Questel Data Privacy Policy

This Data Privacy Policy is drawn up in English. It may be translated in other languages for convenience purposes. In case of a conflict with the translated version, the English version shall prevail.

Questel reserves the right to change its Privacy Policy. You can find the latest version on this webpage. Any changes will be effective when we post on the website the revised Privacy Policy. This Privacy Policy was last updated as of the date listed above (“updated date”). We encourage you to review this page regularly for the latest information on our privacy practices. 

Questel is a global leader in providing trusted information and analysis on intellectual property services and software solutions, as well as the provider of a unique collection of IP databases. 

Questel attaches the greatest importance and care to the protection of privacy and Personal Data, as well as to the respect of the provisions of the applicable legislation. The General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), as well as local data privacy laws, state that Personal Data must be processed lawfully, fairly, and transparently. Thus, this Policy aims to provide you with simple, clear information on the processing of Personal Data concerning you, in the context of your browsing and the operations carried out on our website.

This Policy describes how Questel SAS and its affiliates (hereinafter “Questel”, “we”, “us” and “our”) collect, use, process and secure your Personal Data when visiting our websites, SaaS platforms or other offline business contact with us, in the context of our business relations with our clients or fellow professionals, or in the context of all other occasions on which you provide Questel with your Personal Data, especially when you subscribe to our newsletters or at professional events.

For your information, some Questel websites may have their own privacy policy that describes how Personal Data for those websites are handled specifically. In case of conflict between the specific privacy notice and this Policy, the specific one prevails.

Questel has appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to data privacy. If you have any questions, including any requests to exercise any of your privacy rights, please contact our DPO at dpo@questel.com.

1- What Personal Data do we collect and how?

2- Why do we collect your Personal Data?

3- How long do we keep your Personal Data?  

4- Do we share your Personal Data?

5- How do we ensure the security of your Personal Data?

6- Is your Personal Data transferred to third country?

7- How do we use cookies and tracking technologies?

8- What are your privacy rights?

9- How to exercise your privacy rights?

10- How to contact us?

Personal information (“Personal Data”) generally means information that identifies, relates to, is about you, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Data does not include publicly available, anonymized or aggregated data.

1. Questel collects your Personal Data interacting with you directly:
2. Questel may also collect your Personal Data, indirectly, from third parties:

• When you purchase or have access to our services:
  • You are usually required to provide us with your name and email address. 
  • You may also be required to provide other information necessary for your use of our services or additional information that you choose to disclose to us, such as your professional details or your user preferences.
• When you come to our offices or take part in events organized by Questel or other professional events.
• When you interact with us:
  • When you fill in a form online.
  • When you contact us or request information from us.
  • When you send us applications or reply to job advertisements.
• Through cookies and similar technologies included in our services:
  • When you access our services, we collect device and information relating to your usage of our services. 
  • For more information on how we use these standard technologies, please see Questel Cookie Policy, click here 
• Our partners and service providers: 
  • Technology providers in connection with your use of our services.
  • Market research agencies.
  • Content providers.
• Our customers:
  • Our customers may provide us with Personal Data to integrate with our services, your employer, or the institution you are affiliated with may provide us with contact information so that we can set up your login, etc.
• Publicly available sources:
  • Academic or scientific publications.
  • Patent & trademark offices and regulatory agencies.
  • Court files.
  • Public websites, social media or from data suppliers.

The Personal Data which we collect may consist of the following:

• Personal identifiers, e.g., name, username, e-mail address, phone number, signatures, etc.
• Contact information, e.g., e-mail, phone, address, title, function, etc.
• Demographic information, e.g., gender, location, language, etc.
• Authentication data, e.g., Internet Protocol (IP) address, etc.
• Professional information, e.g., publications, employer, location, licensure, credentials, professional identification number, work history/resume, education history, specialties, expertise, availability, etc.
• Indirect identifiers, e.g., study ID, cookies, IP address, computer device information, etc.
• Knowledge, belief & preference data, e.g., thoughts, concerns, preferences, feedback, opinions and other information provided through surveys, interviews, etc.
• Usage data, e.g., information about your use of our services, such as date and time of visits, the pages viewed, time spent at one of our websites, etc.
• Financial information, e.g., payment information and related bank details, etc.
• Commercial information, e.g., purchase history, subscription information, transaction details, information about sanctions and restrictions, etc.
• Communication data, e.g., information communicated from or to you through telephone recordings, voicemail, email, etc.
• Sensory data, e.g., photographs, audio, video or other similar electronic recordings, etc.

Questel does not collect any Personal Data in the special categories (sensitive information) listed Article 9 of the GDPR, i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Personal Data collected by Questel undergo computer processing so that we can manage your request and ensure that it is followed up. We collect your Personal Data for specific purposes and on the below different legal grounds.  

2.1         Execution of the contract

In the context of the execution of the contract or pre-contractual measures, your Data is processed for the following purposes: 

• Managing information requests
  • Manage requests for information about our services.
  • Manage customer information across our websites.
  • Communicate product usage information to our customers, business partners, content and technology providers.
• Contract management
• Order management, purchasing. 
• Create software accounts.
• Contract management. 
• Provide user and technical support. 
• Perform other related administrative tasks.
• Customer relationship management
• Enforce our terms of business. 
• Management of your customer account.  
• Contact you about renewal of your subscriptions.
• Complaints and after-sales service management.
• If you answer a job advertisement or send an application, so that Questel can reply and potentially reuse those data at the time of the recruitment procedure.

2.2         Consent

Based on your consent, your Data is processed for the following purposes:  

• Business development
• Carrying out commercial and marketing prospecting operations. 
• Transmission of your Data to our commercial partners. 
• Administer events we host or attend (e.g., conferences, webinars, etc.). 
• Management of cookies requiring your consent.  
• Management of the newsletter. 
• Provide you with advertising based on your activity on our websites and services and on third-party websites. 

You can opt out of our marketing communications at any time – all Questel marketing e-mails contain an “unsubscribe” or “manage my preferences” link. If you have questions regarding our use of your information for marketing purposes, please contact dpo@questel.com. See section 8 “What are your privacy rights?”. 

• Product customization and development
• Deliver personalized functionality and content in our services, for instance we may retain your browsing and usage information to make your searches within our services more relevant.
• Analyze product usage information to understand which content and tools are most useful for our users and to allow us to deliver and suggest tailored content, features and other services that we believe may interest you.
• Use information collected on our services to improve the functionalities, the design and content of our services (including sharing your Personal Data across our group which allows us to facilitate the use of these services).

You can withdraw your consent at any time. We will ensure that we provide the opportunity for you to opt out at any time and in an easy manner. See section 8 “What are your privacy rights?”. 

2.3         Legitimate interest

In the framework of the legitimate interest of Questel, your Personal Data are processed for the following purposes: 

• Management and development of the relationship with clients. 
• Establishment of statistics for the improvement of products and services. 
• Marketing activities. 
• Security measures
• Manage access to our premises and for security purposes.
• Protect the security of our IT systems, architecture and networks. 
• Prevent misuses of our services.

2.4         Legal rights 

• Management of pre-litigation and litigation. 
• Fight against Fraud. 
• Fight against money laundering and the financing of Terrorism.  

Within the framework of legal and regulatory obligations to which Questel is subject, your Personal Data are processed for the following purposes:  

• General and auxiliary accounting. 
• Respond to a court order or a regulator. 
• Comply with legal obligations.

Those legal obligations are defined in national and/or international law and in national rules issued by the competent national supervisory authorities and can include maintaining records, compliance checks, or screening and recording for tax, social, or security objectives.

Questel stores your Personal Data throughout the period of your relationship with us and retains it for as long as necessary to fulfil the purposes for which Questel collect it, including for the purposes of satisfying legal, accounting, or reporting obligations or to resolve disputes.  For more information on how long we store your Personal Data, please contact us at dpo@questel.com.

The data recipients are the people responsible for managing the contract between you and us and / or the people receiving requests sent to Questel via our websites, and /or  the people best able to respond to your request, depending on the kind of request.

As a global firm, Questel may share the Personal Data it collects via its websites internally with its offices and affiliates or with third parties service providers. Your Personal data may, depending on the purposes of processing, be disclosed to different individuals and organizations, including:

• Employees and contractors of Questel group whose roles require access to your data. 

Our personnel are bound to confidentiality terms which cover their obligations to protect personal data.

• Services providers who process personal data on our behalf (“processors/vendors”).

Questel may employ the services of third parties to support us with certain tasks, such as internet technical support, marketing automation, designers, website developers, translation services, etc. 

• We may share your data with these third-party service providers, so that they can perform services on our behalf. They process the Personal Data strictly necessary to carry out the services we ask them. Such vendors are contractually bound to protect your data to the same standard as set out in this Policy.   Duly authorized public authorities (judicial, control...), in the framework of our legal and regulatory obligations. 
• Regulated professions (lawyers, bailiffs, etc...) who may intervene in the context of the implementation of guarantees, collection or litigation. 
• Subscribers and members. If your Personal Data is collected from public sources for inclusion in our product databases and any Personal Data you choose to provide to us for display in our services (for example, in profiles and when using online forums), your personal data may be accessed by users of our services. Additionally, if you or your organization register for one of our membership-based communities or products, we may make information about you (including contact and institutional information) available to other members through online and offline services.

Questel does not sell OR lease your personal data to third parties.

Questel takes care to protect and secure your personal data to ensure that they are kept confidential, and to prevent them from being distorted, damaged, destroyed or disclosed to unauthorized third parties. To do so, Questel maintains appropriate administrative, technical, and physical security measures. It may include encryption, firewalls, roles-based data access, intrusion-detection software, and physical access controls to data centers.  In addition, our practices, and policies and physical and logical security measures (secure access, authentication process, backup, software, internal trainings, etc.) are regularly reviewed and updated as necessary. See Questel IT Security Policy. 

Under the applicable European rules, if a Personal Data breach is found which can cause a high risk to the rights and freedoms of data subjects, Questel will notify that breach to the competent national supervisory authority and, where required by the regulation, to the data subjects (individually or collectively depending on the circumstances).

Questel keeps your Personal Data for the time necessary to perform the agreed purposes, subject to its legal rights to archive some data, its obligations to keep certain data and/or to the fact that it can anonymize data.

In addition, Questel’s websites may offer links to third-party websites which may be of interest to you. Questel has no control over the contents of those third-party websites or what those third parties do with any personal data they may gather. Questel therefore cannot be held liable for the processing of your personal data by those third parties, which is not subject to this Policy. You are responsible for finding out about those third parties' data protection policies.

Questel is a global business, and your data may be transferred to countries with different privacy and data protection laws than your own.

We protect our transfers from the European Union to non-EU countries with approved legal safeguards that may include: 

• Questel’s intra-group Agreements incorporating the Standard Contractual Clauses approved by the European Commission (“Standard Contractual Clauses”); 
• Standard Contractual Clauses and other contract terms executed between Questel and applicable third parties that ensure personal data remains protected in accordance with applicable laws.

Please read Questel Cookies Policy for detailed information about the cookies and other tracking technologies used on our websites and services. The Cookie Policy includes information on how you may disable these technologies. You can indeed change the personal configuration of your navigator to prevent cookies registration. Please be aware that if you choose not to accept cookies, you will be able to navigate in the freely accessible public part of the Questel web sites only.

The following privacy rights are available to all individuals. The rights may differ based upon local data protection laws. Please contact us through dpo@questel.com if you have further questions about your privacy rights.

• Right to information on the processing of your Personal Data. Questel endeavors to provide you with concise, comprehensible, and easily accessible information in clear and simple terms about how your Personal Data are processed.
• Right of access of your Personal Data. The right of access enables you to obtain confirmation from Questel that your Personal Data are or are not processed, and where they are, to access them or obtain a copy of them. 
• Right to rectification of your Personal Data. You may request that we correct inaccurate Personal Data we hold about you. You may also have the right to have incomplete Personal Data completed.
• Right to restriction of processing your Personal Data. You may ask us to restrict further processing your Personal Data.
• Right to erasure. The right, under certain conditions, to have the Personal Data erased or deleted, unless Questel has a legitimate interest in keeping it. Subject to the exceptions under the applicable law (e.g. retention of data necessary to comply with a legal obligation), you are entitled to request Questel to erase your Personal Data as soon as possible, where one of the following grounds applies:
• the Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed;
• you wish to withdraw your consent where that consent was the basis for processing your Personal Data when there is no other basis justifying that processing;
• You wish to object to the processing of your Personal Data for direct marketing purposes;
• You believe and are able to show that your Personal Data have been processed unlawfully;
• Your Personal Data must be erased pursuant to a legal obligation.
• Right to personal data portability. The right to request that Personal Data be transmitted in a reusable format that allows it to be used in another database.
• Right to object to the processing of personal data for reasons related to your particular situation (under conditions).
• Right to withdraw consent to the processing of personal data. Where Questel processes your Personal Data based on your consent, you can withdraw that consent at any time using the means made available to you for that purpose. Under the applicable law, however, withdrawing your consent is not retrospective and cannot therefore affect the lawfulness of processing carried out before the withdrawal.
• Right to define post-mortem directives. The right to define directives concerning the fate of Personal Data after your death. 
• Right to make a complaint to a supervisory data protection authority. If, notwithstanding Questel's efforts to keep your Personal Data confidential, you believe that your rights have not been complied with, you have a right to lodge a complaint to the Data Protection Authority, ie for France: CNIL, 3 Place de Fontenoy – TSA 80715 – 75334, PARIS CEDEX 07, France

You can email dpo@questel.com specifying in the subject line of the email " Data subject rights". Upon receiving your request, we will first verify your identity by matching the information you provide (including your name, email address, and phone number) with what we have on file for you. We may ask you for additional information to verify your identity or to comply with your request. We will complete your request in the timeline prescribed by the applicable privacy laws.

Depending on where you are located or where you reside, you may have certain rights granted to you over your personal data under local data protection laws. 

Responding to your requests. Questel undertakes to respond promptly, and in any event within the specific timeframe required by the laws applicable to personal data about you. When necessary, that period may be extended, having regard for the number and complexity of the request you sent. Where that occurs, you will be informed of that extension and the reasons for it.