How are your personal data collected, stored and processed?

Introduction

This Charter applies to all personal data processed within OSMOS. It explains how we use this data, with whom we are likely to share it, and what steps we take to ensure their privacy and security.

Some of the links on our websites may redirect you to websites not belonging to our company. They have their own policies or privacy or data protection charters that may differ from ours: it is your responsibility to read them.
 

What data do we collect?

The data we collect or hold about you may come from a variety of sources. Some have been collected directly from you, others may have been collected in compliance with applicable regulations, in the past or by other companies of the group to which we belong. We may also collect information about you when you interact with us, for example when you visit our websites, when you fill out an online registration form, when you subscribe to our newsletter, when you call us or when you are visiting one of our websites.

• The data you provide us may for example relate to:

• Information about your identity such as your name;

• Your contact information such as your e-mail address, telephone numbers;

• Information that you provide to us by completing forms or contacting us, whether by phone, face-to-face, e-mail or other means of online communication or by responding to questionnaires or satisfaction surveys;

• The data we collect or generate may include:

• Information about our business relationship, your transactions and instructions, the communication channels you use with us;

• The information we use to identify you, such as your e-mail address or username;

• Any information contained in the documentation or forms that you could complete as a customer or prospect;

• Any information of a commercial nature, such as the details of the products or services you benefit from;

• Data collected through cookies. We use "cookies" and similar technologies on our websites and in e-mail messages to recognize you, remember your preferences and present you with content that may be of interest to you. Check out our Privacy Policy ( https://www.osmos-group.com/en/content/privacy-policy more details on how we use cookies ).

• Records of all correspondence and communications between us, including e-mail, instant messaging, social media communications or any other type of exchange and communications;

• Any information we need to comply with our legal and regulatory obligations, the information necessary to detect any suspicious or abnormal activity concerning you or the persons with whom you are in contact.

How do we use your data?

We will only use your personal data if you have consented to it or if it is based on one of the legal grounds laid down by law:

• The protection of our legitimate interests;

• The performance of a contract or commitment for which you are and / or we are engaged;

• Compliance with a legal or regulatory obligation;

• The preservation of the public interest, such as the prevention or detection of fraud or financial crime;

We collect and process information about you for a variety of reasons including:

• understand the use you make of your services;

• improve the quality of our products, contracts and services and ensure the effectiveness of our marketing campaigns;

• keep a record of our exchanges with you (in -presentiel, by email or any other type of communication);

• prevent or detect any risk of fraud or financial crime;

• ensure the continuity of the activity of our services;

• correspond with our lawyers, consultants or any other party (subcontractors, suppliers, carriers, partners or other interested third parties);

• defend our rights and respect our legal, regulatory or tax obligations.

Sometimes, you may have expressed your willingness not to see your data used but we still have to use it for different reasons. In such a case, we will continue to use them if (i) the law requires us to do so, (ii) if we are required to perform a contractual obligation, (iii) if it is in the public interest to do so or ( iv) if we have a legitimate interest in doing so.

Management Software

We may use management software, for example when you want to subscribe to a product or service. We are likely to use such methods to enable us to better monitor you within our establishments.

You are entitled to request to be removed from our database. Please refer to the "Your Rights" section below for more information.

Compliance with our legal and regulatory obligations

We use your personal data to comply with our obligations, comply with any applicable law or regulation and, where appropriate, share it with a regulator or a competent authority in strict compliance with applicable law.

Marketing and market research:

Your personal data may be processed to promote our products and services. If you agree, we may send you commercial messages (e-mail, SMS, phone) containing information about our products and services or those of third parties.

You may withdraw your consent to the use of your data for commercial purposes at any time: taking into account your request and updating our systems may take a few days during which you are likely to receive commercial solicitation requests included in our marketing campaigns already launched. To ask us to stop sending you marketing messages or to use your data for marketing purposes, including to adapt our content or advertising to your profile when you use one of our websites, please click on the button "Unsuscribe" on our newsletter or send an email to the following email address : rgpd@osmos-group.com .

Agencies in charge of carrying out market research may contact you (by post, telephone, e-mail or any other means of communication) to invite you to take part in a study. You may withdraw your consent to use your data for market research purposes at any time. If this is the case, we will stop using your data for this purpose.

With whom are we likely to share them?

We may share your personal data for the following reasons:

• provide you with products or services that you have requested;

• comply with a legal or regulatory obligation;

• respond to a request for regulatory reports, manage litigation or to act in defense of our rights;

• act on the basis of a legitimate interest, for example to manage an operational risk or evaluate the relevance or effectiveness of our commercial campaigns of our products or services;

• act in accordance with your consent, previously collected.

We may transfer and disclose your data to:

• other companies in our group;

• subcontractors, agents or service providers who work for us or other group companies (including their employees, directors and officers);

• any company (new or potential) that acquires all or part of our company;

• statutory auditors, independent administrative authorities or dispute resolution bodies and to comply with their requests;

• companies that carry out commercial or market studies for us;

• any other person involved in litigation with respect to an operation;

• the French government, the judicial / administrative authorities / jurisdictions;

Aggregated or anonymized data sharing:

If we have made your data anonymous, we may share it outside of OSMOS with partners such as research groups, academics, advertisers or related sites. For example, we may publicly share information to present trends in the overall use of our services. These data do not allow you to identify yourself.

How long do we keep them?

We will retain your data as long as you use our services. We may also retain them even if you choose not to use our services or platforms, including to comply with applicable law, to defend our interests, or to enforce our rights. We will not keep them longer than necessary, and when we no longer need them, we will destroy them safely in accordance with our internal policy or we will make them completely anonymous.

Certain data may be retained for an additional period of time for the management of claims and / or litigation as well as to meet our legal or regulatory obligations or to respond to requests from authorized authorities.

The accounting data may be kept for a period of ten (10) years in accordance with the applicable regulations.

International data transfers

Your data may be transferred to, hosted in or accessed from a country outside the European Union where data protection legislation is not equivalent to that of France or the European Union. We will only make such transfers of data to perform a contract between you and OSMOS, perform a legal obligation, protect the public interest, and defend our legitimate interests.

When data about you are transferred to a country outside the European Union, we will always make sure that it is protected. To this end, we submit all transfers of your data to appropriate and relevant safeguards (such as encryption or contractual commitments, including the conclusion of EU-approved standard contract clauses).

You can obtain further information on how we transfer your personal data outside the European Union by contacting us directly.

Your rights

You have rights to your personal data:

• the right to obtain information about the data we hold about you and the treatments used;

• in certain circumstances, the right to withdraw at any time your consent to the processing of your personal data (please note that we may continue to process your personal data if we have a legitimate reason to do so);

• in certain circumstances, the right to receive data in electronic form and / or to request us to transmit this information to a third party where technically possible (please note that this right is only applicable to data that you have provided)

• the right to modify or correct your data;

• the right to ask us to delete your data in certain circumstances (please note that legal or regulatory provisions or legitimate reasons may require us to keep your data;

• the right to ask us to restrict or oppose the processing of your data in certain circumstances (please note that we may continue to process your personal data if we have a legitimate reason to do so);

You can exercise your rights by contacting us. For this, please send an email to rgpd@osmos-group.com .

You will find more information about your rights on the CNIL website: https://www.cnil.fr/ . You also have the right to file a complaint with the Commission Nationale Informatique et Libertés (thank you to send a letter to the following address: CNIL - 3 Place Fontenoy - TSA 80715 - 75334 Paris - Cedex 07) .

How do we ensure the security of your data?

We implement technical and organizational measures to protect your data, including encryption, anonymization and the implementation of physical security procedures. We require our staff and all third parties working for OSMOS to meet high standards of security and information protection, including contractual obligations under which they undertake to protect all data and enforce strict rules on data transfer.

Learn more about your data

If you would like to know more about the provisions of this Data Protection Charter or contact our Data Protection Officer, you can write to us at the following addresses:

37 rue la Pérouse

75116 Paris, France

This Data Protection Policy is subject to change and the latest applicable version is available at: https://www.osmos-group.com/en/content/privacy-policy

APPENDIX 1: PURPOSES AND TIMES OF DATA CONSERVATION

1. Supply of Products and Services: We use your data to provide you with products and services.

2. Compliance with laws and regulations: we ensure compliance with all applicable laws and regulations. This treatment may be based on the respect of a legal obligation, the public interest or our legitimate interest.

3. Security and Continuing Operations: we take steps to facilitate the continuation of our operations and ensure the security of the data we hold (including physical security measures) in order to fulfill our legal obligations, define and put into practice our internal strategy. We also put in place security measures to protect our staff and premises (including a video surveillance device and tracking incivilities).

4. Improved Products and Services: We will use the analysis of your data to identify possible improvements to our products and services. The legal basis for processing your data for this purpose is our legitimate interest.

5. Cookies: We will ask you to consent to the use of cookies. The legal basis for processing your data for this purpose is your consent.

6. Data Analysis for Customer Targeting: We may use your data for analysis to identify opportunities to promote our products and services to current or potential customers. This use of the data is based on our legitimate interest.

7. Marketing: We use your data to provide you with information about OSMOS products and services and the products and services of our partners and other third parties. This use of your data is based on our legitimate interest and / or your consent.

8. Protection of our rights: we may use your data to protect our rights, including in the defense or protection of legal rights and interests, lawsuits, claims management or litigation, corporate restructuring or other merger or acquisition. We will use them on the basis of our legitimate interests.