Authentication portal

v1.0.0
© Orange 2021

Privacy Notice

Orange Connect

This Privacy Notice aims to give you information on how Orange S.A., acting as Data Subprocessor for the application using Orange Connect, processes your personal data when you use our service « Orange Connect ».

What is Orange Connect?

Orange Connect is an Authentication Service used for DIOD Applications and others internal Orange IT applications having delegated their user authentications.

Orange Connect is an Identity Provider (IdP), that enforces the usage of 2 factors authentication.

Why does Orange process your personal data and under what legal basis?

Orange Connect process your personal data in order to perform a strong authentication with two factors.

Thanks to Orange Connect, Orange processes your data in order to:

Purposes	Legal basis
Manage your authentication to the services of the Data Processor using Orange Connect.	The processing is based on the performance of the terms and conditions you agreed with the Data Controller using the service Orange Connect.
Ensure security and prevent fraud.	Your data can be used to monitor for and prevent fraudulent activity, and ensure systems and processes work securely.
Develop, improve the service and debug.	Your data can be used to measure service performance, ensure systems and processes work properly and improve them.

Which personal data is needed in the context of this Orange Connect?

The personal data we collect as part of this service are:

Identification data: last name, first name, e-mail, CUID
Professional data: function within Orange, manager, professional address
Connection data: IP address, device’s operative system, browser and language
Location: Orange Connect does not know your exact location, but it can estimate it from your IP address

Who has access to your personal data?

Within the limits of their respective attributions, the data collected may be accessible by or intended to:

authorized internal services within Orange, in particular the Shared Services Platform Operations, Orange Business Services et Orange Cyberdefense
the service providers in charge who process the data according to Orange's instructions, in particular Worteks S.A.S. (a company incorporated under the laws of France, whose head office is at 16 avenue Hoche, 75008 Paris, registered with the SIREN under No. 824 429 708 and enrolled with the RCS of Paris)

You are informed that, in accordance with the laws and regulations in force, the data may be transmitted to competent authorities, at their request, as Authorized Third Parties.

How long do we retain your personal information?

Orange undertakes to keep your personal data for no longer than is necessary for the purposes for which we process them, and in accordance with the regulations.

You are informed that Orange may be required to keep, in archive file, some of your personal data to be able to fulfil its legal obligations and/or any legal action, and for the duration of prescription provided by the applicable legislation.

What are your rights and how you can exercise them?

In accordance with the regulations in force, you have a right of access and of correction of your Personal Data and the right to request the deletion, the right to oppose the processing of your Personal Data and the right to obtain the limitation or portability of your Personal Data to the extent that this is applicable, subject to urgent, legitimate grounds Orange may show to retain your Data.

To exercise your rights, you can connect to the following website: https://auth.tech.orange/contact-us/?service=817

You are informed that you have the right to submit a request to the supervisory authority in charge of compliance with the obligations regarding personal data in your country. We encourage you to contact us prior to any request, to try to figure out what are the solutions.

Data Protection Officer contact details:

You can contact the Orange Data Protection Officer for any question related to personal data protection:

By e-mail : group-dpo.donnees-personnelles@orange.com
By postal service:
- Orange SA
- To the Data Protection Officer
- 111 quai du Président Roosevelt
- CS 70222 92449 Issy-les-Moulineaux cedex.

Are personal data transferred outside the EU?

The personal data collected and processed by Orange might, in some cases, be transferred to subprocessors outside the EU:

Orange Innovation International Center India, located in India

In case of transfer of personal data outside the European Union, Orange will take appropriate guarantees, including contractual, to ensure the protection of your data and the compliance with the applicable personal data protection regulations.

These companies shall have previously signed with Orange Innovation the European Commission’s « standard contractual clauses » and/or shall be subject to a binding internal regulation framing the processing and approved by the authorities controlling the compliance with obligations relating to the protection of personal data.

How is your personal data secured?

Orange undertakes to protect your personal in a secure and confidential way, including when certain operations are carried out by suppliers. In this respect, appropriate technical and organizational measures to prevent loss, misuse, alteration and deletion of your personal data are implemented. These measures are tailored in line with the level of sensitivity of the data.

Amendments to this Privacy Notice

This Privacy Notice may be subject to amendments.

Last update: 16/12/2022

Cookies Notice

Orange Connect

What is a cookie and what is it for?

A cookie is a small text file stored on your computer and identified by a name, which can be transferred to your browser by a website you connect to. Your web browser will keep it for a period of time and return it to the web server each time you reconnect to it. Cookies have many uses: they can be used to memorize your customer ID with a merchant site, the current content of your shopping cart, an identifier to track your navigation for statistical or advertising purposes, etc. You will find below information about the types of cookies posted by the service Orange Connect.

Technical cookies strictly necessary for Orange Connect service to function

These cookies allow the site to work optimally. You can delete them by managing your browser settings; however, your user experience may be degraded.

Name	Purpose	Duration Storage
OrangeConnectpdata	Token to keep the authentication alive	12 hours
OrangeConnect	Token to keep the authentication alive	16 hours
Llnglanguage	Retrieve the language used by the browser	This information is always provided

Amendments to the section “About Cookies”

The section about “Cookies” may be subject to amendments.

Last update: 16/12/2022