General Privacy Policy – PAXON and Affiliates
Last updated: September 2026
1. PURPOSE OF THIS GENERAL PRIVACY POLICY.
In the context of their business activities, all legal entities operating under the PAXON brand (hereinafter ‘the Companies’) process personal data when this website (hereinafter ‘the Website’) and the websites dedicated to each of the Companies (hereinafter ‘the Websites’) are used.
The Companies attach great importance to the protection of personal data.
The purpose of this policy, as implemented by the Companies, is to inform data subjects of the commitments the Companies have made to ensure compliance with current data protection regulations.
This policy may be modified to take account of changes in the relevant legislation and regulations. Consequently, data subjects are advised to visit this page regularly if they wish to keep up to date with these developments.
Where local circumstances or specific processing requirements so require, additional information may be provided or privacy policies may be adapted by certain Companies.
Important note: As PAXON is a brand and not a legal entity, it does not itself act as controller; the Companies act as joint controllers for processing operations for which they jointly determine the purposes and means in the context of the PAXON Website. Each Company shall act as the controller for processing operations for which it alone determines the purposes and means, in particular in the context of its activities and its own website.
2. PROVISIONS RELATING TO THE CONTACT FORM.
In the context of their business activities, the Companies process personal data provided via the contact form published on the Website.
2.1. Legal basis, nature of the personal data processed & data subjects.
The Companies need personal contact details (surname, first name, job title where applicable, email address, etc.) of individuals who, in the course of their professional activities, contact them to request information about the services offered by the Companies and/or a quote, or to be kept informed of the Companies’ news and offers.
This data is collected with the primary aim of responding to requests submitted by data subjects by forwarding these requests to the relevant department(s) of the Companies responsible for processing them.
The processing carried out on this data is based, depending on the purpose in question, on:
- the Companies’ legitimate interest in responding to general requests for information;
- the performance of pre-contractual measures taken at the data subject’s request, in particular where the latter request information regarding a service or a quotation;
- the consent of the data subject to receive marketing and commercial communications, where such consent is required.
2.2. Purposes of personal data processing.
The Companies use personal data solely for the following purposes:
- to respond to the request made on the Website,
- to record the contact in the CRM system used to manage the request and, where necessary in view of the relevant commercial organisation, in the systems or prospecting databases of the relevant Companies.
- to carry out their marketing and sales communications (service offers, updates – such as newsletters, and invitations to promotional events) subject to the prior and express consent of data subjects.
- to fulfil their legal obligations.
2.3. Sharing and transfer of personal data.
Personal data is intended solely for the Marketing & Sales departments of the Companies for the purposes set out in this policy.
Depending on the nature of the request, its subject matter and the relevant sales organisation, the data collected in our customer and prospect relationship management system (“CRM system”) may be made available to the company responsible for handling the request. Where necessary for the purposes described above, data may also be disclosed to other relevant companies (including those in a different geographical area to where the data was collected) and to authorised service providers or partners, in accordance with the applicable data protection legislation.
This data is not disclosed to any third party (including free of charge).
For further details on transfers, please refer to Chapter 6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
2.4. Hosting & storage of personal data.
The data thus collected is stored in various CRM systems, one of which is shared by most of the Companies operating under the PAXON brand. Depending on the case, each Company may also store this data in its own information system.
The personal data collected via the contact form will only be retained for as long as is necessary to fulfil the purposes for which it was collected.
For Companies based in the European Economic Area or elsewhere in Europe, the personal data is generally hosted within the European Economic Area.
For Companies based outside the European Economic Area or elsewhere in Europe, the personal data is generally hosted in the country in which each Company is based.
Data subjects may exercise their rights (see Chapter 7. YOUR RIGHTS REGARDING YOUR PERSONAL DATA).
3. PROVISIONS RELATING TO THE RECRUITMENT FORM.
In the context of their business activities, the Companies process personal data provided by applicants, in particular via the recruitment form available on their website.
3.1. Legal basis, nature of the personal data processed & data subjects.
The Companies collect only the personal data they need to process applications submitted via the Website by data subjects and to manage their current and future recruitment processes.
The processing of this data is therefore necessary for the purposes of the legitimate interests pursued by the Companies in the context of managing their recruitment.
3.2. Purposes of personal data processing.
The Companies use the personal data solely to manage their recruitment processes (assessing applications, organising tests and job interviews, and creating a database of potential candidates) and to fulfil their legal obligations.
This data is not processed for the purposes of marketing.
3.3 Sharing and transfer of personal data.
The personal data is intended solely for use by the Companies’ internal departments (Human Resources and departments requiring recruitment) for the purposes set out in this policy.
Where necessary to achieve these purposes and perform their remit, such data may be shared amongst the Companies or transferred to partner organisations (in particular recruitment agencies), with whom the Companies have ensured that they have explicitly committed to the same level of confidentiality and compliance with the regulations in force.
This data is not disclosed to any third party (including free of charge).
For further details on transfers, please refer to Chapter 6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
3.4. Hosting & storage of personal data.
The personal data collected via the recruitment form is stored in the Companies’ information systems, as specified above.
The personal data collected via the recruitment form will only be retained for as long as is necessary to fulfil the purposes set out above; it will not be retained for longer than 2 years following the last contact with the candidate, subject to any different time limit provided for by local legislation.
For Companies based in the European Economic Area or elsewhere in Europe, the personal data is generally hosted within the European Economic Area.
For Companies based outside the European Economic Area or elsewhere in Europe, the personal data is generally hosted in the country in which each Company is based.
Data subjects may exercise their rights (see Chapter 7. YOUR RIGHTS REGARDING YOUR PERSONAL DATA).
4. PROVISIONS RELATING TO SERVICES PROVIDED BY THE COMPANIES.
In the context of the provision of services which the Companies (hereinafter the ‘Companies’) carry out at the request of their clients acting as principals (hereinafter referred to as ‘Clients’), the Companies process personal data entrusted to them by Clients or communicated directly to them via access to an electronic catalogue for placing orders online (hereinafter the ‘Catalogue’) or via an online shop (hereinafter the ‘Shop’) which the Companies may make available to their Clients or which their Clients have set up with other service providers.
4.1. Legal basis, nature of the personal data processed & data subjects.
The Companies require personal contact details (surname, first name, job title if required, telephone number or email address, delivery address, and login and password to access a Catalogue or Shop).
The data subjects are the interlocutors of their Clients, the persons placing orders, and the recipients of orders designated by their Clients.
The processing of this data is therefore necessary for the Companies to fulfil the contract entered into with their Clients or for the purposes of the legitimate interests pursued by the Companies (improving the quality of services, ensuring the security and confidentiality of the data processed, and fostering their business development with their Clients).
4.2. Purposes of personal data processing.
The Companies use personal data solely for the following purposes:
- to manage the connection and features of a Catalogue,
- to manage the connection and features of a Shop,
- to manage orders and related services from a logistical and financial perspective,
- to manage commercial relationships with their Clients (negotiating and monitoring contracts, invoicing and accounting, providing evidence of transactions when dealing with any disputes or complaints, monitoring service delivery, and proposing new services),
- to fulfil their legal obligations.
The Companies do not carry out any individual profiling based on this personal data.
4.3. Sharing and transfer of personal data.
The Companies may sometimes need to share personal data with the IT service provider responsible for managing the Website.
The personal data is primarily intended for use by the Companies’ internal operational departments, for the purposes set out in this policy.
Where necessary to achieve these purposes and perform their remit, personal data may be shared between the Companies or transferred to partner companies that carry out certain operations on their behalf (in particular, transport companies responsible for delivering orders, local warehousing companies, companies capable of providing financial backing for stock of products listed online in a Shop, etc.) and with whom the Companies have ensured that they explicitly commit to the same level of confidentiality and compliance with the regulations in force.
The Companies may sometimes need to share personal data with IT service providers responsible for the outsourcing and application maintenance of their information systems (including the Catalogue and Shop).
The Companies may also need to share personal data with their Clients in order to demonstrate that they have provided their services.
This data is not disclosed by us to any third party (including free of charge).
For further details on transfers, please refer to Chapter 6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
4.4. The case of an online payment.
The Companies do not collect payment details: in the event of an online payment for an order placed via a Shop, the payment is processed on the secure website of a company specialising in this type of transaction, which adheres to international security standards regarding the confidentiality, security and integrity of payment data. This specialist company provides the Companies only with truncated data so they can perform bank reconciliations and arrange refunds.
The Companies therefore never contact holders of payment methods, by any means whatsoever (email, telephone or post), to obtain or confirm information relating to their payment details.
4.5. Hosting & storage of personal data.
The personal data processed by the Companies will only be retained for as long as is necessary to fulfil the purposes set out above or to enable them to comply with legal obligations, where required. The Companies therefore retain personal data, as a minimum, for the entire duration of the contract and for a period thereafter not exceeding 10 years.
For Companies based in the European Economic Area or elsewhere in Europe, the personal data is generally hosted within the European Economic Area.
For Companies based outside the European Economic Area or elsewhere in Europe, the personal data is generally hosted in the country in which each Company is based.
Data subjects may exercise their rights (see Chapter 7. YOUR RIGHTS REGARDING YOUR PERSONAL DATA).
5. PROVISIONS RELATING TO RELATIONS WITH SERVICE PROVIDERS.
In the context of the selection of their Service Providers, the Companies (hereinafter the ‘Companies’) process personal data entrusted to them by the Service Providers.
The purpose of this policy, as implemented by the Companies, is to inform data subjects of the commitments the Companies have made to ensure compliance with current data protection regulations.
This policy may be modified to take account of changes in the relevant legislation and regulations. Consequently, data subjects are advised to visit this page regularly if they wish to keep up to date with these developments.
5.1. Legal basis, nature of the personal data processed & data subjects.
The Companies require the personal contact details (surname, first name, job title, business address and business email address) of the Service Providers’ staff responsible for responding to their enquiries.
The processing of this data is therefore necessary for the performance of the contract entered into with the Companies or for the purposes of the Companies’ legitimate interests (ensuring the security and confidentiality of the data processed, and sharing data between the Companies).
5.2. Purposes of personal data processing.
The Companies use personal data solely for the following purposes:
- to select their Service Providers,
- to save contacts in their Service Providers’ database,
- to set out the services in a contract,
- to communicate and monitor their business relationships,
- to carry out audits,
- to fulfil their legal obligations.
5.3. Sharing and transfer of personal data.
The personal data is intended for the Companies’ internal departments (Purchasing, Legal, and staff in the various departments authorised to place orders and monitor the services ordered) for the purposes set out in this policy.
Where necessary to achieve these purposes and perform their remit, this information may be shared amongst the Companies or transferred to partner companies (such as consultants who can prepare and manage tender processes) or to their advisory bodies.with whom the Companies have verified that they propose sufficient safeguards in relation to the applicable data protection requirements and that they manage the processing of data entrusted to them in accordance with the applicable regulations.
The Companies are sometimes required to share personal data with their IT service providers responsible for the outsourced management and third-party maintenance of their information systems.
This data is not disclosed to any third party (including free of charge).
For further details on transfers, please refer to Chapter 6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
5.4. Hosting & storage of personal data.
A Service Provider’s personal data collected by each Company is hosted and stored in the information systems of each Company using the services of that Service Provider.
The data is retained for the duration of the relationship with the Service Provider and thereafter for as long as is necessary to comply with applicable legal obligations (generally not exceeding 10 years) and, where applicable, to resolve any disputes.
For Companies based in the European Economic Area or elsewhere in Europe, the personal data is generally hosted within this same territory.
For Companies based outside the European Economic Area or elsewhere in Europe, the personal data is generally hosted in the country in which each Company is based.
Data subjects may exercise their rights (see Chapter 7 – YOUR RIGHTS REGARDING YOUR PERSONAL DATA).
6. INTERNATIONAL TRANSFERS OF PERSONAL DATA.
6.1. International transfers.
The PAXON Group operates in various regions around the world, and some Companies trading under the PAXON brand are based in Europe (not only within the European Economic Area), the United States, Canada, and Asia.
In the context of our business activities, your personal data may be transferred between different companies within the PAXON Group or to service providers located in a country other than the one in which it was collected.
Such transfers may be necessary or relevant in view of the purposes of the processing, the nature of the services provided or the organisation of our activities. In particular, they may arise from a request or choice made by the customer or user, from the need to involve a group company or a service provider based in another country, or from the centralisation of certain functions, services or IT systems.
For example, when a customer based in the European Economic Area requests services provided or managed by a PAXON group company based in the United States, the personal data necessary for the provision of those services may be transferred to the United States.
We limit the data transferred to that which is necessary for the purposes in question.
For further details on transfers, please refer to Chapter 6.
6.2. Safeguards applicable to international transfers.
Where the applicable legislation sets out specific requirements regarding international data transfers, we implement appropriate safeguards to ensure a level of protection that complies with those requirements.
Depending on the country of origin and destination of the data, the nature of the transfer and the specific circumstances surrounding it, we may, in particular, rely on:
- an adequacy decision or any other mechanism recognising an adequate level of protection in the country of destination;
- standard contractual clauses (‘SCCs’) or other contractual safeguards recognised by the applicable legislation
- any other transfer mechanism recognised by the relevant legislation.
We determine the mechanism applicable to each transfer based, in particular, on the applicable legislation, the country of destination, the nature of the recipient and the characteristics of the transfer.
6.3. Assessment of transfers and additional measures.
Where required by applicable legislation, we carry out an assessment of the risks associated with the transfer and data protection in the country of destination prior to the transfer.
Where necessary, particularly in light of the outcome of this assessment, we implement appropriate additional measures – whether technical, organisational or contractual – to strengthen the protection of the data transferred.
We therefore ensure that international data transfers are carried out in accordance with the requirements of the applicable legislation and that personal data is afforded an appropriate level of protection.
6.4. Further information by country or geographical area.
The requirements applicable to international transfers may vary depending on the country in which personal data is collected or processed.
Further information regarding international data transfers, the mechanisms used – in particular SCCs where applicable – as well as the specific safeguards and requirements applicable in certain jurisdictions, may be set out in the annexes by country or geographic area to this Privacy Policy.
However, the specific rules and obligations set out in each piece of legislation apply even in the event of a transfer to a country or territory other than the one in which the data may have been collected.
For further information regarding international transfers of your personal data or the safeguards in place, please refer to the annexes setting out the specific details relating to transfers by geographical area.
In any event, this data is not disclosed by us to any third party (including free of charge).
For the conditions governing the transfer of personal data from the United Kingdom, please refer to Chapter 9 – SPECIFIC PROVISIONS FOR THE UNITED KINGDOM
For the conditions governing the transfer of personal data from the United States, please refer to Chapter 10 – SPECIFIC PROVISIONS FOR THE UNITED STATES
For the conditions governing the transfer of personal data from Canada, please refer to Chapter 11 – SPECIFIC PROVISIONS FOR CANADA
7. YOUR RIGHTS REGARDING YOUR PERSONAL DATA.
7.1. A reminder of your rights.
Under the relevant legislation, you have certain rights in relation to the personal data we process about you.
Where the General Data Protection Regulation (‘GDPR’) applies, these rights include, in particular:
- Right of access: You may request confirmation as to whether or not we are processing your personal data and, if this is the case, you may access it and obtain a copy of it, as well as certain information regarding its processing.
- Right to rectification: you may request that your personal data be corrected if it is inaccurate or incomplete.
- Right to erasure: you may request the erasure of your personal data where the conditions laid down in the applicable legislation are met. This right may, in particular, be restricted where we need to retain certain data in order to comply with a legal obligation or to exercise or defend our rights.
- Right to restriction of processing: subject to the conditions laid down in the applicable legislation, you may request that the processing of your personal data be restricted.
- Right to data portability: where the conditions laid down in the applicable legislation are met, you may receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or request that it be transferred to another controller.
- Right to object: subject to the conditions set out in the applicable legislation, you may object to certain processing of your personal data, in particular where such processing is based on our legitimate interests. You may also object to the processing of your data for marketing purposes, in accordance with the conditions set out in the relevant legislation.
- Right to withdraw your consent: where we process your personal data on the basis of your consent, you may withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of any processing carried out prior to that withdrawal.
The rights you have may vary depending on the legislation that applies to you. Additional rights or specific conditions governing the exercise of such rights may apply in certain countries or regions. These specific provisions are, where applicable, set out in the annexes to this Privacy Policy.
7.2. How can you exercise your rights?
You can exercise your rights or obtain further information regarding the processing of your personal data by contacting us using the following details:
privacy@staci.com
We may need to verify your identity in order to protect the confidentiality and security of the personal data we process.
We will respond to your request within the timeframe set out in the relevant legislation. Additional time limits may apply where permitted by the relevant legislation, in particular depending on the complexity or the number of requests.
Where the GDPR applies, we will normally respond to your request within one month of receiving it. This time limit may, under the conditions set out in the GDPR, be extended by a further two months where the request is complex or where there is a large number of requests to be dealt with. We will inform you of any such extension, where applicable, within the relevant time limit.
However, we reserve the right to reject any request that we consider to be manifestly unfounded, excessive or constituting an abuse of the right in question, and to refuse to disclose any information that may contain other people’s personal data or trade secrets.
You may also lodge a complaint with the competent data protection supervisory authority, where provided for by the applicable legislation.
8. DATA SECURITY.
We take appropriate technical and organisational security measures to protect your personal data against destruction, loss, alteration, unauthorised access or misuse.
This includes measures designed to restrict access to personal data as much as possible and to grant such access only where necessary. Staff with access to data are made aware of their data security obligations. Security measures are regularly reviewed and updated to ensure an appropriate level of protection.
9. SPECIFIC PROVISIONS FOR THE UNITED KINGDOM.
9.1. Where the processing of personal data falls within the scope of UK data protection legislation, in particular the UK GDPR and the Data Protection Act 2018, the provisions of this Policy apply subject to the specific requirements set out in UK legislation.
9.2. International transfers.
Where personal data subject to UK law is transferred outside the United Kingdom, the Companies implement, where required, a transfer mechanism recognised by the applicable UK legislation, including an adequacy decision, appropriate safeguards or, where the relevant conditions are met, an exception provided for under UK law.
These safeguards may include, in particular, the International Data Transfer Agreement (IDTA) or the UK Addendum to the European Union’s standard contractual clauses, depending on the transfer in question.
9.3. Rights of Data Subjects.
Data subjects have the rights set out in the relevant UK data protection legislation and may exercise those rights in accordance with Chapter 7 of this Policy. In the United Kingdom, if any of the Companies that has received a request to exercise rights considers that clarification is required in relation to that request, it may invoke the rule suspending the time limit.
9.4. Data subjects may also lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection authority.
10. SPECIFIC PROVISIONS FOR THE UNITED STATES.
10.1. California and certain other U.S. state laws permit their residents to request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year. To make such a request, please write to us at the address listed below. Certain laws also permit those residents to request the deletion of their personal information in certain circumstances.
10.2. If you wish to exercise any of the rights set out above, please contact us using our email address at privacy@staci.com and provide your full name or email address as well as a description of your relationship with Paxon so we know how to find your data and process your request (e.g., whether you are a job applicant, former employee, Client representative, or a Consumer of one of our Clients).
10.3. Paxon does not and will not sell personal information of collected through our Sites to unaffiliated third parties within the meaning of the California Consumer Privacy Act and similar laws.
10.4. The Paxon Sites are general audience websites and are not intended for children under the age of 13. We do not knowingly collect personal information via our Sites from users in this age group without verifiable parental consent. If you believe that a child has provided personal information to us, please contact us promptly as described below, and we will endeavor to investigate and delete such information from our systems.
10.5. Minors under 18 years of age may have the personal information that they provide us deleted by contacting us as provided below and requesting deletion.Please note that, while we make reasonable efforts to comply with such requests, deletion of your personally identifiable information does not ensure complete and comprehensive removal of that data from all systems.
11. SPECIFIC PROVISIONS FOR CANADA.
11.1. Canadian residents who have provided information directly to Paxon through these Sites have the right to request access to, or that we correct, personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable request, and the data correction details, we will correct your personal information in our records, unless an exception applies.
11.2. You also have the right to limit or revoke your consent to use your personal information.To submit a verifiable request, please email us at privacy@staci.com
12. SPECIFIC PROVISIONS FOR INDIA.
12.1. Where the processing of personal data falls within the scope of Indian data protection legislation, in particular the Digital Personal Data Protection Act, 2023 (DPDP Act) and its implementing rules, the provisions of this Policy shall apply subject to the specific requirements of applicable Indian law.
13. SPECIFIC PROVISIONS FOR CHINA.
13.1. Where the processing of personal data falls within the scope of the laws of the People’s Republic of China, in particular the Personal Information Protection Law (PIPL), the provisions of this Policy shall apply subject to the specific requirements of applicable Chinese law. The PIPL requires, in particular, that individuals be informed of the identity and contact details of the personal information processor, the purposes and methods of processing, the categories of personal information processed, the applicable retention periods, and the procedures for exercising their rights.
International Transfers.
13.2. Where personal information collected in China is transferred outside China, the Companies shall implement the measures required under applicable Chinese law. Depending on the circumstances, these may include a security assessment, personal information protection certification, the conclusion of the Chinese Standard Contractual Clauses, or any other transfer mechanism recognised under applicable law.
13.3. Where required, data subjects shall be informed, in particular, of the identity and contact details of the overseas recipient, the purposes and methods of processing, the categories of personal information transferred, and the procedures for exercising their rights with the overseas recipient. Separate consent for the transfer shall be obtained where required under applicable law.
14. VALIDITY OF THIS PRIVACY POLICY.
This General Privacy Policy may be amended, in particular to bring it into line with new legal and/or regulatory requirements, to reflect changes to our services or organisational changes.
Any amendments to this General Privacy Policy shall take effect as soon as they are published on the Website. We recommend that you always refer to the most recent version. The date of the last update is stated at the start of this General Privacy Policy.