Privacy Policy

Introduction 

At APGAR, protecting your personal data is essential. 

We are committed to collecting and using only the data necessary to: 

• operate, maintain, and secure our website; 

• respond to your professional requests; 

• organise webinars in which you choose to participate; 

• send you, where permitted, professional information that may be of interest to you; 

• measure and improve the quality of our content, events, and services; 

• respect your choices regarding cookies and other tracking technologies; 

• facilitate the exercise of your rights relating to your personal data. 

This Privacy Policy explains clearly and accessibly what personal data we process, why we use it, who may access it, how long it is retained, and what rights you have. 

It applies to processing carried out in connection with the APGAR Group website, its forms and content, webinars organised by APGAR, and related professional communications. 

As the website presents APGAR activities in several countries, certain requests may be directed to the relevant APGAR entity depending on your country, the nature of your request, the offering concerned, or the organisation of the professional relationship. 

Processing relating to applicants, employees, former employees, and other workers is covered by separate privacy notices and is therefore not detailed in this Policy. 

Who is this website intended for? 

• prospective customers, customers, and professional partners; 

• participants in events and webinars; 

• readers of content published by APGAR; 

• visitors wishing to contact an APGAR entity; 

• individuals exercising their data protection rights. 

1. Who processes your data? 

1.1. Organisation responsible for the website 

The controller responsible for processing activities common to the website is: 

Apgar Consulting SARL 

Limited liability company | SIREN 813 343 738 | Nanterre Trade and Companies Register 813 343 738 

Registered office: 20-26 boulevard du Parc, 92200 Neuilly-sur-Seine, France 

Data protection contact: dpo@apgar-group.com 

Full information about the website publisher is available in the website Legal Notice. 

This controller determines the purposes and means of the processing activities common to the operation, administration, and security of the website, cookie management, and APGAR-wide corporate communications. 

1.2. Role of APGAR France 

APGAR France participates in the implementation and operational management of several processing activities associated with the website, including: 

• governance of content and forms; 

• receipt and routing of professional requests; 

• management of contacts and marketing communications; 

• qualification of business prospects; 

• organisation of webinars; 

• collection of satisfaction feedback; 

• production and publication of content; 

• management of requests to exercise data protection rights. 

Given APGAR’s current organisation, APGAR France administers or implements several activities associated with the website, forms, professional communications, webinars, and requests falling within its remit. 

This involvement does not mean that APGAR France is the sole controller for all processing carried out through the international website. Its role depends on the operations and responsibilities within its remit. 

1.3. Involvement of other APGAR entities 

Depending on your country, the nature of your request, and the entity with which you have or are considering a relationship, another APGAR entity may process your data to: 

• respond to your request; 

• arrange a meeting or provide local commercial follow-up; 

• manage a pre-contractual or contractual relationship; 

• send professional communications relating to its remit; 

• comply with its own legal obligations. 

The identity of the relevant entity and information specific to the processing are provided at the time of collection, when your request is routed, or in the first communication sent to you. 

Where several APGAR entities take part in the same processing activity, their respective responsibilities are defined in accordance with applicable law. 

Certain partners and suppliers may also act as processors, independent controllers, or joint controllers, depending on the services they provide and their degree of autonomy. Where such an arrangement affects the processing of your data, additional information is provided in the notice applicable to the service concerned. 

2. Why do we use your data? 

2.1. When you browse the website 

When you visit our website, we may process technical information necessary for its operation, administration, and security, including: 

• your IP address; 

• information about your device; 

• your operating system and browser; 

• the date and time of your connection; 

• pages viewed and actions performed on the website; 

• technical and security logs; 

• information necessary to detect and prevent incidents or unauthorised access. 

This processing is based on our legitimate interests under Article 6(1)(f) of the GDPR. Our legitimate interests are to provide a functional website, administer, maintain, and secure it, and protect our systems and their users. 

Operations involving cookies or tracking technologies that are not strictly necessary are carried out only after you have given your consent, where consent is required. 

 

2.2. When you contact us 

When you use a form to contact APGAR, we may collect: 

• your first and last name; 

• your professional email address; 

• your telephone number, where requested or provided voluntarily; 

• your company, job title, and country; 

• the subject matter and content of your request; 

• the page or form from which the request was submitted; 

• the date of your request; 

• subsequent communications; 

• information necessary to qualify and route your request. 

• Depending on the journey used, your data may also include your responses to an assessment questionnaire, calculated maturity results or scores, assessed categories, and the requested results document. 

This data is used to receive, qualify, route, and process your request. Where an assessment or download journey is offered, it may also be used to calculate and provide a result, generate or send the requested document and, where clearly stated, qualify the associated professional need. Requests may be directed to the relevant APGAR entity based on their nature, subject matter, and country. Where a local APGAR entity handles your request, only the necessary data is disclosed to it. 

Where you request a commercial proposal or enter into discussions with a view to a professional relationship, processing is based on steps taken at your request prior to entering into a contract, under Article 6(1)(b) of the GDPR. 

For partnership, press, support, or other professional requests, processing is based on APGAR’s legitimate interest in assessing the request and routing it to the relevant department or entity. 

Processing your professional request is separate from using your data for marketing communications or individual tracking. Where a form provides for such use, it is presented separately at collection, together with the applicable legal basis and choices. 

If you submit an application through the general contact form, we will direct you to the appropriate recruitment channel. Your application is not automatically used for commercial or marketing purposes. 

2.3. When we send you professional communications 

We may process professional contact details to: 

• manage our professional contacts and prospects; 

• send information about our activities, expertise, events, and content; 

• qualify your professional needs or areas of interest; 

• administer our communication campaigns; 

• manage registrations, preferences, objections, and unsubscribes; 

• refer qualified requests or contacts to sales teams. 

The data concerned may include your first and last name, professional contact details, company, job title, industry, country, contact source, professional interests, relevant campaign, event or content, communication history, contact status in our tools, and your preferences, unsubscribes, and objections. 

B2B direct marketing may be based on our legitimate interests under Article 6(1)(f) of the GDPR where the communication relates to your professional activity, reasonably corresponds to your role, and allows you to object easily and free of charge to further communications. 

Where we expressly request your consent through a subscription form or dedicated journey, processing is based on your consent under Article 6(1)(a) of the GDPR. 

You may object to direct marketing at any time by using the unsubscribe link in our communications or by contacting dpo@apgar-group.com. 

2.4. When your data comes from another source 

In some circumstances, your professional contact details may come from: 

• a professional platform or network; 

• an event organiser; 

• a partner or co-organiser; 

• a professional data provider; 

• a referral or introduction; 

• a publicly available professional source; 

• another APGAR department or entity, where use is based on an appropriate legal basis. 

Data obtained indirectly may include your identity, professional contact details, company, job title, industry, country, the source of the contact, and professional information associated with the introduction. 

In accordance with Article 14 of the GDPR, we provide the required information within a reasonable period after obtaining your data and, at the latest, within one month, at the time of our first communication with you where the data is used to contact you, or before it is first disclosed to another recipient. 

This information includes the source or category of source used, including where the data comes from a publicly accessible source. You may object at any time to the use of your data for professional direct marketing. 

2.5. When we analyse your interactions 

Where permitted by the applicable legal basis and, if necessary, after obtaining your consent, we may process certain interactions to: 

• measure the opening of or clicking on a communication; 

• identify content downloaded or viewed; 

• understand your professional interests; 

• personalise content or communications; 

• qualify a contact’s level of interest; 

• identify a professional request or opportunity; 

• refer a qualified contact to sales teams. 

The main criteria may include forms submitted, content viewed or downloaded, opens and clicks, identified visits, frequency of interactions, and declared or observed areas of interest. These criteria are used to adapt communications or route a contact to a sales team. 

Individual tracking mechanisms subject to consent are activated only after a valid choice has been expressed. Certain internal qualification operations may rely on our legitimate interests only if they are necessary, proportionate, compatible with your reasonable expectations, and accompanied by appropriate safeguards. 

APGAR does not, solely on the basis of these qualifications or scores, make any decision based exclusively on automated processing that produces legal effects concerning you or similarly significantly affects you. 

You may request access to qualifications concerning you, their rectification and, where the GDPR conditions are met, their erasure, restriction, or discontinuation. You may also request human review of a qualification. 

APGAR does not use your interactions to seek to infer sensitive information about you. 

2.6. When you participate in a webinar 

When you register for a webinar, we may process: 

• your first and last name and professional email address; 

• your company, job title, and country; 

• the webinar concerned, its date, and your registration status; 

• your attendance and connection time; 

• questions, comments, or messages you submit; 

• documents downloaded; 

• any access to the replay; 

• information necessary to organise and follow up the webinar. 

This data is used to organise the webinar, manage your registration, send practical information, enable participation, and provide associated content. 

Management of a professional webinar is based on our legitimate interest in organising and promoting professional events, subject to your reasonable expectations and the proportionality of the data collected. 

Where stated in the registration form, your data may also be used to send professional communications or include you in a marketing journey. This use is presented at registration. Any individual tracking and any disclosure to a partner or co-organiser are announced before collection or disclosure and rely on the applicable legal basis. 

Where a webinar is recorded, you are informed before recording begins of its purpose, the content that may be recorded, recipients, publication media, and intended period of use. 

2.7. When you respond to a survey 

We may invite you to complete a voluntary questionnaire to measure your satisfaction with our events, content, offerings, or services. Depending on the arrangement, we may process: 

• your professional contact details; 

• your responses, ratings, opinions, and comments; 

• your expectations or suggestions for improvement; 

• any request to be contacted; 

• technical information needed to administer the questionnaire. 

This processing is based on our legitimate interest in assessing and improving our events, content, offerings, and services, subject to voluntary participation, data minimisation, and your right to object. 

Before participation, we state whether the questionnaire is anonymous or whether responses may be linked directly or indirectly to your identity. A questionnaire is described as anonymous only where APGAR and the provider concerned cannot reasonably re-identify participants from the available information. 

2.8. When you appear in APGAR content 

The APGAR website may publish articles, news items, testimonials, interviews, photographs, videos, podcasts, or presentations featuring people who contribute to our content. Published data may include: 

• your first and last name; 

• your company and job title; 

• your professional biography; 

• your photograph, image, or voice; 

• your contribution, testimonial, or quotation; 

• professional information you have agreed to make public. 

Where you personally participate in such content, appropriate information is provided before recording or publication. Where necessary, your specific consent or authorisation is obtained for the content, purposes, media, audiences, and periods concerned. 

Certain limited corporate content containing strictly professional information may be based on our legitimate interests, subject to necessity, proportionality, your reasonable expectations, and your right to object. 

You may withdraw consent where it is the legal basis or object to continued use based on legitimate interests. APGAR handles requests to remove content from media under its control. Complete removal of republications independently made by third parties cannot be guaranteed. 

2.9. When you exercise your rights 

When you exercise a right or submit a complaint to APGAR, we use the information necessary to: 

• receive, record, and investigate your request; 

• verify your identity where necessary; 

• identify the relevant data and processing; 

• coordinate searches with the relevant departments or entities; 

• send you a response; 

• document the actions taken; 

• retain evidence necessary to demonstrate compliance. 

This processing is primarily based on our legal obligation under Article 6(1)(c) of the GDPR. Retention of certain evidence after closure of the request may also be based on APGAR’s legitimate interest in demonstrating compliance or defending its rights. 

Proof of identity is requested only where there are reasonable doubts about your identity and other verification methods are insufficient. Where a copy is necessary, it is deleted as soon as verification is complete. 

3. What data must you provide? 

Mandatory fields are identified as such in the forms. A field may be mandatory only where necessary to provide the requested service. Where a separate use, such as marketing communications or individual tracking, is based on consent, the corresponding choice is presented separately and must not be a condition for submitting a request that can be processed without that use. 

If you do not provide mandatory data, we may be unable to: 

• process your request; 

• register you for a webinar; 

• send you the requested content; 

• contact you; 

• provide the requested service. 

Other fields are optional. Please do not provide sensitive data, identity documents, or information unrelated to your request in free-text fields. 

4. Who may access your data? 

Within the limits of their duties and authorisations, your data may be accessed by the following categories of recipients: 

• Marketing teams of the relevant entity or region, and individuals responsible for communications, the website, and forms; 

• sales teams of the relevant entity or region; 

• the relevant APGAR entity based on your country, request, or professional relationship; 

• the department responsible for handling your request; 

• organisers or owners of a webinar or content; 

• the data protection contact; 

• Legal, Compliance, IT, or Security functions where their involvement is necessary; 

• duly authorised administrators of the tools used. 

Other APGAR entities may access data only where necessary to handle your request, manage a professional relationship, organise a shared service, or comply with an applicable obligation. 

Any disclosure to another APGAR entity is limited to the necessary information. Where that entity is outside the European Economic Area, the safeguards described in the section on international transfers also apply. 

Certain data may be processed by suppliers or service providers involved in: 

• website hosting and administration; 

• management of forms and contacts; 

• sending communications; 

• management of cookie choices; 

• organisation of webinars; 

• audience measurement; 

• surveys; 

• system backup and security. 

Depending on the services actually used, these suppliers or providers may include OVH, Indexel, HubSpot, Microsoft, Barracuda, Livestorm, the cookie consent management provider, Google, LinkedIn, or other analytics and advertising platforms. 

Further information about the main categories of providers and their roles is available by contacting dpo@apgar-group.com. 

Data collected through certain forms may be sent to HubSpot to enable its processing, qualification, follow-up, and routing to the relevant teams. 

Some of these parties may process your data on APGAR’s behalf. Others may determine all or part of the purposes and means of their own processing, depending on the services used. 

Where a partner, co-organiser, or APGAR entity receives certain data, this disclosure is announced before collection or, at the latest, before the data is shared. 

APGAR does not sell your personal data. 

APGAR does not make your personal data available to third parties for their own independent marketing purposes. 

 

5. How long do we retain your data? 

We retain your data for no longer than necessary for the purpose for which it was collected, subject to legal obligations and limitation periods required to establish, exercise, or defend legal claims. 

The principal retention periods currently applicable are: 

• inbound commercial requests: two years from the last active interaction, unless a commercial or contractual relationship continues; 

• unsuccessful partnership proposals: three weeks after submission; 

• press, support, or other requests not pursued: three weeks after submission; 

• applications mistakenly received through the general form: deletion after the appropriate recruitment channel has been communicated; 

• active marketing contacts: for the active marketing relationship, with a review two years after the last active contact; 

• objections and unsubscribes: separate, minimised retention of the information necessary to respect the choice expressed; 

• form data: the period applicable to the request or recipient processing activity; 

• copies of identity documents: deletion when identity verification is complete; 

• cookie and tracking data: the periods stated in the Cookie Policy and preference centre; 

• irreversibly anonymised statistics: may be retained where they no longer identify an individual. 

For webinars, surveys, interaction data, marketing qualifications, technical logs, consent evidence, and published content, the applicable period or retention criteria are specified in the notice presented at collection or in the relevant interface. Criteria may include closure of the event or survey, last active contact, period of content publication, security needs, evidence of the choice expressed, and periods needed to defend APGAR’s rights. 

At the end of the applicable period, or when the retention criteria are no longer met, data is deleted or irreversibly anonymised unless limited retention remains necessary to comply with a legal obligation or establish, exercise, or defend legal claims. 

Working copies and exports are deleted when no longer necessary. Data in backups is not reused for day-to-day activities after its retention period expires. 

6. Cookies and other tracking technologies 

The APGAR website uses cookies and other technologies that store or access information on your device. These technologies may be used to operate and secure the website, remember your choices, measure audiences, provide third-party content or features and, where you agree, personalise content or measure campaign effectiveness. 

What choices can you make? 

• Accept cookies and tracking technologies subject to consent; 

• Refuse them with the same level of ease; 

• Customise your choices by purpose or partner; 

• Continue browsing without making a choice, without such browsing constituting consent. 

Cookies strictly necessary for the website to operate or to provide a service expressly requested may be used without prior consent. Other tracking technologies, particularly those used for non-exempt audience measurement, personalisation, advertising, retargeting, or individual tracking, require your consent where required by applicable law. 

Managing and withdrawing consent 

You may change or withdraw your consent at any time, as easily as you gave it, through the preference centre: Change my consent 

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. It must prevent new reading, writing, or tracking operations relating to the withdrawn purposes. Refusal or absence of consent does not prevent access to the website, except where an optional feature relies on a third-party service that you have refused. 

Detailed information about tracking technologies 

The cookie declaration states, for detected tracking technologies, the provider, purpose, category, maximum retention period, and storage type. It is generated and updated using the consent management tool. Depending on the services actually loaded, it may refer to services associated with Cookiebot, HubSpot, Google, LinkedIn, YouTube, and technical website components. 

The displayed categories and classifications must correspond to the actual purpose and technical behaviour of each tracking technology. A tracking technology used for conversion measurement, personalisation, advertising, or navigation tracking cannot be considered strictly necessary merely because it is used by a website feature. 

Configuration monitoring and updates 

APGAR configures its consent management tool so that continued browsing does not constitute consent, acceptance and refusal choices are available at the same level, and consent-based tracking technologies are activated only after a valid choice. Configuration and classification are periodically reviewed and updated. 

The cookie declaration is the operational source detailing detected tracking technologies. Any classification or configuration identified as inaccurate is corrected and validated. You may report an issue with your choices or exercise your rights by contacting dpo@apgar-group.com. 

7. Transfers of data outside the European Economic Area 

Because APGAR operates internationally, certain data may be accessible to an APGAR entity, supplier, technical platform, support service, or processor located outside the European Economic Area. 

Remote access from a third country also constitutes a transfer where a person or organisation in that country can access personal data. 

Where a transfer takes place, APGAR determines whether it can rely on an adequacy decision of the European Commission. If not, APGAR implements one of the safeguards provided by the GDPR, including the European Commission’s Standard Contractual Clauses or, where applicable, approved Binding Corporate Rules. A derogation under Article 49 of the GDPR may be used only exceptionally and where its conditions are met. 

Where the circumstances of the transfer require it, APGAR assesses the level of protection in the destination country and implements supplementary contractual, technical, or organisational measures. 

You may obtain information about transfers relating to the service you use, the countries or categories of countries concerned, the existence or absence of an adequacy decision, and the applicable safeguards. You may also request a copy of appropriate safeguards by contacting dpo@apgar-group.com. 

This Policy does not mean that all APGAR entities have general access to data collected through the website. Access is allocated according to responsibilities, countries, purposes, and operational needs. 

8. How do we protect your data? 

APGAR implements appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful disclosure, unauthorised modification, loss, destruction, alteration, or any other form of unlawful processing. 

Depending on the systems concerned, these measures may include: 

• access rights management; 

• use of named user accounts; 

• strong authentication; 

• limiting access to authorised persons; 

• logging of certain operations; 

• backup of relevant environments; 

• security incident management; 

• oversight of providers and technical access; 

• security of communications and workstations. 

Persons authorised to access data are bound by confidentiality obligations. APGAR adapts the measures implemented to the nature of the data, the purposes of processing, and risks to individuals’ rights and freedoms. 

9. What are your rights? 

Depending on the processing concerned and its legal basis, you may have the following rights: 

• right of access: obtain confirmation as to whether we process your data and access the data concerning you; 

• right to rectification: request correction or updating of inaccurate or incomplete data; 

• right to erasure: request deletion of your data in the circumstances provided by law; 

• right to restriction: request temporary suspension of certain uses of your data; 

• right to object: object, on grounds relating to your particular situation, to processing based on legitimate interests; 

• right to object to direct marketing: object at any time, easily and without justification, to the use of your data for direct marketing; 

• right to withdraw consent: withdraw consent at any time where processing is based on consent; 

• right to data portability: receive data you have provided to us in a structured, commonly used, machine-readable format where the conditions of Article 20 of the GDPR are met; 

• right not to be subject to a decision based solely on automated processing: where the conditions of Article 22 of the GDPR are met; 

• right to define instructions after death: where this right is provided by the law applicable to your situation; 

• right to lodge a complaint with the French Data Protection Authority, the Commission nationale de l’informatique et des libertés (CNIL). 

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. 

Certain rights are not absolute. Their exercise may be restricted where processing is necessary to comply with a legal obligation, perform a contract, or establish, exercise, or defend legal claims. 

10. How can you exercise your rights? 

You may exercise your rights through APGAR’s data protection contact: 

• by email at dpo@apgar-group.com; 

using the data subject rights request form; 

• by post to: Data Protection, Apgar Consulting SARL, 20-26 boulevard du Parc, 92200 Neuilly-sur-Seine, France. 

This contact point centralises requests relating to processing covered by this Policy. Where your request concerns APGAR France or another APGAR entity, it is handled with the relevant entity without requiring you to identify it beforehand. 

Requests submitted through the form are routed to the data protection contact and tracked to comply with applicable deadlines. 

Your request must make it possible to understand the right you wish to exercise and identify the relevant data or processing activity. 

APGAR responds as soon as possible and, in principle, within one month of receipt. This period may be extended by two months where justified by the complexity or number of requests. You will be informed of the extension and reasons within the initial one-month period. 

Where APGAR does not act on your request, you will be informed within one month of the reasons and of your right to lodge a complaint with the CNIL and seek a judicial remedy. 

Exercising your rights is generally free of charge. For a request that is manifestly unfounded or excessive, particularly because it is repetitive, APGAR may charge a reasonable fee reflecting administrative costs or refuse to act on it. 

Where there are reasonable doubts about your identity, APGAR may request additional information strictly necessary for verification. A copy of an identity document will be requested only if other available verification methods are insufficient. 

You may also lodge a complaint with the French Data Protection Authority: CNIL website 

10.1. Further use of your data 

If APGAR intends to use your data for a purpose that is different from and incompatible with the purpose for which it was collected, additional information will be provided before that further use and, where necessary, your consent will be obtained. 

11. Updates to this Policy 

We may amend this Policy to reflect changes in our processing activities, tools, suppliers, the organisation of APGAR entities, or applicable law. 

The date of the latest update is shown at the top of the Policy. 

Where a material change affects how we use your data or the conditions for exercising your rights, appropriate information is made available on the website or provided through a suitable channel where necessary. 

Continued browsing of the website does not constitute consent to new processing. Where a change requires your consent, it is obtained before the relevant processing begins. 

 

12. Contact us 

For any questions about this Policy or the use of your personal data, please contact: 

APGAR Data Protection Contact 

Email: dpo@apgar-group.com 

Address: Apgar Consulting SARL, 20-26 boulevard du Parc, 92200 Neuilly-sur-Seine, France 

For general enquiries unrelated to data protection, please use the contact methods provided on the APGAR website.