Privacy Policy

1- INTRODUCTION

The purpose of this Privacy Policy (hereinafter “ Privacy Policy ”) is to formalize our commitment to respecting the privacy of adults using the website https://www.afidium.com/ or our customers in the context of our applications or APIs (hereinafter “ Customers ” or “ Services ”) operated by the company AFIDIUM , with a share capital of €100,000, whose registered office is located at 41 RUE GABRIEL PERI, 91300 MASSY France, registered in the Trade and Companies Register of EVRY under number 482 524 618 represented by Patrick RAJAUD (hereinafter “ AFIDIUM ” or “ Company ”).

Below you will find information on the type of personal data we process, why we do it, what we use this data for, how we may share it, and what your rights are as a Data Subject.

Respect for your privacy and your personal data is a priority for the Company, which undertakes to process your data in accordance with the Data Protection Act No. 78‑17 of 6 January 1978, as amended, the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (hereinafter " GDPR ") and the related standards and recommendations issued by the French National Commission for Information Technology and Civil Liberties (hereinafter " CNIL ") or the European Data Protection Committee or other competent authorities whose decisions, guidelines or standards apply in the French territory applicable in this matter (hereinafter " Applicable Regulation ").

AFIDIUM acts as the data controller for all data collected through its Services, by any other means, or when you enter into a contractual relationship with AFIDIUM, unless otherwise stated in the Privacy Policy or in the contracts binding us.

If you wish to exercise any of your rights under the Applicable Regulations and as mentioned in section 8 of this Privacy Policy, you can contact AFIDIUM by one of the means provided below, specifying your identity and the precise purpose of your request (you may be asked to provide proof of your identity if we are not certain).

If you have any questions about our data processing practices summarized in this Policy, if you have a privacy or data use concern, or if you wish to exercise any of your rights, please contact us, specifying your identity and the specific purpose of your request, by one of the following means:

• By email to: dpo@afidium.com
• By post: 41 rue Gabriel Peri, 91300 Massy

2 – WHAT IS PERSONAL DATA?

Personal data (hereinafter “ Personal Data ”) is any information that is directly or indirectly related to a natural person (“ Data Subject ”), i.e. any type of information that can be associated with an individual. This may include, for example, names, email addresses or telephone numbers if they can be associated with a specific living natural person, but also, for example, a photo in which the person can be recognized.

3 – WHAT DOES “PROCESSING” OF PERSONAL DATA MEAN?

In principle, the term " Processing " includes all types of actions that can be taken with personal data. The definition is very broad and includes all forms of data processing, from collection, recording, retention/storage and adaptation to use, sharing and even deletion of Personal Data.

4 – WHAT PERSONAL DATA DO WE PROCESS, FOR WHAT PURPOSES AND ON WHAT LEGAL BASES?

We process your Personal Data for the following purposes described below.

We process the Personal Data described below for the purposes described below and in order to perform our contract:

Use of the Services .

Based on a contract that binds us or possibly in application of a legitimate interest, you may transmit Personal Data to us when you connect to the Services or when you use them.

The relevant Personal Data that you must provide are the IP address, a pseudonym, your first and last name, your email, the entity to which you belong, any information that you have voluntarily transmitted or even the connection data (date, time, number of connections, etc.) .

In any event, you may also send us information about some of your customers whose data depends on the Services subscribed to and the contract binding us.

We will process Personal Data on the basis of our legitimate interests:

• Customer Service . If you request customer service from us through our support channels, we will process your Personal Data in order to assist you on the relevant matter (i.e. your name, email address and other contact details, our correspondence with you, technical information about the devices and operating systems used ).

• Questions and Complaints . If you have contacted us with questions or complaints about our Services (not based on an agreement with you), you may have provided us with Personal Data such as your name, address, email address, and telephone number . We use this data to respond to your questions and investigate issues with our Services.

• You contact us on your own initiative . If you choose to contact us following our general invitation or on your own initiative via one of our general email addresses, you provide us with personal data that we use to respond to and evaluate the content of your email or if you apply for a job with us.

• If we receive an application , we may process your data such as your surname, first name, age, gender, professional experience, postal address, telephone number, email address or your CV .

• If necessary to protect our rights or the rights of third parties , as we have a legitimate interest in establishing, exercising, and defending legal claims. This may include promoting the security, integrity, and safety of our Services to (i) verify accounts and activity, (ii) locate violations of our Terms of Service or applicable local regulations, (iii) investigate suspicious activity, (iv) detect illicit behavior, or (v) maintain the integrity of our Services.

• Collection of your opinions : If you agree to leave a opinion on one of our Services, you agree that we may use your first and last name, the comment (written or video) and the associated product in order to highlight it on our site or our Services.

• If we sell or otherwise transfer parts of our business and/or assets, you agree to the transfer of your Personal Data.

Legal requirements and claims and public interest:

We may process your Personal Data to meet legal requirements (for example, record‑keeping requirements or in response to a request from you to exercise your individual rights) and by order of courts or public authorities (for example, for tax reasons).

We may also be required by law or compelled by the public interest to process Personal Data relating to product issues. We may also process your Personal Data, such as your bank account information or identity, to establish, enforce, or defend legal claims.

In addition, we may process your Personal Data based on your consent:

In this case, we will obtain your consent in advance for a specific purpose and ensure that it is provided voluntarily, specifically, knowingly, expressly, and unambiguously. You have the right to withdraw your consent at any time; you can contact our department at dpo@afidium.com or refer to the contact details below.

Note that the withdrawal of consent will not apply retroactively to processing that has already been implemented.

• Cookies and Similar Technologies . If you visit the Services and accept our cookies, we may collect Personal Data, for example:
  • In the form of IP address information, user‑generated data from cookies (e.g., clicks, page viewed, page visits, time spent on page, products viewed and clicked, orders, how you access and exit the Services, etc.), geographic location (country only), technical data (e.g., device type, browser settings, time zone, operating system, platform).

However, with respect to strictly necessary cookies, our processing is necessary for our legitimate interest in being able to provide you with a functional service when you visit and use the Services.

5 – WHO ARE THE RECIPIENTS OF PERSONAL DATA?

Only parties who need to process Personal Data for the purposes mentioned above will have access to your Personal Data.

We may also work with partners in many countries, both inside and outside the EEA, and therefore may also need to share Personal Data, for example with service providers and legal advisors who are not based in the EEA.

This means that your Personal Data may be transferred outside the EEA. Where possible, such transfers will be based on decisions by the European Commission regarding adequate levels of security and, otherwise, primarily on the performance of an agreement entered into between us. In other cases, any transfer of your Personal Data to third countries will depend on adequate safeguards such as standard contractual clauses. In exceptional cases, we may also make such transfers based on your explicit consent, important reasons of public interest, the handling of legal claims, or in order to protect your vital interests or those of another person.

AFIDIUM enters into data processing agreements with third parties who have access to Personal Data or process it on our behalf, whether through their Services or our collaboration. We therefore ensure that the third parties we work with process data in the same lawful and secure manner as we do.

More specifically, Personal Data is shared with the following categories of service providers:

• Authorized personnel from the marketing, administrative, legal, compliance, financial and IT departments of the Data Controller;
• People responsible for internal and external control missions;
• External service providers, particularly for the provision of cloud services, IT service providers or our technical partners.

We also share your Personal Data with other data controllers with other persons due to the functionalities of the Services in accordance with our agreements.

These Data Controllers may be authorities (Police, tax authorities or other authorities) with whom we are required to share data by law or following suspected criminal activity, payment providers and banks to facilitate transactions, external advisors (lawyers and auditors) and courts to protect our rights, companies that purchase all or part of our operations/assets, and transport companies in order to manage and deliver your order.

When your Personal Data is shared with other Data Controllers, they will be responsible for your Personal Data and we refer to them for further information on how they process your Personal Data.

Under no circumstances does AFIDIUM sell or rent your Personal Data to third parties for their own activities.

6 – HOW LONG IS PERSONAL DATA KEPT?

• In connection with the use of the Services , we retain your Personal Data for the duration of the contract and delete it when the contract ends. However, the following exceptions apply:
  • As soon as you delete certain Personal Data on your account subject to our retention rights for a longer period due to our legal obligations.
  • If we are required by law to retain or disclose some of your Personal Data after the end of the contract, we will retain the data for as long and to the extent required by law (for example, up to five (5) years from the end of the contractual relationship under the general statutory limitation regime) or as directed by a court or public authority.
  • If this is necessary for the establishment, exercise or defense of legal claims, we will retain the relevant Personal Data until it is no longer needed for such purpose.

• Questions and complaints regarding the Services : We will process Personal Data for three (3) years after receiving it, in order to perform statistical analyses of questions and complaints, to investigate, monitor, control and improve our customer service, to pay compensation and to prevent fraudulent behavior (e.g., unfounded compensation claims).

• Collection of your opinions : We keep your opinions for a period of five (5) years from their publication.

• Site Visitors : We will process your Personal Data for a maximum period of thirteen (13) months after the collection of cookies on the Site, subject to your prior express consent.

• Unsolicited job application : If you have unsolicited a job application with us, we will retain your Personal Data for six (6) months from the date of application in order to contact you if a suitable position arises. If you have applied for a particular position with us but have not been offered the job, we will delete your application documents as soon as we inform you that you have not been offered the position, unless otherwise agreed.

Where we process personal data based on your consent, we will do so until you withdraw your consent or for the duration necessary for the purpose of processing the personal data, whichever comes first, up to a maximum of three (3) years after our last contact or the end of our contractual relationship, whichever comes first.

Please note that the above retention periods do not apply to the extent that AFIDIUM is required to retain your Personal Data (in part or in full) in accordance with applicable mandatory law (e.g., accounting legislation) or during the statutory limitation period related to any requirement from you or applicable to you.

7 – WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

Subject to the terms of the Applicable Regulations, you have the following legal rights:

• Right of access : At any time, you may request access to your Personal Data. Upon request, we will provide you with a copy of your Personal Data in a commonly used electronic format.
• Right of rectification : You have the right to have incorrect Personal Data corrected and incomplete Personal Data completed.
• Right to erasure : In certain circumstances (including processing based on your consent), you may ask us to erase your Personal Data. Please note that this is not an unconditional right. Therefore, an attempt to exercise this right may not result in any action by us.
• Right to object : At any time, subject to the conditions set out in the GDPR, you may object to any processing of your Personal Data by us. We will then only process your Personal Data if it can be demonstrated that there are definitive legitimate grounds for processing the data, which override your interests, rights and freedoms or if the processing takes place to establish, exercise or defend legal claims. You always have the right to object to the use of your Personal Data for direct marketing purposes, including profiling. This objection can be made at any time.
• Right to withdraw your consent to the processing of your data (when the processing of your data is based on your consent).
• Right to restriction of processing : In certain circumstances, you may request that we restrict the processing of your Personal Data. Please note that this is not an unconditional right. Therefore, an attempt to exercise this right may not result in any action on our part.
• Right to data portability : You have the right to obtain the personal data you have provided to us (or to have those personal data transferred directly to another controller, if technically feasible) in a structured, commonly used and machine‑readable format, where the processing of your personal data is based on consent or in order to perform an agreement with you.

If you have any questions or wish to exercise any of your rights, please contact our Company at dpo@afidium.com , specifying your identity and the precise purpose of your request (proof of identity may be requested).

For any questions regarding the use of your data and your rights, you can contact AFIDIUM by one of the following means:

• By email to: dpo@afidium.com
• By post to the following address: 41 rue Gabriel Peri, 91300 Massy

You can also make a request using this form .

For the management of cookies and other tracking tools, AFIDIUM invites you to consult article 8 below.

AFIDIUM undertakes to respond to you as soon as possible, and in any event within one (1) month of receipt of your request. If necessary, this period may be extended by two (2) months, taking into account the complexity and number of requests addressed to AFIDIUM. In this case, you will be informed of this extension and the reasons for this delay.

If your request is submitted electronically, information will also be provided electronically where possible, unless you expressly request otherwise.

If AFIDIUM is unable to respond to your request, you will be informed of the reasons for this inability.

You will always have the option to file a complaint with a supervisory authority and/or seek legal redress. In particular, if after contacting AFIDIUM and despite AFIDIUM's efforts, you believe that your rights have not been respected, you may file a complaint with the competent supervisory authority. In France, this is the Commission Nationale Informatique et Libertés (hereinafter " CNIL "): https://www.cnil.fr/fr/plaintes .

8 – COOKIES

As part of our way of providing personalized services on the Services, we use cookies to store and sometimes track information about you. A cookie is a small data file that is sent to your browser from a web server, is stored on your hard drive, and allows easier access the next time you visit the same page. Their main purpose is to improve your experience of the Services and to enable personalized services to be sent. We only store and access cookies (which are not absolutely necessary on your hard drive) if you have expressly consented to this.

Some of these navigation tracking tools are only used for purposes strictly necessary for the operation of the Services and are, therefore, exempt from consent, as they are necessary to guarantee access and stable operation of the Sites. Others are subject to your express and prior consent.

On the computer, cookies are managed by the Internet browser. These cookies can be session cookies (in this case the cookie will be automatically deleted when the browser is closed) or persistent cookies (in this case the cookie will remain stored in the terminal until its expiration date).

Follow the links below for instructions on how to change your browser settings from some of the most common browser providers (note that these are links to third‑party websites over which we have no control):

• Microsoft Internet Explorer
• Safari
• Firefox
• Google Chrome

By restricting cookies, you may not be able to access all parts of the Services because certain features of the Services depend on cookies.

For transparency, we have summarized the cookies used on our Services below.

By clicking on the cookie settings, you will find a detailed list of the cookies we use on the Services. We classify cookies into the following categories:

• Strictly Necessary Cookies – These cookies are necessary to help you use the features and services we offer on the Services. These cookies do not collect information about you that can be used to identify you, and they do not track or remember where you have been on the internet. Cookies that allow the Services to hold items in your shopping cart while you shop online are an example of strictly necessary cookies. They are typically set in response to actions you take that amount to a request for services, such as setting your privacy preferences.
• Preference cookies – also known as “functionality cookies” – allow the Services to remember choices you have previously made, such as your preferred language, or your username and password so you can automatically log in (if we provide a login feature). They may be set by us or by a third‑party provider whose Services we have added. If you do not allow these cookies, some or all of these services may stop functioning properly.
• Statistics cookies – also known as “performance cookies” – collect information about how you use the Services, such as the pages you visited and the links you clicked on. This information cannot be used to identify you. All data and information is aggregated and therefore anonymized. The purpose of these cookies is to improve the functionality of the Services and if you disable these cookies, we will not receive information about when you visited the Services and will therefore not be able to monitor the performance of the Services.
• Marketing Cookies – These cookies track your online activity to help us and our advertisers deliver more relevant ads or limit how often you see an ad. These cookies may be set through the Services by our advertising partners. These cookies may be used by those companies to build a profile of your interests to show you relevant ads on other websites. They do not directly store Personal Data but are based on identifying your browser and internet device. If you do not allow these cookies, you will see fewer targeted ads.

If you have consented to all cookies, you can withdraw your consent (except for essential cookies) by going to our cookie settings.

With the exception of essential cookies, blocking the installation of cookies does not prevent you from using the Services effectively.

The retention period for the user's choice is six (6) months. The period during which the tracers can collect data in the event of user acceptance is a maximum of thirteen (13) months.

The cookies used on the Services are as follows:

9 – UPDATE OF THE PRIVACY POLICY

AFIDIUM reserves the right to modify or update the Privacy Policy at any time. Any modification or update will be effective upon publication on the Services or, in the case of a contractual relationship, by any means, including email, to inform the Data Subject. In the event that these changes are significant or impact your obligations, AFIDIUM will notify you and request your consent.

10 – DATA SECURITY

We take appropriate technical and organizational measures, including security and integrity measures, to protect your Personal Data from loss and to prevent unauthorized persons from accessing it. Appropriate security measures we have taken include the implementation of secure private connections, traceability, restoration of lost data, and access restrictions.

11 – OTHER

This Privacy Policy is governed by French law, subject to the provisions of the law of any other country in which you may reside.

In the event of a dispute and if an amicable agreement cannot be reached, the competent court will be that determined according to the applicable procedural rules.

We would like to have the opportunity to resolve any complaints you may have, but you also have the right to lodge a complaint with the supervisory body responsible for data protection at any time, as set out above.

To do this, you can contact the French Privacy Authority. You will find more information on its website: https://www.cnil.fr/fr/plaintes .

If you have any questions regarding our processing of your Personal Data or our use of cookies, or if you wish to exercise any of your rights under applicable privacy laws, please contact our Data Protection Representative at: dpo@afidium.com .