Privacy Policy

Preamble

The Platform available at the following address: keyzz.app (hereinafter referred to as the "Platform") is published by RECALLBY, a simplified joint-stock company, with a share capital of 10,105 euros, registered with the Paris Trade and Companies Register under number 940 003 080 and whose registered office is located at 7 rue de Saussure 75017 PARIS (hereinafter referred to as "RECALLby") which, in its capacity as the controller of personal data, attaches great importance to the protection and respect of privacy.

This privacy policy aims to inform, when browsing the Platform, any person using the Platform (hereinafter referred to as the "Users" or the "User") of RECALLby's practices regarding the conditions for collecting, using and sharing the information that Users are required to provide, as well as their rights.

The Platform complies with French and European standards relating to the protection of privacy and personal data, in particular Law No. 78-17 known as the "Data Protection Act" of 6 January 1978 relating to data processing, files and freedoms, as amended by Law 2004-801 of 6 August 2004, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 known as the "GDPR" relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data.

Important: note to users

ANY BROWSING OF THE PLATFORM AFTER THE PUBLICATION OF THIS PRIVACY POLICY CONSTITUTES UNRESERVED ACCEPTANCE OF IT.

If the User wishes to withdraw their consent to the processing of their data, they simply need to make the request directly by email to the following address: support@recallby.com.

Furthermore, where required by law and/or in certain circumstances, the User's consent will be obtained or an option to refuse will be provided before any data transmission.

Controller of the personal data collected

The controller of the personal data is RECALLby.

Nature of the data collected

The data collected on the Platform in the context of using the Platform is that which allows RECALLby to identify Users directly or indirectly.

This may include the following categories of data concerning Users:

• civil-status, identity and identification data such as surname, first name, email address, date of birth, parental authorization;
• economic and financial data such as order and payment data (means of payment and transaction ID);
• Platform usage data, such as the public Wallet address, the type of KEYZz, interaction with content; and
• technical and connection data such as trackers, IP addresses, connection logs, browsing data on the Platform, device type.

The mandatory or optional nature of the personal data collected and the possible consequences of a failure to respond are indicated at the time of collection.

Users who communicate the personal data of a third party must confirm that they hold the consent of that third party regarding the Platform's use of the latter's personal data.

Purpose and legal basis of the processing activities

Purpose of the personal data collected

The personal data collected on the Platform is used only for and during the performance of the services for the following purposes:

• creation and management of User accounts: management of the Wallet (technical connection, no keys); provision of KEYZz; access to the associated content;
• management of the commercial relationship: processing and management of orders; hosting of the content on the Platform;
• proper functioning and continuous improvement of the Platform and its features: general administration of the Platform; general management of the Platform's security; collection of information by means of trackers.

In addition, RECALLby may use the data to satisfy, where applicable, its legal and/or regulatory obligations.

Legal basis of the processing activities

The processing activities and the collection of personal data are authorized on the basis of the following legal grounds:

• The performance of pre-contractual and contractual obligations, for the creation and management of User accounts; the management of the commercial relationship; and the hosting of the content.
• The User's consent, for: the placement of trackers.
• The legitimate interest in guaranteeing the best level of operation and quality of the Platform for the proper functioning and continuous improvement of the Platform.

Aggregation with non-personal data

RECALLby reserves the right to publish, disclose and use aggregated information (information about Users or about specific groups or categories of Users combined in such a way that an individual User can no longer be identified or referred to) and non-personal information for industry and market analysis purposes, demographic profiling, promotional and advertising purposes, and other commercial purposes.

Time of collection

The data collected by RECALLby is freely communicated by Users during the registration procedure on the Platform and when paying for orders.

Certain data may be collected automatically when using the Platform, in particular when the User browses the pages of the Platform.

This automatically collected data does not reveal the identity of the User but concerns the use of the services. This collection is necessary for the maintenance and operation of RECALLby's services as well as for its internal analyses and reports.

This information includes:

• information on how the services are used (frequency, traffic data, the way in which the User reached the Platform);
• information concerning the device used to access the services (device name, country, location, browser and device characteristics, operating system, language preferences, referring URL).

In any event, the personal data collected:

• will be obtained and processed fairly and lawfully;
• will be recorded for specified and legitimate purposes;
• will be used in accordance with those purposes;
• are adequate, relevant and not excessive in relation to those purposes; and
• will be subject to precautions to ensure the security and confidentiality of the data in order to prevent it from being damaged, modified, destroyed or communicated to unauthorized third parties.

Recipients of the personal data

The recipient of the personal data collected on the Platform is first and foremost RECALLby.

The personal data is not communicated to any third parties with the exception of RECALLby's partners whose communication of the personal data is necessary in the context of providing the services offered by RECALLby (order processing and management of the Platform's content).

However, the partners undertake to scrupulously comply with the provisions of the Data Protection Act, the GDPR and any future provisions.

Furthermore, other recipients may have access to the personal data. These are, where applicable, the resource providers in charge of the Platform (vendors, service providers, contractors and third-party agents, etc.) and its external providers (technical service provider, access providers, communication agencies, etc.).

In the event of a change of control of RECALLby or a merger, acquisition, insolvency proceedings or any other form of asset transfer, the data collected by RECALLby may be transferred to third parties. Nevertheless, RECALLby undertakes to guarantee the confidentiality of the personal data collected and to inform Users before it is transferred or subjected to new confidentiality rules.

Where required by law, the User's consent will be obtained or an option to refuse will be provided before any data transmission.

The data collected may also be transferred if vital interests are at stake and RECALLby considers it necessary to investigate, prevent or take measures to prevent the potential violation of its policies and, more broadly, in situations involving suspected fraud, potential threats to security and illegal activities, or may be used as evidence in a dispute involving RECALLby.

Users' rights

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 known as the "GDPR" relating to the protection of natural persons with regard to the processing of personal data and the free movement of such data, and with Law No. 78-17 known as the "Data Protection Act" of 6 January 1978, as amended by Law 2004-801 of 6 August 2004 relating to data processing, files and freedoms, the User has:

• a right of access to their personal data;
• a right to rectify their personal data;
• a right to delete and erase their personal data;
• a right to object to the processing of their personal data;
• a right to restrict the processing of their data;
• a right to the portability of their data, where the data is subject to automated processing based on consent or a contract;
• a right to withdraw their consent at any time; and
• a right to determine the fate of their data after their death.

A User wishing to exercise one of their rights may send their request by email or by post to the following addresses:

• Postal mail: RECALLby, 7 rue de Saussure 75017 PARIS
• Email: support@recallby.com

When exercising one of these rights, the User must provide RECALLby with the information necessary for their identification: surname, first name, email address and, where applicable, postal address.

In addition, in accordance with the regulations in force, the User's request must be clear and specify in detail the right they wish to exercise as well as the address to which they wish to receive the response in the event of the exercise of one of the rights listed above. RECALLby may ask them to provide a photocopy of an identity document bearing their signature in order to be able to verify their identity.

RECALLby then undertakes to respond within a maximum period of one (1) month following receipt of the User's complete request.

Due to the complexity of the request and/or the number of requests, this period may be extended by two (2) months provided that RECALLby informs the User within one (1) month of receipt of their request of the reasons for the postponement.

RECALLby informs Users of their right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (hereinafter referred to as the "CNIL") in one of the ways indicated below:

• Via the CNIL website: www.cnil.fr/fr/plaintes or www.cnil.fr
• By postal mail: Commission Nationale de l'Informatique et des Libertés - CNIL, 3 Place de Fontenoy, TSA 80715 - 75334 PARIS CEDEX 07

Data retention period

Retention of data during the contractual relationship

The personal data of Users collected is not retained beyond the time necessary for the performance of RECALLby's obligations defined at the conclusion of the contract or the predefined duration of the contractual relationship, except for the data that RECALLby would need to retain as evidence, for legal or administrative needs or in accordance with the legislation in force.

Personal data whose collection is not necessary for the performance of RECALLby's services will be deleted and, where applicable, anonymized or stored securely preventing any further processing while awaiting their deletion.

Retention of anonymized data beyond the contractual relationship

RECALLby retains the personal data of Users collected for the period strictly necessary to achieve the purposes described in this privacy policy.

At the end of the commercial relationship, RECALLby will retain the information provided by the User for five (5) years from the end of the commercial relationship.

Beyond this period, it will be anonymized and retained for exclusively statistical purposes and will not give rise to any use whatsoever.

Transfer of personal data abroad

As far as possible, RECALLby processes Users' data only within the European Union and does not transfer this data outside this area.

Nevertheless, in the event of an international transfer of Users' data outside the European Union, a distinction must be made between:

• countries that have been the subject of an adequacy decision by the European Commission: in this case, the data is transferred to a country ensuring a level of protection deemed sufficient and adequate to the provisions of the European data protection regulation; and
• countries whose level of data protection has not been recognized as adequate: in this case, to guarantee a transfer in compliance with European regulation, and in particular to ensure the security of the data, RECALLby will base its transfer on protection mechanisms adapted to each service provider and subcontractor, such as the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules or pursuant to an approved certification mechanism.

Security

RECALLby undertakes to implement the appropriate technical and organizational measures reasonably necessary in light of the regulations applicable to the protection of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, in order to guarantee a level of security adapted to the risks to the rights and freedoms of natural persons in the context of the processing covered by this privacy policy.

When personal data is transferred to third parties for processing, RECALLby ensures that these third parties implement all appropriate technical and organizational measures to ensure the protection of personal data in accordance with applicable laws.

These measures are defined taking into account the state of knowledge, the costs of implementation and the nature, scope, context and purposes of the processing as well as the identified risks.

Depending on the needs, risks, costs and purpose of the processing, these measures may include the pseudonymization and encryption of data.

Finally, in the event of a breach of rights concerning personal data likely to result in a high risk to the rights and freedoms of the User, RECALLby undertakes to inform the User of this breach within a maximum period of seventy-two (72) hours.

Trackers

Trackers are small files that are placed on the User's device by the sites and/or applications that the User visits. They are used to operate the sites and/or applications and improve their use.

When consulting the Platform, Users are informed that trackers or other means of recording browsing data are used by the Platform or by third parties, service providers for the Platform, and placed on the User's device (computer, mobile or tablet).

RECALLby or its partners may install, subject to the User's acceptance, various trackers including in particular:

• session trackers, which disappear as soon as the User leaves the Platform;
• permanent trackers, which remain on the User's device until their lifespan expires or until the User deletes them; and
• statistical trackers (allowing the Platform's audience to be measured).

Only the issuer of a tracker can read or modify the information it contains.

In application of the CNIL's recommendations, on their first connection to the Platform, the User will be expressly asked to accept the Platform's trackers.

Purpose of the trackers

The trackers used by RECALLby or its partners make it possible to identify Users, to recognize their browser when they connect to the Platform, to record their access frequencies (traffic measurement) and their display preferences on the Users' device, to adapt and/or personalize the presentation of the Platform to improve the Users' experience and to optimize the Platform for the sole purpose of providing the services requested by the User.

In addition, the trackers used on the Platform are based on the International Chamber of Commerce guide by category:

• strictly necessary trackers;
• performance trackers;
• functionality trackers;
• advertising targeting trackers.

Strictly necessary trackers

Strictly necessary trackers allow the User to browse the Platform.

These trackers do not collect any information about the User that could be used for marketing purposes.

RECALLby uses these trackers to:

• ensure the operation of the Platform;
• secure forms and protect them against malicious scripts.

RECALLby does not use these trackers to:

• collect information that could be used to promote products or services to Users; or
• remember the User's preferences or name after their visit.

Performance trackers

These trackers allow the improvement of performance and of the Platform, such as error management, response-rate tracking or the improvement of the Platform's design.

Functionality trackers

These trackers are used to provide services or to remember the User's settings in order to improve their visit to the Platform.

Advertising targeting trackers

These trackers are used to promote products or services to the User on other sites. They may also be used to limit the number of times the User sees a particular advertisement on the Platform and to measure the effectiveness of a particular campaign.

Tracker retention period

In accordance with the CNIL's recommendations, the maximum retention period for trackers is thirteen (13) months at most after their first placement on the User's device, as is the validity period of the User's consent to the use of these trackers. The lifespan of the trackers is not extended at each visit. The User's consent must therefore be renewed at the end of this period.

The User's right to refuse trackers

On the first browsing of the Platform, an explanatory banner on the use of trackers appears. It allows the User to enable or disable certain trackers. It will only disappear once the User has accepted, or not, the use of trackers in order to continue browsing.

The recording of a tracker remains subject to the will of the Users. In accordance with the legislative and regulatory provisions, RECALLby obtains prior consent to the placement of trackers.

Users also have the possibility of configuring their device so as to object, in whole or in part (in particular according to the issuer), to the recording of trackers. The configuration also offers the possibility of accepting or refusing trackers on a case-by-case basis, before they are recorded on the Users' device.

However, in the event of objection to the recording of trackers or uninstallation of a tracker, Users are informed that certain services may no longer function correctly.

Modification of the privacy policy

RECALLby reserves the right to modify and update this privacy policy at any time, in particular to take into account any legal and/or jurisprudential developments and to meet the requirements of the regulations applicable to the protection of personal data.

The version that prevails is the one accessible online on the day of consultation of the Platform.

Any consultation of the Platform after publication of the modified privacy policy constitutes unreserved acceptance by the latter of the new privacy policy.

Contacts

For any request for information or to find out more about the processing of their personal data, including the exercise of their rights indicated above, the User may contact RECALLby by email or post at the following address:

• Postal mail: RECALLby, 7 rue de Saussure 75017 PARIS
• Email: support@recallby.com

For any complaint or dissatisfaction in the context of the use of their personal data by RECALLby, the User may contact RECALLby by email or post at the following address:

• Postal mail: RECALLby, 7 rue de Saussure 75017 PARIS
• Email: support@recallby.com

When the User contacts RECALLby, they will be asked to identify themselves.

Version updated on [TO BE COMPLETED]