Privacy Notice

Because the core business of a mutual insurance group is the protection of its members, customers, patients and users, the VYV Group is committed to protecting their privacy and personal data. The VYV Group ensures this protection through seven commitments that meet the requirements set out in the General Data Protection Regulation (hereinafter "GDPR") as well as in the amended French Data Protection Act of January 6, 1978.

---

These seven commitments are monitored by the VYV Group's Data Protection Officer (DPO) and its Data Protection Department.

1st Commitment: Transparency & Accountability

The VYV Group, located at Tour Maine Montparnasse - 33, avenue du Maine - 75015 Paris, may process your personal data as data controller or subcontractor for the Group's mutual insurers, Unions and associated structures.

When a prospect, a member, a patient or a user enters into a relationship with the VYV Group by means of a subscription, a quotation, a paper or electronic collection form such as on the YVON portal, the VYV Group undertakes to provide clear, understandable and simple information for these persons.

The purpose of this information is to explain the processing of personal data that will be carried out via the YVON portal and, more specifically, for what purposes and for how long your data will be stored. The purposes for which the VYV Group processes your personal data via the YVON portal are as follows:

Investigate, manage and respond to requests to take out a supplementary health insurance or insurance contract, and handle customer relations. This processing is based on the performance of pre-contractual measures on the part of the VYV Group. When you contact VYV Group entities to subscribe to offers, the entities will collect certain information in order to process and respond to your request in the subscription form.

Carry out all operations required for contract award, management and execution. VYV Group entities process your health data when you apply for university insurance.

Manage and organize your participation in events. This processing is based on your consent. The VYV Group offers you the chance to take part in competitions and raffles.

To ensure the proper functioning and optimal, personalized use of the YVON portal through the use of cookies (to learn more about "cookies" and the types of cookies we use on this site, see Cookie Policy).

Some cookies are used to analyze the number of visitors to the site and to ensure, for example, that member areas meet the needs of members, customers, patients and users.

Meet regulatory obligations, including: debt collection and litigation, the fight against fraud, money laundering and the financing of terrorism. This processing is based on compliance with legal and regulatory obligations.
VYV Group entities process your data (economic and financial situation, profession, etc.) to meet regulatory requirements for the fight against fraud and money laundering.

Offer value-added services. This processing is based on our legitimate interest in improving our offer and providing you with services that meet your needs.

Communicating with our members. This processing is based on our legitimate interest in keeping you informed of the latest actions and events related to the VYV Group.

Our value-added services include BAC results, our YvonMag community platform, and more.

As part of our communication activities, you can receive information from the VYV Group via our newsletter.

Within the framework of the offers proposed on the YVON portal, certain data may also be transferred to our partners so that they can provide the services provided and, in particular, your treatment in health care establishments, the reimbursement of health care services, your tenants' liability insurance, etc. This processing is independent of that carried out by the VYV Group for the aforementioned purposes and will be carried out, depending on the offer to which you have decided to subscribe, by MGEN, MGEL, Harmonie conseil, MUTEX and Altima MAIF.

The recipients of your data may be, within the limits of their respective attributions and in the context of achieving the aforementioned purposes: authorized personnel of VYV Group entities, its subcontractors, its management delegates, its authorized partners, intermediaries, reinsurers and authorized professional bodies.

Your personal data may also be communicated, at their request, to official bodies and administrative or judicial authorities, in particular in the context of the fight against money laundering or the financing of terrorism, in application of legal provisions, in order to meet legal and regulatory obligations.

VYV Group entities undertake to ensure that the personal data they collect will not be transmitted to unauthorized third parties, and to take all security measures necessary to preserve the confidentiality of the personal data processed.

2nd Commitment : Protection of minors
The VYV Group may need to process data relating to minors as part of the execution of its contracts (student, parent of children, family contracts, for example); in accordance with article 45 of the amended law of January 6, 1978, the collection and processing of this data are subject to enhanced information to the minor and the holder of parental authority.

3rd Commitment: Limited retention of your data
The length of time the VYV Group keeps your personal data depends on the nature and purpose of the processing as well as regulatory requirements or those of the Commission Nationale de l'Informatique et des Libertés (CNIL). The VYV Group undertakes to collect and retain your data for a limited period, which will not exceed the time necessary to achieve the purpose for which the data was collected.

The Group DPO and the Data Protection department have drawn up a repository of retention periods that serves as a reference for the Group. These retention periods may be extended for justified reasons; they will always remain proportional to the expected purposes. These retention periods are specified on all collection media.

Here are a few illustrations of the shelf lives set out in the standard:
To process, manage and respond to requests to subscribe to a complementary health insurance offer or an insurance contract, and to maintain customer relations: your data is kept for the duration of your relationship with the VYV Group and will be deleted 3 years from the date of collection if you do not subscribe to our offers, or 3 years from the end of the commercial relationship if you are a customer.

To carry out the operations necessary for the conclusion, management and execution of the contract: your data is kept for the duration of your relationship with the VYV Group and will be deleted 5 years after the end of the contract.

Manage and organize your participation in contests. This processing is based on your consent.
To ensure the proper functioning and optimal, personalized use of the YVON portal through the use of cookies (to find out more about "cookies" and the types of cookies we use on this site, see article 8). Cookies managed by the VYV Group have a maximum lifetime of 13 months.

Meet regulatory obligations, in particular: debt collection and litigation, the fight against fraud, money laundering and the financing of terrorism.

Offer value-added services.

External communication with our members. Your data is kept for the duration of your relationship with the VYV Group and will be deleted 5 years after the end of the contract.

Your data will be kept for the duration of your contractual relationship with the VYV Group and deleted 2 years after the inactivity of your account.

Your data is kept for the duration of your contractual relationship with the VYV Group and deleted 3 years after the end of the commercial relationship.

4th Commitment : Proportionality and minimization of your data
The fair and proportionate collection of your personal data is a strong commitment of the VYV Group. The VYV Group uses the data necessary to achieve the purposes for which it was collected.

This commitment is known throughout the VYV Group's businesses and ensures that your privacy is strongly protected. This culture of minimization and proportionality also ensures that your data is collected and processed for specific purposes.

5th Commitment : Your rights
The protection of your personal data goes hand in hand with the effective possibility of exercising your rights as a data subject. These rights allow you to request :

- Access to your personal data: you have the right to obtain from the VYV Group confirmation as to whether or not personal data relating to you is being processed and, if so, access to said data as well as information relating to the processing carried out;

- Correcting your personal data: the VYV Group and its businesses endeavor to update your personal data regularly, either through customer service or via the member area. If these corrections are not taken into account, you can contact the DPO to have these changes made;

- The deletion of your personal data: you have the right to obtain from VYV Group the deletion, as soon as possible, of your personal data, for legitimate reasons (unlawful processing, withdrawal of consent, opposition to processing, data not necessary with regard to the purpose for which they were collected, etc.). Any request for deletion made to the DPO may, however, be limited in the event of legal and regulatory obligations;

- Limiting the processing of your personal data: if you question the compliance with the RGPD of a processing carried out by the VYV Group, we will only process the data necessary for the performance of the contract, until we are assured, and able to confirm to you, of the compliance of said processing ;

- The portability of your personal data: you have the right to request the return of the personal data that you have provided or that has been generated by your activity in a structured, standard and machine-readable format;

- Objection to the processing of your personal data: you have the right to object to any processing of your personal data based on the legitimate interests or a public service mission of the data controller. This may result in the impossibility of providing you with certain services.

- Withdrawal of your consent: you may request at any time and without justification the withdrawal of any special and express authorization you may have given for the use of some of your personal data and/or their use for a particular purpose;

- Expression of posthumous wishes: you have the right to send us instructions concerning the retention, deletion, use and communication of your personal data after your death.

If you wish to exercise one or more of the rights mentioned above, you may contact the VYV Group's DPO by e-mail at the following address: dpo@groupe-vyv.fr or send a letter by post to the address :
VYV Group - Data Protection Officer - Tour Maine Montparnasse - 33 avenue du Maine 75015 Paris.

If you consider that the processing of your personal data does not comply with the RGPD, you have the right to lodge a complaint with the CNIL by clicking on the following link: https: //www.cnil.fr/fr/plaintes.

6th Commitment : Data protection by design
The protection of your personal data begins with the design of new projects, products or service offers. VYV Group employees are made aware of the challenges of protecting personal data, and the developers of new projects and services strive to integrate data protection measures into every stage of their projects and services, from design to production. This integration of personal data protection right from the design stage plays on three levels of action: Human, Data, Media/Applications.

Security measures are of an organizational, legal and technical nature; they also take the form of data access restrictions (authorization policy) or complex measures such as encryption or enhanced pseudonymization.

The VYV Group favors the use of Privacy Enhancing Techniques (PETS) in projects involving your personal data.

Commitment 7: Data security
Securing personal data is a legal, operational and technical challenge. The security of the collection, flow and processing of your personal data are important issues for the VYV Group.

VYV Group employees are made aware of personal data security and confidentiality issues, and of the organizational, legal and technical measures to be taken to reinforce them.

A network of security and data protection professionals meets regularly to ensure the legal and technical security of existing and new projects, in terms of the protection of personal data processed.

Cookie Policy
What is a cookie? A cookie is a trace deposited on your computer, device or cell phone when you browse VYV Group websites, member areas or applications, including the YVON portal. These cookies enable the VYV Group to collect information about your visit, such as your browsing habits and language preference, in order to improve your browsing experience and personalize content and functionalities.

Through our Cookies banner and the present policy, the VYV Group informs you that during your visits to the YVON portal, functionality, analytical and statistical cookies are deposited on your terminal.

Functionality cookies
Statistics/analytics cookies
Social network cookies

Functionality cookies
Functionality cookies are used to configure the website. These cookies include "language choice" cookies and cookies that recognize users when they log on to their member area. In general, these cookies have a lifetime corresponding to the duration of the current session.

Analytics cookies
The site uses Google Analytics, a web analytics tool that enables website and application owners to better understand their users' behavior. This tool uses cookies to collect anonymous information and generate reports on usage statistics for the YVON portal, without individual users being personally identified by Google. As a result, when you visit our sites, a cookie is assigned to you and stored on your terminal's hard drive. Only the sender of a cookie can read or modify the information contained in it.

Social network and third-party cookies
We use cookies on our websites to enable you to share the content of our site with other people or to let them know your consultation or your opinion concerning content on our site. This is particularly true of the "Share" and "Like" buttons on social networks such as Facebook and Twitter. The social network is likely to identify you thanks to this button, even if you did not use it when consulting our site. This type of application button may enable the social network concerned to track your browsing on our site, simply because your social network account was activated on your terminal (open session) during your browsing on our site.

We have no control over the process used by social networks to collect information about your browsing on our site. We invite you to consult the privacy policies of these social networks in order to learn about the purposes of use, particularly advertising, and the browsing information that may be collected through these application buttons. These policies will enable you to exercise your choices with regard to these social networks, in particular by configuring your user accounts for each of them.

Your cookie management
When you visit the VYV Group websites, in particular the YVON portal, you will be informed of the cookies that are stored and their purpose, and you will be asked for your consent. In the absence of your refusal to deposit cookies, by browsing the VYV Group sites, and in particular the YVON portal, you accept the use of said cookies. You can deactivate them at any time by clicking on the banner and thus managing your consent. To delete cookies from your terminal, go to your terminal's browser and follow the steps described below:

Internet Explorer :
We invite you to consult the following page:
http://windows.microsoft.com/fr-FR/windows-vista/Block-or-allow-cookies

Firefox :
We invite you to consult the following page:
https://support.mozilla.org/fr/kb/activer-desactiver-cookies

Safari :
We invite you to consult the following page:
https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

Google Chrome :
We invite you to consult the following page:
https://support.google.com/chrome/answer/95647?hl=fr

Opera :
We invite you to consult the following page:
http://help.opera.com/Windows/10.20/fr/cookies.html

Glossary

Personal data/Personal data :
"Any information relating to an identified or identifiable natural person. A person can be identified :
- directly (e.g. last name, first name) ;
- indirectly (e.g. telephone number, fingerprint, customer ID number) ;
- by individualization, inference or correlation.

Processing of personal data :
Any operation or set of operations involving personal data, whatever the process used (collection, recording, organization, storage, adaptation, modification, extraction, consultation, use, communication by transmission, dissemination or any other form of provision, reconciliation, etc.). Personal data may be processed electronically or on paper.

Purpose:
This is the objective of the treatment.
e.g. customer loyalty, contracting, sales statistics.

RGPD:
for General Data Protection Regulation of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, which came into force on May 25, 2018.

Legal basis for processing :
To be lawful, the processing of personal data must be based on one of the six legal grounds determined by the GDPR (Article 6):
- Contract performance/pre-contractual measures;
- Compliance with a legal obligation;
- Carrying out a mission in the public interest or in the exercise of public authority;
- Safeguarding vital interests;
- A legitimate interest pursued by the controller ;
- Requesting the consent of the person whose data is being processed.

Person concerned :
Individual whose data is processed (e.g. customers, prospects, users, etc.).

Data controller :
Person who determines the purposes (why) and means (how) of processing. (e.g. the legal entity represented by its legal representative).

Subcontractor :
Any natural or legal person, public authority, department or other body that processes personal data on behalf of the controller.

To:
Person receiving the communication of personal data. (e.g. recruitment department, IT department, management, service providers, accommodation providers).

Shelf life :
Period of time during which data will be retained for processing (this period must be proportionate to the purpose of the processing) or, failing this, the criteria used to determine the retention period.