Privacy policy

Processing purposes

Your data is processed for the following purposes:

• subscribing to, managing and performing your exhibitor cancellation insurance contract;
• handling claims and supporting you with claim notifications;
• invoicing, collection of premiums, and any refunds;
• compliance with our legal and regulatory obligations (French Code des assurances, anti-money-laundering, etc.);
• improving our service and communicating with you, subject to your specific consent for marketing solicitations.

Legal basis

Depending on the purpose, processing relies on:

• performance of a contract to which you are a party (subscription, management, claims) · art. 6.1.b GDPR;
• compliance with legal obligations to which VAX CONSEILS is subject (French Code des assurances, anti-money-laundering / counter-terrorist-financing) · art. 6.1.c GDPR;
• the legitimate interest of VAX CONSEILS in improving the service and preventing fraud · art. 6.1.f GDPR;
• your specific consent for marketing solicitations and for the declaration of the key person · art. 6.1.a GDPR.

Data collected

The data processed concerns the exhibiting company, the subscriber and — where applicable — the declared key person: identity, role, professional contact details, postal address, company identifiers (SIRET, VAT), information relating to participation in the show (insured amount, type of stand, SIAE basket), payment data, time-stamped consents, and — for the declared key person where the insured amount reaches €80,000 — date of birth.

Retention periods

• In-progress dossiers (unfinished reservation): 90 days after last activity, then purged.
• Finalised dossiers (active contract): contract term then 5 years after its expiry, in line with the obligations of the French Code des assurances.
• Accounting data: 10 years (art. L123-22 of the French Code de commerce).
• Marketing data (opt-in re-contact): 3 years after the last contact, unless you object.

Recipients and processors

Your data is shared with the following recipients, strictly on a need-to-know basis:

• Cooper Gay SAS (coverholder / binding authority);
• Fidelidade Companhia de Seguros SA (insurer);
• Groupe Polyexpert (loss adjuster appointed in the event of a claim);
• our technical service providers: hosting OVH (France), transactional email (EU), chartered accountant, legal counsel;
• public authorities where required by law.

All data is hosted within the European Union. No transfer outside the EU is carried out as part of this programme.

Your rights

Under articles 15 to 22 of the GDPR, you have the right to access, correct, erase, restrict, port your data, and object to processing, as well as the right to withdraw your consent.

To exercise these rights, write to dpo@vax-conseils.fr or by post to VAX CONSEILS, 7 rue du Renard, 78600 Maisons-Laffitte, France. You will receive a response within 30 days (extendable to 90 days for complex requests).

If a dispute remains unresolved, you may lodge a complaint with the French data-protection authority CNIL · 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France · www.cnil.fr.

Security

VAX CONSEILS implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of your data: encryption in transit (TLS 1.3), encryption at rest, access controls, logging, daily backups, and quarterly restore verification.