Preamble

This document has been drafted to inform you and help you understand which personal data, within the meaning of the applicable regulations, is collected by DIXI MEDICAL on its website or through any remote means, on what occasions, for what purposes, and how it is processed.

This policy applies in particular to customers and users of DIXI MEDICAL’s offers and services, as well as to visitors to the DIXI MEDICAL website.

In accordance with the French Data Protection Act and the General Data Protection Regulation (GDPR), DIXI MEDICAL undertakes to use your data lawfully and appropriately, particularly with regard to obtaining your consent where required, the purpose of processing, and the retention period of your personal data.

This policy may be amended or updated at any time by DIXI MEDICAL, in particular to comply with legislative, regulatory, case-law or technological developments. The update date will be indicated on the document. These modifications are binding on the user, who is therefore advised to regularly consult this privacy policy to be aware of any changes.

1. Definitions

Personal data or Data: Any information relating to an identified or identifiable natural person (“Data Subject”), directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more elements specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Data Controller: The natural or legal person who determines the purposes and means of processing.

Processor: The natural or legal person who processes personal data on behalf of the controller.

Recipient: The natural or legal person to whom personal data is disclosed, whether or not a third party.

Third Party: A natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

Consent: Any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

2. Personal Data Collected

The data processed, for the purposes mentioned below, includes:

• Identification and contact data: name, first name, phone number, postal address, email address, company name, CV, and cookies.

3. When Personal Data is Collected

Personal data may be collected in the following situations:

• When requesting a quote on the website or by phone
• When submitting a spontaneous job application
• When handling complaints or disputes
• When participating in satisfaction surveys
• When subscribing to newsletters
• When logging into our websites (IP address, cookies)
• When visiting our social media pages

4. Purpose of Processing Personal Data

Your data may be collected for one or more of the following purposes:

• Making contact, scheduling appointments
• Responding to requests for information (inquiries, quotes)
• Newsletter subscription
• Providing downloadable content
• Reviewing and managing spontaneous job applications
• Monitoring your browsing preferences on the site
• Developing DIXI MEDICAL’s business opportunities

Each processing operation corresponds to one or more specific purposes. Where the same processing serves multiple purposes, your consent will be obtained separately for each.

5. Recipients of Your Data

The data collected is intended for DIXI MEDICAL’s internal departments, within the limits of their responsibilities (marketing, sales or customer relations, HR, accounting, auditors such as statutory auditors), and its processors.

The data may also be processed by authorized third parties (e.g., accountants). In such cases, partners intervene to provide services. Data may also be transferred to competent authorities upon request, in the context of investigations, judicial proceedings, or to comply with other legal obligations.

6. Transfers Outside the European Union

Personal data collected may be processed outside the European Union, particularly in the following contexts:

• Customer relations activities
• Use of data on social networks
• IT services

In such cases, DIXI MEDICAL takes the necessary measures with its processors and partners to ensure an adequate level of data protection in accordance with applicable regulations.

If the processors and partners are not Privacy Shield certified (for transfers to the United States) or not located in a country deemed to provide adequate protection, they will have signed the European Commission’s Standard Contractual Clauses or be subject to Binding Corporate Rules approved by the authorities.

7. Data Retention Period

DIXI MEDICAL undertakes to limit the retention of your personal data to the period necessary for the purposes for which it is processed, in accordance with applicable legal provisions.

Retention periods may vary depending on the type of data and purpose of collection. Certain legal obligations may also impose specific retention periods.

As a general rule:

• Billing or contract data remains accessible for 10 years.
• Newsletter/emailing data is kept until you unsubscribe.
• Once the purpose or retention period has expired, your data may be anonymized and kept solely for statistical purposes.

8. Your Rights

Any individual whose personal data is processed by DIXI MEDICAL has the following rights:

• Right of access to your data, subject to proof of identity
• Right of rectification or deletion of inaccurate, outdated, or incomplete data
• Right to restriction of processing
• Right to define instructions for data after death
• Right to object to processing, including for commercial prospecting purposes
• Right to withdraw consent at any time
• Right to data portability where applicable
• Right to lodge a complaint with the supervisory authority (CNIL in France: www.cnil.fr)

9. Exercising Your Rights – Response Time

You can exercise your rights by sending a request to:

📧 dpo@diximedical.com
📮 DIXI MEDICAL – 2A Route de Pouligney, 25640 MARCHAUX – CHAUDEFONTAINE, France

Please include the purpose of your request and a signed copy of valid ID. For email requests, a copy of your ID must be sent by fax or post.

DIXI MEDICAL may refuse manifestly abusive requests (due to number, repetitive or systematic nature).

DIXI MEDICAL undertakes to respond within a reasonable period, not exceeding two months from receipt of your request.

10. Security and Confidentiality Obligations

DIXI MEDICAL ensures that your personal data is processed securely and confidentially, including when operations are performed by processors. Appropriate technical and organizational measures are implemented to prevent loss, misuse, alteration, or deletion of your personal data.

In compliance with Articles 33 and 34 of the GDPR, in the event of a personal data breach, DIXI MEDICAL will notify the CNIL within 72 hours and, if the breach presents a high risk to your rights and freedoms, will inform the affected individuals or organizations without delay.

📌 Updated on September 24, 2021

‍