Privacy Policy

Who does this policy apply to?

This policy addresses website visitors, prospects, clients, partners, suppliers, candidates, study participants, respondents, panellists and anyone whose data may be processed in the context of IMMAR's activities.

Depending on the project, IMMAR may act as data controller when it determines the purposes and means of processing, or as data processor when acting on behalf of a client under a specific contractual framework.

What data may we process?

Sensitive data is collected only when necessary for a clearly identified study, with specific information provided, enhanced safeguards applied and, where required by regulation, explicit consent obtained.

Why do we use this data?

• To respond to requests submitted via the website, prepare a proposal or organise a commercial discussion.
• To conduct market research, surveys, audience measurement, media analysis, CX programmes and consultancy assignments.
• To produce reliable results, control field quality, detect duplicates or inconsistencies, and secure our platforms.
• To manage contracts, invoices, accounting obligations, legal obligations and data subject requests.
• To measure website usage and improve the experience — only where non-essential cookies have been accepted.

Legal bases used may include performance of a contract or pre-contractual measures, compliance with a legal obligation, IMMAR's legitimate interests or those of its clients, and consent where required. Where IMMAR relies on legitimate interests, a balancing test is carried out to verify that those interests do not override your fundamental rights and interests.

With whom may data be shared?

Data may be accessible to authorised IMMAR staff, clients involved in an assignment, technical service providers, hosting companies, survey platforms, security tools, professional advisors and authorities where necessary or legally required.

IMMAR does not sell personal data. Research deliverables are designed to limit direct identification of respondents, notably through aggregation, anonymisation or pseudonymisation where the context allows. Data submitted via website forms (newsletter, contact requests) is transmitted to HubSpot Inc., a CRM service provider hosted within the European Union (EU1 region). HubSpot acts as a data processor within the meaning of Art. 28 GDPR and is bound to IMMAR by a data processing agreement.

In the context of international projects or technical tools, data may be transferred outside the European Economic Area or your country of collection. Such transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission (implementing decision 2021/914), supplemented by contractual confidentiality commitments and security measures appropriate to the level of risk.

How long is data retained?

Data is retained for the period necessary for the purposes described above, then deleted, anonymised or archived where required by law. Commercial contact data may be retained for up to three years after the last active exchange, subject to any applicable obligation or contrary request.

Research data is retained according to project requirements, quality control obligations, contractual commitments and legal requirements. Cookie choices are retained for twelve months to respect your preference. Analytics data collected via Google Analytics 4 is retained for 26 months within the Google Analytics interface, in accordance with the settings applied. Microsoft Clarity session recordings are retained for 30 days.

Security and confidentiality

IMMAR applies organisational and technical measures to protect data: TLS/HTTPS communication encryption, access restriction on a least-privilege basis, staff and service provider confidentiality obligations, environment security, quality control, regular backups and internal procedures adapted to the sensitivity of the information processed.

What are your rights?

Under applicable regulations, you have the following rights. Any request receives a response within a maximum of 30 days (Art. 12 GDPR), unless particular complexity justifies an extension.

• Access (Art. 15) — Obtain confirmation that data concerning you is being processed and receive a copy.
• Rectification (Art. 16) — Correct inaccurate or incomplete data concerning you.
• Erasure (Art. 17) — Request deletion of your data where the legal conditions are met.
• Restriction (Art. 18) — Temporarily restrict the use of your data in certain cases provided for by law.
• Portability (Art. 20) — Receive your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21) — Object to processing based on legitimate interests or carried out for direct marketing purposes.
• Withdrawal of consent (Art. 7) — Withdraw consent previously given at any time, without retroactive effect on processing already carried out.
• Automated decisions (Art. 22) — Not be subject to a decision based solely on automated processing that produces significant legal effects.

For research studies, you may also refuse to answer certain questions or stop your participation, subject to the specific information provided within the relevant study design.