Data Protection Policy

  1. Introduction

The Comité permanent du Salon International de l’Automobile (GIMS, we, us, our), a foundation organised under Swiss law and in charge of organising the Salon International de l’Automobile, is committed to handling your personal data responsibly. We comply with the legal requirements set out in the Federal Act on Data Protection (FADP), the Ordinance on Data Protection (ODP) and other data protection provisions applicable in Switzerland. We also comply with the provisions of the European General Data Protection Regulation (GDPR) insofar as it applies to us.

GIMS processes your personal data directly and through trusted professional third parties. These third parties process all or part of your personal data so as to enable the provision of the services you request from GIMS. GIMS is able to guarantee that no third party has the possibility of using all or part of your personal data for purposes that do not strictly comply with this Data Protection Policy.

  1. Data controller

The party responsible for processing your personal data is the Comité permanent du Salon International de l’Automobile, whose registered office is at Route François-Peyrot 30, 1218 Le Grand-Saconnex, Switzerland, and which is registered in the Commercial Register of the Canton of Geneva under the number CHE-104.032.519.

  1. What data is processed and why

In this section, we inform you about the personal data we process, how we process it and the purposes for which it is processed. The processing of your data is lawful where it is based on your consent, on our overriding private interest or on a legal basis.

3.1          Visiting and using our website

When you visit our website (the Site), the browser or applications you use automatically transmit a log file to us. The data contained in the log file is as follows:

  • the IP address of the device used to visit the Site;
  • the date and time of interactions on the Site;
  • the pages consulted on the Site;
  • the type of browser used to visit the Site (Chrome, Firefox, Safari, etc.);
  • the operating system of the device used when visiting the Site (Windows, iOS, Android, etc.);
  • the website referring to our Site (if access to our Site is via a link on another website);
  • any errors encountered during a visit to the Site;
  • data stored in cookies.

The IP address of the device used is only analysed in the event of an attack on the Site’s network infrastructure or in the event of suspicion of illegal or abusive use of the Site for the purposes of clarification, defence and, where applicable, as part of legal proceedings against the user concerned.

The protocol file is temporarily stored on our servers in Switzerland. It enables the use of the Site (establishment of the connection), the long-term guarantee of the security and stability of the Site, the optimisation of the Internet offering and the provision of statistical data.

Cookies

Cookies are small text files stored on your device when you visit our Site. Their purpose is to collect information about your browsing and to improve your online experience. Cookies are widely used to personalise content, offer social features and analyse Site traffic.

There are different types of cookies, each fulfilling specific functions:

  • Necessary cookies: these cookies are essential to the Site; they enable browsing and access to basic functions. They ensure the basic functionality and security of the Site;
  • Statistics and comfort cookies: these cookies collect information on how visitors use the Site in order to improve its performance and provide a more personalised user experience. They aim to understand how users interact with the Site in order to optimise it;
  • Marketing cookies: these cookies are used to track visitors to different websites. The aim is to display ads that are relevant and engaging to you by tailoring them to your interests.

The use of cookies leads to the processing of the following personal data:

  • your basic identifiers (your IP address, your unique cookie identifier and device identifiers);
  • your location (approximated on the basis of your IP address);
  • your browsing data (website pages visited, time spent on each page, links clicked);
  • your profiling data for marketing cookies (creation of a user profile by analysing your preferences, interests and online behaviour in order to personalise advertising);
  • your preferences (preferred language, selected region) to improve your online experience.

You can manage your cookie preferences on our Site and withdraw your consent at any time. You can also adjust your preferences via your browser settings. Cookies are stored for a period of 3 years.

Access to the Media Center

To access and download official GIMS media content (videos, images, articles, etc.), you must complete an access request on our Site. By submitting your request, you consent to the following personal data being processed by us:

  • Your first and last name;
  • Your e-mail address.

To manage access to the Media Center, we use the management tool developed by the Irish company HubSpot Ireland Limited (see section 4.2). This data is kept for a period of 2 years. It is stored on Amazon Web Services servers in Frankfurt, Germany.

Links to our social media platforms

We have integrated links to our social media profiles on the Site via social plugins. Social plugins are applications that link your visit to our Site to a social media platform. The social media platforms in question are as follows:

  • Facebook (Meta Platforms Ireland Limited, located at Merrion Road, Dublin 4, D04 X2K5 Ireland);
  • X (formerly Twitter; Twitter International Unlimited Company, One Cumerland Place, Fenian Street, Dublin 2, D02 AX07 Ireland);
  • Instagram (Meta Platforms Ireland Limited, located at Merrion Road, Dublin 4, D04 X2K5 Ireland);
  • TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380 Ireland);
  • YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland);
  • LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland).

Some content (texts and photos, user pseudonyms) published on social media platforms in connection with an event organised by the GIMS may be used for display on the Site and/or one or other of the aforementioned social media platforms.

You are linked to the social media platform that you select by clicking on the icons to access the social media platform that interest you. However, effective access presupposes that you have logged in to your corresponding user account (beforehand or as part of this process).

A direct link is then established between your browser and the server of the social media platform in question. The social media platform thus receives the information that you have visited our Site with your IP address and that you have clicked on the relevant link. According to the information available to us, when you click on a link to a site while you are logged in to your account on a social media platform, the content of this site can be linked to your profile on the social media platform in question, which means that said social media platform can establish a connection between your visit to our Site and your user account. According to information available to us, if you wish to prevent this, you should log out of your user account on the social media platform in question before clicking on any of the corresponding links. As far as we are aware, the establishment of a connection with a social media platform occurs in all cases if you connect to the social media platform via a link.

For more information, please consult the privacy policies of the above-mentioned social media platforms:

3.2          Buying tickets on the online ticketing service

Tickets for our events can be purchased online via our Site (please refer to our General Terms and Conditions for Online Ticket Sales, which are available at the following address: https://ticketing.genevamotorshow.com/).

When you purchase tickets to access to our events via the Site, payment is solely made by credit card (Visa, Mastercard or other cards, subject to change and according to the list provided by the ticketing service). Tickets are purchased via the platform set up by the French company EVENTMAKER SAS (see section 4.2).

To purchase tickets online, we process the following personal data:

  • your first and last name;
  • your title;
  • your date of birth;
  • your payment details (information relating to your credit card or other accepted means of payment);
  • your e-mail address;
  • your postal address;
  • your telephone number;
  • your interests;
  • the means of transport you use.

This personal data is kept for the period required by the applicable legislation. EVENTMAKER SAS stores the data on its servers in Dublin, Ireland.

Card payments are secured and encrypted using a TSL (Transfer Layer Security) coding and encryption system set up by the French company Wordline SA. Wordline SA also handles payment processing, in particular by using the 3D Secure authentication system. As part of 3D Secure authentication, the data processed is the PAN (Primary Account Number) and the following content of the PARes (Payer Authentication Response):

  • identification of the purchaser;
  • identification of the merchant;
  • the transaction reference;
  • the date of the transaction;
  • the amount of the transaction;
  • the currency of the transaction;
  • the status of the signature and the value of the signature.

The data processed by Wordline SA is kept for 540 days from the date of the transaction. It is then destroyed or made anonymous. For further information, see section 4.2 below.

3.3          Newsletter

When you visit our Site, an offer to subscribe to our newsletter will appear. By subscribing, you expressly agree to our newsletter being sent to you. You can unsubscribe from the newsletter at any time and you will find an unsubscribe link in all newsletter e-mails.

To receive our newsletter, we will need your e-mail address. The date of subscription is also recorded in our database. Each time a newsletter is sent to you, information is generated relating to the address file used, the subject and the number of newsletters sent. We can also see which e-mail addresses have not yet received the newsletter, to which e-mail address it was sent and which addresses failed to receive it. In addition, we can see the opening rate, including information about the addresses that opened the newsletter and clicked on the various links and/or made a purchase (tracking pixels). Finally, we may also see information about addresses that have unsubscribed. We use this data for statistical purposes and to optimise the content and structure of our newsletter.

Your e-mail address will be kept until you unsubscribe from the newsletter.

To manage newsletter subscriptions and electronic mailings, we use the platform set up by the French company EVENTMAKER SAS and the Irish company HubSpot Ireland Limited (see section 4.2). The data processed by EVENTMAKER SAS is stored in Dublin, Ireland, and the data processed by HubSpot Ireland Limited is stored on Amazon Web Services servers in Frankfurt, Germany.

3.4          Contact form

If you wish to contact us using the contact form on our Site, you must provide us with the following personal data:

  • your first and last name;
  • your title;
  • your country of residence;
  • your e-mail address;
  • your telephone number; and
  • any other personal data that you include in your message to the GIMS.

The retention period for the above-mentioned personal data is that determined by the applicable legislation (e.g. if you make a complaint). We use the platform set up by the Irish company HubSpot Ireland Limited (see section 4.2) to manage the contact form. HubSpot Ireland Limited stores the data on Amazon Web Services servers in Frankfurt, Germany.

3.5          Marketing and sales

Marketing

When you purchase a ticket on our Site, you expressly agree that we may use your details for marketing purposes, such as invitations to events and satisfaction surveys. You can unsubscribe from all marketing campaigns at any time. You will find our contact details below under “Contact” (see section 9). We process the following personal data:

  • your first and last name;
  • your title;
  • your date of birth;
  • your e-mail address;
  • your postal address;
  • your telephone number;
  • your interests;
  • the means of transport you use.

As indicated above (see section 3.2), we use the tool set up by the French company EVENTMAKER SAS to manage online ticketing. The personal data mentioned above is stored in Dublin, Ireland, for a period of one month following the end of an event organised by us. It is then archived for 2 years.

Marketing your personal data

When you buy a ticket on our Site, you consent to your personal data being sold by us to exhibitors who have taken part in our events and who are located in the following countries:

  • Germany;
  • France;
  • Italy;
  • Poland;
  • United Kingdom;
  • Slovakia;
  • Sweden;

The above-mentioned countries are considered to be countries in which an adequate level of data protection is guaranteed in accordance with the ODP. The sale of your data enables us to continue organising our events and to improve the quality of the services we offer. In this context, the personal data sold to exhibitors is as follows:

  • your first and last name;
  • your title;
  • your date of birth;
  • your e-mail address;
  • your postal address;
  • your telephone number;
  • your interests;
  • Exhibitors or products added to your favourites (via your personal space).

3.6          Analysis tools

When you use our Site, we use Google Analytics 4, an analysis service provided by Google Ireland Limited, whose registered office is at Gordon House, Barrow Street, Dublin 4, Ireland. This tool enables us to analyse the use of the Site, to prepare reports on Site activity, to provide other services relating to use of the Site for market research purposes and to enable us to understand how to improve our Site in accordance with user needs.

For devices used within Europe, Google Analytics 4 does not record or store individual IP addresses. Instead, Google Analytics 4 provides approximate geolocation data by deriving the following metadata from IP addresses: city (and latitude and longitude derived from the city), continent, country, region, subcontinent (and corresponding identifiers). For traffic within the EU, IP address data is used solely to determine geolocation data and is deleted immediately. It is not stored, accessed or used for any other purpose. Google Analytics 4 collects the following data by default:

  • city (including the city’s latitude and longitude);
  • minor version of the browser;
  • browser user-agent string;
  • make, name and model of your appliance;
  • minor version of the operating system;
  • minor version of the platform.

The aforementioned data is stored for a period of 14 months. Information relating to the use of the Site is generally transmitted to Google servers located in the EU. However, we cannot guarantee that no data will be transmitted to the United States.

For more information on Google Analytics 4, please consult the following address:

https://support.google.com/analytics/answer/12017362?hl=fr&sjid=7065083677018360423-EU

You can deactivate the collection of the above-mentioned data at any time by adding the Google Analytics deactivation browser add-on, which can be found at the following address: https://tools.google.com/dlpage/gaoptout

3.7          Exhibitor representatives

When you are a representative of an exhibitor and you wish to enter into a commercial relationship with the GIMS, we process the following personal data:

  • your first and last name;
  • your title;
  • your function and the position you hold;
  • your e-mail address;
  • your postal address;
  • your telephone number;
  • your language.

This data is kept for a period of 7 years, in accordance with the practice established between us and exhibitors. This data is shared with our following service providers: Palexpo SA for the management and use of the portal dedicated to exhibitors (see section 4.1) as well as EVENTMAKER SAS and HubSpot Ireland Limited for the management and monitoring of exhibitors participating in our events (see section 4.2). The data stored by EVENTMAKER SAS is located in Dublin, Ireland and that stored by HubSpot Ireland Limited on its Amazon Web Services servers in Frankfurt, Germany.

3.8          Media representatives

In order to legitimise your activities as a representative of a media organisation for the purpose of granting you accreditation to attend an event organised by the GIMS, we process the following personal data:

  • your first and last name;
  • your title;
  • the position you hold within the media you represent;
  • your e-mail address;
  • your postal address;
  • your telephone number;
  • the details on your press card, including the card number;
  • your interests;
  • the type of publisher for which you publish.

Personal data is kept for a period of 7 years, in accordance with the practice established between us and the media in connection with the granting of accreditation. We use the platforms and tools set up by EVENTMAKER SAS and HubSpot Ireland Limited to manage accreditations for media representatives (see section 4.2). The data stored by EVENTMAKER SAS is located in Dublin, Ireland and that stored by HubSpot Ireland Limited on its Amazon Web Services servers in Frankfurt, Germany.

3.9          Personal data from other sources

We may receive personal data about you from third parties, for example from a person appointed by you (such as a lawyer), administrative or judicial authorities in Switzerland or abroad, customers, contractual partners or Internet analysis services. We may also obtain personal data about you from publicly accessible sources (public registers such as the commercial register or the debt collection register, media outlets, social media platforms or the Internet).

This data may be processed for different purposes, for example to defend our rights in the event of a dispute, to negotiate and enter into contracts with commercial partners and sponsors, for marketing purposes or simply to organise an event.

3.10       Wi-Fi

A Wi-Fi service is publicly available to visitors free of charge. This service is provided by Palexpo SA. When you connect to this Wi-Fi network, you will automatically be redirected to our Site. For further information, please consult the general regulations of Palexpo SA (see section 4.1).

  1. Transmission of your data to third parties

4.1          In Switzerland

We only entrust the processing of your personal data to third parties when we are authorised to do so by contract or by law, and only to carry out processing that we would be entitled to carry out ourselves. For example, we pass on your personal data to affiliated companies and to our trusted professional advisers who assist us with the services we provide.

We also pass on users’ personal data to third parties insofar as this is necessary for the use of the Site and to answer questions, process requests for information or, where applicable, provide the services requested by the user. The use by any third party of the data transmitted for this purpose is strictly limited to the purposes set out in section 3 above. These third-party companies are required to respect the privacy of users in the same way as the data controller itself.

In view of the foregoing, we use the services of Palexpo SA (a limited company incorporated under Swiss law with its registered office at route François-Peyrot 30, 1218 Le Grand Saconnex, Switzerland and registered in the Commercial Register of the Canton of Geneva under number CHE-114.342.370) for the rental of space dedicated to events organised by us. In addition, Palexpo SA provides a portal dedicated to exhibitors so that they can manage their participation and their exhibitions during our events. Palexpo SA also provides Wi-Fi access in its areas. For further information, in particular concerning the exhibitor portal and the use of Wi-Fi, please consult the general regulations and the privacy policy of Palexpo SA at the following address: https://palexpo.ch/politique-de-protection-des-donnees/.

We use the services of service providers such as Infomaniak Network SA (a limited company incorporated under Swiss law with its registered office at Rue Eugène Marziano 25, 1227 Les Acacias and registered in the Commercial Register of the Canton of Geneva under number CHE-103.167.648) to host our Site and provide us with IT support.

We additionally use the services of banks and credit card companies to process payments and ticket refunds.

We also use the services of law firms to ensure the protection of our rights and legitimate interests, particularly in the event of litigation.

4.2          Abroad

We are entitled to transfer your data to third-party companies abroad without your consent, provided that the country in which the data is transferred has an adequate level of protection or in accordance with procedures approved by the Federal Data Protection and Information Commissioner. You can find the list of countries with an adequate level of protection in the ODP.

The transfer of your personal data to service providers located in countries that do not have an adequate level of protection in accordance with the ODP (such as the United States) only takes place on the basis of your consent.

Under the GDPR, personal data transferred from the EEA to third parties in the United States is adequately protected in accordance with the European Commission’s Adequacy Decision of 10 July 2023 on the EU-US Data Privacy Framework.

Your personal data will only be transferred abroad insofar as this is necessary for the processing of your personal data for the purposes set out in section 3 above.

In view of the above, we are using the services of:

  • the company EVENTMAKER SAS (with registered office at 28 rue Laffite, 75009 Paris, France and registered in the Paris Trade and Companies Register under number 512747676) for the use of its platform for managing newsletter subscriptions and electronic mailings, for purchasing tickets online, for setting up and managing the contact form, for managing and monitoring participants in our events, particularly exhibitors, and for managing accreditations for media representatives. EVENTMAKER SAS stores the data on its servers in Dublin, Ireland. For further information, please consult the EVENTMAKER SAS general terms and conditions of sale and use at the following address:

https://drive.google.com/file/d/1xq_pLWuydhDKZibsbFLjt6jbmM_iprYr/view;

  • Wordline SA (located at Tour Voltaire, 1 Place des degrés, CS 81162, 92059 Paris La Défense Cedex, France, and registered with the Nanterre Trade and Companies Register under the number 378901946) for payment processing, security and encryption services for online payments. For further information, please consult the Worldline SA privacy notice at the following address:

https://worldline.com/fr-fr/compliancy/privacy.html;

https://docs.direct.worldline-solutions.com/en/security-and-risk-management/security/data-retention-of-personal-data;

  • HubSpot Ireland Limited (located at 1 Sir Rogerson’s Quay, Dublin 2, Ireland) for the use of its platform for managing contact forms and access to the Media Centre, as well as for managing and tracking participants in our events, particularly exhibitors, and for managing accreditations for media representatives. HubSpot Ireland Limited stores the data on Amazon Web Services servers in Frankfurt, Germany. For more information, please see HubSpot Ireland Limited’s privacy policy at the following address:
  • https://legal.hubspot.com/fr/privacy-policy?hubs_content=www.hubspot.fr/&hubs_content-cta=Politique%20de%20confidentialit%C3%A9;
  • Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google Analytics 4 for statistical purposes. For further information, please consult the privacy policy and terms of use of Google Ireland Limited at the following address:

https://policies.google.com/privacy?hl=fr.

The aforementioned companies may transfer your personal data to the United States. By providing us with your personal data, you expressly consent to such transfers.

  1. Retention and deletion of your data

In principle, your personal data is kept for the periods indicated in section 3 above. By law, we are obliged to destroy or anonymise your personal data as soon as it is no longer required for the purposes of processing.

Please note that, by law, certain personal data must be kept for a specific period. This data must therefore remain stored with us until this period has elapsed. We store this data separately in our system and only use it to comply with the applicable legal provisions.

  1. Your rights

6.1          In general

You may at any time request information about the personal data we have stored about you (see section 6.2). Your request must be submitted in writing with proof of identity.

You also have the right to request the deletion, correction, restriction or destruction of your personal data at any time. We will communicate any rectification or request for erasure to third parties to whom your personal data has been transmitted (see section 4). You also have the right to object to the processing of your personal data insofar as there are reasons linked to your particular situation.

To exercise your rights, please contact us by e-mail or post using the contact details given below (see section 9).

You can also lodge a complaint with a locally competent supervisory authority within the EEA or contact the Swiss Federal Data Protection and Information Commissioner.

6.2          Right to information

In principle, you have the right to ask us for information about the processing of your personal data.

In principle, we will respond to your request for information within 30 days of receipt. If we are unable to do so within this period, we will inform you and let you know when the information will be provided.

We will provide you with this information free of charge, unless it would cause us disproportionate effort. In this case, we will ask you to contribute an amount not exceeding CHF 300. We will inform you of the precise amount before we send you the information. You will have 10 days to confirm your request and your agreement to the participation fee. If we do not hear from you within this period, your request for information will be deemed to have been withdrawn.

6.3          Right to the delivery or transmission of your personal data (data portability)

In principle, you have the right to ask us to provide you with your personal data in a commonly used electronic format or to transmit this data to a third party if this does not require disproportionate effort.

In principle, we will respond to your request for delivery and/or transmission within 30 days of receipt. If we are unable to do so within this period, we will inform you and let you know when delivery and/or transmission will take place.

The provision and transmission of personal data is free of charge, unless it involves disproportionate effort on our part. In this case, we will ask you to pay a contribution not exceeding CHF 300. We will inform you of the precise amount prior to delivery and/or transmission. You will have 10 days to confirm your request and your agreement to the amount of the contribution. If we do not hear from you by the end of the cooling-off period, your request for delivery and/or transmission will be considered withdrawn.

  1. Data security and notification in the event of a data breach

We use appropriate technical and organisational security measures to protect the data we have stored about you against manipulation, total or partial loss and unauthorised access by any third party. Our security measures are constantly adapted to keep pace with technological developments. In particular, we ensure that your personal data is only accessible to authorised persons, that it is available when needed, that it cannot be altered unlawfully or inadvertently and that it is processed in such a way that it can be traced. These measures are also taken by third parties to whom we subcontract the processing of your data (see section 4).

We also take internal data protection very seriously. Our employees and the service providers acting on our behalf are obliged to respect confidentiality and comply with the legal provisions on data protection. Access to personal data is granted only to the extent necessary.

In the event of an actual or suspected breach of your personal data, we undertake to use our best efforts to notify the competent authorities and to inform you, in accordance with the applicable legislation.

  1. Information for children and parents

Our Site is intended for adults. Minors, in particular children under the age of 16, are prohibited from sending us their personal data or registering for a service. If we become aware that such data has been sent to us, it will be deleted from our database. The child’s parents (or legal representatives) may contact us and request deletion or de-registration. In order to comply with such a request, we require a copy of an official document certifying that you are a parent of the child or that you are responsible for the child’s upbringing for other reasons.

  1. Contact

If you have any questions about data protection or if you wish to exercise any of your rights mentioned above, please contact Mr Sandro Mesquita by e-mail at info@genevamotorshow.com.

If you wish to contact us by post, please send your request to the following address:

Standing Committee of the International Motor Show

Data Protection Officer (DPO)

P.O. Box 112

1218 Le Grand-Saconnex

Switzerland

  1. Consents and authorisations

By accepting our Data Protection Policy, you signify your agreement and authorise us to act and process your personal data in accordance with the above text.

For clarification purposes, your agreement and authorisations relate in particular to one and/or other of the following elements (depending on the context in which the data is processed), it being specified that you may revoke your agreement and authorisations at any time and for the future. Thus, your agreement may imply, depending on the case(s) concerned, that you accept that the GIMS, where appropriate with the assistance of third parties:

  • processes your personal data in order to provide the services you request from GIMS and/or any of its affiliated entities;
  • send you regular e-mails with information about GIMS and/or invitations to GIMS-related events;
  • collects cookies in order to gather, record and use usage data for marketing purposes;
  • transmit your personal data to the service providers mentioned in section 4.2 above and that these service providers may transmit your personal data to the United States;
  • may offer you personalised advertising, including invitations, satisfaction surveys and/or special offers and services, if necessary on the basis of additional data to be submitted for specific analysis;
  • transmit your personal data to exhibitors located in the countries mentioned in section 3 above.

We reserve the right to update this data protection policy. The French version of the Data Protection Policy shall prevail.

 

Status: December 2023