Personal Data

PERSONAL DATA PROTECTION POLICY

Last updated : 04 November 2026

Compagnie des Alpes attaches great importance to protecting your personal data. This policy describes the processing carried out when you visit our corporate website.

This policy applies to the following websites:

compagniedesalpes.com
engagements.compagniedesalpes.com/
compagniedesalpes.softy.pro/offers
espace-actionnaires.compagniedesalpes.com
news.compagniedesalpes.com
fondation.compagniedesalpes.com

You will find the following information below :

Who is responsible for using your data?
Who is your data shared with?
When is your personal data collected?
What data do we collect, why, and how long do we keep it?
CDA corporate website — compagniedesalpes.com
CDA shareholder website — espace-actionnaires.compagniedesalpes.com
CDA recruitment website — compagniedesalpes.softy.pro/offers
Common contact point for exercising rights across CDA websites
Cookies and other trackers
Where is your data processed?
How do we protect your data?
What are your rights?
How can you exercise your rights or contact us?
Updates to this policy

1. Who is responsible for using your data??

The controller responsible for the processing described in this policy is Compagnie des Alpes, a French public limited company registered with the Paris Trade and Companies Register under number 349 577 908, whose registered office is at 50-52 boulevard Haussmann, 75009 Paris, France.

When you use a service provided by a subsidiary of the Compagnie des Alpes Group or communicate directly with that subsidiary, it may act as controller, either alone or jointly with Compagnie des Alpes. Information about processing carried out by subsidiaries of the Compagnie des Alpes group in connection with their activities and services can be found in their respective data protection policies, available on their websites.

2. Who is your data shared with?

Recipients within the Compagnie des Alpes group:

Your data is processed by Compagnie des Alpes, the parent company of the Compagnie des Alpes group.

Within this company, your data can only be accessed by a limited number of people in specific departments (communications, IT, human resources, etc.), and only where access is necessary for the performance of their duties.

When you apply for a vacancy published on our recruitment website, your CV may be included in the Compagnie des Alpes Group’s candidate pool. This enables the human resources departments of Group companies to access your profile and, where appropriate, contact you about future career opportunities matching your skills and experience. In this context, CDA and its group companies act as joint controllers for the processing of your data in managing the page displaying the Group’s job vacancies. This means that they work together and jointly determine how your data is collected on this page. This relationship is governed by a joint controllership agreement compliant with the GDPR, which allocates responsibilities and establishes a single contact point for your requests (section 10, “Contact us”). However, each company is solely responsible for the vacancies it publishes and for managing the resulting recruitment process.

Your data is not disclosed to other companies in the Compagnie des Alpes group for other purposes.

Compagnie des Alpes does not sell or rent your personal data to third parties.

Recipients outside the Compagnie des Alpes group:

Your data may also be shared with recipients outside the Compagnie des Alpes group:

With all our technical service providers acting as processors whose involvement is necessary for the processing described below (IT service providers, printers, recruitment management tool providers, etc.), strictly within the scope of our instructions;
With our shareholder relations service provider, acting exclusively on our instructions, in our name and on our behalf;
With members of the Fondation Compagnie des Alpes and with the Fondation de France, to assess applications for funding for public-interest projects based on conviviality, sharing and participation.
Where applicable, with national or local authorities, if required by law or in the context of an investigation and in accordance with applicable regulations.

3. When is your personal data collected?

We may collect your personal data on various occasions:

Online:

On our website and associated online spaces, when you:

use the contact form, in particular to submit an enquiry, a press enquiry or a complaint;
access the shareholder area, request access credentials, subscribe to its communications or events, or request its benefits;
view our job vacancies, create a candidate account or submit an application;
submit a funding application to the Fondation Compagnie des Alpes;
use a form to report breaches of laws or the CDA Group’s internal rules, or a form to report a security vulnerability.

During our interactions with you:

When you attend an event organised by Compagnie des Alpes, including a press conference, a general meeting, a shareholder meeting or event, or any other event.

When, following assessment of your application, you are selected for an interview as part of the recruitment process.

4. What data do we collect, why, and how long do we keep it?

The processing of data collected by Compagnie des Alpes relies on several legal bases:

Performance of a contract or pre-contractual measures: where processing your data is necessary for the performance of a contract entered into with you or to take steps at your request prior to entering into that contract (for example: assessing your application at a job offer or managing your participation in a game or competition in accordance with the rules you have accepted).
Consent: where processing is optional, we obtain your prior agreement. You are free to accept or refuse and may withdraw your consent at any time. Details on exercising your rights and our contact information can be found in sections 9 and 10 of this policy.
Legal obligation: where processing your data is necessary to comply with an obligation laid down by law or regulation.
Legitimate interests: In certain cases, we process your personal data because we have a “legitimate interest” in doing so. This means that:
- We pursue a genuine and serious objective (for example: ensuring the safety of the park, improving our services, managing our relationship with you or defending our rights);
- The processing is necessary to achieve this objective;
- We have checked that this interest does not disproportionately interfere with your rights and freedoms (privacy, protection of your data, etc.), taking into account the nature of the data used, how it is processed and what you can reasonably expect.

When we process your data on the basis of our legitimate interests, you may object to this processing at any time on grounds relating to your particular situation. If you exercise this right, we will stop processing your data for that purpose unless we demonstrate compelling legitimate grounds for continuing the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims. You may exercise this right by contacting us as described in section 9, “How can you exercise your rights or contact us?”. Exercising this right is free of charge.

Below you will find a list of the processing activities involving data collected through the Compagnie des Alpes website. Once the retention periods specified below have expired, we delete the data from our systems or anonymise it so that it can no longer identify you.

In accordance with the principle of data minimisation, we collect only information that is adequate, relevant and strictly necessary for the purposes pursued.

Fields marked as mandatory in forms are necessary to process your request or provide the requested service. Without this information, we may be unable to respond to you or give you access to the relevant service.

4.1 CDA corporate website : compagniedesalpes.com

Contact request

Purpose: Responding to enquiries, press enquiries and complaints received via a form, email or telephone.
Data collected: identification and contact details; capacity (student, professional, shareholder, etc.); subject and content of your request; attachments and correspondence necessary to handle it.
Legal basis: Legitimate interest in responding to requests.
Retention period: For as long as necessary to handle the request, then for five years from its closure, to keep track of correspondence and retain the information necessary for the establishment, exercise or defence of our rights in the event of a dispute.

Whistleblowing system

Purpose: Receiving, analysing and handling reports of breaches of laws or the Group’s internal rules through the whistleblowing system (for example: corruption, fraud, human rights violations or environmental harm).
Data collected: identity and contact details, unless the report is anonymous; reported facts; identity of the persons concerned; supporting documents; correspondence and information necessary to assess the report.
Legal basis: Legal obligation.
Retention period: Depending on the admissibility of the report and the action taken, for the periods necessary for its assessment, investigation and resulting measures, and to comply with applicable legal and evidentiary obligations.

Security vulnerability reporting

Purpose: Receiving and investigating reports of vulnerabilities affecting the Group’s security systems through the reporting page and ensuring that they are remedied.
Data collected: identification and contact details; description of the vulnerability; technical information; supporting documents; data relating to the systems concerned and correspondence necessary to investigate the report.
Legal basis: Legitimate interest in ensuring the security of information systems.
Retention period: For as long as necessary to analyse and remedy the vulnerability, then for the period useful for traceability and the defence of rights.

4.2 CDA shareholder website : espace-actionnaires.compagniedesalpes.com

Shareholders’ Club

Purpose: Creating and securing individual shareholders’ personal accounts, verifying shareholder status, managing membership, communicating benefits and organising Club events.
Data collected: identification and contact details; evidence of share ownership; date of registration with the Club; login credentials; subscriptions to communications and registrations for events; requests for benefits.
Legal basis: Legitimate interest in facilitating access to information and promoting shareholder dialogue.
Retention period: For the duration of the shareholder relationship indicated by the member. When the account is closed, data is deleted, subject to archiving where necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims, for the applicable period.

Shareholders newsletters

Purpose: Informing members of the Shareholders’ Club about Compagnie des Alpes news and the events, content and benefits offered to them.
Data collected: identification and contact details; shareholder status; subscription preferences; technical data relating to the sending and viewing of communications.
Please note that a tracking pixel is embedded in our emails. A tracking pixel is an invisible image embedded in an email that makes it possible to determine whether it has been viewed and the date on which it was viewed. Our pixels are used exclusively for technical purposes related to email deliverability; their use relies on the exemptions provided for by applicable regulations. Your prior consent is not required.
Legal basis: Legitimate interest in communicating with members of the Shareholders’ Club. Shareholders may unsubscribe from the newsletter at any time by clicking the unsubscribe link provided in the communications.
Retention period: For as long as the member’s Shareholder Area account exists, unless they object earlier.

Lottery/game – Shareholders’ Club

Purpose: Managing game registrations, verifying eligibility, selecting winners and awarding prizes.
Data collected: identification and contact details; shareholder status; information necessary for registration, verification of eligibility and delivery of prizes.
Legal basis: Performance of the game or competition rules;
Retention period: For the duration of the game or competition, then for as long as necessary to deliver prizes and handle disputes, up to a maximum of six months.

4.3 CDA recruitment website : compagniedesalpes.softy.pro/offers

Managing your candidate profile on the recruitment page

Purpose: creating and managing your candidate profile.
Data collected: identification and contact details; curriculum vitae; cover letter; education; qualifications; professional experience and career history; login credentials and information entered in the candidate profile.
Legal basis: Performance of pre-contractual measures.
Retention period: 2 years from the date of your most recent application.

Managing the recruitment process *

Purpose: Organising the recruitment process, including interviews and reference checks.
Data collected: identification and contact details; information relating to the application; interview reports; availability; expectations; information provided during discussions and, where applicable, data obtained from reference checks. If the candidate is selected, the data is reused for personnel management purposes.
Legal basis: Performance of pre-contractual measures.
Retention period: 2 years from the date of your application.

(*) This processing is carried out independently by the company that published the job vacancy.

Sharing your candidate profile within the “CDA Talent Pool” CV database

Purpose: Sharing your candidate profile within the “CDA Talent Pool” with other companies in the CDA group.
Data collected: identification and contact details; curriculum vitae; cover letter; education; qualifications; professional experience and career history; information relating to the positions sought.
Legal basis: Legitimate interests for all candidates who submitted a CV before August 2026. Since then, CDA has obtained candidates’ explicit consent to join the CDA Group’s CV database.
Retention period: Up to two years from submission of the CV. If the candidate declines to join the CV database, the CV is deleted three months after the candidate is rejected for the position concerned.

Partage de votre profil candidat au sein de la CVthèque « Vivier CDA »

Finalité : Partager votre profil candidat au sein du « Vivier CDA » avec les autres sociétés du groupe CDA.
Données collectées : données d’identification et de contact ; curriculum vitae ; lettre de motivation ; formation ; diplômes ; expérience et parcours professionnel ; informations relatives aux postes recherchés.
Fondement : Intérêt légitime pour tous les candidats ayant remis un CV avant août 2026. Depuis, CDA recueille explicitement le consentement des candidats à joindre la CVthèque du Groupe CDA
Durée de conservation : Jusqu’à deux ans à compter de la remise du CV. En cas de refus du candidat d'intégrer la CVthèque, le CV est supprimé 3 mois après le refus du candidat au poste concerné.

4.4 Assessment of funding applications to the Fondation CDA : https://fondation.compagniedesalpes.com

Purpose: Assessing funding applications submitted to the Fondation Compagnie des Alpes.
Data collected: identification and contact details; information relating to the project applicant and the project; supporting documents; financial and budgetary data, including the projected budget, expenditure, revenue, funding, amount requested and accounting documents provided.
Legal basis: Pre-contractual measures.
Retention period: For unsuccessful applicants, the data collected is retained for 2 years from the last contact, in intermediate archives with restricted access. For successful applicants, the data is retained for as long as necessary for the funded project.

4.5 Common contact point for exercising rights across CDA website :

Purpose: Receiving, verifying and handling requests relating to personal data.
Data collected: identification and contact details; subject and content of the request; data concerned; correspondence and, where strictly necessary, proof of identity.
Legal basis: Legal obligation.
Retention period: 6 years from closure of the request. Where proof of identity has had to be collected, it is deleted as soon as verification has been completed.

5. Cookies and other trackers

Our websites use trackers that are strictly necessary for their operation, in particular to secure authentication in shareholder areas, detect navigation problems and remember your cookie choices. They may also use, with your consent, functionality, audience measurement and performance, affiliate and social media trackers.

You may accept, refuse or configure non-essential trackers using the cookie management tool, and change your choices at any time. The lifespan of trackers and your choices is specified in the applicable cookie policy.

6. Where is your data processed ?

All your personal data is stored exclusively on servers located in the European Union or in countries offering an “adequate” level of protection (for example, the United Kingdom).

Although hosted in the European Union, this data may be accessed from third countries when we use technical service providers (for example: AWS, Microsoft, Google) established abroad (namely: the United Kingdom and the United States). Access from these countries is considered a data transfer but is necessary for the proper operation and maintenance of the IT tools they provide. These providers have specialist expertise that justifies using their services.

We make every effort with these providers to ensure that your data is protected in accordance with European regulations. These providers act only on our instructions. A contract is systematically entered into with them, and personal data transfers are governed by specific enhanced contractual clauses (standard contractual clauses – SCCs – issued by the European Commission) whenever the laws of the country concerned do not offer protection equivalent to that provided by the GDPR (so-called “adequate” countries). Where appropriate, additional technical or legal measures are implemented. We keep all this information available. To consult it, you may contact our Data Protection Officer, whose contact details are provided in section 10 at the end of this policy.

7. How do we protect your data ?

The security of your personal data is a central concern for the companies in the Compagnie des Alpes group, which pool their resources to provide an appropriate level of security in line with the state of the art.

To preserve the confidentiality and security of your personal data, in particular to protect it against unlawful or accidental destruction, accidental loss or alteration, or unauthorised disclosure or access, the Compagnie des Alpes group implements appropriate technical and organisational measures and requires its processors to meet the same standards. These measures are adapted to the sensitivity of the data processed and the level of risk.

The Compagnie des Alpes group has established procedures to detect, analyse and monitor security incidents and any suspected personal data breach, and to be able to block access to data at any time. Procedures for managing individual access permissions have also been implemented to ensure that access to data is as restricted as possible.

Despite our efforts, vulnerabilities may still exist in our systems. If you believe you have identified a vulnerability, please contact us using this form (vulnerability disclosure page).

8. What are your rights ?

You have several rights in relation to the personal data we hold about you:

The right to object: you no longer wish to receive our shareholder communications.
The right to rectify your data: Have you moved? Changed your email address? Are you no longer a CDA shareholder? Let us know by keeping your data up to date.
The right to access your data: you may request a copy, in an understandable format, of all the personal data we hold about you.
The right to erase your data: you wish to delete your entire shareholder account or all the personal data we hold about you. We will comply with your request, except for information that may be necessary to maintain our evidentiary records (in the event of potential legal proceedings), or where retention is legally required.
The right to restrict the use of your data: you are involved in a dispute and wish to prevent your data from being erased; your data will then be retained without being used.
The right to data portability: You wish to retrieve some of your data. You are then free to store it elsewhere or transfer it easily from one system to another for reuse for other purposes.

You will find all our contact details below to exercise these rights.