What is included in our CRM services?


Who operates the CRM services?

Collection and source of personal data 

What personal data does the sodexo CRM services hold and for which purposes it may be used?

How and for which purposes will my personal data collected be used?

On which legal basis will my personal data be collected and processed? 

To whom will my personal data be disclosed?

How will my personal data be protected?

How can I access my personal data?

Right of access

You can request access to your personal data. You may also request rectification of inaccurate personal data, or to have incomplete personal data completed. 
You can request any available information as to the source of the personal data, and you may also request a copy of your personal data being processed by Sodexo.

Right to be forgotten

Your right to be forgotten entitles you to request the erasure of your personal data in cases where:
(i)    the data is no longer necessary in relation for the purposes of its collection or processing;
(ii)    you choose to withdraw your consent;
(iii)    you object to the processing by automated means using technical specifications; 
(iv)    your personal data has been unlawfully processed;
(v)    there is a legal obligation to erase your personal data;
(vi)    erasure is required to ensure compliance with applicable laws.

Right to restriction of processing

You may request the restriction of processing in the cases where:
(i)    you contest the accuracy of the personal data;
(ii)    Sodexo no longer needs the personal data, for the purposes of the processing;
(iii)    you have objected to processing for legitimate reasons.

Right to data portability

You can request, where applicable, the portability of your personal data that you have provided to Sodexo, in a structured, commonly used, and machine-readable format you have the right to transmit this data to another controller without hindrance from Sodexo where:
a)    the processing of your personal data is based on consent or on a contract; and
b)    the processing is carried out by automated means.
You can also request to transmit directly your Personal data to a third party of your choice (where technically feasible). 

Right not to be subject to automated decisions

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint to the competent supervisory authority

If you have a privacy-related complaint against us, you may complete and submit the Request/Complaint Form (available in our Global Data Protection Policy) or make your complaint by email or by letter in accordance with our Global Complaints/Requests Handling Policy. You may also seek recourse by contacting the competent supervisory authority or the competent court. You can notably contact our lead supervisory authority, the French supervisory authority (the “CNIL”, www.cnil.fr). 


To exercise these rights, you can send your request or complaint by sending an email to the Group CRM team at the following email address : CRM_group@sodexo.com, your local data protection single point of contact or the Group Data Protection Officer at the following email address dpo.group@sodexo.com

How long will my personal data be held? 

Generally, the CRM Services will retain your personal data for 36 months after the last contact with you for the relevant purposes described in this Policy (in accordance with our Global Data Retention Policy). This may be different from country to country dependent upon local law and may be affected by specific regulatory or legal obligations for particular regulations.

How will I be notified if the uses of my data change?

Contact us Open sharing and other actions