Personal Data Protection Policy

Welcome to the website By connecting to the Website, you acknowledge that you have read, understood and accepted this Personal Data Protection Policy (herein after referred to as the “Policy”) without limitation or reservation along with our General Terms and Conditions of Use. Please note that other general terms and conditions and personal data protection policies apply to other websites of the Total group. It is recommended that you read them carefully.

This Policy is intended to inform you of the rights and freedoms that you can exercise with regard to our use of your personal data. It also describes the measures implemented to protect them.

Total S.A (referred to herein as the “Data Controller”) is responsible for processing personal data concerning the management of the Website. Said processing is implemented in accordance with applicable laws.


When visiting the Website, you may provide with personal data such as your surname and first name in order to benefit from the services offered. 

We can in particular collect some of your personal data for external communication purposes, such as answering your requests for information and better understanding your expectations. In our online forms, compulsory fields are marked with an asterisk. If you do not answer the compulsory questions, we will not be able to provide you with the requested service.

Your personal data are not subsequently processed in any manner that is incompatible with the purpose described above or in the collection forms. They are only stored for the requisite amount of time needed to fulfill these purposes.


Your personal data may be disclosed only to our specific departments tasked with processing or subsidiaries directly or indirectly owned or to specific partners, independent distributors or sub-contractors for analysis and survey purposes. 

Furthermore, if you submit a comment intended to be posted online, we may publish some of your personal data on the Website. Given the characteristics of the Internet, i.e., free capture of broadcast information and the difficulty, or even the impossibility, of monitoring usage by third parties, we inform you that you can stop such distribution by contacting us, as indicated in article 5 below.

Any data transfer to a third country outside of the European Economic Area is completed in accordance with applicable law and in such a way as to ensure adequate protection of data. For this purpose, for intra-group personal data transfers, the Total group has adopted 'Binding Corporate Rules' (BCR) (Company’s internal regulations) governing the processing of personal data from European Union. For data transfers outside of the European Economic Area, other safeguards are implemented.


We implement the appropriate measures to ensure the security and confidentiality of your personal data and in particular to prevent them from being altered, damaged or accessed by unauthorized third parties.


4.1 Principles

When you visit the Website, a “cookie” may be installed in your computer. A cookie is a file that records information concerning your browsing of the Website from that computer (e.g., visited pages, date and time of browsing, viewed links) and will facilitate your visits by making it easier and faster for you to identify yourself to access your target pages. 

You can delete cookies installed on your computer at any time and prevent new cookies being saved and receive notification before installation of a new cookie by configuring your browser software. Please refer to the help section of your browser software for more information on how to activate and deactivate these functions and refer to the browser’s “types of cookies, cookies, statistics, settings”. 

Please note that you may not benefit from some of the services if you uninstall a cookie or prevent cookies from being installed on your machine. 

4.2 Types of cookies, cookies and statistics and settings

Cookies installed on your server when you surf on the Website are cookies which exclusively aim at enabling or facilitating communication through electronic mean or which are strictly necessary for the provision of services you require (Languages cookies, identify cookies…) or statistics cookies or other cookies under the following conditions.

When cookies require your prior consent to the installation, you are asked through the link “More information” in the banner displayed on the front page, given that the pursuit of the navigation on the website means your acceptation.

4.2.1 Which cookies are installed?

• Data Controller cookies

CookieDescriptionHow to optout ?Persistence
Site (has_js)Contains information about the browser session and allows visitors to log into the websiteSee article 4.2.2Removed when the browser is closed
Site (cookie_agreed)Remembers a visitor's choice regarding cookiesSee article 4.2.213 months 

• Third parties cookies

Cookie editorDescriptionHow to optout ?Persistence
Score Card Research BeaconAllows Share this to see how many visitors come to the site
 click on the “Opt Out” button for advertising cookies or see article 4.2.2
2 years
ShareThisAllows sharing on Miscellaneous Social platforms
 click on the “Opt Out” button for advertising cookies or see article 4.2.2
__unam (9 months)
__stdlxmap (7 days)
__stgmap (7 days)
__stid (24hours)
__uset (24hours)
STPC (24hours)
Allows and records the opening of the satisfaction form about the sitePlease contact or see article 4.2.27 months
FASTFONTAllows to improve the display of contentsSee article 4.2.2Removed when the browser is closed
TWITTERRecords ID’s for sharing on twitterThrough your profile, go to your Security Settings page and uncheck the box under the promoted content section or see article 4.2.218 months
FACEBOOKRecords ID’s for sharing on facebook
scroll down to the "Choice" heading, click the last "click here" link in the paragraph, and fill in your information or  see article 4.2.2
2 years 

• Statistics cookies

Cookie editorDescriptionHow to optout ?Persistence
Allows to see how many visitors come to the site and how often or see article 4.2.27 months

Statistics Cookies enable to measure the number of visits, the number of pages views, in addition to the activity of visitors on the website including their return rate. In that case, a statistical tool creates a cookie with a unique identifier, which will Xiti – AT INTERNET be stored for a maximum of 24 months.

Your IP address is also connected in order to determine the city from where you are connected. It is immediately rendered anonymous after your navigation on the website, which prevents your identification as a physical person. The statistic data concerning the site traffic are first collected by the service provider AT Internet and then returned to the data controller through an aggregated and anonymous way with a web interface to which only him can access.

Such data will not be transferred to third parties nor used for another purpose. At any time, you can block those cookies by using the “opt out” proceeding above

4.2.2. How can you delete, set up your browsing to refuse or be informed about the installation of new cookies? 

• How can you delete cookies file already installed on your computer? 

  • Go on your workstation
  • Select in C:\ the “Windows file”
  • Open the “temporary internet Files” file
  • Select all the files (CTL A) 
  • Choose the option “delete”

• How can you set up your browsing to refuse or be informed about the installation of new cookies? 

  • Surfing with Internet Explorer 5 (Microsoft): choose “Tools”, “internet Options”, “Security”, “Customise the level”, in the rolling menu, click on, “authorize cookies on your computer”, choose “ask for”, to be informed or deactivate so as to refuse all the cookies.
  • Surfing with Internet Explorer 6, 7 or 8 (Microsoft): Click on “Tools”, “Internet Options”, “Confidentiality”, then the level you want to apply.
  • Surfing with Firefox: Click on “Tools”, “Options”. In “Privacy” uncheck “Accept cookies”. 
  • Surfing with Google Chrome: Click on “Customise and Control Google Chrome”, click on “Settings”. In “Confidentiality”, click “Content Settings”, and  tick “Block cookies and data from third parties websites.


In compliance with the applicable regulation, you have a right to access, query, modify, rectify or delete your personal data. You can obtain disclosure of your personal data. You can also object to the processing and circulation of your personal data for legitimate purposes, and you have the right to define directives regarding your personal data after your death. The Company reserves the right to reject any request it deems inappropriate. In accordance with applicable law in force, you have a right of formal consent to sales canvassing via e-mail, fax or automatic caller.
If you wish to exercise these rights or obtain other information, please send your request with the contact form or by post to the following address:

Communication Department
2 Place Jean Millier - La Défense 6
92400 COURBEVOIE, France

Total's Binding Corporate Rules


The Total Group (or "Total") promotes a culture and practices protecting personal data(1), in accordance with the applicable laws. To this end, Total has implemented binding corporate rules ("BCRs").

This document summarizes the data protection principles that apply under our BCRs and the rights granted by them. 


Our BCRs are a set of internal binding rules, which are applicable to all of the Total subsidiaries that have adopted them. They have been approved by the European data protection authorities.

They allow Total subsidiaries to transfer personal data originating from the European economic area ("EEA")(2) to Total subsidiaries located outside of the EEA in compliance with the applicable law.


Our BCRs apply to all EEA-originating personal data processed by Total subsidiaries including data relating to former and current employees, job applicants, clients and prospective clients, suppliers and sub-contractors and the staff of third companies acting on behalf of the Group subsidiaries as well as shareholders (hereafter "data subjects"). 


The following principles set out in our BCRs must be respected:  

  • Lawfulness

Any processing(3) operation carried out within the Group has a legal basis, provided by the applicable law.

Personal data must only be processed for legitimate and lawful purposes. The data must not be further processed in a way which is incompatible with those purposes.

  • Relevance

Personal data must be accurate and proportionate, in terms of quality and quantity, in relation to the purpose of the processing.

  • Transparency

Personal data must be obtained lawfully and loyally. Data subjects must be informed about the characteristics of the processing of their personal data and about their rights, unless this proves impossible or would involve disproportionate efforts.

  • Security

Personal data must be protected by appropriate security measures to limit the risks of unauthorized access, destruction, alteration or loss. 

When calling upon the services of a third party to process personal data, Total subsidiary makes sure that the latter offers sufficient guarantees as regards the security and confidentiality of data. 

  • Retention

Personal data must be retained only for a reasonable and not excessive period of time with regard to the purpose of the processing. 

When the retention period expires, the data is destroyed, anonymized or archived.

  • International transfers(4) of personal data

Total does not transfer personal data originating from a country of the EEA directly to a Total subsidiary located in a third country which does not provide an adequate level of protection, unless such subsidiary has formally subscribed to the BCRs or uses another legal instrument recognized by the European Commission. 

Total does not transfer personal data originating from the EEA directly to a company not belonging to the Group located in a country which does not provide an adequate level of data protection (data controller or processor) without a legal basis under applicable law and instruments providing for sufficient safeguards, such as the standard contractual clauses. 

Similarly, where a data importer further transfers personal data originating from the EEA to a company not belonging to the Group (data controller or processor) located in a country which does not provide an adequate level of data protection, the data importer shall enter into an agreement with this company whereby it commits to observe the principles of BCRs.


Under our BCRs, data subjects whose personal data are processed have the following rights: 

  • Right of access to the data
  • Right to rectify, erase and lock data
  • Right to object to the processing
  • Right to limit the processing

[A comprehensive list of the rights granted by the BCRs is detailed in APPENDIX 1 hereafter].

Data subjects may exercise these rights by submitting a request using the contact details provided in the legal notice concerning the processing of their data. Total subsidiaries undertake to give replies within a reasonable timeframe about queries concerning the processing outside the EEA.

Moreover, if data subjects believe that a Total subsidiary has failed to observe our BCRs, they have the right to lodge a complaint by sending: 


  • A letter to TOTAL – DATA PROTECTION, Tour Coupole, 2 place Jean Millier, Arche Nord Coupole/Regnault, 92078 PARIS LA DEFENSE CEDEX.

Data subjects will be informed about the status of their complaint and of any further steps.

The internal complaint procedure is described in APPENDIX 2 hereafter.

The fact that data subjects may file a complaint with Total does not affect their rights to lodge a complaint with the competent EEA data protection authorities or to bring an action before the courts of the EEA country where the Total subsidiary responsible for exporting the personal data is established. 


If necessary, our BCRs may be completed or updated.


A copy of the comprehensive version of BCRs and a list of Total subsidiaries can be obtained by sending an e-mail at:

(1) Personal data means any information enabling the direct or indirect identification of a natural person.
(2) EEA means Member States of the European Union plus Iceland, Liechtenstein and Norway.
(3) Processing means any operation which is performed upon personal data, whether or not by automatic means (e.g.: collection, recording, storage, destruction…).
(4) Transfer means all virtual and physical exchanges of EEA-originating personal data from one country to another.



Total’s BCRs grant rights to Data Subjects to enforce the Rules as third-party beneficiaries, as detailed in the various chapters of these BCRs.

More specifically, they may enforce the following principles according to the terms and conditions set out in these BCRs: 

  • That any processing operation carried out within the Group must have a legal basis as provided for by Applicable Law;
  • That Total must collect and process Personal Data for legitimate, specified and explicit purposes and must not further process any Personal Data in a way incompatible with the purpose for which they were collected;
  • That Total must process Personal Data that are relevant and not excessive in relation to the purposes for which they are collected, and that these Data must be accurate and, where necessary, kept up to date;
  • That Data Subjects must be provided with easy and permanent access to the information relating to their rights under these BCRs;
  • That Data Subjects whose Personal Data originate from the EEA must have a right of access, of rectification and of objection to the processing of their Personal Data in accordance with Applicable Law;
  • That Data Subjects whose Personal Data originate from the EEA must not be subject to a decision that produces legal effects concerning them or significantly affects them and that is based solely on automated processing of Personal Data intended to evaluate certain personal aspects relating to them, unless that decision:
    • Is taken in the course of the entering into or performance of a contract, provided the request for the entering into or the performance of the contract, lodged by the Data Subject, has been satisfied or that there are suitable measures to safeguard his/her legitimate interests, such as arrangements allowing him/her to express his/her point of view; or
    • Is authorized by Applicable Law, which also lays down measures to safeguard the Data Subject’s legitimate interests;
  • That Total must implement appropriate measures to guarantee the security and confidentiality of the Personal Data, having regard to the state of art and the cost of their implementation;
  • That Total must conclude a written processing agreement with any service provider used to process Personal Data, specifying that the service provider shall act only under Total’s instructions and shall implement appropriate security and confidentiality measures;
  • That Total must not transfer Personal Data from a Member State of the EEA or originating from the EEA to a company not belonging to the Group and located in a Third Country which does not provide an adequate level of data protection (either an External Data Controller or Processor) without a legal basis under Applicable Law and instruments providing for sufficient safeguards; 
  • That a Total Subsidiary must immediately inform the Data exporter if this Total Subsidiary deems that the legislation applicable in its jurisdiction is likely to prevent it from fulfilling its obligations pursuant to Total’s BCRs, and have a detrimental effect on the guarantees offered by these BCRs, unless where prohibited by a law enforcement authority, in particular as a result of a prohibition under criminal law to preserve the confidentiality of a law enforcement investigation; 
  • That any Data Subject may lodge a complaint with Total through the internal complaint mechanism in accordance with the terms set out in the Chapter "Complaint handling"; 
  • That any Total Subsidiaries that have subscribed to the BCRs must cooperate with the competent supervisory authorities, follow their recommendations regarding the international Transfers of Data in the event of a complaint or of a particular request from such authorities and accept to be audited by the supervisory authority of their country of establishment; 
  • That any Data Subject may lodge a complaint with the National Supervisory Authorities or bring an action before the court of the EEA Member State where the Data exporter is established in order to enforce the above principles, and, where appropriate, to receive compensation for the damage suffered as a result of a breach of Total’s BCRs. If, in the course of a transfer of Personal Data outside the EEA, the Data importer fails to observe Total’s BCRs, the Data exporter will defend any claim, establish that the Data importer has not violated the BCRs, and pay compensation to the Data Subject for the damage suffered as a result of that violation.



If a Data Subject believes that a Total Subsidiary has not complied with Total’s BCRs, he/she may file a complaint in accordance with the complaint procedure set forth in the relevant privacy policy or contract or pursuant to the procedure described below.


Data Subjects may file a complaint by sending: 


  • A letter to TOTAL – DATA PROTECTION, Tour Coupole, 2 place Jean Millier, Arche Nord Coupole/Regnault, 92078 PARIS LA DEFENSE CEDEX.

The complaint should clearly provide as much detail as possible about the issue raised, including: 

  • The country and the Total Subsidiary concerned, the Data Subject’s understanding of the violation of the BCRs, the redress requested;
  • The Data Subject’s full name and contact details as well as a copy of his/her identity card or any other identifying document;
  • Any previous correspondence on this specific issue.


Within three months of Total receiving a complaint, the appropriate Branch Data Privacy Lead ("BDPL") shall inform the Data Subject in writing of the admissibility of the complaint; and if the latter is admissible, of the corrective actions that Total has taken or will take in response. The appropriate BDPL shall ensure that, if necessary, appropriate corrective actions are taken to achieve compliance with Total’s BCRs if necessary.

The appropriate BDPL shall send a copy of the complaint and any written reply to the Corporate Data Privacy Lead ("CDPL").


If the Data Subject is not satisfied with the response from the appropriate BDPL (e.g., the complaint has been rejected), he/she may refer to the CDPL by sending an e-mail or letter as indicated above. The CDPL will review the complaint and reach a decision within three months of the data the request was received. Following this period, the CDPL will inform the Data Subject whether the initial response has been upheld or communicate a new response.

The fact that Data Subjects may file a complaint with Total does not affect their right to lodge a complaint with the competent National Supervisory Authority or bring an action before the court of the EEA Member State where the Data exporter is established.