Privacy Policy

MySupervisionHub Mobile Application

Introduction

This Privacy Policy outlines how CMA Ships, part of the CMA CGM Group, handles personal data collected through the MySupervisionHub mobile application (the "App"). This Privacy Policy aligns with the CMA CGM privacy statement and provides details on what personal data is collected, how it is processed, and your rights under applicable privacy laws.

CMA CGM is committed to safeguarding your personal data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR), the 2002/58/EC Directive, and other relevant data protection laws.

Our Commitment to Privacy

CMA CGM's privacy policy adheres to GDPR principles and the Organization for Economic Cooperation and Development (OECD) guidelines. To ensure robust data protection, we have implemented the following measures:

• Regular employee training on privacy principles and compliance with our code of conduct.
• Strong contractual frameworks with suppliers and affiliates to ensure appropriate safeguards and enforceable rights.
• Regular audits of affiliates, subsidiaries, and suppliers to uphold high compliance standards.

CMA Ships, headquartered in Marseille, France, serves as a data controller. If any of our subsidiaries or affiliates processes your personal data, they will act as separate data controllers.

Data Collection and Usage

What Personal Data We Collect

• Information you provide during registration or use of the App.
• Data generated by your use of the App, such as usage logs and preferences.
• Technical data such as device type, operating system, and IP address.

How We Use Your Data

• To provide, maintain, and improve the App's functionality.
• To comply with legal obligations.
• For analytics to enhance user experience.

Data Sharing

We may use service providers to process your data under contracts that comply with data protection laws. Data recipients are bound by GDPR principles, ensuring lawfulness, fairness, transparency, and confidentiality.

International Data Transfers

CMA CGM operates globally in over 160 countries. In some cases, your data may be transferred outside the European Economic Area (EEA). These transfers are governed by:

• Binding Corporate Rules (BCRs) for intragroup transfers.
• Standard Contractual Clauses (SCCs) approved by the European Commission for third country transfers.

Data Retention 

We keep your personal data for as long as necessary to fulfil the purposes for which we collected and continue to process it, and to satisfy any legal, accounting or statistics requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

What are your rights

1. Your right to be informed:

   We will give you information about the processing of your personal data, in particular:

   • The purpose of the processing.
   • The activities covered by the data processing.
   • The recipients.
   • The storage duration of the data.
   • The legal basis for the processing.

2. Your right of access

   • You have the right to ask us for copies of your personal information.

   We may object to your request when:

   • Your personal data is inseparable from the personal data of others. In this case, we reserve the right to redact or withhold it if it will infringe the rights of those third parties.
   • Your request is “manifestly unfounded or excessive”.
   • Your personal data is no longer available.

3. Your right to rectification

   You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

4. Your right to restrict the processing

   You have the right to ask us to restrict the processing of your information. This right applies when:

   • The accuracy of the personal data is contested.
   • The processing is unlawful.
   • You need the data for the establishment, exercise or defense of legal claims.
   • You have objected to the processing, pending the verification of our legitimate ground.

   While we consider your request, we will stop processing your personal data. We will notify you of our decision and any justifications for continuing to process your personal data as soon as we can.

5. Your right to erasure (right to be forgotten)

   You have the right to ask us to erase your personal data. This right applies when:

   • The personal data is no longer necessary for the purpose which we originally collected processed it for.
   • We no longer have a legal basis for the processing.

   CMA CGM may have some legal basis for storing your personal data such as:

   • Where continued processing is required under a contractual obligation (e.g. retention of contractual obligation is 10 years as from the end of the contractual relation),
   • Where processing is required for the establishment, exercise or defence of legal claims.

6. Your right to object to processing

   You have the right to ask us not to process your personal data for marketing purposes, including profiling (eg. tracking your usage of our Website).
   You also have the right to object on the processing which relies on our legitimate interest. We will then stop the processing of your data until we demonstrated compelling legitimate grounds for the processing.

7. Your right to data portability

   You have the right to transfer personal data we have to another controller. This right relates to processing carried out by automated means based on your consent or on a contract we have with you.

8. Your right to withdraw consent

   You can withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Your right not to be subject to an evaluation based on automated processing

   You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.

   This right may not apply if:

   • The processing is necessary for entering into, or performance of, a contract between you and us,
   • The processing is authorised by Union or Member State law to which we are subject,
   • The processing is based on your explicit consent.

10. Your right to complain to the Supervisory Authority

    If you feel that CMA CGM have processed your personal data unfairly or unlawfully, you have the right to complain about us to the relevant Supervisory Authority.

    In France, the Supervisory Authority for personal data protection is the

    Commission Nationale de l’Informatique et des Libertés (CNIL)

    You can contact this Supervisory authority here or on +33 (0)1.53.73.22.22.

Data Security 

Taking care of your data has been the core of our concerns for years of service. By this commitment, we constantly strive to do our best in building secure environment that provide confidentiality, availability and integrity to your data.
Therefore, we implement technical and organizational measures to protect your rights and freedom and your personal data against data breaches.

Here is a non-exhaustive list of our appropriate organisational and technical measures:

• pseudonymisation, encryption and minimisation policy of personal data
• software for preventing piracy and malicious intrusions in our database,
• provision of regular training programs to our employees,
• audits of our legal entities executed by highly qualified staff,
• access control and transmission control,
• risk analysis mechanisms (DPIA).

CMA CGM and its staff remain constantly attentive to any innovations or new measures which can improve your Data security.

Contact Us

If you have any questions about the processing of your personal data, or if you wish to exercise your rights, please contact our data protection office:

Through our personal data portal

Or with a letter specifying:

• Surname, first name, the country, date
• The address for the response and any correspondence
• The name of the legal entity concerned
• The subject and scope of the request in order to make it easier to identify the data in question (HR, commercial, etc.).

The request must be sent to the following addresses:

- Mail: At the attention of CMA CGM data protection officer - 4, Quai d’Arenc, 13235 Marseille Cedex 02 France

Depending on your request, we may seek additional information.

Time limit to respond

The time limit to reply to the request is one month. Occasionally it may take us longer than a month if your request is particularly complex. In this case, we will notify you and keep you updated.