Privacy and Personal Data Protection Policy

v

1. Who processes your personal data?

Hexa-GO (hereinafter “we” or the “Company”) places the protection of your personal data at the heart of its concerns.

This Privacy Policy sets out the principles and guidelines for the protection of your Personal Data and aims to inform you about:

• The Personal Data we collect and the reasons for such collection,
• The way in which your Personal Data is processed,
• Your rights regarding your Personal Data.

We undertake to comply with the regulations in force relating to the processing of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter the “GDPR”), as well as any applicable national regulations (hereinafter the “Regulations”).

2. What personal data is processed by our services?

We undertake to collect only data that is strictly necessary for the direct or indirect performance of the subscribed services when they require the processing of our customers’ personal data (or that of our customers’ customers). Where optional data is requested, we will clearly inform you which Personal Data is necessary for the performance of the subscribed service and which data is voluntarily provided by you.

The Company mainly processes Personal Data collected directly from you, such as:

• Identification data: last name, first name, company name, SIRET number
• Connection data: logs, browsing data, etc.

3. Why do we process your personal data?

We undertake to process your personal data for specified, explicit and legitimate purposes and not to process it further in a manner incompatible with those purposes.

Legal bases:

Each processing operation carried out by the entities of the Company, as Data Controller, is based on at least one of the legal grounds provided for by the applicable regulations, namely:

• The performance of a contract to which the data subject is party, or the performance of pre-contractual measures taken at their request,
• Compliance with legal and regulatory obligations to which the Company is subject,
• The protection of the vital interests of the data subject or of another natural person,
• The performance of a task carried out in the public interest,
• The legitimate interests pursued by the Company, while respecting the interests, freedoms and fundamental rights of the data subject,
• And/or the collection of the data subject’s consent for one or more specific purposes.

Purposes:

We process your Personal Data in particular for the following purposes and on the basis of the legal grounds presented in the table below.

• Managing the commercial relationship between professionals and Hexa-GO and, in certain cases, Colissimo.
• Enabling professionals to contact customer service.
• Enabling professionals to manage their widget.
• Enabling professionals to access their secure area.
• Producing statistics and satisfaction surveys.
• Carrying out commercial prospecting.
• Sending newsletters and/or automated emails (subject to prior customer consent).
• Managing the exercise of rights.

4. How long is your personal data retained?

The retention period of your personal data is determined according to the products and services subscribed to and the Personal Data processing operations carried out by the Company. We undertake not to retain your Personal Data beyond the period necessary to provide such products or services in accordance with your contract.

Some of your Personal Data may be retained for longer periods pursuant to specific legal or regulatory provisions, or in order to respond to requests from authorities or authorized third parties.

Personal Data which, due to its use for various processing operations, is subject to several retention periods is retained for the longest applicable period.

Except in the cases mentioned above, the retention of any Personal Data is limited to the sole purpose(s) for which it is processed, unless otherwise stated and notified to you.

At the end of these periods, we proceed with their destruction in accordance with our internal policy or anonymize them for statistical purposes.

5. How is your Personal Data protected?

In accordance with the regulations in force, we undertake to implement all appropriate technical and organizational measures to ensure a level of security for your Personal Data that is appropriate and proportionate to the risk. These measures (e.g. data segregation, anonymization, encryption, access restriction, etc.) are intended to ensure the confidentiality, integrity, availability and resilience of your Personal Data.

The Company undertakes to take into account the protection of your Personal Data and your privacy from the design stage of new products or services offered to you. To ensure security and guarantee the respect and proper exercise of your rights, measures to protect your Personal Data are implemented.

As data controller, we notify personal data breaches to the competent supervisory authority, namely the French Data Protection Authority (CNIL), as soon as possible and, where feasible, within seventy-two (72) hours after becoming aware of any personal data breach likely to result in a risk to your rights and freedoms. Any breach of your Personal Data likely to result in a high risk to your rights and freedoms will be notified to you as soon as possible in accordance with the applicable regulations.

6. With whom is your Personal Data shared?

Your Personal Data is collected directly from you and is used only for the purposes that have been brought to your attention.

Your Personal Data may in particular be communicated to the following recipients, for the purposes set out above:

• The Company’s potential subsidiaries and the Group to which it belongs, to internal departments responsible for the performance of the subscribed services, in particular Customer Service, Sales Department, etc.,
• Subcontractors, partners or service providers who perform services on your behalf or on our behalf,
• Commercial partners, after having informed you in advance and allowed you to express your choices via a checkbox,
• Authorized administrative or judicial authorities or, more generally, any authorized third party (lawyers, statutory auditors, etc.), in order to comply with our legal or regulatory obligations.

Some of your Personal Data processed by the Company is collected indirectly from the following sources:

- Either from our customers, who provide information on subscribers, beneficiaries, rights holders, contacts and recipients. This data is necessary for the performance of the subscribed services,

- Or from third parties, such as fraud prevention organizations, data providers, organizations (World Customs Organization, etc.) and members of the Universal Postal Union.

In the event of indirect collection, the Company undertakes to inform the individuals in accordance with the conditions set out in Article 14 of the GDPR.

Certain services may be used by minors. In such cases, minors must obtain the consent of their parents or legal representatives.

7. Is your personal data transferred outside the European Union?

All processing of your Personal Data is carried out within the territory of the European Union (EU).

However, for certain specific services, we may use subcontractors, partners or subsidiaries established outside the EU. In such cases, your Personal Data is communicated to them strictly for the purposes of carrying out their assignments.

In the event of transfer of your Personal Data to a country outside the EU, we undertake to implement all appropriate safeguards available under the applicable regulations to ensure the supervision and security of such transfers.

8. What are your rights and how can you exercise them?

When we collect your personal data, you receive, through information notices, clear and transparent information on the processing carried out and on the procedures for exercising your rights. In accordance with the Regulations, you may exercise your rights subject to meeting the applicable conditions.

These rights are:

• The right to access the personal data we hold about you. This includes the right to request additional information on:
• The categories of data we process,
• The purposes of the processing of such data,
• The recipients and categories of recipients to whom your data has been disclosed,
• The retention period of your data where possible, or, where this is not possible, the criteria used to determine such period;
• The right to have inaccurate or incomplete personal data concerning you rectified;
• The right to object at any time to the use of your Personal Data;
• The right to be “forgotten” by exercising your right to erasure of your Personal Data;
• The right to request the restriction of the processing of your Personal Data;
• The right to request that your Personal Data be recovered in a structured, commonly used and readable format in order to use it and transmit it to another data controller (right to data portability);
• The right to provide instructions regarding the fate of your Personal Data after your death;
• The right to withdraw your consent at any time, where consent has been requested. This will in particular allow you to modify and/or withdraw your consent regarding commercial prospecting.

Any request must indicate your last name, first name and the address to which you wish to receive the response. You must provide proof of your identity. In the event of a genuine doubt as to your identity, an identity document (front/back copy) may be requested. It will be retained for the time necessary to process your request and then permanently deleted.

These rights may be exercised by contacting us:

- either by email at: pro@hexa-go.com

- or by post at: 31 boulevard Tisseron, 13014 Marseille, France

The Company undertakes to respond to your requests to exercise your rights as soon as possible and, in any event, within the legal time limits.

If, after contacting us, you consider that your rights regarding your data are not being respected, you may submit a complaint to the French Data Protection Authority (CNIL):

CNIL - 3 place de Fontenoy - TSA 80715 – 75334 Paris Cedex 07

Or by telephone: +33 1 53 73 22 22.

You are informed of the existence of the telephone marketing opposition list “Bloctel”, on which you may register: https://conso.bloctel.fr.

9. How can you contact our Data Protection Officer (DPO)?

Hexa-GO has appointed a Data Protection Officer (DPO) with the CNIL.

You may contact the Data Protection Officer at the following address:

Data Protection Officer

Juliette Pairé, admin@hexa-go.com, +33 4 12 33 30 31

Glossary

“Personal Data”: Any information relating to an identified or identifiable natural person.

“Recipient”: Any department, company or organization that receives and may access your Personal Data.

“The Company”: The legal entity, acting as data controller, which drafted this Policy.

“Privacy and Personal Data Protection Policy” and “Policy”: This Policy describing the measures taken for the processing, use and management of your Personal Data and your rights as a data subject.

“Data Controller”: The Company that carries out the processing of your Personal Data.

“Processing”: Any operation or set of operations applied to your Personal Data.

“Personal Data Breach”: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your Personal Data.

“Processor”: Any natural or legal person, public authority, department or other body which processes personal data on behalf of the data controller.