IN Groupe Privacy Policy
IN Groupe is committed to protecting your privacy. The purpose of this Privacy Policy (hereinafter referred to as the “Policy”) is to define the categories of personal data we collect, how we collect and process such data, the parties with whom we share it in connection with the services we provide, and certain rights you have in this regard.
Who are we?
Personal data are processed by:
Imprimerie Nationale S.A., represented by its President and CEO Agnès DIALLO, who is Data Controller.
Headquarters: 38, avenue de New York – 75016 PARIS.
Why do we collect your personal data?
Your personal data are collected as part of email exchanges relating to the reporting of vulnerabilities that may affect IN Groupe’s products.
These data are processed for the purposes of receiving, analyzing, and following up on vulnerability reports, as well as enabling direct interaction with the reporting party in connection with handling the vulnerability.
What is the legal basis for the processing?
The processing of personal data is based on IN Groupe’s legitimate interest in ensuring the security of its products, preventing and correcting vulnerabilities that may affect them, and analyzing and handling the corresponding reports.
What data do we collect?
The data that may be collected, depending on the information provided as part of the report, include in particular:
- Identification data and contact details of the reporter or any person designated as a point of contact (first name, last name, email address, and, where applicable, phone number);
- Professional data (company name, position);
- Technical information contained in the vulnerability report (evidence, logs);
- Data necessary for monitoring and managing communications (communication history, associated metadata).
Reporters must only provide information that is strictly necessary for processing the report and should refrain from communicating any sensitive or irrelevant data with regard to the reported vulnerability.
How long do we keep your data?
The data are retained for the period necessary to process the vulnerability report (for a maximum period of 12 months).
Who are the recipients of your data?
The recipients of the personal data are authorized personnel within IN Groupe involved in handling vulnerability reports affecting the products, in particular:
- Members of the PSIRT;
- Product teams (technical teams, R&D).
What are your rights?
You have the right to request access to your personal data. You also have the right to request the rectification of your personal data if they are inaccurate, by email at: dpo@ingroupe.com.
In any event, if you are not satisfied with the answer we provide, you have the right to lodge a complaint with the CNIL: https://cnil.fr/fr/plaintes.