Updated: July 15, 2020
The purpose of this Privacy Policy for the PALAM Application is to inform the Application users of their rights and obligations with regard to the collection of their personal data.
The French Data Protection Act, and European Regulation 2016/679 of 27 April 2016 (GDPR), which came into force on 25 May 2018, provide for a specific system for the management and protection of Personal Data.
This Privacy Policy falls within this framework.
This policy also provides the answers to questions that users of our services may have when using the Application.
In this context, this policy aims to provide clear, complete and honest information on the means and methods used by the PALAM Application to protect the data of its users and respect their rights.
To enable you to use our services safely and confidently, this charter sets out clear, simple and honest information in relation to the processing of Personal Data by PALAM in the framework of its activity, in one document.
As part of our activities, we are required to collect, process and store certain data about the Users of our Application.
This Policy is supplemented by the Terms and Conditions of our Application.
By using the Services provided by PALAM, Users undertake to comply with and be bound by this Policy.
In this respect, and for certain processing activities, active consent (opt-in) may be requested from the User beforehand.
DEFINITIONS
Application: IT solution, for Android, iOS and iPadOS operating systems, which allows Users with an Account to use the Features and Services offered by PALAM on a smartphone;
Account: Access system reserved for Customers requiring a username and password;
Data(s): Any items (information, text, photographs, messages, etc.) collated and implemented within the Application and Services by the User as they use these;
Personal data:
Pursuant to Article 4.1 of the GDPR, ‘personal data’ means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Feature(s): Each element implemented, accessible and usable within the different Services;
PALAM:
Trade name used by SAS PALAM, with a capital of €10,000, whose registered office is based at Allée de Chartres, 33000 Bordeaux, France, registered in the Trade and Companies Register of Bordeaux under number 883 528 846, represented by Mr Etienne Waldron in the capacity of Chairman;
French Data Protection Act (Loi Informatique et Libertés):
Law No. 78-17 of 6 January 1978 on data protection, available online at link
Means of Access: Methods and/or functions by which the User can access one or more Services to make use of them for their own needs;
Operator: Company that operates various electronic telecommunications networks needed to access and use the Services;
Policy: This Privacy Policy;
User(s): Any natural person that accesses the Application;
Data controller:
Pursuant to Article 4(7) of the GDPR, data controller refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 available at link
Services: All the services made available to the User by PALAM and accessible via the Means of Access;
Data processor: Pursuant to Article 4(8) of the GDPR, the ‘data processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
Processing:
Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Third parties: Natural persons who are not connected to PALAM or other individuals who are not connected to PALAM and/or the User;
1. WHO COLLECTS YOUR DATA (IDENTITY OF DATA CONTROLLER)?
The Data Controller is:
SAS PALAM
Simplified joint-stock company with a share capital of €10,000
7 Allée de Chartres, 33000 Bordeaux
Bordeaux Trade and Companies Register 883 528 846
Application Manager Mr Etienne Waldron
Contact contact@palam.app
Therefore, PALAM shall determine the means and purposes of collecting the Personal Data required for the User to use the Services, as well as other Data needed to implement, monitor and improve the contractual relationship.
2. WHAT DOES PALAM DO AND WHAT SERVICES DOES IT OFFER CUSTOMERS?
PALAM is a computer Application that provides an online social network, accessible via iOS, iPadOS and Android, that can be used by Users wishing to access information published by other Users of the Application, depending on their geographical location and/or their subscriptions.
These Services can only be accessed via the PALAM Application, which can be downloaded from Android and iOS app stores.
The User can download the Application without creating an account. However, if they wish to access certain Services, they must set up a User Account.
Through the Application, PALAM allows Users, whether individuals or legal entities, with an Account to:
- Create a personal User Account allowing them to exchange information with other Users publicly, within a fixed geographical radius;
- Create content that may be accessed by other Users of the Application and to interact with this content (like, comment, share, etc.);
- Access information related to local news based on location tracking;
- Access information in the Account of another User of the Application (content published, interactions, statistics) based on location tracking;
- Follow the updates of other Users and allow other Users to follow their updates and content published, based on location tracking;
- Manage and edit their User Account (modify, add photos, nicknames, Account type, delete Account).
For the purpose of this Policy all of these items are referred to as ‘Services’.
These Services are only accessible via multifunctional mobile devices, which can be tracked.
The technology used is based on the GPS system or the communication interfaces of a mobile phone. In order to offer you Services that best meet your expectations, we must collect and process certain Personal Data.
We therefore collect information about you. In this respect, PALAM shall only collect and process Personal Data that is strictly necessary and limited to the performance and improvement of the Services and to PALAM’s various legal, accounting and tax obligations.
3. WHEN IS PERSONAL DATA COLLECTED?
On the Application, Personal Data is collected by PALAM:
- When Users visit our Application (login details);
- When Users fill out one or more forms on the Application;
- When Users create and manage an Account;
- When PALAM receive and follow up posts by our Customers;
- When Users click on links to our social networking sites;
- During our contact and your actions on our social networking sites;
- As PALAM monitor the relationship between PALAM and Customers.
Once the contractual relationship has been established, certain Personal Data will be collected by PALAM.
4. HOW IS PERSONAL DATA COLLECTED BY PALAM?
4.1. ONLINE PERSONAL DATA COLLECTION CHANNELS
Personal Data is collected by PALAM through:
The Application, via User posts;
The User’s Facebook profile, via Facebook Login;
Direct contact (telephone, email, etc.) between the User and PALAM;
5. WHY DOES PALAM COLLECT PERSONAL DATA?
PALAM collects your Personal Data for the following purposes:
- To provide the Services set out above;
- To establish and monitor the contractual relationship;
- To manage relationships with prospective customers;
- To manage requests to access, rectify, transfer (if applicable) and object to the processing of personal data;
- Statistical analysis.
Data collection is carried out strictly for the purposes mentioned above and the monitoring thereof.
6. WHAT ARE THE LEGAL GROUNDS FOR COLLECTING PERSONAL DATA?
Article 6 of the GDPR states that a processing operation is lawful only if at least one of the following conditions is met:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
In this respect, PALAM stipulates that its Processing of Personal Data is based on:
- Requirements related to entering into and performing a contract;
- The legitimate interest of the Data Controller;
- The consent of the Data Subject, for particular processing operations listed below.
In any case, we take your interests and fundamental rights and freedoms seriously, and allow you to object, in full or in part, to the processing activities described in this Privacy Policy, at any time.
Your rights in relation to the Personal Data collected by PALAM are set out below.
Should you choose to object to the processing of your data, we will inform you of the consequences this shall have on the service requested.
7. WHAT DATA IS COLLECTED BY PALAM?
As part of our Services, we collect and process the following Personal Data:
Data to enter into or perform a contract:
- Contact details of prospective customers (future customers): surname, first name, e-mail address, telephone numbers, subject of the message and message (free text field);
- User’s login details (via Facebook, Google, or Apple Connect): Social network ID number, avatar, email address, first and last name;
- Data related to the Users’ use of the Services: User’s avatar, username and public pseudonym, biographical information supplied by the User, number of votes received for the User in relation to their activity, number of posts and subscribers, list of blocked persons, history of votes cast, User’s last post, login dates and activity history, access rights, account deletion date, username linked to content published by the User, text, images, videos and sound of content published and comments received in relation to this content;
Data collected for the purpose of legitimate interest:
Data related to the use and control of equipment:
- Data related to the use of the equipment provided through the Application;
- Contact details collected by the User’s social networks: Facebook, Google;
- Tracking and marketing data: IP address, Login data (dates, number of logins);
Data based on data subject’s consent:
- Facebook/Google/Apple Login and use of the Data collected by the chosen social network;
- Location data of the User’s device: GPS data of the User’s device
8. HOW DOES PALAM KEEP MY DATA SECURE?
PALAM takes the security and privacy of the data you send us very seriously.
As a result of this Policy, only Data Processors and partners that meet the standards set by current legislation are selected. In addition, all PALAM employees undertake to comply with a strict security and privacy policy.
In summary, PALAM implements legal and organisational instruments to ensure the best possible protection with regard to the classification and purposes of Personal Data collected in order to protect this Data against alteration, accidental or illicit loss, unauthorised use, disclosure or access.
PALAM therefore takes the following very seriously: Informing its employees about confidentiality requirements; Binding its Data Processors by confidentiality obligations; Securing access to its premises and IT platforms; Securing access to, sharing and transfer of Data; Implementing a general IT security policy; Selecting partners and service providers based on their compliance with the GDPR and other legal requirements applicable in France.
8.1. DATA STORAGE
Personal Data is stored on secure servers located in Europe that comply with the relevant security standards in relation to the Data processed.
8.2. CONFIDENTIALITY OBLIGATION
All PALAM employees are bound by a strict confidentiality obligation are informed about the requirement to comply with data protection legislation. Furthermore, all of the Data Processors selected by PALAM have stated that they comply with their obligations in this respect and are bound by a confidentiality obligation.
8.3. LOGIN DETAILS
Users create an Account on the PALAM Application by logging into a Facebook, Google, or Apple account.
The User will be asked to consent to the transfer of their Personal Data from Facebook/Google/Apple Login to the Application;
The login details for these accounts, which allow the User to log into the PALAM Application, are strictly personal and must under no circumstances be disclosed to a Third Party.
Please be aware that PALAM and our partners will never ask you for your password.
9. LOCATION TRACKING INFORMATION
Subject to your consent, PALAM may use the location Data of your device to enable you to Use the Services related to location tracking (posting, sharing information, searches).
In this respect, the location tracking settings on your device will be different depending on the operating system.
9.1. IOS/iPadOS User Location Settings
IOS and iPadOS Users can choose between three location tracking options on their device:
- ‘Never’: this option disables the Application’s access to the location of the User’s device. Therefore, the User will not be able to access Services related to location tracking (location-tracked posts, location-tracked search).
- ‘App active’: this option allows the Application to use the device’s location system only when the Application is active. As a result, the Services will only be able to operate in the background subject if the User has consented to this.
- ‘Always’: the Application can access the location of the User’s device, even when the Application is inactive in the background. The first time the Application is opened, the User will be asked to select one of the three options.
For more information about your device’s location services, please visit this link.
9.2. User location settings on Android
Android Users can choose between two location tracking options on their device:
- ‘Allow only while using the App’: this option allows the Application to use the device’s location system only when the Application is active. As a result, the Services will only be able to operate in the background if the User gives their consent.
- ‘Allow all the time’: the Application can access the location of the User’s terminal, even when the Application is inactive in the background.
- ‘Deny’: the Application can never use your location. Therefore, the User will not be able to access Services related to location tracking (location-tracked posts, location-tracked search).
For more information, please visit this link.
9.3. Sharing information related to location tracking
PALAM does not share any information related to its Users with Third Parties, including location Data.
10. HOW LONG MAY PALAM KEEP MY DATA?
Below you will find a list of the main retention periods applied by PALAM.
- Data used to create and update Customer profiles :
Period of use of Customer Account. In the event that the Account remains inactive for 12 months, PALAM may have to delete the Account after notifying the User.
- Raw audience measurement statistics and traffic data from the Application
13 months
- Data related to satisfaction surveys and customer opinions
36 months
As a matter of principle, PALAM shall delete the Data collected at the end of the contractual relationship, i.e. When the User closes their Account, where applicable.
If the User remains inactive (no logins to the Application, etc.) for a continuous period of 12 months, the Data collected will be deleted securely. Prior to deleting the data, PALAM may be required to seek the User’s consent to continue to use their Account, which would mean that PALAM would retain Data.
If the Customer does not give consent, the Data will be automatically deleted permanently and securely, with the exception of certain statistical Data which will be anonymised and may be used to improve PALAM’s customer experience.
Should the Account be deleted, all of the Data held shall be deleted, except Personal Data that may be kept by PALAM due to legal requirements and standards applicable to the processing in question.
At the end of the retention periods set out above, PALAM shall delete all Personal Data permanently and securely. The Customer may request a copy of the Data collected by PALAM until their Account is deleted.
Personal Data held on paper will be destroyed in a secure manner (shredded, burned or other). If stored electronically, it will be destroyed.
11. DOES PALAM COLLECT ‘SENSITIVE’ DATA AND/OR DATA RELATING TO CHILDREN?
The GDPR defines ‘sensitive’ Data as:
“Information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health or sex life. In principle, sensitive data can only be collected and used with the explicit consent of the data subject.”
In this respect, PALAM affirms that in principle it is not required to collect Sensitive Data sent by the User when providing Services.
Sensitive Data that may be collected by PALAM shall only be collected using the tools made available to the User.
In this regard, the User undertakes not to disclose sensitive information and Data about themselves or a Third Party when customising the Product, and to limit the information and Data provided on the Application to what is strictly necessary.
Regarding Personal Data relating to minors, Recital n°38 of the GDPR provides that:
“Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child.”
Article 7.1 of the French Data Protection Act sets the age limit for the use of Personal Data to 15 years old.
In this context, PALAM may be required to collect Data from Users below the age of 15.
12. WHAT ARE THE OBLIGATIONS OF USERS?
Firstly, the User must use recognised and up-to-date internet access programs, including the various addon modules giving access to the Services. The User shall provide PALAM with accurate and up-to-date information relating directly to them. In this respect, when providing Data on the Application or directly, each User shall comply with PALAM’s General Terms and Conditions. Finally, the User shall not disclose (for example by email) any information not expressly requested by PALAM necessary for the provision of the Services.
13. OPTIONAL AND MANDATORY PERSONAL DATA
Only form fields marked with an asterisk (*) are mandatory for those wishing to access PALAM Services. Providing other data is optional and may improve the User’s experience on the Application and enable PALAM to customise this.
14. WILL MY CONTACT DETAILS BE USED FOR ADVERTISING PURPOSES? WILL I RECEIVE SPAM FROM PALAM?
PALAM does not carry out marketing by sending emails without the prior agreement of the User. Pursuant to the applicable legal and statutory provisions, PALAM may only send you marketing offers or commercial offers if you have given your clear, unambiguous and explicit consent to receiving these. Tick boxes are provided in the Application for you to give consent. It is also possible to withdraw your consent at any time if you no longer wish to receive such offers. The User is not required to consent to receiving commercial offers in order to create an Account. Therefore, the Customer may accept PALAM’s Terms and Conditions without ticking the box to receive additional promotional offers. Users are reminded that during the entire contractual relationship between the User and PALAM, i.e. while the User holds a personal Account, PALAM may send the User promotional offers by email, for marketing purposes, for products and services similar to those of PALAM, or if the marketing is not of a commercial nature. The User will be able to opt out of receiving marketing emails, simply and free of charge: By unsubscribing from PALAM’s emailing database by selecting the relevant option in each email sent by PALAM. In any case, every email sent by PALAM will be signed and will clearly state the name of the person that wrote it and how to unsubscribe. In the event that emails signed by PALAM are sent to you and do not include this information, please notify PALAM as soon as possible.
15. AUTOMATED EMAILS AND PROCESSING
Personal Data collected by PALAM is not subject to automated decisions alone. Automated decision-making or processing will always be subordinate to a human person.
16. WHERE IS THE DATA COLLECTED BY PALAM PROCESSED?
PALAM mainly processes Data on servers located in Europe. Our Data Processors are mainly based in the European Economic Area. Rarely, for certain specific Services, the Data collected by PALAM may be sent to data Processors located outside the European Union. In this case, PALAM shall ensure that the appropriate guarantees are provided by the Data processors concerned to govern any transfer of Personal Data, by entering into specific agreements to protect the rights of Users.
17. WHO RECEIVES THE DATA COLLECTED? WILL PALAM SHARE MY DATA WITH THIRD PARTIES?
Personal Data collected by PALAM may be sent to the Data Processors selected by PALAM if they require the Data in order to carry out their duties for PALAM (in particular the storage of Data). Otherwise, PALAM does not transfer or assign any Data, relating directly or indirectly to its Users, to Third Parties. In addition, Data related to the User’s login via Facebook, Google, or Apple is sent to the chosen platform and some Data can thus be transmitted to these platforms by PALAM (permission to use the Login, login activities). For more information regarding the use and sharing of Data with Facebook, Google, or Apple, please refer to the information provided on these platforms directly.
18. OUR DATA PROCESSORS
PALAM uses data processors in order to supply its Users with the best Services. If you would like to access our extensive list of subcontractors, you can contact PALAM directly using a contact form or the contact details provided in Article 23 of this Privacy Policy.
19. WHAT RIGHTS DO USERS HAVE?
Pursuant to the current general European regulations on data protection, each User has the right to obtain information about the Personal Data collected by PALAM free of charge. Your rights and claims include the following:
- Article 15 GDPR – Right to information on how Personal Data is processed by PALAM;
- Article 16 GDPR – Right to rectify Personal Data collected by PALAM through the Account or by contacting PALAM directly;
- Article 17 GDPR – Right to have Personal Data deleted. This right does not apply to all the Data collected;
- Article 20 GDPR – Right to transfer data (portability), this right only applies to Data collected based on consent or a contract;
- Article 21 GDPR – Right to object to the processing of Personal Data.
The User may send any such request using the contact details provided in Article 23.
If necessary, PALAM may ask you for certain additional information (proof of identity, username, etc.) to confirm your identity for exercising your rights.
20. WHAT HAPPENS TO MY DATA IN THE EVENT OF MY DEATH? WHO WILL HAVE ACCESS TO THE DATA DISCLOSED?
PALAM may be required to hold a deceased person’s personal data. In this case, Law No.2016-1321 of 7 October 2016 stipulates that the personal rights of the deceased shall lapse upon the death of their holder. However, the regulations provide for two exceptions in which these rights may continue to apply on a temporary basis:
- The deceased has given instructions during their lifetime to any person regarding the storage, erasure or disclosure of their personal data after their death;
- If the data subject does not instruct otherwise, the rights relating to the below may, “to the extent necessary”, be exercised by their heirs:
- "the organisation and settlement of the estate of the deceased. In this respect, heirs may have access to the processing of personal data about them to identify and receive information required for the liquidation and distribution of the estate. They may also receive information about digital assets or data resembling family heirlooms that can be passed on to heirs”
- “when the data controllers, take account of their death. In this respect, heirs may close the user accounts of the deceased, object to further processing of personal data about them or update such data”.
In the event that you would like to inform PALAM of your instructions regarding the post-mortem disclosure of Personal Data, please contact us using the contact details in Article 23 of this Policy.
21. HOW ARE USERS NOTIFIED OF CHANGES TO THIS PRIVACY POLICY?
PALAM may amend this Privacy Policy at any time.
PALAM shall inform Users by any means of any amendments made to this document.
PALAM requests that Users regularly review the Privacy Policy in order to keep up-to-date with the provisions.
22. SUPERVISORY AUTHORITY
Should you feel that PALAM is not complying with its obligations regarding the protection of Personal Data, you may contact the relevant supervisory authority, i.e. the CNIL (French Data Protection Authority) (https://www.cnil.fr/fr/agir or 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07).
23. PALAM CONTACT DETAILS
Users may contact PALAM for any questions they may have about this Privacy Policy at the following addresses:
By e-mail at the following address: contact@palam.app
By post at the following address:
PALAM SAS
7 ALLÉE DE CHARTRES
33000 BORDEAUX
FRANCE
You may be asked to provide proof of identity before your request is processed.