthorized third parties. We may, however, share your personal data with entities within the Sodexo group and with authorized service providers (for example: technical service providers [hosting, maintenance], consultants, etc.) whom we may call upon for the purpose of providing our services. We do not authorize our service providers to use or disclose your data, except to the extent necessary to deliver the services on our behalf or to comply with legal obligations. Furthermore, we may share personal data concerning you (i) if the law or a legal procedure requires us to do so, (ii) in response to a request by public authorities or other officials or (iii) if we are of the opinion that transferring these data is necessary or appropriate to prevent any physical harm or financial loss or in respect of an investigation concerning a suspected or proven unlawful activity.

STORAGE PERIOD OF YOUR PERSONAL DATA

We will store your data only for as long as necessary to fulfill the purposes for which it was collected and processed. This period may be extended, if applicable, for any amount of time prescribed by any legal or regulatory provisions that may apply.

SENSITIVE PERSONAL DATA

As a general rule, we do not collect sensitive personal data via our platform. “Sensitive personal data” refers to any information concerning a person’s racial or ethnic origins, political opinions, religious or philosophical beliefs, union membership, health data or data relating to the sexual life or the sexual orientation of a natural person. This definition also includes personal data relating to criminal convictions and offenses.

In the event that it would be strictly necessary to collect such data to achieve the purpose for which the processing is performed, we will do so in accordance with local legal requirements for the protection of personal data and, in particular, with your explicit prior consent and under the conditions described in this Confidentiality Policy.

PERSONAL INFORMATION AND CHILDREN

The platform is for use by adult persons who have the capacity to conclude a contract under the legislation of the country in which they are located.

Children users under the age of 16 years or without legal capacity must obtain consent from their legal guardians prior to submitting their data to the platform.

The 16-year age limit may be reduced to 13 years depending on the local legislation in your usual place of residence.

TRANSFER OF PERSONAL DATA

As Sodexo is an international group, your personal data may be transmitted to internal or external recipients that are authorized to perform services on our behalf and that are located in countries outside the European Union or the European Economic Area which do not offer an adequate level of personal data protection. Such access from the different Users of Innov’Hub is in fact necessary for the purpose of allowing an interaction with the content submitted by other users.

To guarantee the security and confidentiality of personal data thus transmitted, we will take all necessary measures to ensure that these data receive adequate protection. When registering on Innov’Hub to participate in the Innovative initiative, by ticking the box to that effect, you consent as a User, that your Personal Data be accessible to the Users willing to interact with You who may be based in country which is not considered by the European Commission or the data protection national authorities as providing an adequate level of protection.

YOUR RIGHTS

In accordance with the applicable law, you have certain rights relating to the processing of your personal data.

Right of access	You have the right to request access to your personal data. You may also request rectification of inaccurate personal data or request that incomplete data be completed. You also have the right to know the source of the personal data.
Right of erasure	Your right to be forgotten entitles you to request the erasure of your personal data when: (i) the data are no longer necessary to achieve the purposes for which they were collected and processed; (ii) you choose to withdraw your consent (if your consent was obtained as the legal basis for processing), without such a withdrawal affecting the lawfulness of any processing carried out prior to the withdrawal; (iii) you object to the processing; (iv) your data were processed unlawfully; (v) your data must be erased to comply with a legal obligation; or (vi) erasure of the data is required to ensure compliance with current legislation.
Right to restriction	You may also request restriction of processing of your personal data if: (i) you dispute the accuracy of your data; (ii) we no longer need these data for processing purposes; and (iii) you are opposed to the processing of the data.
Right to refuse direct marketing messages	You may at any time request to no longer receive advertising or prospecting by contacting us directly, free of charge, or via the “unsubscribe” link included with any form of prospecting that we might send to you by email, or by sending us an email to the address provided below. This opposition is without prejudice to the lawfulness of any communication sent to you before the opposition was implemented. In accordance with Article L.223-2 of the French Consumer Code, Users are hereby informed of their right to subscribe, free of charge, to the national “do not call” registry to opt out of telephone canvassing (www.bloctel.gouv.fr).
The right not to be the subject of a decision based exclusively on automated data processing	You have the option not to be the subject of a decision based exclusively on automated processing that has legal effects concerning you or that has a significant impact on you.
Right of portability	You may request that we provide your personal data in a structured, commonly used, machine-readable format or you may request that it be transmitted directly to another controller on condition that: (i) the processing is based on your consent or necessary to fulfill a contract with you; and (ii) that it is done via automated means.
Right to issue advanced instructions about the processing of your personal data after your death	In application of the French Data Protection Act, you may also formulate instructions on exercising your rights as set out in this section, after your death (in particular with regard to the storage period or the erasure and/or disclosure of the data) as well as appoint a person tasked with exercising these rights.
Right to lodge a complaint with a supervisory authority	If you have any concerns or complaints with regard to the protection of your personal data, you have the right to lodge a complaint with the French Data Protection Agency (CNIL) using the following link: www.cnil.fr. However, please address any requests to us beforehand by contacting us at the address given below so that we can deal with your request and find an amicable solution.

To exercise your rights, you can contact us by writing to us at the following address: contact.InnovHub@sodexo.com stating your surname, first name and the reason for your request. We will most likely ask you for additional information in order to identify you and to enable us to deal with your request.

SECURITY

We implement all possible technical and organizational security measures to ensure security and confidentiality in processing your personal data.

To this end, we take all necessary precautions given the nature of the personal data and the risks related to its processing, in order to maintain data security and in particular to prevent distortion, damage or unauthorized third-party access (physical protection of the premises, authentication procedures with personal, secured access via identifiers and confidential passwords, a connection log, encryption of certain data, etc.).

LINKS TO OTHER SITES

Occasionally, we provide links to other platforms for practical and informative purposes. These platforms are mostly Sodexo platforms and some of them operate independently from our platforms and are not under our control. These platforms are run by third parties with their own confidentiality recommendations or terms of use which we strongly advise you to read. We do not accept any liability with regard to the content on these sites, for the products and services that may be offered there or for any other use thereof.

UPDATES OF OUR CONFIDENTIALITY POLICY

This policy will become effective on May 25, 2018. We may update or amend this confidentiality policy as and when needed. In this case, amendments will only become applicable after a period of 30 business days from the date of the amendment. Please consult this page from time to time if you want to be informed of any possible changes.

DATA STORAGE

If you have subscribed to certain services via our platform and you no longer want to receive emails, please consult the “unsubscribe” page corresponding to the service you are subscribed to. You can close your account via the user profile interface of the platform or by contacting contact.InnovHub@sodexo.com. We will dissociate your public posts from your account profile but we may retain information about you for the purposes authorized by this policy and archive your Personal data 5 years after the deactivation of your account for analytics consistency purposes.

When employees leave the company, they shouldn’t have access anymore to Innov’Hub but their account and related personal data is kept in the system for 5 years for statistics purposes and also to keep more consistency with their contributions in the platform.

HOW TO CONTACT US

If you have any questions or comments with regard to this policy, please do not hesitate to contact us at the following address: contact.InnovHub@sodexo.com or contact our Group Data Protection Officer at the following address: dpo.group@sodexo.com.

Last updated: May 28, 2018

Discover and share innovative solutions.