Preliminary consultation on the submarine electricity interconnection project between Morocco and the UK (“PEMR”)

24 March to 10 June 2025

XLINKS 1 LIMITED
UK-registered company, No. 13481017
Kingfisher House, Woodbrook Crescent, Billericay, CM12 0EQ, United Kingdom

The purpose of this personal data protection policy is to inform the participants in the preliminary consultation on the PEMR project, located in French territorial waters and French exclusive economic zone, of the commitments and measures taken to ensure the protection of their personal data in accordance with the obligations of the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) and the French law no. 78-17 of January 6, 1978 (loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés).

With a view to continuous improvement and taking into account the issues related to the protection of participants’ data, this policy is likely to evolve in order to comply with any change in the regulatory context or to allow XLINKS 1 LIMITED to implement the most relevant developments in terms of security and/or functionalities of the IT environments it operates.

Release date: March 2025

XLINKS 1 LIMITED (hereinafter “the Company“) collects personal data from participants in the preliminary consultation on the PEMR project in French waters for the sole purpose of conducting the consultation, by informing, engaging in discussions, and collecting the participants’ opinions.

For this exclusive purpose, the methods of data collection, the information collected, as well as their retention periods, are summarized in the table below:

Collection method	Collected data	Purpose	Retention period
Registration for public meetings/workshops	Name, email address Optional: Consent to receive PEMR consultation updates	Logistics (safety, catering, event management)	6 months
Submission of comments via the website	Name, email address Optional: Consent to receive PEMR consultation updates	Conducting the consultation and, more broadly, taking public comments into account in the design of the PEMR project.	6 months
Attendance tracking at public meetings and workshops	Name, email address	Counting participants at each event and planning future events	6 months
Prepaid mail	Name, email address Optional: Postal address, phone number (if follow-up needed)	Conducting the consultation and taking public comments into account in the design of the PEMR project.	6 months

 

The Company undertakes to anonymise the data (number of participants and content of written contributions) included in its reports.

This data collection is based on the consent of the individuals concerned, with the aim of considering their opinions on the PEMR project, registering them for relevant events, and providing them with related information.
Furthermore, the Company ensures that the collection and processing of participants’ data comply with the following principles:

• Lawfulness, fairness and transparency: data may only be collected and processed solely for the purposes of (i) conducting the public consultation, as required under Articles L. 121-1 and following of the French Environmental Code, and (ii) pursuing the legitimate interest of informing the public about the PEMR project and gathering feedback on its design. Participants shall be fully informed of the applicable personal data protection policies.
• Limited purposes: data collection and processing are carried out to fulfil one or more specific objectives defined in this privacy notice;
• Minimisation of data collection and processing: only the data necessary for the proper execution of the Company’s objectives are collected;
• Integrity and confidentiality of collected and processed data: the data controller undertakes to implement appropriate safeguards to protect the integrity and confidentiality of the collected data, in accordance with applicable GDPR provisions.

Data Controller​

Xlinks 1 Limited Data Privacy
UK-registered company, No. 13481017
Kingfisher House, Woodbrook Crescent, Billericay, CM12 0EQ, UK

Website: https://xlinks.co
Email: [email protected]

 

Rights of data subjects over their data

In accordance with the provisions of the French Data Protection Act and the European Data Protection Regulation, natural persons have the right to access, rectify, erase, object to, restrict the processing of, and transfer their personal data.

To exercise their rights regarding access to their personal information, data subjects must contact the data controller.

These rights can be exercised at any time by making a request to the following email address: [email protected]

In addition, the persons concerned have the right to file a complaint with the CNIL (French Data Protection Authority).

Information Security

The Company adheres to generally accepted standards to protect the information it collects and receives, both during transmission and after receipt.

The Company maintains appropriate administrative, technical, and physical safeguards to protect the personal information of data subjects against accidental or unlawful destruction, accidental loss, unauthorised modification, unauthorised disclosure or access, misuse, and any other unlawful form of processing.

This includes, for example, IT security measures such as firewalls, anti-virus software, password protection, and other access and authentication controls, as recommended by relevant authorities in the field.

If the Company believes that transmitted information has been compromised, it will inform the affected data subjects in accordance with applicable laws.

Transmission of information to third parties:

The Company does not transfer the data collected to third parties, except to Sphère Publique, WSP, CREOCEAN, Xlinks First Limited and Xlinks Limited, when this is necessary for the purposes of the consultation. Otherwise, when transmitting information related to the collected data, the Company commits to transmit only anonymised data (such as number of participants and content of written entries via registers or websites).

Transmission of data outside the EU:

The Company does not transfer data outside the European Union, with the exception of transfers to the United Kingdom. These transfers are authorised under the adequacy decisions adopted by the European Commission on 28 June 2021, which recognise that the United Kingdom ensures a level of data protection equivalent to that of the EU:

• Implementing Decision (EU) 2021/4801 concerning the GDPR (General Data Protection Regulation), covering transfers of personal data;
• Implementing Decision (EU) 2021/4800 concerning the LED Directive (Directive 2016/680), regarding data processed for law enforcement purposes.

These decisions, published in the Official Journal of the European Union (OJEU L 247 of 13 July 2021), include a “review clause” limiting their initial validity to 27 June 2025. Their extension will depend on a reassessment by the European Commission of UK legislation on data protection.
No transfer to the UK will be carried out beyond this date without prior verification of the continued adequacy of the protection level or the implementation of supplementary safeguards.

Collection of data from minors:

The Company does not seek to collect data relating to minors. Consequently, no personal data of a minor natural person is requested by the Company.

Discrepancy between the French and English versions:

In the event of any discrepancy between the French and English versions of this document, the French version shall prevail.