Computing and freedom

French law on Data Processing, Files and Individual Liberties as it applies to our website

Who gathers personal information (and who is in charge of processing it)?

Your personal information is gathered by CRPNPAC, 14 rue des Pyramides, CS 60322, 75041 Paris Cedex 01, France (hereinafter referred to as CRPNPAC).


How personal information is gathered and used

“Personal information” refers to any information pertaining to a natural person who is either identified or identifiable, whether directly or indirectly, through reference to an identification number or to one or more pieces of information that are unique to them.

CRPNPAC agrees to gather and process your personal information from the website in a manner compliant with France’s general data protection rules (RGPD) of April 27, 2016, and with France’s amended Law on Data Processing, Files and Individual Liberties of January 6, 1978.

Any personal information gathered by CRPNPAC is gathered in a fair and transparent manner based in part on displaying full user notifications.


Why we need to process your personal information

CRPNPAC agrees to only gather personal information for clear, precise, and legitimate purposes, and to process it in accordance with stated purposes.

Each form or eservice collects the least amount of personal information possible (using the concept of data minimization).

CRPNPAC agrees to only process that personal information which is appropriate and relevant and which does not go beyond the purposes for which it was gathered.

Any personal information is only gathered and/or processed based on the legal grounds set forth by applicable regulatory policy, and for the following purposes:

  • To ensure that we are in compliance with our legal and regulatory obligations under currently applicable law:
    • Administering supplementary retirement pension entitlements on behalf of companies, members, and pensioners (calculating supplementary retirement pension entitlements, administering pensions, collecting contributions, etc.);
    • Administering social protection entitlements on behalf of members and pensioners;
    • Liaising with companies and with members and pensioners;
    • Tax and social security withholdings;
    • Administering social welfare benefits on behalf of members and pensioners (calculation, administration, payment);
    • Administering the scheme by CRPNPAC
  • As part of the fulfillment of a contract:
    • Registration for a Personal CRPN account on our website (Terms of Use)


Who receives and can be contracted out your personal information

CRPNPAC’s authorized staff members are the recipients of your personal information in order to process the requests and online services you have activated.

CRPNPAC may work with technical subcontractors in order to process all or part of your personal information, only to the extent necessary to provide their services.

CRPNPAC does not transfer any of the personal information it gathers to another country and stores it exclusively in France.

CRPNPAC does not make any automated decisions on the basis of the personal information it gathers.

CRPNPAC may be required to share your personal information without your prior agreement in order to comply with the law. On this basis, you agree to allow CRPNPAC to share your personal information if it determines that this is necessary in order to comply with a subpoena, a warrant, or a court decision or order, or with an authority that has standing to conduct a specific investigation or in order to pursue a legitimate interest, including to defend its own rights.


Security and confidentiality

The personal information that is gathered through the use of online services on is processed in accordance secure protocols and is used by CRPNPAC to handle the requests it receives through its computerized applications.

CRPNPAC shall take all necessary measures to ensure that all users’ personal information remains confidential and secure, and to prevent said information from being damaged, deleted, or accessed by unauthorized third parties,

Access to personal information is strictly limited to authorized personnel who have been assigned certain responsibilities and are bound by a confidentiality agreement.


How long your personal information will be stored

CRPNPAC processes and stores personal information in a secure environment for the amount of time needed to achieve the purposes for which it was gathered.

Personal information is not stored beyond the length of time CRPN needs in order to fulfill its statutory mandate.


Right to information, access, correct, delete, restrict processing, and register special directives with regard to the storage, deletion, or sharing of your information after your death.

Pursuant to currently applicable law in France (French Law on Data Processing, Files and Individual Liberties No. 78-17 of January 6, 1978) and in Europe (EU regulation No. 2016/679 of April 27, 2016) you have the right to information, access, correct, and delete your personal information as well as the right to restrict how your information is processed. In addition, you have the option to register a directive regarding the storage, deletion, and sharing of your information after your death. These directives can be amended or revoked at any time.

To exercise your rights, you can send your request in writing to the following address (attaching any document that can serve as proof of your identity):
Data Protection Officer
14 rue des Pyramides
CS 60322
75041 Paris Cedex 01

Or by filling out the form below:

    (The fields with an * are required in order for us to process your request)

    Please retype the following code:


    Compliance with france’s law on data processing, files and individual liberties

    You are required to abide by the provisions of France’s amended law of January 6, 1978, on data processing, files, and individual liberties, and with France’s general data protection rules (RGPD) of April 27, 2016, violating which is liable to criminal prosecution.

    This means that each user must refrain from collecting, processing, or inappropriately using the personal information they access and, in a general sense, from engaging in any action liable to infringe on another individual’s privacy or reputation.


    Changes to the personal information processing rules

    If any changes are made to the rules set forth above, the latter will be published online on and become effective from the date of publication. Please refer to these rules every time you stop by the site in order to review the most recent version available on the site.



    If you have any questions about CRPNPAC’s use of your personal information, please contact our Data Protection Representative (“Délégué à la Protection des Données”/ DPO) at the address below:
    Délégué à la protection des données
    14 rue des Pyramides
    CS 60322
    75041 Paris Cedex 01

    or by clicking on the following link:



    Our website stores audience-measuring cookies (number of visits, pages viewed) in accordance with the terms of exemption from user consent set forth by the French Data Protection Authority (CNIL)’s “Cookies” recommendation, using Matomo (formerly known as Piwik), a free, open-source solution which has been set up for this specific purpose. This means, in particular, that these cookies are used only to produce anonymous statistics and cannot be used to track a user over to other websites.

    This website also deposits browsing cookies for technical purposes only; they are not saved to your machine.

    Platform performance is not affected if a user’s browser has cookies disabled


    How long your information will be stored

    CRPNPAC stores a record of its communications with website users in a repository that logs and tracks these communications. The record of any exchange of information is logged for 3 years (1 year in the active database and 2 years in an archive database (for evidentiary purposes)

    Retention period (“Durée d’utilité administrative”/ DUA) applicable to the information handled by CRPNPAC once it has been gathered through the website.
    The retention period (“DUA”) refers to how long information is stored in our active database once it has been gathered through the website and processed.
    The retention period is 5 years from the death of the claimant or any beneficiaries they may have.
    Beyond the retention period, assuming it is not a matter of public record, the information gathered through the website will be destroyed.

    Frequently asked questions

    Check out our FAQ page