AlertEthic
Would you like to report a breach of the Group’s ethical guidelines?Contact us
Logo
AlertEthicCAT Web Portal

Privacy policy

1.1 Introduction

Compagnie d’Affrètement et de Transport C.A.T (“CAT SAS”, “we”, “us”), acting as data controller, is committed to protecting the privacy of visitors to www.groupecat.com (the “Website”) and processes personal data in accordance with Regulation (EU) 2016/679 (“GDPR”) and French Law No. 78-17 of 6 January 1978, as amended.

1.2 Data controller

CAT SAS is the data controller for personal data collected via the Website. Requests and questions relating to the protection of personal data may be addressed to the Legal & Internal Audit Director, who acts as point of contact for data protection matters, at alertesGDPR@groupecat.com.

1.3 What data we collect and why

We collect personal data when a User voluntarily submits it (e.g. via a contact form or a job application), plus limited technical data generated by browsing and by the security and audience measurement tools described below. Simply visiting the Website does not require disclosing your identity.

1.4 Processing activities

Contact / information request
Data: Name, first name, e-mail, subject, message; optionally company, phone number.
Purpose: Respond to and manage requests.
Legal basis: Legitimate interest.
Retention: three (3) years after your last contact with us.

Job applications / CV
Data: Name, contact details, CV and attachments, optional details.
Purpose: Assess candidacy and manage recruitment.
Legal basis: Consent / pre-contractual measures.
Retention: two (2) years after you shared this information.

Website audience measurement
Data: Pseudonymised technical data (pages visited, referrer, browser, device and operating system type, approximate location). No cookies are used and no individual profile is created.
Purpose: Measure the Website’s audience and improve its content.
Legal basis: Legitimate interest.
Retention: Statistics are retained for three (3) years.

Form protection (anti-bot)
Data: Technical data generated when a form is displayed or submitted. IP addresses are anonymised by one-way hashing before storage
Purpose: Protect the Website’s forms against spam and automated abuse.
Legal basis: Legitimate interest.
Retention: No retention.

1.5 Recipients of the data

Personal data is accessible only to authorised Groupe CAT staff (Groupe CAT corresponds to CAT SAS and its subsidiaries) on a need-to-know basis, and to technical service providers acting as processors strictly on our instructions, namely:

  • OXEVA SAS, for Website hosting;
  • Sweet Punk SAS, for Website development and maintenance;
  • Plausible Insights OÜ (Estonia), for audience measurement;
  • Friendly Captcha GmbH (Germany), for form protection.

With other Groupe CAT entities

Groupe CAT is a global organisation. Although it comprises separate legal entities (e.g. national subsidiaries) in many parts of the world, our internal processes and infrastructure are international in scope and nature and generally span national borders. Consequently, CAT SAS may share your personal data with other Groupe CAT entities, subject to the safeguards described in Section 1.6.

External providers

CAT SAS engages external providers and partners with whom it may share your personal data for the purposes indicated above, except for marketing purposes. When CAT SAS engages such third parties, it ensures that they provide an adequate level of protection for the personal data they process on our behalf. Such third parties are located within the European Union.

Judicial, public, and/or government authorities

CAT SAS may also be required, by law, legal proceedings, litigation, and/or requests from public and government authorities within or outside your country of residence, to disclose your personal data. CAT SAS may also disclose your personal data if it determines that disclosure is necessary or appropriate for purposes of national security, law enforcement, or other matters of public interest.

CAT SAS may also disclose personal information if it determines in good faith that disclosure is reasonably necessary to protect its rights and pursue available remedies, enforce its terms and conditions, investigate fraud, or protect its operations or its users.

Data is never sold or transferred to third parties for commercial or promotional purposes.

1.6 International transfers

Personal data is not transferred outside the European Union, unless legally required or, where a transfer is necessary, only to recipients providing an adequate level of protection (adequacy decision, standard contractual clauses, or another safeguard recognised by the GDPR).

1.7 Cookies

The Website does not use cookies for tracking, advertising or audience measurement. Only a strictly functional cookie may be set to remember your language preference; it does not require your consent and contains no personal data.

1.8 Security

CAT SAS implements technical and organisational measures appropriate to the risk, including: access limited to authorised personnel; staff awareness of confidentiality obligations; contractual oversight of subcontractors; incident and breach management procedures; EU-based hosting; encrypted exchanges (HTTPS); and regular backups.

1.9 Your rights

Subject to the conditions set out in applicable law, you have the right to:

  • Access your personal data and obtain a copy;
  • Rectify inaccurate or incomplete data;
  • Erasure (“right to be forgotten”), subject to exceptions;
  • Restrict processing;
  • Data portability, for data you provided and that is processed on the basis of consent or a contract;
  • Object to processing based on legitimate interest, for reasons relating to your particular situation;
  • Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand;
  • Give instructions on the use of your data after your death;
  • Lodge a complaint with the CNIL (www.cnil.fr) or another competent supervisory authority.

These rights may be exercised at any time and free of charge by sending an email to alertesGDPR@groupecat.com, or a signed letter to Compagnie d’Affrètement et de Transport C.A.T, Direction juridique et de l’audit interne, 5-7 rue Frédéric Clavel, 92150 Suresnes, France, together with proof of identity.

1.10 Changes to this Policy

CAT SAS reserves the right to modify this Policy at any time. This Privacy Policy may be updated to reflect changes in our practices or in applicable law. These modifications will take effect upon publication of the new policy. The version in force is the one published on the Website at the time of your visit.

Last updated: November 2, 2026