Privacy policy

Last updated: 14 November 2026 (V6 CLD) — previous version: 7 October 2026 (French version) — English translation: 14 November 2026

This English version is a translation provided for information only. The French version is the original and authoritative text: in the event of any inconsistency or difference in interpretation, the French version prevails.

1. Who is responsible for your data?

EBS SERVICES (trading as EBS Emballage), a French simplified joint-stock company (société par actions simplifiée) with a share capital of €49,000, RCS Villefranche-Tarare 392 791 505, whose registered office is at 67 rue des Hauts de Borne, 69790 Propières, France, is the controller of the personal data processing carried out on the website www.ebs-emballage.com. For any question: our data protection contact — rgpd [at] ebs-emballage.com — +33 4 74 03 67 69 — or by post to EBS SERVICES, 69 allée des Bouleaux, 69790 Propières, France, for the attention of the data protection contact.

2. How is your data collected?

Personal data is collected directly from you, through the forms on this website — for example when you request a quotation — or indirectly: through the HelloWork recruitment platform when you apply there for one of our job offers and, when you select a company from the list offered by a form, through the public API “Recherche d'entreprises” (French company directory), which fills in the company's SIRET number, VAT number and address.

3. What data, for what purpose, on what legal basis, and for how long?

The table below summarises all the processing operations for which EBS SERVICES may use your personal data.

Processing	Data	Purpose	Legal basis	Retention period
Quotation or contact request (the “Request a quote” form, which the “Contact” link also leads to)	identity and contact details (surname, first name, email address, telephone number), status (business or private individual), company, SIRET number (companies in France), VAT number, country, delivery and billing addresses, description of your needs, any attachment (drawing, photo)	to study your request, reply to your contact or quotation request and prepare a quotation; then to follow up the quotation issued (reminder)	steps taken at your request prior to entering into a contract (Article 6(1)(b) of the GDPR); for the follow-up of a quotation issued: EBS's legitimate interest in following up its quotations (Article 6(1)(f)), to which you may object at any time	request not followed up: 3 years from the last contact initiated by you, then deletion; if you become a customer: for the duration of the business relationship, then archived as evidence for 5 years; accounting documents (invoices): 10 years
Sending a configuration (3D configurator)	identity and contact details (name, email address, telephone number), status, company, SIRET number (companies in France), VAT number, country, address of the delivery site, details of your project, configuration parameters (product, format, options) and its visual: an image of the 3D preview from your viewing angle, attached to your request and to your acknowledgement of receipt (the website keeps no copy of it)	to study your request and get back to you about your project	steps taken at your request prior to entering into a contract (Article 6(1)(b))	as for a quotation request
Pallet buy-back proposal	identity and contact details (surname, first name, email address, telephone number), status (business or private individual), company, SIRET and VAT numbers where applicable, address of the batch, indicative distance calculated from the municipality, description of the batch and up to 4 photos	to study your proposal and reply to you	steps taken at your request prior to entering into a contract (Article 6(1)(b))	proposal not followed up: 12 months after the last contact, then deletion; if it leads to a deal: for the duration of the relationship, then archived as evidence for 5 years; accounting documents: 10 years
Job application (“Recruitment” form or HelloWork)	identity (surname and first name) and contact details (email address, telephone number), position applied for, message or cover letter, CV, and any information you include in it	to review and manage your application, contact you about it and arrange an interview	steps taken at your request prior to entering into a contract (Article 6(1)(b))	application not accepted: 3 months after the end of the recruitment process, then deletion; application accepted: until hiring, after which the data becomes part of the personnel file
Talent pool (CV database)	CV, identity, contact details, position applied for	to offer you other positions matching your profile	your consent (Article 6(1)(a)), given by ticking the optional box on the form; you may withdraw it at any time	2 years at most after our last contact; beyond that, only with your renewed consent
Defence in the event of a recruitment-related dispute	identity, position applied for, dates, reason for the decision (strictly necessary data)	to enable EBS to respond to a complaint or to defend itself in court	legitimate interest of EBS (Article 6(1)(f))	archived as evidence for 5 years after the decision, with restricted access
Operation and security of the website	IP address, time stamp, pages viewed, technical browser data (server logs)	to ensure the operation, security and availability of the website; to comply with the legal obligations to retain connection data	legitimate interest (Article 6(1)(f)); legal obligation for the hosting provider	1 year (technical logs)
Exercise of your rights	identity, contact details, content of the request	to handle and document your request	legal obligation (GDPR)	as long as necessary to handle the request, then archived for 5 years

The fields marked with an asterisk in the forms are necessary to process your request; without them, we cannot respond to it. We do not collect any sensitive data (health, opinions, etc.) and do not ask for any: please do not include any in your messages or your CV. No automated decision is taken about you.

4. Who has access to your data?

Internally: the sales team (quotations, configurations, buy-back), the persons in charge of recruitment for applications, the QSE (quality, safety and environment) manager for CSR questions, and the administration for the exercise of rights.
Our processors, who act on our instructions and under contract: OVHcloud (hosting of the website and sending of the forms — data hosted in France); our business email providers: Mailinblack (filtering of incoming messages) and Microsoft (hosting of mailboxes).
Public services queried by the website to make data entry easier for you (they receive only the relevant entry and the IP address): the Recherche d'entreprises API (DINUM, the French interministerial digital directorate) when you type a company name (in the quotation and configuration forms: only if the country selected is France); the geocoding service of the IGN Géoplateforme (successor to the API Adresse) to locate the municipality of a batch of pallets.
The authorities, upon a lawful request.

We neither sell nor rent out your data.

5. Transfers outside the European Union

The website and its forms are hosted in France (OVHcloud). We endeavour to keep your personal data within the European Union; however, some of the services we use (business email, technical support from certain providers) may involve transfers outside the Union. Where your data is transferred outside the European Union, we ensure that the transfer takes place:

either to a country, or a company, recognised by the European Commission as ensuring an adequate level of protection — for the United States, companies participating in the EU-U.S. Data Privacy Framework (Commission decision of 10 July 2023);
or within a framework permitted by the GDPR, in particular the standard contractual clauses adopted by the European Commission.

You can obtain a copy of these safeguards by writing to rgpd [at] ebs-emballage.com.

6. Cookies

This website does not set any cookie or tracker that requires consent and does not use any audience measurement or advertising tool. See the cookie policy.

7. Your rights

Right of access — You can request and obtain information about the personal data we hold about you, and a copy of that data.

Right to rectification — You have the right to ask for your inaccurate or incomplete personal data to be corrected.

Right to erasure — Also known as the “right to be forgotten”, it allows you to request the deletion of your personal data, unless it must be kept, in particular:

to comply with a legal obligation;
for the establishment, exercise or defence of legal claims.

Right to restriction of processing — This right allows you to ask us to restrict the use of your personal data in certain circumstances:

you have asked for your data to be rectified: processing may then be restricted while the necessary checks are carried out;
the processing is unlawful and you oppose the erasure of your data;
we no longer need your data, but you need it for the establishment, exercise or defence of legal claims;
you have objected to the processing and we are verifying whether our legitimate grounds override yours.

Right to data portability — For the data you have provided to us and that we process on the basis of your consent or of pre-contractual steps, you can receive it in a structured, machine-readable format in order to transmit it to another organisation.

Right to object — You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (follow-up of a quotation, technical logs, defence in court), unless there are compelling legitimate grounds for continuing the processing. You may refuse any sales follow-up without having to give reasons.

Withdrawal of consent — Where processing is based on your consent (talent pool), you may withdraw it at any time, without affecting what was done before the withdrawal.

Instructions for after your death — Under French law, you may set instructions concerning the retention, erasure and communication of your data after your death.

To exercise your rights: rgpd [at] ebs-emballage.com, +33 4 74 03 67 69, or by post to EBS SERVICES — data protection contact — 69 allée des Bouleaux, 69790 Propières, France. We may ask you for proof of identity if there is any doubt. We reply within one month, which may be extended by two months for a complex request (you would be informed of this).

You may also lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, the French data protection authority — www.cnil.fr).

8. Security

Data is transmitted over HTTPS. The forms are protected against bots. Access to requests and applications is restricted to the persons in charge of handling them, and the retention periods indicated above are applied through a monthly review of our mailboxes. In the event of a data breach likely to harm you, we would inform you in accordance with the regulations.

9. Updates

This policy may change; the date shown at the top is authoritative.