Privacy policy
At Burger King, protecting your personal data is a priority.
When you use the bk.v2.etiq.com website (the “Site”), we collect personal data about you.
The purpose of this policy is to inform you of how we process this data in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”).
This translation is provided for information only: the French version of this policy is authoritative.
1. Who is the data controller?
The data controller is TODAY ASSURANCES, SAS, registered with the Valenciennes trade and companies register under number 893 977 124, whose registered office is at 12 place des Victoires, 75002 Paris (“We”).
2. What data do we collect?
Personal data is data that identifies an individual, either directly or when combined with other data.
We collect data in the following categories:
- Identification data (in particular your surname, first name, email and postal address, phone number);
- Where applicable, connection data (in particular IP address);
Mandatory data is indicated when you provide your data to us. It is marked with an asterisk and is necessary for us to provide our services.
3. On what legal bases, for what purposes and for how long do we keep your personal data?
| Purposes | Legal bases | Retention periods |
|---|---|---|
| Building a customer and prospect database | Our legitimate interest in developing and promoting our business | For customers: the data is kept for the entire duration of the contractual relationship. For prospects: the data is kept for 3 years from your last contact, for prospecting purposes. |
| Sending newsletters, offers and promotional messages | Our legitimate interest in retaining our customers and prospects and keeping them informed of our latest news | The data is kept for 3 years from your last contact with Us. |
| Responding to your requests for information | Our legitimate interest in responding to your requests | The data is kept for as long as needed to handle your request and deleted once it has been handled. |
| Handling requests to exercise your rights | Our legitimate interest in responding to your requests and keeping a record of them | If we ask you for proof of identity: we keep it only for as long as needed to verify your identity. Once verified, it is deleted. If you exercise your right to object to receiving marketing: we keep this information for 3 years. |
4. Who receives your data?
The following will have access to your personal data:
- (i) Our company’s staff;
- (ii) Our processors: hosting provider, newsletter delivery provider;
- (iii) Where applicable: public and private bodies, solely to meet our legal obligations.
5. Can your data be transferred outside the European Union?
Your data is kept and stored for the entire duration of processing on the servers of Amazon Web Services, located in the European Union.
Through the tools we use (see the section on recipients regarding our processors), your data may be transferred outside the European Union. Any such transfer is secured by the following means:
- either the data is transferred to a country covered by an adequacy decision of the European Commission, in accordance with Article 45 GDPR: in this case, that country ensures a level of protection deemed sufficient and adequate under the GDPR;
- or the data is transferred to a country whose level of data protection has not been recognised as adequate under the GDPR: in this case, these transfers are based on the appropriate safeguards set out in Article 46 GDPR, adapted to each provider, including but not limited to standard contractual clauses approved by the European Commission, binding corporate rules or an approved certification mechanism;
- or the data is transferred on the basis of one of the appropriate safeguards described in Chapter V GDPR.
6. What are your rights over your data?
You have the following rights regarding your personal data:
- Right to information — this is precisely why we have written this policy. This right is provided for by Articles 13 and 14 GDPR.
- Right of access — you have the right to access all of your personal data at any time, under Article 15 GDPR.
- Right to rectification — you have the right to correct inaccurate, incomplete or outdated personal data at any time, in accordance with Article 16 GDPR.
- Right to restriction — you have the right to obtain restriction of the processing of your personal data in certain cases defined in Article 18 GDPR.
- Right to erasure — you have the right to require that your personal data be erased and to prohibit any future collection on the grounds set out in Article 17 GDPR.
- Right to lodge a complaint with a competent supervisory authority (in France, the CNIL) — if you consider that the processing of your personal data infringes the applicable rules (Article 77 GDPR).
- Right to set instructions for the retention, erasure and disclosure of your personal data after your death — in accordance with Article 40-1 of the French Data Protection Act (loi informatique et libertés).
- Right to withdraw your consent at any time — for purposes based on consent, Article 7 GDPR provides that you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
- Right to data portability — under certain conditions set out in Article 20 GDPR, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to require its transfer to the recipient of your choice.
- Right to object — under Article 21 GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue processing despite your objection on legitimate grounds or for the defence of legal claims.
You can exercise these rights by writing to us at the contact details below. We may ask you for additional information or documents to verify your identity.
7. Which cookies do we use?
We only use cookies that are necessary for our website to work.
8. Personal data contact point
Contact email: dpo@etiq.com
Postal address: TODAY ASSURANCES, for the attention of the Data Protection Officer, 12 place des Victoires, 75002 Paris
9. Changes
We may amend this policy at any time, in particular to comply with any regulatory, case-law, editorial or technical changes. These amendments will apply from the date the amended version comes into force. You are therefore invited to consult the latest version of this policy regularly. We will nevertheless inform you of any significant change to this privacy policy.
Effective date: 2 May 2022