Privacy Policy
1. PURPOSE AND SCOPE
This privacy policy (the “Policy”) describes how PICOT (hereinafter “PICOT” or “we”) collects, uses, stores, shares and protects the personal data of individuals who visit (hereinafter “User”) the website picot-group.com (hereinafter the “Site”) and interact with its features (contact forms, requests for information, recruitment, subscriptions, etc.). It applies exclusively to data processing carried out via the Site.
If you have any questions regarding the protection of personal data, you can contact us using the details provided below.
In order to ensure respect for the privacy of Website Users, we undertake to ensure that the collection and processing of personal data comply with the regulations in force, and in particular:
- Regulation (EU) 2016/679 of 27 April 2016 on data protection (GDPR);
- Law No. 78-17 of 6 January 1978, as amended, known as the “Data Protection Act”.
2. DATA CONTROLLER
The data controller is:
PICOT
Simplified joint-stock company with a share capital of €22,710,000
Registered office: Le Bas Rocher – 53800 Congrier
830 922 688 Laval Trade and Companies Register
In its capacity as data controller, PICOT implements all appropriate technical and organisational measures to ensure the security, confidentiality and integrity of the personal data processed.
You can contact us:
- by email: dpo@picot-group.com
by post: Le Bas Rocher – 53800 Congrier – for the attention of the DPO/Legal Department
3. LEGAL BASIS FOR DATA PROCESSING
In accordance with the GDPR and the French Data Protection Act, our processing of personal data is based on:
- the legitimate interests of the PICOT GROUP (management, security and improvement of the Website, responding to enquiries);
- the performance of pre-contractual or contractual measures (responding to a request for a quote, managing a commercial relationship initiated via the Website);
- the User’s consent (marketing via email, sending newsletters or the placement of certain cookies);
- compliance with a legal or regulatory obligation (responding to requests from authorities, retaining certain logs).
4. DATA COLLECTED, PURPOSES AND RETENTION PERIODS
The data that may be collected via the Website are as follows:
| Purpose | Data | Legal basis | Retention period | Recipients/Access |
| Website operation and security, improvement of user experience | IP address, connection data, information related to device and browser, traffic data and audience measurement, security events | Legitimate interest | 6 months for browsing data | Hosting provider (OVH), website maintenance (772424), internal IT teams |
| Audience measurement and analytics | Cookie/tracker identifier, pages viewed, user journey, technical parameters | Consent (or legitimate interest if the solution is exempt from consent and strictly compliant) | 6 months for browsing data | internal IT teams |
| Requests via forms (contact/quote/study) | Title, first and last name, status (individual or professional), email, phone number, company and position (where applicable), message content, attachments, any information voluntarily provided in the message | Performance of pre-contractual measures / Legitimate interest | 3 years from the last contact in the absence of a contract, otherwise for the duration of the contract then the legal archiving period | Relevant internal departments (sales, marketing, legal), CRM/Emailing provider |
| Subscriptions and commercial prospecting, email | Email, contact data, browsing data (preferences, interaction history) | Consent (B2C), Legitimate interest (B2B depending on the relationship) | Until withdrawal of consent or 3 years after last contact | Emailing tool (ActiveCampaign), internal marketing |
| Recruitment (application) | Identity and contact details (CV, cover letter, qualifications, professional background) | Legitimate interest / Pre-contractual measures | 18 months after last contact (or 2 years if consent is given for talent pool retention) | HR & Hiring managers |
| Management of legal obligations | Supporting documents, proof of consent/refusal, exchanges with authorities | Legal obligation | According to applicable legal requirements | Legal and compliance department, authorities if required |
5. DATA RECIPIENTS
Data is processed exclusively by authorised internal departments of the PICOT GROUP. It may be disclosed, to the extent strictly necessary:
- to technical service providers involved in the hosting or maintenance of the Website;
- to administrative or judicial authorities where required by law;
- to companies within the PICOT Group, where necessary for the management of requests.
We undertake not to sell or transfer any of your personal data to third parties. As a matter of principle, your data is hosted and processed within the EU/EEA. If certain service providers involve a transfer to a third country:
- we will ensure that the country has an adequacy decision from the European Commission, or
- we will implement standard contractual clauses (SCCs) and, where necessary, additional safeguards (encryption, pseudonymisation). You can obtain information on these safeguards by contacting us (see §2 above).
6. YOUR RIGHTS
In accordance with current regulations, you have the following rights:
- right of access;
- right to rectification;
- right to erasure;
- right to restriction of processing;
- right to object;
- right to data portability (where applicable);
- right to withdraw your consent at any time where processing is based on consent.
To exercise your rights, you may contact us using the contact details provided in Article 2.
A response will be provided within one month, extendable by two months if necessary.
7. MARKETING & OBJECTION TO TELEMARKETING
You may unsubscribe from marketing emails at any time via the unsubscribe link included in each message.
In accordance with Article L.223-2 of the French Consumer Code, you may register free of charge on the cold calling opt-out list via the official Bloctel service:
8. COOKIES
A cookie is a piece of information stored on a user’s hard drive by the server of the website they are visiting. It contains several pieces of data: the name of the server that placed it, an identifier in the form of a unique number, and possibly an expiry date. This information is sometimes stored on the computer in a simple text file which a server accesses to read and record information.
Cookies enable us to optimise your browsing experience on our website and to compile visitor statistics, allowing us to improve the performance of our website.
Our website uses the following types of cookies:
- Strictly necessary cookies: essential for the website to function properly (e.g. secure access, shopping basket).
- Performance and analytics cookies: used to measure audience figures and improve the site’s performance (e.g. most visited pages).
- Personalisation cookies: remember your preferences (e.g. language, region).
- Advertising cookies: used to offer you content and adverts tailored to your interests.
When you first visit our website, a banner informs you about the use of cookies. You can:
- Accept all cookies
- Reject all non-essential cookies
- Customise your choices
You can change your browser settings to ensure that cookies are blocked. Most browsers explain how to do this in the help function
- Safari settings
- Chrome settings
- Firefox settings
- Internet Explorer settings
Cookies are stored for 13 months. Unless the User renews their consent, this data will be deleted.
9. COMPLAINTS
If you feel that your rights have not been respected, we invite you to contact us in the first instance (see §2).
You also have the right to lodge a complaint with the competent supervisory authority:
Commission Nationale de l’Informatique et des Libertés (CNIL)
3 Place de Fontenoy – TSA 80715
75334 PARIS CEDEX 07
10. AMENDMENTS TO THE POLICY
This Policy may be amended at any time to take account of legislative, regulatory or technical developments. The applicable version is the one published on this page on the date of your visit.
We invite you to consult this page regularly.
Last updated: 26/03/2026
Effective date: 01/04/2026