1. Data Controller

COVALIGEN acts as a Data Controller within the meaning of the General Data Protection Regulation (GDPR), as we process personal data relating to our clients, business partners, and other individuals who interact with our services.

Our contact details are provided below:

• Company name: COVALIGEN

• Location: Bartenheim, Alsace, France

• Company Registration Number: […]

If you have any questions regarding the processing of your personal data, please contact us at covaligen@gmail.com.

2. Processing Activities

2.1. Website Visitors

When you visit our website, we use cookies and similar technologies to ensure its proper functioning.

Further information regarding the use of cookies, their purposes, and your choices can be found in our Cookie Policy.

2.2. Communication with Prospective Clients

If you have any questions about our website or would like to learn more about our services, you may contact us through the following channels:

• Contact form

• Email

• Telephone

• Professional networking platforms, such as LinkedIn

When you contact us through these channels, we process your personal data for the purpose of communicating with you, including responding to enquiries concerning our services.

We only process the personal data that you voluntarily provide during our communications.

The categories of personal data generally processed include:

• Full name

• Email address

• Telephone number, where applicable

• Company name

Legal basis for processing: Article 6(1)(f) of the GDPR — Legitimate Interests.

Our legitimate interest consists of responding to enquiries, maintaining professional communications, and developing business relationships.

We retain correspondence for as long as necessary to determine whether a business relationship will be established.

Where justified by specific circumstances, certain personal data may be retained for a longer period, provided that such retention complies with applicable data protection legislation.

2.3. Clients

We process personal data relating to our clients to ensure the proper provision, management, and administration of our services.

The personal data processed may include:

• Full name

• Postal address

• Company name and relevant business information

• Details of services provided

• Contractual arrangements and specific agreements

• Billing and payment information

• Other information necessary for the performance of our contractual obligations

Legal basis for processing: Article 6(1)(b) of the GDPR — Performance of a Contract.

Following the completion of the services and settlement of any outstanding payments, personal data will be deleted or securely archived when no longer necessary, unless further retention is required by law, justified by legitimate interests, or necessary in connection with an ongoing contractual or business relationship.

2.4. Accounting and Financial Records

We retain invoices, accounting records, and related supporting documents for accounting, financial reporting, and compliance purposes.

These documents may contain personal data, including:

• Full name

• Postal address

• Company name

• Description of services provided

• Payment and invoicing information

We are legally required to retain certain accounting documents in accordance with applicable French accounting and commercial legislation.

Legal basis for processing: Article 6(1)(c) of the GDPR — Compliance with a Legal Obligation.

Accounting documents and supporting records are generally retained for 10 years, in accordance with applicable French legal requirements.

2.5. Job Applications

We welcome job applications and process candidates' personal data to assess their suitability for current or potential employment opportunities within COVALIGEN.

When you submit an application, we may process the personal data contained in your CV, cover letter, and any other documents or information provided during the recruitment process.

Legal basis for processing: Article 6(1)(f) of the GDPR — Legitimate Interests, where applicable.

Our legitimate interest consists of assessing applications and identifying candidates whose qualifications, experience, and professional profiles correspond to our recruitment needs.

Unsolicited applications are assessed to determine whether they match our current recruitment requirements.

Where an application does not correspond to an existing opportunity, the relevant personal data will be deleted unless its further retention is justified and permitted under applicable data protection legislation.

For applications submitted in response to a specific job vacancy, unsuccessful candidates will be informed of the outcome of the recruitment process. Their personal data will be retained only for an appropriate period, in accordance with applicable legal requirements and retention policies.

If your application is successful and you are recruited by COVALIGEN, you will receive separate information concerning the processing of your personal data in the context of your employment.

3. Disclosure of Personal Data

We do not sell or disclose personal data to third parties for their own independent marketing purposes.

Where necessary for the operation of our business and the provision of our services, personal data may be processed by authorised service providers acting on our behalf and under our instructions.

Such processing is subject to appropriate confidentiality, security, and data protection obligations, in accordance with the GDPR.

4. Profiling and Automated Decision-Making

We do not carry out profiling or make decisions based solely on automated processing, including profiling, that produce legal effects concerning individuals or similarly significantly affect them, within the meaning of Article 22 of the GDPR.

5. Transfers of Personal Data to Third Countries

We primarily use data processors established within the European Union (EU) or the European Economic Area (EEA), or service providers that store and process personal data within these territories.

In certain circumstances, personal data may be transferred to or accessed from countries outside the EU/EEA.

Where such transfers occur, we ensure that appropriate safeguards are implemented in accordance with Chapter V of the GDPR.

These safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses (SCCs), or other legally recognised transfer mechanisms, as applicable.

6. Data Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing of personal data.

We assess the risks associated with our processing activities and implement proportionate security measures to protect personal data against unauthorised access, accidental loss, destruction, alteration, or unlawful disclosure.

Our security measures include reviewing internal procedures, promoting awareness of data protection obligations, and providing employees with relevant information and training concerning the GDPR and information security.

Where applicable, we may use continuous cybersecurity awareness training resources, including those provided by RGPD.COM.

7. Rights of Data Subjects

Under the General Data Protection Regulation (GDPR), individuals have several rights concerning the processing of their personal data.

These rights are subject to the conditions and limitations established by applicable data protection legislation.

If you wish to exercise any of these rights, please contact us at covaligen@gmail.com.

7.1. Right of Access

Under Article 15 of the GDPR, you have the right to obtain confirmation as to whether personal data concerning you is being processed.

Where such processing takes place, you have the right to access your personal data and obtain information regarding the relevant processing activities.

7.2. Right to Rectification

Under Article 16 of the GDPR, you have the right to request the correction of inaccurate personal data concerning you.

You also have the right to have incomplete personal data completed, taking into account the purposes of the processing.

7.3. Right to Erasure (Right to Be Forgotten)

Under Article 17 of the GDPR, you have the right to request the erasure of personal data concerning you under certain circumstances.

This right is subject to applicable legal exceptions, including situations in which the retention of personal data is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.

7.4. Right to Restriction of Processing

Under Article 18 of the GDPR, you have the right to request the restriction of the processing of your personal data in certain circumstances.

Where processing is restricted, the relevant personal data may generally only be processed, beyond storage, with your consent or on another ground permitted under Article 18(2) of the GDPR.

7.5. Right to Object

Under Article 21 of the GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on legitimate interests.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

7.6. Right to Data Portability

Under Article 20 of the GDPR, where the relevant legal conditions are met, you have the right to receive personal data that you have provided to us in a structured, commonly used, and machine-readable format.

You may also have the right to transmit such data to another data controller without hindrance and, where technically feasible, request its direct transmission between controllers.

7.7. Right to Withdraw Consent

Where the processing of your personal data is based on consent, you have the right to withdraw that consent at any time, in accordance with Article 7(3) of the GDPR.

The withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

7.8. Right to Lodge a Complaint with a Supervisory Authority

Under Article 77 of the GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection legislation.

In France, the competent supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

You may contact the CNIL through its official website:

www.cnil.fr

We encourage you to contact us directly if you have any questions or concerns regarding how your personal data is processed.

For further information about your rights and applicable data protection rules, you may also consult the official websites of the CNIL and the European Commission.