Responsibility for processing

The policy for the protection of individuals with regard to the processing of personal data by the Community institutions and bodies is thus based on EU Regulation No. 679/2016 (General Data Protection Regulation – GDPR).

Personal data (DCP) means any information relating to an identified or identifiable natural person; An identifiable person is a person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more specific elements specific to his identity.

In principle, access to the information available on or through the SUERA website does not require the provision of personal data by the user. However, to use certain online services, you may be asked to provide certain information about yourself.

The Provence-Alpes-Côte d'Azur Region (SUD Region), as a legal person, processes personal data as part of its action as Technical Secretariat of the European Union Strategy for the Alpine Region (SUERA).

Purposes of processing

The main purpose of the processing is the animation of the community of actors of the Technical Secretariat of EUSALP. The European Union Strategy for the Alpine Region is one of the four macro-regional strategies of the European Union.

The Alpine Macroregional Strategy concerns five EU Member States and two third countries:

• France
• Germany
• Austria
• Italy
• Slovenia
• Swiss
• Liechtenstein

It thus covers 48 regions (including Auvergne – Rhône-Alpes, Burgundy – Franche-Comté and Provence-Alpes-Côte d’Azur for France) and 80 million people. It can rely on existing cooperation organizations: the Alpine Convention and the Alpine Space Programme, and for France, the Comité du Massif des Alpes, the Comité de Massif Jura and the Conseil National de la Montagne.

EUSALP is co-managed by the State and the regions, in close association with institutional, public and private actors. The governance bodies were set up in 2016: general assembly, executive council and action groups.

The SUERA Technical Secretariat undertakes to collect only the personal data strictly necessary for the purposes of the processing.

Legal basis of processing

The legal basis of the processing is based on the performance of a mission of public interest or falling within the exercise of the public authority vested in the Region, as data controller, and within the framework of the resolution of the European Parliament of 23 May 2013 concerning the Alpine Macroregional Strategy

Data gathering

The persons concerned are the agents of the institutional and academic partners of EUSALP, non-governmental organizations, public and private actors.

The categories of personal data collected are as follows: Professional contact details, affiliated organization, function within the organization.

These data were collected in part by the National Agency for Territorial Cohesion (ANCT) and entrusted to the Provence Alpes Côte-d'Azur Region in order to take charge of the organization of the Technical Secretariat of the EUSALP.

Recipients of personal data

EUSALP partners may be recipients of data collected by the Region within the framework of the EUSALP.

The data processors of the Région SUD, AUGURE and EMAGINEURS have access limited to the personal data strictly necessary for the performance of their services and have a contractual obligation to use them in accordance with the regulations in force in terms of personal data.

The Region undertakes not to transmit your personal data to any third party other than partners and subcontractors.

Under no circumstances does the Region market, transfer or exchange your personal data to third parties for commercial purposes.

Personal data retention periods

The retention period of your personal data is strictly linked to the legal basis of the processing, the nature of the personal data concerned and the purpose of the processing.

Your data will thus be kept for a period of 3 years, in connection with the EUSALP Technical Secretariat contract hosted by the Provence Alpes-Côte d'Azur Region. The data will be updated regularly as the exchanges progress.

At the end of the retention period strictly necessary for the aforementioned purpose, the Region undertakes to destroy all your personal data within the limits and under the conditions provided for in compliance with its legal obligations.

Security of your data

As part of the implementation of its public policies, the SUD Region attaches the utmost importance to the security of your personal data.

In this sense, the Region implements technical and organizational security measures to guarantee the availability, integrity and confidentiality of personal data in order to prevent them from being distorted, damaged or that third parties unauthorized access. They provide a level of protection and security adapted to the risks associated with the processing and the nature of the data to be protected.

Personal data is stored on hosting servers located in the European Union or in third countries whose level of security in terms of personal data protection is in line with that offered in the European Union and the European Economic Area.

In accordance with the regulations in force, the Region keeps a register of personal data processing activities.

How to exercise your rights?

You have the possibility to exercise your rights provided for by the GDPR in terms of personal data. Your rights regarding the processing of your personal data are as follows:

• Right of access: You have the right to request information about the personal data we hold about you.
• Right to portability of personal data: The right to portability applies to data processed automatically and collected based on your prior consent or the performance of a contract.

This right of portability entitles you to:

To retrieve the personal data you have provided, in a structured, commonly used and machine-readable format

Obtain that your personal data be transmitted directly to another organization. It should be noted that this right to transfer does not apply to processing necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller.

Right of rectification: You have the right to request the rectification of your personal data if it is inaccurate, including to complete your incomplete personal data.

Right to erasure/right to be forgotten: You have the right to request, at any time, the erasure of all your personal data processed by the Region in the following cases:

• Your personal data is no longer necessary for the purposes for which it was collected.
• You decide to withdraw your consent on which the processing is based and there is no other legal basis for the processing.
• You object to the processing and there is no overriding legitimate reason for the processing.
• Your personal data has been unlawfully processed.
• A legal obligation imposes the erasure of your personal data.

However, these obligations do not apply to the extent that this data processing is necessary:

• The exercise of the right to freedom of expression and information.
• To comply with a legal obligation to which the controller is subject.
• To carry out a task in the public interest or in the exercise of official authority vested in the controller.
• For reasons of public interest in the field of public health.
• For archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes.
• For the establishment, exercise or defense of rights in court.

Right to object to the processing of your data: You have the right to object at any time to the processing of your personal data unless the Region presents legitimate and compelling reasons for the processing.

Right to restriction of processing: You have the right to request that the Region restrict the use of your personal data in the following circumstances:You dispute the accuracy of your personal data.

• The processing is unlawful and you oppose their erasure and demand the limitation of their use instead;
• The Region no longer needs your personal data for the purposes of the processing, but they are still necessary for you to establish, exercise or defend legal rights,
• You have objected to the processing pending the verification of whether there are legitimate grounds for continuing the processing.

Right not to be the subject of an individual decision including profiling: You have the right not to be the subject of a decision based exclusively on automated processing, including profiling, producing legal effects concerning or significantly affecting you.

Right of complaint to a supervisory authority: If you consider that the processing of your personal data constitutes a violation of the legislation in force, you have the possibility of lodging a complaint with the National Commission for Computing and freedoms (CNIL).

To exercise one of these rights, you can contact the Data Protection Officer (DPO) of the SUD Region either by using this form:

Or by post to:
Regional Hotel
Data Protection Officer
27 place Jules Guesde - 13481 Marseille cedex 20
​​​​​​​France

The DPO will ensure that your personal data is systematically used in a transparent, accurate manner and in accordance with the applicable regulations and will take into account your requests to exercise the rights defined above.