Snapshot 64094
Normalized text
Scripts and page chrome removed; this is what change detection compares.
PRIVACY NOTICE
FOR ORANGE BUSINESS CORPORATE CUSTOMERS AND PROSPECTS*
Introduction
Orange Business provides a range of solutions tailored to its customers’ needs. In doing so, Orange
Business processes certain Customer Personal Data (as defined in section 1).
Orange Business is committed to protect Customer Personal Data in accordance with applicable
personal data protection and information security laws, including but not limited to the EU General Data
Protection Regulation 2016/679 (the “GDPR”), the EU ePrivacy legislation, and other applicable national
personal data protection laws.
Orange Business is made up of several legal entities in a number of countries. This privacy notice is
issued on behalf of all the Orange Business entities.
This privacy notice explains how the Orange Business entities (“Orange Business”, “we”, “us” or “our”)
use and protect Customer Personal Data and provides information about the rights individuals have in
respect of their Customer Personal Data.
Please click through to any of the areas listed below.
1. Definitions
2. The scope of this privacy notice
3. Who we are and our contact information?
4. What Customer Personal Data may we collect?
5. How do we use Customer Personal Data as Controller and Processor?
6. To whom may we disclose Customer Personal Data?
7. International Transfers of Customer Personal Data
8. Our data security practices
9. Our data retention policy
10. Data subjects’ rights
* (formerly known as Privacy Policy for Orange Business Services Corporate Customers and Prospects)
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
1
1. Definitions
Controller has the meaning set out in the GDPR (or of the nearest equivalent
term in the applicable data protection legislation); in short, it is the
company that (alone or jointly with others) determines the purposes
and means of the processing of Personal Data
Customer a customer or potential customer of Orange Business who is a
business, enterprise or other organization, to the exclusion of natural
persons
Customer Personal Data (a) Personal Data that we collect from Customer representatives
during our relationship with Customers, such as when Customers
approach us to ask about our services, or when we communicate
with Customers during the provision of our services (“Customer
Representative Personal Data”); and (b) Personal Data that relates
to End Users provided to us by Customers or generated by us in
connection with the services that we provide to Customers (“End
User Personal Data”)
Customer Representative a natural person interacting with us on behalf of a Customer
End User the natural persons who are the users of the solutions that we
implement for Customers, such as for example Customer
employees or clients
Personal Data any information relating to an identified or identifiable natural person
Processor has the meaning set out in the GDPR (or of the nearest equivalent
term in the applicable data protection legislation); in short, it is the
company that processes Personal Data on behalf of the Controller
2. The scope of this privacy notice
What information does this privacy notice relate to?
This privacy notice applies to Customer Personal Data that Orange Business processes in
connection with its relationship with its Customers. This privacy notice describes our general
Personal Data protection framework and does not change the content of any individual contract
signed with our Customers.
This privacy notice does not apply to the Personal Data of natural persons who are contracting
directly with Orange Business for the provision of a service such as natural persons who subscribe
directly a mobile internet access service from Orange Business. The privacy notice of Orange
Business in respect of the Personal Data of customers who are natural persons is provided together
with the terms of use pursuant to which Orange Business provide the service.
Our services are not intended for use by children, and we do not knowingly collect Personal Data
relating to children.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
2
The importance of reading this privacy notice, and keeping us updated
It is important that you read this privacy notice together with any other privacy notice or related
information we may provide on specific occasions, so that you are fully aware of how and why we
use Customer Personal Data. This privacy notice supplements other notices and privacy policies
and is not intended to override them.
It is important that all Customer Personal Data that we hold is accurate and current. Please keep
us informed if you become aware that any Customer Personal Data has changed during your
relationship with us.
Third-party links
Our website www.orange-business.com may include links to third-party websites, plug-ins and
applications. Clicking on those links or enabling those connections may allow third parties to collect
or share Personal Data about you. We do not control these third-party websites and are not
responsible for their privacy statements. When you leave our website, please read the privacy notice
of the other websites/services that you visit.
Changes to this privacy notice
Our privacy notice is regularly reviewed. This version was last updated in April 2025.
3. Who we are and our contact information?
Controller
An Orange Business entity acts as a Controller in respect of all Customer Personal Data collected
or generated by Orange Business for its own purposes, independently of its Customers’
requirements and for which the Orange Business entity solely determines the means of the
processing outside of the contractual documentation agreed with the Customer.
Any Orange Business entity operating as an electronic communications service or network provider
and each third-party electronic communications service or network provider interconnected with
an Orange Business entity may act as a Controller in respect of:
• End Users electronic communications metadata we process in order to build, operate and
secure the Orange Business network;
• End Users electronic communications metadata we process in order to transmit their
electronic communications and, as regards voice communications, the Call Detail Records
(CDRs) we process to produce the traffic details required for the invoice;
• End User Personal Data we process to perform activities that applicable law requires electronic
communications providers to undertake, such as monitoring for intrusion / fraud detection /
security weaknesses and dealing with requests from law enforcement, security or regulatory
authorities.
The Orange Business entity engaging with you may act as a Controller in respect of Customer
Representative Personal Data, in relation to any Orange Business sales or marketing activities,
surveys, customer satisfaction or service improvement programs, events invitation and
management activities that involve such Customer Representative Personal Data.
Orange S.A. (Orange Business division) is the Controller in respect of the Personal Data of
Customers Representatives processed through our website www.orange-business.com. The
Controller of any other public website is the Orange Business entity identified as the editor on the
relevant website.
Orange Business may act as Controller in respect of Customer Personal Data for data analysis for
its own purposes.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
3
For further details on our processing activities as Controller and the type of Personal Data
processed, please see section 5.
Processor
The Orange Business entity you contract with as a Customer acts as a Processor in respect of all
Customer Personal Data collected or generated by Orange Business in order to provide its services
to the Customer, on its documented instructions, and not for any other purpose.
Each Customer defines the purpose of the processing of the Customer Personal Data by specifying
the services it procures from Orange Business entities and its end-users to which the service must
be provided. The means of the processing are described in the contractual documentation agreed
by Customer and the Orange Business entity.
For further details on our processing activities and the type of Personal Data processed, please see
section 5.
Data protection officer
We have appointed a global data protection officer (DPO) who is responsible for overseeing
questions in relation to this privacy notice. We also have appointed local data protection officers
where required. For requests to exercise your rights, please refer to section 10.
Contact details
For enquiries to the Chief Data Protection Officer or to any local data protection officer:
Email: obs.dpo@orange.com
Or; for enquiries relating to France only:
Email: obs.francedpo@orange.com
4. What Customer Personal Data may we collect?
We may collect, use, store and transfer different types of Customer Personal Data which we have
categorised in the table below.
Category Personal Data in category
Billing Data the consumption data that Orange Business collects from services that it
provides to its Customers in order to calculate charging as well as billing
information, to the extent related to natural persons.
Contact Data first name, last name, email address, postal address and telephone numbers, job
role within the Customer.
Support Data Customer Representatives’ or End Users’ service ticket information, Customer
Representatives’ or End Users’ telephone recordings for incident.
Identity Data first name, last name, honorific (e.g. Ms, Mr. Dr.,…), username or similar identifier,
password, ID document / number.
Location Data geographic location, device location, SIM card location for mobile services.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
4
Marketing and preferences in receiving marketing from us and/or third parties and
Communications communication preferences.
Data
Profile Data interests, preferences, comments, questions, feedback and survey responses.
Technical Data internet protocol (IP) address, login data, browser type and version, time zone
setting and location, browser plug-in types and versions, operating system and
platform, as well as other technology on the devices natural persons use to
access areas of our website or other technical data generated through the use of
the service.
Traffic / Connection data revealing a communication’s origin, destination, route, format, size, time
Data duration, IP address, time zone setting, MAC address.
Hosted Data any categories of Customer Personal Data that may be recorded or stored (such
as voicemails, call recordings, files) by Customer and which is hosted on the
cloud infrastructure provided by Orange Business (e.g. IaaS, PaaS, SaaS ...).
Usage Data information about how End Users use our products and services and how natural
persons use our website.
Visual Data photographs and other visual records we take during Orange Business’ or third
parties’ events or that we process based on your consent.
We collect Personal Data from the following categories of sources: our customers, suppliers,
partners or directly from you.
When the processing of Customer Personal Data is subject to Swiss law, it is clarified that the
Customer Personal Data shall not be considered as secret data.
Aggregated/anonymised data
We also collect, use and share aggregated and anonymised information such as statistical or
demographic information. Aggregated or anonymised data could be based on Customer Personal
Data but is not legally considered to be Personal Data. For example, we may aggregate or
anonymise Usage Data to calculate the percentage of users accessing a specific function on our
website. If we combine or link aggregated or anonymised data with any Customer Personal Data
so that it can identify an individual, we treat the combined data as Personal Data which will be used
in accordance with this privacy notice.
Special categories of Personal Data
We may process, as Processor, “special” or “sensitive” categories of Personal Data (information
revealing race or ethnicity, political opinions, religious or philosophical beliefs, trade union
membership, genetic data, biometric data, health data or data concerning sex life or sexual
orientation) relating to Customers or End Users, only if it is contained in Hosted Data. However, we
do not collect it for our own purposes and we are not aware of when we are processing such
Personal Data (except in the framework of hosting services in the health sector) and, we don’t use
such Personal Data outside of a data subject’s reasonable expectations.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
5
5. How do we use Customer Personal Data as Controller and Processor?
The tables below show how we use Customer Personal Data for which we are Controller and our legal
basis for doing so (including a description of our legitimate interests), as well as how we use Customer
Personal Data for which we are Processor.
The contract between a Customer and an Orange Business entity will include further information on
Customer Personal Data which we process as Processor and the respective obligations of the parties
regarding the processing of Customer Personal Data.
Customer Personal Data for which we are Controller
Categories of Personal
Our Activity Our lawful bases for processing
Data processed
To manage the sales and Contact Data • Necessary for our legitimate interests to
contractual relationships with our Identity Data develop and manage our sales activities and
Customers the relationship with our Customers, including
Profile Data
ordering, billing and collection of payments
Billing data
• Consent where required
Traffic/Connection Data
Marketing Data and • Necessary to comply with legal obligations we
Communications Data may have under applicable laws (for example,
electronic communications regulations and e-
privacy regulation, tax laws etc…)
To build, operate and secure our Traffic / Connection Data • Necessary for our legitimate interests to
network assess the amount of data moving across our
network at a given point in time, to manage
such data
• Necessary to comply with legal obligations (to
prevent or detect fraud)
To assist national law enforcement All • Necessary to comply with legal obligations we
/ security agencies, to respond to may have under applicable laws (for example
requests from public, governmental to provide lawful intercept and/or data
and regulatory authorities, to retention by national law enforcement /
comply with court orders, litigation security agencies)
procedures and other legal
processes
To complete a survey, provide Identity Data • Necessary for our legitimate interests to study
customer satisfaction feedback, Contact Data how Customers use our products/services, to
take part in service improvement try to increase and improve interaction with
Profile Data
programs, and attend any events Customers, to find out how we can improve
that we organise Usage Data our services, and to develop and grow our
Marketing and business, to communicate about our events
Communications Data
Visual Data
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
6
Customer Personal Data for which we are Controller
Categories of Personal
Our Activity Our lawful bases for processing
Data processed
To make suggestions and Identity Data • Necessary for our legitimate interests to
recommendations to you about Contact Data develop our products/services, grow our
goods or services that may interest business and maintain our Customer
Profile Data
you relationships
Usage Data
• Consent where required
Marketing and
Communications Data
To administer and protect our Contact Data • Necessary for our legitimate interests to run
business, services and our our business, provision of administration and
Technical Data
websites IT services, network security, cloud security, to
prevent fraud and in the context of a business
reorganisation or group restructuring exercise
• Necessary to comply with a legal obligation
To provide access to you, as an Identity Data • Necessary for the legitimate interests of your
individual, to on-line portals for Contact Data organisation, our Customer, to provide you
your own individual usage with this feature to improve and facilitate your
Technical Data
management use of the service;
Profile Data
• Necessary for our legitimate interests to study
how you use our service, to try to improve
interaction with you, to find out how we can
improve our services, and to develop and
grow our business
To use data analytics to improve: Depending on the activity, • Necessary for our legitimate interests to
our website, products/services, certain: manage or improve/develop our products,
marketing or Customer Contact Data services, offers, marketing strategy, keep our
relationships and experiences websites updated and relevant
Support Data
Profile Data
Marketing and
Communications Data
Technical Data
Usage Data
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
7
Customer Personal Data for which we are Processor
Our Activity Categories of Personal Data processed
Delivering, activating and implementing services and Identity Data
changes to services requested by Customer Contact Data
(including intrusion detection and monitoring services
Support Data
ordered by Customer)
Profile Data
Hosted Data
Technical Data
Incident management (troubleshooting, resolution Identity Data
and reporting) related to a specific Customer Contact Data
Support Data
Technical Data
Profile Data
Hosted Data
Providing reports to Customer on billing, usage, Identity Data
quality of service and other reports required by the Contact Data
Customer
Billing Data
Support Data
Traffic/Connection Data
Profile Data
Location Data
Hosted Data
Providing access to Customer portals, on-line tools Identity Data
and other applications managed by Orange Business Contact Data
for the provision of services to its Customers
Technical Data
(including troubleshooting, data analysis, testing,
system maintenance, support, reporting and hosting Profile Data
of data)
Hosting Customer data and infrastructure Hosted Data
Marketing
We provide Customers with choice regarding the use of Customer Personal Data around marketing
and advertising. You can always ask us to stop sending you marketing messages by contacting us
at any time.
You will receive marketing communications from us if you have provided your consent to receive
those communications (unless we are exempted to obtain consent under applicable laws).
Cookies
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
8
We use necessary cookies to make our website work and we may also use optional cookies to help
us improve our website. For more information about the cookies we use and how to disable them,
please see our cookie policy here. Our online tracking is not of the nature such that it qualifies as
“selling” or “sharing” under California law and we do not have actual knowledge that we have sold
or shared the Personal Data of anyone under 16 years old.
6. To whom may we disclose Customer Personal Data?
As a Processor of the Customer Personal Data
We disclose Customer Personal Data to other Processors, whether other entities within Orange
Business or external providers, that we engage in our capacity as Processor for carrying out specific
processing activities on behalf of our Customer, the Controller.
We inform our Customers of all the Processors (other entities within Orange Business and external
providers or partners) we engage under a general written authorization (or specific authorization).
We may share some Customer Personal Data with third parties acting as Controllers in their own
rights. For example, to deliver you a parcel we share your Contact Data with courier companies.
As a Controller of the Customer Personal Data
We may share Customer Personal Data as Controller of such data with the parties set out below
for the purposes set out in the table in section 5 above.
Orange Business entities
The Orange Business entity which is the Controller of your Personal Data may share such Data with
other Orange Business entities acting as Processors. The list of countries where Orange Business
entities are located can be found on Orange Business’ website (about us/where we are).
External parties
Service providers acting as Controllers in their own rights, in which case the processing of
Customer Personal Data will be subject to these service providers’ privacy policies. For example,
to provide transmission to carry traffic on our network we share Traffic/Connection Data with other
regulated providers of electronic communications or to distribute third parties’
applications/software, which are used directly by the End-Users in accordance with the privacy
notice of those third parties.
Service providers acting as Processors, such as providers of IT and system administration services,
maintenance, expert technical support or hosting.
National authorities (such as tax authorities), agencies and regulators acting as Processors or
Controllers who have the legal authority to require reporting of processing activities or disclosure
of Customer Personal Data in certain circumstances.
7. International Transfers of Customer Personal Data
We may transfer and process Customer Personal Data to/in countries other than the country in
which the Customer Personal Data is initially collected. Please see Annex 1 to this document for
the list of countries where Orange Business may transfer Customer Personal Data.
International transfers to Orange Business entities
We may transfer Customer Personal Data amongst Orange Business entities as Controller or
Processor, inside or outside of the European Union (“EU”).
All Orange Business entities have signed an intra-group agreement for processing and transferring
personal data, which includes the EU Commission standard contractual clauses. This intra-group
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
9
agreement defines the adequate safeguards all Orange Business entities must put in place to
protect Personal Data and its transfer. For more information about the transfer of Customer
Personal Data to Orange Business entities for a specific processing activity, please contact us.
International transfers to external suppliers
When we transfer Customer Personal Data to an external supplier in another country, we make sure
that a similar degree of protection is afforded to the Customer Personal Data. For transfers outside
of the EU or to a country which the EU Commission has not assessed as providing an adequate
level of protection (for further details, see the relevant page of the European Commission website
here), we use the EU Commission standard contractual clauses or another appropriate safeguard.
International transfers from Switzerland
When an Orange Business entity located in Switzerland transfers Personal Data to an Orange
Business entity or an external supplier in a country not recognised by Switzerland as providing an
adequate level of protection, Orange Business signs the EU Commission standard contractual
clauses adapted to Swiss law, as appropriate safeguards.
8. Our data security practices
We have put in place appropriate security measures to prevent Customer Personal Data from being
accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we
limit access to Customer Personal Data to those employees, agents, contractors and other third
parties who have a business need to access it. They will only process Customer Personal Data on
our instructions and they are subject to a duty of confidentiality.
We require all third parties to respect the security of Customer Personal Data and to treat it in
accordance with applicable data protection laws.
We have put in place procedures to deal with any suspected Personal Data breach and will notify
Customers and any applicable regulator of a breach where we are legally or contractually required
to do so.
9. Our data retention policy
How long will we retain Customer Personal Data?
We retain Customer Personal Data in respect of which we are Processor for the period agreed with
our Customer, the Controller, unless applicable law requires us to retain it for a longer period (e.g.
regulatory, tax or accounting obligations). We may also retain Customer Personal Data for a longer
period in the event of a complaint or if we reasonably believe there is a prospect of litigation in
respect to our relationship with our Customers, including as evidence. Our contractual
documentation agreed with our Customer describes the retention periods for the processing
activities we perform as Processor for our Customer, the Controller. We retain Customer Personal
Data in respect of which we are Controller only for as long as reasonably necessary to fulfil the
purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax,
accounting or reporting requirements. To determine the appropriate retention period for Customer
Personal Data in respect of which we are Controller, we consider:
• the amount, nature and sensitivity of the Customer Personal Data;
• the potential risk of harm from unauthorised use or disclosure of Customer Personal Data;
• the purposes for which we process Customer Personal Data and whether we can achieve
those purposes through other means; and
• the applicable legal, regulatory, tax, accounting or other requirements.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
10
10. Data subjects’ rights
Which are the data subjects’ rights?
Under certain circumstances, individual Customer Representatives or End Users may have the
following rights under data protection laws in relation to their Personal Data:
• request access to, correction of, or erasure of Personal Data, including the right to know the
following about your Personal Data: the categories of Personal Data collected, the categories of
sources from which the Personal Data has been collected, our purposes for doing so, with whom
we have shared that Personal Data, and the specific pieces of Personal Data that we have
collected;
• object to processing of Personal Data;
• request restriction of processing of Personal Data (except that we do not sell or share Personal
Data and do not use sensitive Personal Data in a manner that provides an opt out right under
California law);
• request transfer of Personal Data to another organisation;
• withdraw consent to processing of Personal Data;
• make a complaint to the relevant national data protection regulator (such as the Information
Commissioner’s Office (ICO) in the UK – www.ico.org.uk, or the Commission Nationale de
L’Informatique et des Libertés (CNIL) in France – www.cnil.fr/fr).
We will not discriminate or retaliate against you for exercising your Personal Data protection rights.
Whom should you contact?
- If you want to exercise your rights in respect of your Personal Data of which Orange Business
is a Controller:
o For Traffic/Connection Data: we do not identify the individual to which
Traffic/Connection Data relates. We only identify the Customer to which
Traffic/Connection Data relates. Traffic/Connection Data is also subject to confidentiality
obligations under our agreements with our Customers. Therefore, in order to exercise
your rights in respect of your Personal Data that is Traffic/Connection Data, you should
contact your employer, or the organisation through which you have been using Orange
Business’ services. The person(s) authorised by your organisation to ask our assistance
in respect of your request will contact us.
o For other Personal Data of which Orange Business Service is a Controller, you can
contact us by using the online contact form or emailing us at obs.dpo@orange.com.
Alternatively, you can fill and print the form and send it by post to:
If you are based in France:
Orange Business
Agences Entreprises
Gestion des données personnelles
TSA 70007 - 82008 Montauban - France.
If you are based outside of France:
Orange Business
DPO Office (Legal Department)
1 Place des Droits de l'Homme, 93579 La Plaine St Denis, France.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
11
- If you want to exercise your rights in respect of your Personal Data of which Orange Business
is a Processor for a Customer: you should contact your employer, or the organisation through
which you have been using Orange Business’ services in the first instance, to obtain
information about, or exercise, the rights you may have in respect of your Personal Data. The
person(s) authorised by your organisation to ask our assistance in respect of your request
will contact us.
- If you are authorised by our Customer to ask Orange Business’ help in answering a data
subject request, you can contact us through your “My Service Space” portal or your “Espace
Entreprise Client” portal.
How will Orange Business deal with my request?
Usually no fee
You will not have to pay a fee to access your Personal Data (or to exercise any of your other rights).
However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or
excessive. Alternatively, we could refuse to comply with your request in these circumstances.
What we require
We may need to request specific information from you to help us confirm your identity and ensure
your right to access your Personal Data (or to exercise any of your other rights). This is a security
measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.
We may also contact you to ask you for further information in relation to your request to speed up
our response. You may also ask for an authorized agent to submit a request on your behalf and (if
you do so) your agent should submit evidence of their authority.
When we will respond
We try to respond to all legitimate requests within one month. Occasionally it could take us longer
than a month if your request is particularly complex or you have made several requests. In this case,
we will notify you and keep you updated.
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
12
Annex 1 – Countries where Customer Personal Data may be
processed/transferred
Argentina Australia Austria
Belgium Brazil Bulgaria
Canada Chile China
Colombia Croatia Czech Republic
Denmark Egypt Finland
France Germany Ghana
Greece Hong Kong Hungary
India Ireland Israel
Italy Ivory Coast Japan
Kazakhstan Lebanon Luxembourg
Madagascar Malaysia Mauritius
Mexico Morocco Netherlands
New Zealand Nigeria Norway
Pakistan Peru Poland
Portugal Qatar Romania
Russia Saudi Arabia Senegal
Singapore Slovakia South Korea
Spain Sweden Switzerland
Thailand Taiwan Thailand
Turkey Ukraine United Arab Emirates
United Kingdom United States Vietnam
Orange Business is a trading name of the Orange Group and a trademark of Orange Brand Services Limited
Customers and Prospects Privacy Notice_EN_V.7_April 2025
13