Information on the addition of new sub-processors
In accordance with our obligations under Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the ” GDPR”), we hereby inform you that we intend to involve new subprocessors in the provision of our audience measurement solution.
The two new sub-processors are as follows:
The list of sub-processors involved by AT Internet is also available at the following address: https://atinternet.com/en/processor-sub-processor-information-parent-company/
Please note that Salesforce.com France’s involvement involves the transfer of data to a third country. For clarification purposes, only data relating to personnel authorised by you may be transferred to the third country. Authorised personnel means any person within your organisation as well as any natural person mandated by you to use the digital analytics solution or to ensure the implementation of the commercial relationship with us (purchasing, project management, invoicing, etc.). Audience data, i.e. data relating to visitors to sites and applications audited by the AT Internet solution, are stored in the European Union.
By accepting this sub-processor, you authorise us to use processing facilities located in a third country within the meaning of the GDPR, it being understood that we undertake to respect one of the following guarantees:
- setting up, with the sub-processor carrying out the non-European processing, a contract for the transfer of personal data in accordance with the model clauses drawn up by the European Commission;
- the sub-processor carrying out the non-European processing has subscribed to the “E.U.-U.S. Privacy Shield Arrangement”, an authorised transfer mechanism for personal data validated by the European Union institutions;
- the sub-processor carrying out the processing outside Europe has adopted “Binding Corporate Rules” validated by an authorised European personal data protection authority.
We remind you that, unless a longer period is agreed between us in the data processing agreement applicable between our companies, you have a period of eight (8) calendar days from the date of receipt of this letter to submit your objections.
If there is no objection within this period, we will proceed with the involvement of the two sub-processors presented above.
In addition, we invite you to contact us, if you consider it necessary, in order to conclude a data processing agreement or to update it if there is one signed between our companies, via the following contact details:
AT Internet
Legal Department
85 avenue J F Kennedy
33700 Mérignac
France
dpo(at)atinternet.com