PERSONAL DATA HANDLING POLICY

FAYAT SAS is committed to protecting its customers’ personal data and ensuring the highest level of protection.

To deliver its service, FAYAT SAS collects personal data about visitors to its FAYAT SAS website.

As Data Controller, FAYAT SAS agrees to comply with the provisions of the (EU) regulation no. 2016/679 of 27 April 2016 on personal data protection (GDPR) and of Law no. 78-17 of 6 January 1978 as amended.

CONTENTS

1. IDENTITY OF DATA CONTROLLER.

2. TYPE OF DATA COLLECTED.

3. PURPOSES OF COLLECTING DATA, LEGAL BASES AND RETENTION PERIODS.

4. RECIPIENTS OF DATA.

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION.

6. DATA SUBJECT RIGHTS.

7. MARKETING.

1. IDENTITY OF DATA CONTROLLER

The company collecting the personal data and carrying out the data processing is:

FAYAT SAS, an SAS (French simplified joint-stock company) with capital of €110,000,000, whose registered head-office address is 137 Rue du Palais Gallien, Bordeaux, SIREN (French company registration number) ‎595 750 589.

2. TYPE OF DATA COLLECTED

2.1. Data you provide us with directly

When using our Platforms, you will be asked to provide us with information, some of which could be used to identify you (“Personal Data”). This is the case when you fill out forms (such as the application form, for example), when you contact us – whether by phone, email or any other means of communication – or when you report a problem.

This information includes the following data:

- your full name, email address, telephone number

- the information contained in your CV and covering letter

- postal address

- a copy of all communication between you and FAYAT SAS

- information about your payment card, banking information in the event of online payment transactions

- your answers to our surveys and opinions you have submitted

2.2. Data we collect automatically

- In cases where you connect to our services using the provided social media features, FAYAT SAS will have access to certain data (in particular, your full name, photographs, email address and number of Facebook friends) from your account on the said social media site in compliance with the general terms of use for the social media site in question. We may also collect certain Personal Data when you interact with features of these social media sites, such as “Like” features.

- In compliance with applicable legislation and with your consent, every time you visit our website, when necessary, we may collect information about the devices on which you are using our services or the networks from which you are accessing our services, such as your IP addresses, connection data, types and versions of internet browsers used, types and versions of plug-ins used in your browser, operating systems and platforms, data about how you browse on our Platforms, in particular your path through different URL pages of our Platforms, the content you access or consult, the search terms used, download errors, time spent consulting certain pages, the advertising identifier of your device, interactions with the page and any phone number used to contact us. Among the technologies used to collect this information, we use cookies (for more information about this subject, please refer to our Cookies Policy [link to cookies page].

3. PURPOSES OF COLLECTING DATA, LEGAL BASIS AND RETENTION PERIODS

FAYAT SAS ensures that it has one or more of the following legal bases for collecting personal data:

· performance of a contract (ex: to process and send an order or to open and manage a FAYAT SAS customer account )

· fulfilment of a legal obligation (ex: keeping invoices)

· when it is in the legitimate interest of FAYAT SAS

· when the customer has consented to the collection of data

FAYAT SAS collects and processes personal data about its customers for the following processing purposes. FAYAT SAS has established precise rules for the retention period for personal data about its Customers. As a matter of principle, unless otherwise required by law, data is retained for the necessary period to accomplish the purposes for which it is collected.

4. RECIPIENTS OF DATA

Your data is transmitted to FAYAT SAS’s partners who may process the data on their behalf (they are thus recipients), or solely on behalf of and according to the instructions of FAYAT SAS (they are thus sub-contractors).

Data recipients are:

- contributors from subsidiaries (HR or Communication profiles): for processing applications and other user requests.

- FAYAT IT (FAYAT Group): as data host.

FAYAT SAS also relies on sub-contractors for the following operations:

- Carrying out maintenance and technical development of FAYAT’s website : CLEVER AGE

5. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

For certain activities, personal data may be sent to companies located outside the European Union. In accordance with existing regulations, before transferring data outside the European Union, FAYAT SAS ensures that it will be carried out in a secure manner.

Data may be transferred outside the European Union as part of the following activities:

6. DATA SUBJECT RIGHTS

6.1. What rights may be exercised?

Pursuant to Articles 15 to 22 of Regulation 2016/679 of 27 April 2016, any natural person whose data is collected may exercise the following rights:

- The right of access

- The right to rectification

- The right to object to processing of their data and to erasure of their data

- The right to object to profiling

- The right to limit processing

- The right to data portability

Customers may also issue guidelines concerning the retention, erasure and disclosure of their personal data after their death, in accordance with Article 40-1 of Law 78-17 of 6 January 1978. These guidelines may be general or specific.

Should FAYAT SAS detect a personal data breach which may pose a high risk for the Customer’s rights and freedoms, the Customer will be notified about this breach as soon as possible.

Lastly, Customers may withdraw their consent at any time.

6.2. How to exercise these rights

These rights may be exercised with FAYAT SAS, who collects personal data, in the following way:

· By sending an email to: dpo@fayat.com

The request must include the customer’s full name, postal address, email address and, if possible, the customer reference number.

After verifying your identity, FAYAT SAS will send a response within one month of your request to exercise this right. In some cases, due to the complexity or number of requests, this period may be extended by 2 months.

These rights may be subject to exceptions in certain cases specified by the regulation.

If the data subject receives no response or an unsatisfactory response, he/she may refer the matter to the French data protection supervisory authority (CNIL: www.cnil.fr).

7. MARKETING

FAYAT SAS uses your contact information to send you targeted advertising in particular by email, postal mail, SMS or on social media.

FAYAT SAS complies with the rules enacted by Directive 2002/58/CE of 12 July 2002, which requires the prior express consent of the customer to send electronic marketing messages(email or SMS).

As such, when you create your account on the website, you will be expressly asked to give your consent to receive offers from FAYAT SAS by email.

FAYAT SAS will not send you personalised offers by email or SMS if you have not given your consent.

An exception is when the Customer may still be contacted without having given prior consent if he/she is already a customer of FAYAT SAS, if the purpose of the marketing message is to propose similar products or services and if he/she has had the opportunity to object to receiving such messages at the time of collection.

In any case, the Customer may object to receiving these messages by taking the following steps:

- For email, by clicking on the unsubscribe link in each email

- For SMS, by sending stop SMS to the number provided in the message

- By contacting customer service

FAYAT SAS may contact you by telephone to provide you with product or service offers. If you wish not to be contacted, you may add your name to the do-not-call-list for telephone marketing, accessible on the websitewww.bloctel.gouv.fr