The purpose of this personal data protection policy is to inform users of the website mon-compte.bzh about the commitments and measures taken to ensure the protection of their personal data in the context of the processing operations carried out by Mégalis Bretagne.
This approach is part of the personal data protection framework established by :
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (GDPR); and
- French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties, as amended.
This Privacy Policy may be updated to reflect legal and regulatory developments, as well as guidance issued by the Commission Nationale de l’Informatique et des Libertés (CNIL), the French Data Protection Authority. Any new versions will take effect upon publication.
I. Purpose of the mon-compte.bzh website
The mon-compte.bzh website is a solution for identifying and authenticating a user with partner online services operating in Brittany and offering our identification services.
It allows you to centralise all login information for the various partner platforms in a single account and to control how the data stored in that account is used.
mon-compte.bzh serves as the interface between our identification tool and the partner service provider by generating a unique technical identifier.
II. Who are we ?
Mégalis Bretagne is the controller for the processing operations carried out via the mon-compte.bzh website:
- Mégalis Bretagne, Syndicat mixte de coopération territoriale, registered under number 253 514 491 000 47, with its registered office at 15 Rue Claude Chappe, 35510 Cesson-Sévigné, represented by its President.
ATOS acts as a processor:
- ATOS France, registered under number 408 024 719 00572, with its registered office at 80, quai Voltaire – Immeuble River Ouest, 95870 Bezons.
The controller has appointed a Data Protection Officer (DPO). The DPO’s role is to ensure compliance with the personal data protection regulations.
The DPO is consulted prior to the creation, implementation or modification of any system involving the processing of personal data. The DPO maintains a register listing all Mégalis Bretagne personal data processing activities as they are implemented.
The DPO also ensures respect for individuals’ rights (right of access, rectification, objection, erasure, restriction of processing and, where applicable, data portability).
To exercise these rights, data subjects may contact the DPO by email at : dpo@megalis.bretagne.bzh.
III. Personal data processed
In the course of managing the use of the mon-compte.bzh website, Mégalis Bretagne collects the following data :
- Identification data of natural persons : title, birth name, preferred name, given name(s), date and place of birth, email address, and telephone number.
- Authentication data via FranceConnect : information provided by FranceConnect for authentication on the mon-compte.bzh website.
- Connection data : IP address.
Data are collected either: directly from users, in relation to identification information; or indirectly, through the transfer of data provided by FranceConnect.
IV. Purposes of data collection and data retention periods
The processing operations carried out by the data controller pursue explicit, legitimate and specific purposes.
Depending on the purpose of the processing, the retention period for users’ personal data may vary.
The data controller retains personal data only for the time necessary to achieve the purpose for which it was collected or to meet legal obligations.
Below are the purposes for which data are collected, together with their corresponding legal bases and retention periods :
- To manage your access to mon-compte.bzh and its use, and to respond to any request regarding your use of the services.
- Legal basis : performance of the Terms of Use.
- Retention period : the account is deleted at the user’s request or after a period of 24 months of inactivity.
- To secure access to mon-compte.bzh (nouvel onglet) by verifying potential compromises of user information (in partnership with Anozrway).
- Legal basis : performance of the Terms of Use.
- Retention period : records are retained by Anozrway for a rolling period of six months.
- To manage the relationship between Mégalis Bretagne and its users, enabling Mégalis Bretagne to centralise user requests and respond more efficiently.
- Legal basis : legitimate interest.
- Retention period : five years after the last contact.
- To transfer your personal data to partner platforms.
- Legal basis : consent.
- Retention period : data are deleted upon withdrawal of consent.
- To send you information about updates and news concerning our services.
- Legal basis : consent.
- Retention period : data are deleted upon withdrawal of consent.
- To share information about the operational status of services related to the mon-compte.bzh website.
- Legal basis : performance of the Terms of Use.
- Retention period : data are deleted 24 months after the request has been processed.
- To process and follow up on your support requests, complaints or the exercise of your rights.
- Legal basis : performance of the Terms of Use.
- Retention period : data are deleted 24 months after the request has been processed.
- To compile usage and traffic statistics for our services and to optimise their operation and efficiency.
- Legal basis : legitimate interest.
- Retention period : data used for statistical purposes are anonymised.
When Mégalis Bretagne no longer needs to use users’ personal data for the purposes described above, such data are either deleted from its systems and files or anonymised, so that individuals can no longer be identified.
V. Recipients of personal data
Within Mégalis Bretagne, the recipients of personal data are only those staff members who are duly authorised to process it as part of their duties. The data controller does not rent, transfer, or sell users’ personal data, including for commercial prospecting purposes.
However, personal data may be processed on behalf of and under the instructions of Mégalis Bretagne by trusted service providers. In such cases, Mégalis Bretagne ensures that all providers with whom it works maintain strict confidentiality and security standards. Mégalis Bretagne may, in particular, transfer personal data to :
- the data hosting provider;
- the service provider managing email communications for information distribution;
- the partner responsible for verifying potential credential breaches;
- partner platforms with which users choose to connect or interact. Mégalis Bretagne may also share users’ data with:
- public-sector agents responsible for the management of public services and related administrative or accounting operations, in particular those who must access the data or processing results, and their hierarchical superiors;
- authorised State services carrying out oversight activities in this area;
- public officers or ministerial officials;
- financial, judicial, administrative, or regulatory authorities, as well as public agencies, where Mégalis Bretagne may be required to disclose certain data — for instance, in the context of a legal proceeding, investigation, audit, or official request — within the limits permitted by applicable law.
Finally, some anonymised data may be shared with third parties. Such data are transmitted in a form that no longer allows individuals to be identified.
VI. Storage of personal data
Mégalis Bretagne carries out all personal data processing operations relating to mon-compte.bzh within the territory of the European Union (EU).
The data collected through the mon-compte.bzh website are hosted on servers located in France.
VII. Security of personal data
Mégalis Bretagne undertakes to take all necessary measures to ensure the security and confidentiality of users’ personal data, in particular to prevent such data from being damaged, erased, or accessed by unauthorised third parties.
In the event of a security incident resulting in the accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access to users’ personal data, Mégalis Bretagne undertakes to make all necessary notifications in accordance with applicable data protection regulations.
VIII. Rights relating to personal data protection
In accordance with data protection regulations, users have the following rights, depending on the circumstances :
- Right to information : Users are informed in a clear, transparent, understandable and easily accessible manner about how Mégalis Bretagne uses their personal data and about their rights, notably through this Privacy Policy.
- Right of access : Users may obtain a copy of their personal data by downloading a file via a dedicated feature available on the website.
- Right to data portability : Users may receive their data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from Mégalis Bretagne. This right applies only to data provided by the user and processed on the basis of consent or the performance of the mon-compte.bzh Terms of Use.
- Right to withdraw consent : Users may notify Mégalis Bretagne of their decision to withdraw consent to the processing of their personal data (where processing is based on consent).
- Right to rectification : Users may ask Mégalis Bretagne to correct inaccurate or outdated personal data, or to complete incomplete data, by directly updating their information through the website interface.
- Right to object : Users may contact Mégalis Bretagne to express their wish to stop their data being processed for the purposes described.
- Right to erasure : Users may request the deletion of their personal data by contacting the Brittany Region at the following address: dpo@megalis.bretagne.bzh.
- Right to restriction of processing : Users may request the restriction of data processing in relation to their personal data.
- Right to lodge a complaint : Users have the right to file a complaint with the competent data protection authority in their country if they wish to challenge the way their personal data are being processed.
To exercise these rights, users may write to the following address : dpo@megalis.bretagne.bzh.
If Mégalis Bretagne has reasonable doubt regarding the identity of the person making the request, it reserves the right to request additional information or supporting documents in order to verify that identity. Mégalis Bretagne undertakes to respond to all requests for the exercise of rights as promptly as possible and, in any event, within the time limits prescribed by law.
