1. Purpose

This privacy policy (hereinafter the “Privacy Policy”) illustrates the commitment of CONSCIO TECHNOLOGIES, a simplified joint stock company with a share capital of €90,005, registered in the Vannes Trade and Companies Register under number 438 116 212, with the following intra-community VAT number: FR 06438116212 and whose registered office is located at 3 rue Camille Claudel, 56890, Plescop (hereinafter the “Company”) with regard to the privacy and protection of personal data of users of the following website https://www.conscio-technologies.com/ (hereinafter the “Site”).

The Website allows you, in particular, to:

• discover the Company and the software services (hereinafter referred to as the “Software”) offered by the Company;

• request a demonstration of the Software offered by the Company;

• contact the Company.

1. Processing of your personal data

2.1. Description of the processing of your personal data

In accordance with applicable laws and regulations, the Company, acting as data controller, collects certain personal data when you visit the Site.

In order to respond to your contact requests/requests for a demonstration on the Site, the Company, acting as data controller, collects the following personal data:

• Name;

• First name;

• Company name;

• Email address;

• Subject of the message.

When you connect to the Website, the Company, acting as data controller, also collects the following personal data:

• Connection logs;

• Connection data;

• IP address.

The Company uses your personal data for the following purposes:

Purpose

Legal basis

Personal data retention period

Receipt and management of contact requests

The processing is based on your consent

Until you withdraw your consent or for a period of three years from the last contact with you

Request for a software demonstration

The processing is necessary to respond to your request and is based on your consent

Until you withdraw your consent or for a period of three years from the last contact with you

Management of requests for access, portability, erasure, restriction of processing, rectification and objection

The processing is necessary to respond to your requests to exercise your rights and is based on your consent

Until one year after your request to exercise your right(s)

Management of requests to object to commercial prospecting

Processing is necessary in order to respond to the request to exercise the right to object

Up to three years from the exercise of your right to object

2.2. Recipients/transfers of your personal data

Access to your personal data is restricted to those persons who need your personal data in order to fulfill the specific purpose of the processing.

Your personal data may also be disclosed by the Company to third parties:

• if the law or a legal procedure requires the Company to share your personal data;

• in response to a request from a public or judicial authority (in particular in the event of a court order);

• when the Company considers that the transmission of your personal data is necessary or appropriate to ensure the safety of individuals or to protect the public.

Your personal data is transmitted to OVH, which hosts the Site on servers located in Paris.

Your personal data is hosted in France and is therefore not transferred outside the European Economic Area.

You can access social media pages by clicking on the share buttons provided for this purpose. The collection of information by social media share buttons is subject to the privacy policies of these third parties. We invite you to read the policies of these social media networks to find out how your personal data is used.

2.3. Security of your personal data

The Company takes care to secure your personal data by implementing appropriate technical and organizational measures to ensure a level of security appropriate to the risk:

• pseudonymization and encryption of your personal data;

• any means to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

• any means of restoring the availability of and access to personal data;

• a procedure for regularly testing, analyzing, and evaluating the effectiveness of the technical and organizational measures implemented.

2.4. Retention of your personal data

Your personal data is only kept for as long as necessary to fulfill the purpose for which the Company holds your data, to meet your needs, to fulfill its legal or regulatory obligations, to enable it to exercise its rights, and/or for statistical or historical purposes.

At the end of the periods mentioned above, your personal data will be deleted or the Company will proceed to anonymize it.

2.5. Your rights regarding your personal data

You have the following rights regarding your personal data:

Right of access and rectification

You may request access to your personal data.

You may also request the rectification of any inaccurate personal data or the completion of any incomplete personal data.

You also have the right to know the origin of your personal data.

Right to erasure

You may request the erasure of your personal data when:

1. Your personal data is no longer necessary for the purposes for which it was processed;
2. You have chosen to withdraw your consent (in cases where consent is the legal basis for processing), without affecting the lawfulness of the processing prior to its implementation;
3. You have objected to the processing of your personal data;
4. Your personal data has been processed unlawfully;
5. Your personal data must be erased to comply with a legal obligation; or
6. The erasure of your personal data is required to ensure compliance with applicable legislation, in particular with regard to applicable retention periods.

Right to object

You may object to the processing of your personal data in accordance with the legal obligations imposed on the Company.

Right to restriction

You may also request the restriction of the processing of your personal data if:

1. You contest the accuracy of your personal data;
2. The Company no longer needs your personal data for the purposes of the processing; and
3. You have objected to the processing of your personal data.

Right not to be subject to a

decision based

solely on automated

data processing

You have the option of not being subject to a decision based solely on automated processing that produces legal effects concerning you or significantly affecting you, in particular based on profiling.

Right to portability

You may request that the Company provide you with your personal data in a structured, commonly used, machine-readable format, or request that it be “transferred” directly to another data controller under the following conditions:

1. The processing is based on your consent; and
2. The processing is carried out by automated means.

Right to issue advance instructions on the processing of personal data after your death

Pursuant to Article 85, I of the French Data Protection Act of January 6, 1978, as amended, you may define guidelines on the exercise of your rights provided for in this section after your death (in particular on the retention period of your personal data, their deletion and/or the communication of your personal data), and designate a person responsible for exercising these rights.

In the absence of such instructions, the Company will comply with the requests of your heirs, as set out in Article 85, II of the French Data Protection Act.

Right to lodge a complaint with a supervisory authority

If you have any concerns or complaints regarding the protection of your personal data, you have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (French Data Protection Authority) via the following link: Online complaints | CNIL

The CNIL can also be contacted at the following address: 3 Place de Fontenoy, 75007 Paris, France – telephone: +33 (0)1 53 73 22 22.

You are invited to inform the Company in advance so that the Company can process the request and attempt to find an amicable solution.

You may exercise your aforementioned rights and/or ask any questions relating to the processing of your personal data by the Company by email at the following email address: dpo@conscio-technologies.com or at the following postal address: Data Protection Officer, CONSCIO TECHNOLOGIES, 3 rue Camille Claudel, 56890, Plescop.

In order for the Company to process your request as quickly as possible, you may indicate in your request the subject matter and the context in which your personal data was processed by the Company.

In case of reasonable doubt as to your identity, the Company may ask you to provide a copy of both sides of a valid identity document.

2.6. Links to third-party websites

In order to improve the quality of the Website, the Company may include links to third-party websites on the Website. These websites have privacy policies that are different from and independent of the Company’s privacy policy. You are invited to consult the privacy policies of the third-party websites you visit.

2.7. Language of the site

This Privacy Policy is written in French. In the event that it is translated into one or more foreign languages, only the French version shall be binding in the event of a dispute.

2.8. Cookies

The provisions relating to the use of cookies on the Site are set out in the cookie policy available on the Site.

2.9. Modification of the Privacy Policy

The Company reserves the right to make changes to this Privacy Policy at any time.

The Company recommends that you check this page regularly, referring to the date of its last modification.

In the event of a significant change to the Privacy Policy, the Company will notify you of these changes.