Legal information
Data protection and respect for individuals
Processing carried out by eurocrm, legal bases, retention periods, international transfers and your rights.
Last updated: 16 September 2026. The French version of this page prevails.
The essentials
EURO CRM FRANCE is the controller for the processing it determines in relation to the operation of the site, its institutional and commercial relations, certain datamarketing operations, recruitment and the management of its partners.
In services delivered for client brands, a eurocrm entity most often acts on their behalf and according to their instructions. The exact role of each party depends on the operation concerned.
For commercial telephone prospecting of consumers, prior consent has been the principle since 11 August 2026, subject to the exceptions provided for by law. Where consent is required, eurocrm ensures that it can be demonstrated.
You can object to prospecting, withdraw your consent where processing is based on it, obtain information on the origin of your data under the conditions provided for by regulation, and exercise your rights free of charge at dpo@eurocrm.com.
The site uses no advertising tracker and no tracker subject to consent. The trackers used are described on the page “Cookies and trackers”.
Controller and scope
EURO CRM FRANCE, a simplified joint-stock company whose registered office is located at 11 rue de Solférino, 75007 Paris, is the controller for the processing whose purposes and means it determines, in particular for the site www.eurocrm.com, its professional relations, the management of its prospects, partners and candidates, and certain datamarketing operations of its own.
EURO CRM FRANCE also acts, together with other eurocrm group entities, on behalf of client brands. In that context, the eurocrm entity concerned generally acts as a processor within the meaning of the GDPR, on the documented instructions of the client, which remains the controller. Depending on the nature of the operation and the actual allocation of responsibilities, a eurocrm entity may also act as a separate controller or, where the legal conditions are met, as a joint controller. This qualification is determined case by case in the contracts and in the information provided to the individuals concerned.
This policy describes the principles applied by eurocrm and the processing for which it is responsible. It does not replace the information that a client brand must provide when it determines the purposes of processing carried out by eurocrm on its behalf.
EURO CRM FRANCE obtained the “GDPR Governance” label issued at the time by the CNIL in 2018. This reference is historical and does not mean that eurocrm currently holds a valid CNIL label or certification.
Data protection governance
eurocrm has an internal personal data protection policy, a data protection officer, procedures for handling rights requests, incidents and data breaches, authorisation and retention rules, and team awareness programmes.
The group's general governance also includes an anti-corruption prevention charter and a CSR policy. These arrangements are combined with the contractual obligations specific to each client and each engagement.
Our principles
eurocrm designs its processing around simple principles: identified purpose, determined legal basis, data minimisation, understandable information, defined retention periods, security adapted to risks, traceability and effective exercise of rights.
When data is used to contact a person, eurocrm takes into account the channel, the collection context, the person's status, the subject of the solicitation, the applicable legal basis and, where relevant, sector rules.
Regulatory developments relating to commercial solicitation are built into the collection, selection, routing, proof, objection and audit processes, in order to limit unwanted contacts and preserve the quality of the relationship with individuals.
Where relevant, eurocrm also takes into account professional codes and recommendations applicable to customer relations, data and marketing, including those published by the SP2C and the professional organisations representing marketing and data. These frameworks supplement legal rules without replacing them.
Data processed and sources
Depending on the context, eurocrm may process identification and contact data, professional information, information relating to a request or project, browsing and security data, information linked to the commercial relationship, elements relating to the origin and proof of consent, solicitation or objection statuses, commercial qualification information, and the data required to deliver a customer relations or datamarketing service.
Data may be provided directly by the person, by the company they represent, by a eurocrm client, by a partner or data supplier, or come from publicly accessible sources where their collection and reuse are lawful and compatible with the purpose pursued.
Where data is not collected directly from the person, the information required by regulation is provided within the applicable deadlines, in principle within one month of obtaining it and, if a communication takes place earlier, at the latest at the time of that first communication.
Where data comes from a third party for a prospecting or customer relations operation, eurocrm applies, according to its role, controls relating in particular to provenance, collection arrangements, information provided, legal basis, the scope of consent where required, and arrangements for exercising rights.
Processing related to the site
Pre-contractual measures and, depending on the context, legitimate interest
Contact form and e-mails sent to eurocrm
Purposes: respond to the request, qualify the need, organise discussions and, where applicable, prepare a commercial relationship. Data: first name, last name, job title, company, e-mail, telephone if a call back is requested, services of interest, message, attachments, originating page. Retention: time needed to handle the request, then, for a prospect, three years from the last contact initiated by the prospect. Form attachments are deleted from the storage area within a maximum of 90 days, unless they must be included in a contractual or pre-contractual file.
Legitimate interest in ensuring the security of the site
Protecting the form against abuse
Purposes: detect automated, fraudulent or diverted submissions. Data: IP address, timestamp, strictly necessary technical elements. Retention: 24 hours, unless an incident requires longer retention for evidential purposes.
Legitimate interest, under the consent exemption conditions defined by the CNIL
Audience measurement exempt from consent
Purposes: produce traffic statistics and improve the site. Data: pseudonymised browsing data, truncated IP address. Retention: a maximum of 25 months for measurement data.
Legitimate interest and security obligations
Security logs
Purposes: secure the site, detect incidents and establish the facts. Data: IP address, timestamp, request, browser, security events. Retention: six months in principle, with limited extension where an incident justifies it.
Legitimate interest in securing publication
Site contributor accounts
Purposes: manage access to the publishing tool and trace changes. Data: identity, professional e-mail, role, action log. Retention: for the duration of the role, then the activity log is kept for one year unless a specific need arises.
The site infrastructure and the storage directly associated with the site are hosted in France by OVH SAS. Requests sent through the form are then routed to eurocrm's professional mail system. The processing specific to that mail system is covered by the internal mapping of providers and transfers.
Main processing for which eurocrm is responsible
Pre-contractual measures and, depending on the context, legitimate interest
Contact, meeting, quote or presentation requests
Respond to the request, qualify the need, organise discussions and prepare a possible contractual relationship. Retention: time needed to handle the request, then, for a prospect, three years from the last contact initiated by the prospect.
Contract, legal obligations and legitimate interest
Relations with clients, partners and suppliers
Contractual, operational, administrative, financial and compliance management. Retention: for the duration of the relationship, then archiving according to applicable legal or limitation periods.
Legitimate interest, subject to the right to object
B2B commercial relations
Present services relevant to the professional role and ensure commercial follow-up, respecting the rules specific to the channel used. Retention: three years from collection or from the last contact initiated by the prospect, unless a contractual relationship or a separate obligation applies.
Consent where required by regulation, otherwise legitimate interest where lawful
Collection and activation of prospect data for datamarketing
Build, verify, deduplicate and update prospect data, send solicitations and, where the person has agreed, pass contact details to partners. Retention: compatible with the purpose and legal basis, within the validity period of consent where required and, for prospect data, three years from collection or from the last contact initiated by the prospect unless a shorter rule applies.
Legal obligation
Proof of B2C telephone consent
Demonstrate consent and respond to proof requests. Retention: three years from the collection of consent, with limited additional retention where necessary to establish, exercise or defend legal claims.
Respect for individuals' rights and legitimate interest
Management of objections
Prevent any solicitation incompatible with the objection expressed. Retention: at least three years in line with the CNIL recommendation, with periodic review and data minimisation.
Pre-contractual measures and legitimate interest
Recruitment
Process an application and, where relevant, build a talent pool. Retention: duration of the recruitment process, then, for an unsuccessful application kept in the talent pool, two years from the last contact, unless an earlier objection or erasure request is made.
Legal obligation
Exercise of rights
Handle requests, respond to them and keep proof of how they were handled. Any identity document is deleted after verification. The request file is kept for the period useful to demonstrate compliance with obligations.
These are reference retention periods. A different period may apply where a legal text, a contract, a lawful client instruction, litigation or an evidential obligation requires it. In that case, the additional retention is limited to what is necessary and is documented.
Datamarketing and transfers to partners
Where eurocrm collects data through its own journeys or through partners acting on its behalf, the person is informed of the identity of the controller, the purposes, the solicitation channels, the identity of the partners likely to receive the data, whose up-to-date list is accessible from the collection form, and of their rights. Each partner informs the person of the origin of their data at the latest at the time of the first communication.
Where consent is the applicable legal basis, it is obtained through a clear affirmative action, without pre-ticked boxes, and with the level of granularity required by the purposes and channels concerned. Refusing consent that is not necessary for the service requested does not condition access to that service.
Data is subject to consistency checks, deduplication and, where relevant, comparison with objection lists. The elements used to demonstrate consent are linked to the source, date, time and context of collection.
Where a partner receives contact details to use under its own responsibility, it must comply with its own obligations regarding information, legal basis, security, retention and individuals' rights. Where necessary, eurocrm organises contractually the circulation of consent withdrawals and objections between the parties concerned.
Telephone solicitation of consumers
Since 11 August 2026, commercial telephone prospecting of a consumer has in principle been based on their prior consent, subject to the exceptions provided for by law.
Where eurocrm calls a consumer on its own behalf or on behalf of a client brand, the basis for the call must be identified and documented. Where consent is required, eurocrm ensures, according to its role in the processing, that it is freely given, specific, informed, unambiguous, revocable and expressed through a clear affirmative action.
Consent to telephone marketing may not last more than one year. It cannot be tacitly renewed. The evidence required by regulation is kept for three years and is provided free of charge on a durable medium to any consumer who requests it.
Consent may be withdrawn at any time, including orally during a call, and it must be possible to do so through arrangements no more complex than those used to obtain it.
Exceptions to prior consent are used only where their conditions are actually met. This applies in particular to certain solicitations directly linked to the performance of an ongoing contract and to call-backs expressly requested by the consumer, under the conditions and limits set by law.
eurocrm also applies the rules on days, times, frequency, prohibited or more strictly regulated sectors, and caller identification obligations applicable to the operation concerned.
Solicitation of professionals
Where a person is contacted in a strictly professional context, the rules may differ from those applicable to a consumer. eurocrm nevertheless ensures that the person is informed, that the solicitation is limited to a subject relevant to their activity or role, and that they can object simply and free of charge to further solicitation.
Publicly accessible data is not freely reusable for that reason alone. Its collection and reuse must remain lawful, proportionate and compatible with the reasonable expectations of the person concerned.
E-mails, SMS, messaging and other electronic communications
For electronic communications addressed to individuals, eurocrm obtains prior consent where article L. 34-5 of the French Post and Electronic Communications Code requires it, subject to the exceptions set out in that text, in particular in certain relationships with existing customers for similar products or services.
In a professional context, a communication may, depending on the circumstances, rely on legitimate interest within the meaning of the GDPR where it relates to the recipient's professional activity or role and the conditions specific to the channel used are met.
Each prospecting communication identifies the sender or makes it possible to identify them and includes a simple means of exercising the right to object or withdraw where that right applies.
Data suppliers and partners
Where data comes from an agency, a data broker, a lead supplier or another partner, eurocrm does not consider the mere delivery of a file to be a sufficient guarantee of compliance.
Contracts, supplier approval procedures and controls cover, depending on the risk and on eurocrm's role, the origin of the data, collection arrangements, information given to individuals, the recipients announced, the legal basis, the scope of consent where required, the collection date, the evidence available and the management of rights.
Where eurocrm acts on behalf of a brand, these controls are combined with the obligations and instructions of the controller and do not transfer to eurocrm the responsibilities that the law assigns to each party.
Recording and analysis of conversations
Depending on the nature of the service, certain conversations may be recorded to ensure quality, train or assess teams, secure an operation, establish proof or meet a specific obligation. The person is informed of the recording and of its purpose under the conditions applicable to the operation.
Access to recordings is limited to authorised staff. The retention period depends on the purpose. Recordings used solely for quality or training purposes are kept for a short and defined period. A different period may apply where an item is required to prove a consent, a subscription or an instruction, or to defend a right.
Automated analysis or artificial intelligence tools may be used for certain quality, transcription, qualification or processing support purposes. Their use is governed by the applicable minimisation, confidentiality, security and governance rules.
Artificial intelligence and automated decisions
eurocrm distinguishes the automation of a process from the use of an artificial intelligence system. An AI system is used where it meets an identified purpose and its use is compatible with applicable security, data protection, transparency and auditability requirements.
Where an AI system is intended to interact directly with a person, eurocrm ensures that they are clearly informed that they are interacting with an AI system where that information is required and where the automated nature of the interaction is not already clear from the context.
In connection with the use of the corporate site, EURO CRM FRANCE bases no decision producing legal effects or similarly significantly affecting a user solely on automated processing. Should processing falling under article 22 of the GDPR be implemented in a particular context, specific information and the required safeguards would be provided.
Where AI systems are used in a service delivered for a client, their role, purposes, the data processed and the responsibilities are determined by the contract, the controller's instructions and applicable regulation.
Recipients and group entities
Data is accessible to authorised eurocrm teams according to their duties, as well as to the technical providers, advisers, partners or processors that need access for the purpose concerned and that are bound by appropriate contractual obligations.
Main French group entities
- EURO CRM FRANCE, SIREN 432 380 822: 11 rue de Solférino, 75007 Paris
- EURO CRM NORMANDIE, SIREN 751 872 508: 272 rue Edouard Branly, 14100 Lisieux
- EURO CRM NORD, SIREN 827 946 112: 11 rue de Solférino, 75007 Paris
- EURO CRM OCCITANIE, SIREN 991 536 418: 11 rue de Solférino, 75007 Paris
- CCA WEST EURO CRM CARAIBES, SIREN 439 265 752: 28/29 Immeuble Futura, Zone Industrielle Jarry, Voie N1, 97122 Baie-Mahault
In Mauritius, the group's activities are carried out in particular by EURO CRM Mauritius Ltd., Avenue Mahatma Gandhi, Moka 80808, Mauritius. The group also operates in Madagascar, in Antananarivo.
The operational sites and the entities that actually take part in a service depend on the contractual organisation chosen. An operational site may belong to an entity whose registered office is located in another city.
Transfers outside the European Economic Area
Certain services agreed with clients may require access to or processing of data from Mauritius or Madagascar. As at the date of this policy, these countries do not benefit from a European Commission adequacy decision allowing a transfer on its own without additional safeguards.
Where the GDPR applies to a transfer to one of these countries, eurocrm and the controller concerned put in place the mechanism provided for by chapter V of the GDPR that is appropriate to the situation. Where the European Commission's standard contractual clauses are used, they are used in their version in force and are supplemented, where necessary, by a transfer assessment and by additional technical, organisational or contractual measures.
Reliance on a derogation based on a person's consent is not used as a general mechanism for international transfers.
Mauritius has the Data Protection Act 2017, in force since 2018, and a supervisory authority, the Data Protection Office, under the authority of the Data Protection Commissioner.
Madagascar has law no. 2014-038 on the protection of personal data. That law establishes the Commission Malagasy de l'Informatique et des Libertés, CMIL, as the supervisory authority provided for by Malagasy law.
These local laws contribute to the protection framework applicable to operations conducted in the countries concerned. They do not replace the safeguards required by the GDPR where a transfer falls within that regulation.
Anyone may request information about the safeguards applying to a transfer concerning them by writing to dpo@eurocrm.com.
Security and confidentiality
eurocrm implements technical and organisational measures proportionate to the risks in order to preserve the confidentiality, integrity, availability and traceability of data. Depending on the context, these measures include authorisation management, authentication, logging, environment segregation, encryption or pseudonymisation where relevant, backup, monitoring, incident management, team awareness and contractual oversight of processors.
For security reasons, this policy does not describe technical configurations or mechanisms whose disclosure would reduce their effectiveness.
Your rights
Under the conditions provided for by regulation, any person may request access to the data concerning them, its rectification or erasure, the restriction of processing, portability where that right applies, and may exercise a right to object.
Where processing is based on consent, that consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal.
The right to object to the use of data for commercial prospecting purposes is exercised simply and free of charge and requires no particular reason.
Where a person objects to prospecting, eurocrm may keep, in an objection list, only the information necessary to prevent a further solicitation incompatible with that objection. The CNIL recommends retention of at least three years. Where relevant, eurocrm favours minimised or hashed data.
A person may also request information about the origin of their data where it was not collected directly from them and, under the conditions provided for by regulation, about the recipients to whom it has been disclosed and the safeguards applying to an international transfer.
In France, a person may set instructions on the retention, erasure and communication of their data after their death, under the conditions provided for by law.
Exercising your rights and contacting the DPO
eurocrm's data protection officer can be contacted by e-mail at dpo@eurocrm.com or by post at EURO CRM FRANCE, for the attention of the Data Protection Officer, 11 rue de Solférino, 75007 Paris, France.
A request must make it possible to identify the person and the processing concerned with sufficient certainty. An identity document is requested only where there is reasonable doubt about the requester's identity, and only to the extent necessary for verification.
eurocrm responds to requests within the period provided for by the GDPR. That period is in principle one month and may be extended by two further months where the complexity or number of requests justifies it. The person is then informed of the extension and of the reasons for it within the first month.
A person may lodge a complaint with the Commission nationale de l'informatique et des libertés, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or use the online complaint service available at www.cnil.fr.
Where the processing falls mainly within the responsibility of a client brand for which eurocrm acts as a processor, eurocrm forwards the request to the client concerned or assists it in handling the request in accordance with the contract and the GDPR.
Cookies and other trackers
Details of the trackers actually used on the site are set out on the page “Cookies and trackers”.
The site uses no advertising tracker, no social network pixel and no tracker subject to consent. Audience measurement is carried out with Matomo, without a measurement cookie, under the consent exemption conditions defined by the CNIL.
Should a tracker subject to consent be added, it would only be stored or read after obtaining valid consent, with refusal as simple as acceptance and the possibility of changing the choice at any time.
Policy updates
This policy may be amended to reflect legal, regulatory, case-law, technical, contractual or organisational developments. The update date shown at the top of the page identifies the published version.
A substantial change concerning processing already under way is subject to appropriate information where regulation requires it.
Let's discuss your programme.
We frame a first scope together, the expected indicators and the engagement model that suits you.