TOXSEEK EMERGENCY (hereafter "the Association") is committed to ensuring the best possible protection of the personal data of the person concerned, in accordance with Regulation 2016/679 of the European Parliament and of the Council of the European Union (General Regulation on Data Protection, hereafter "GDPR") and the Act n° 78-17 of 6 January 1978 relating to information technology, files and liberties as amended by the Act n° 2018-493 of 20 June 2018 regarding the protection of personal data.
User: a person who has created an account connecting to the website accessible at the URLs toxseek-urgence.org, toxseek-notfall.org, toxseek-urgencia. org, toxseek-emergency.org and having completed one of the forms necessary to benefit from TOXSEEK EMERGENCY Services, as defined in the T&Cs.
Tested person: User from whom a strand of hair is taken for analysis by the SERFI partner toxicological analysis laboratory.
Concerned Person: in accordance with Article 4.1 of the GDPR, it is the person whose personal data is subject to a processing operation within as mentioned in the Article 4.2 of the GDPR, whether it is the User or the Tested Person.
Responsible for processing: The Association determines the means and purposes of the data processing.
SERFI : the company SERFI, a simplified joint stock company, registered in the Trade and Companies Register of Pontoise, under the registration number 322 068 313, which registered office is located at the Parc d'activités des Portes du Vexin, 5 rue Ferrié, in Ennery (95300) France, which transmits, with the consent of the Tested Person, their personal data in order to be processed.
Processing: the data is collected and processed in order to compare the results of the analyses of the Tested Person by the SERFI toxicological laboratory with those resulting from the information provided by the User contamination profiles on the website toxseek-urgence.org site (https://toxseek-urgence.org "toxSeek Urgence homepage") established by the Association.
The operations described in this personal data protection policy are carried out under the direction of the TOXSEEK EMERGENCY association regulated by the 1901 Act and registered in the national directory of associations under the number W953011223. Its head office is located at 5 rue Ferrié - 95300 Ennery - France. Within the framework of its activities, the Association is led to collect a certain number of personal data relating to Users and Tested Persons. The purpose of this personal data protection policy is to inform the Persons Concerned about the personal data collected by the Association, in particular with regard to :
- The data collected by the Association,
- How long the data will be kept,
- The recipients of the data,
- The rights of the Person Concerned,
- Data security,
- Data transfer outside the European Union,
- The minor's data.
The Association may process the following data: Data concerning the User (a)
- Marital status;
- Last name;
- First name;
- Postal address;
- Company name;
- Registered office;
- Email address;
- IP address;
- Phone number;
- Residence in urban or rural area;
- Food consumption habits (organic / conventional);
- Proximity (in hundreds of metres) of the residence with, for example:
- Wind turbines;
- Polluting industrial sites
- Areas of major works;
- Relay antennas;
- High-voltage lines;
- Fields subject to pesticide spraying.
- Health status, for example:
- No symptoms;
- Presence of dermatological symptoms (redness, tingling and burning sensations);
- Presence of neurasthenic and vegetative symptoms (tiredness, lassitude, difficulty in concentrating, dizziness, nausea, heart palpitations and digestive disorders);
- Presence of other symptoms: dizziness, nausea, heart palpitations, digestive problems...
- Chronic diseases (fibromyalgia, cancer, autoimmune diseases, neurodegenerative diseases)
- State of animal health, for example:
- Presence of mastitis, leukocytes, dermatitis, abscesses, abortions.... (For dairy cows)
- of an association ;
- of a collective;
This personal data enables TOXSEEK EMERGENCY to establish the potential sources of contamination and/or pathological mechanisms of the User and/or the Tested Person.
Data concerning the Tested Person (b)
- Marital status;
- Lat name;
- First name;
- Date of birth;
- Email address;
- Postal address;
- Username and Password to access the online account;
- Sample number;
- Hair sample;
- Analysis results;
- IP address; These data are necessary for the proper execution of the service. TOXSEEK EMERGENCY offers a service to highlight correlating elements between the presence of pollutants in a toxicological analysis of the Tested Person via the contamination profile of this person, the potential sources of contamination and/or the symptoms and pathologies indicated by the User when connecting to the Website. To implement the EMERGENCY TOXSEEK Service, the User must connect to the Website and fill in a form with questions about his lifestyle, aimed at establishing potential sources of contamination and/or symptoms and pathologies that he may have declared.
Users who have duly completed their form will then receive, at the discretion of TOXSEEK EMERGENCY, an e-mail offering them the opportunity to carry out a toxicological analysis through SERFI, a simplified joint stock company, registered with the Trade and Companies Register of Pontoise, under the registration number 322 068 313, which registered office is located at the Parc d'activités des Portes du Vexin, 5 rue Ferrié, in Ennery (95300), and that operates the Website toxseek. com, a pollutant screening service (hereinafter "SERFI").
Once the analysis has been carried out, the User becomes a Tested Person as defined herein. The toxicological analysis resulting from the Tested Person's order is transmitted to the Tested Person, in accordance with the Terms and Conditions of Use of the website toxseek.com, and to TOXSEEK EMERGENCY, to which the Tested Person expressly consents by making use of the present services of the Website. When the User does not perform the toxicological analysis via SERFI, only data (a) is collected. For the Tested Person, data (a) and (b) are collected.
The Concerned Person agrees that personal data may be collected and processed for the following purposes:
- Conclusion of the Terms and Conditions of the Site: The data of the Concerned Person is collected in order to allow the conclusion of the T&Cs;
- Communications: The Concerned Person's data is collected in order to enable the Association to communicate with the Concerned Person.
- Establishment of sources of contamination and/or pathological mechanisms: The Tested Person's data are collected in order to investigate potential sources of contamination and potential pathological mechanisms.
- Carrying out studies: The data of the Tested Person are collected in order to investigate environmental sources and pathological mechanisms in the framework of studies.
Duration of storage of personal data
The data is kept for the time strictly necessary to fulfil the purposes set out above. In this way, the Association undertakes to archive or delete personal data as soon as the purpose and the maximum legal duration of their conservation have expired.
The data collected by the Association will not be transmitted to third parties without the consent of the interested parties, except for the subcontractors that the Association uses for the strict and necessary fulfilment of the above-mentioned purposes. The Association undertakes to use only subcontractors who comply with the provisions of the RGPD and ensure a reasonable level of security and pseudonymisation of the personal data of the Person Concerned. At the request of the competent judicial or administrative authorities, the Association may be required to communicate personal data relating to the Person Concerned.
Legal basis for data processing
Any processing of personal data must be justified by a legal reason. The processing of such data may be justified on one of the following legal grounds:
- Consent: The Concerned Person has consented to the processing of his/her personal data for one or more specific purposes (art. 6.1.a of the GDPR);
- Application of the Contract: Processing is necessary for the performance of a contract of which the Concerned Person is also a party or for the performance of pre-contractual measures taken at the request of the Concerned Person (art. 6.1.b of the GDPR);
- Legal obligation: Processing is necessary for compliance with a legal obligation to which the controller is responsible (art. 6.1.c of the GDPR);
- Legitimate interest: Processing is necessary for the protection of the vital interests of Concerned Person or of another natural person (art. 6.1.f of the GDPR).
Rights of the Concerned Person
The Concerned Person is the holder of the following rights:
- Right of access : This is the right to access his/her personal data. The Association reserves the right to charge an administrative fee in the event of a request for several copies of the information, within the limit of the cost of reproduction ;
- Right of rectification: The right to obtain, as soon as possible, the rectification of personal data;
- Right to erasure: The right to obtain, as soon as possible, the erasure of personal data;
- Right to limitation of processing: The right to demand the limitation of the processing of one's personal data.
- The right to data portability: The right of the data subject to receive his personal data and to transfer them to another controller when the processing is based on consent;
- Right of opposition: The right to object to the processing of personal data;
- Post-mortem guidelines: The right to define guidelines for the storage, erasure and communication of one's personal data after death. When the Concerned Person wishes to exercise one of these rights, an e-mail should be sent to the data controller at the following address: email@example.com In all cases, the data controller undertakes to allow the Person Concerned to exercise his/her rights as soon as possible.
The Association implements data security methods to guarantee the confidentiality of the information collected. Transfers of personal data between the Association and its sub-contractors use encryption protocols that guarantee the confidentiality of the exchange. In accordance with Articles L.1111-8 and R.1111-9 to R.1111-15-1 of the French Public Health Code, the Company's hosting provider is accredited to host health data on digital media. The HDS accreditation number is FR050438. The Association undertakes to implement appropriate technical and organisational security measures to prevent the loss, destruction, publication or access by an unauthorised person to the personal data of the Person Concerned.
Transfer of personal data outside the European Union
The Association does not transfer personal data outside the territory of the European Union.
Concerning the personal data of minors
Minors may only contract with the Association through their legal representative. However, they shall benefit from appropriate prior information, which shall precede the collection of their personal data.