INTRODUCTION

This privacy notice (Notice) is provided for you as an individual concerned by the personal data (Data) processing operated by Professional Cards Authenticator - P.C.A, a simplified joint-stock company with share capital of 1000 euros, registered in the Paris Trade and Company Register under no. 810 151 290 (PCA).

PCA gathers and processes information that identifies you and may concern both your private and working lives (such as your name, date of birth, family status, profession, income and charges).

PCA gathers and processes information that identifies you and may concern both your private and working lives (such as your name, date of birth, family status, profession, income and charges).

PCA has appointed a Data Protection Officer (DPO). This person ensures that personal data processing performed by PCA complies with applicable regulations.

Whose Data is collected?

This notification is intended for all individuals acting in a personal capacity or with direct and indirect links (such as legal representatives, proxies, agents or beneficial owners, contact persons - if, for example, you are a member of their family, or a co-borrower or guarantor), with a company that is already a Client or wishes to enter into contractual relations with PCA.

For what purpose is your Data collected and used?

We process your Data with a view to providing you with products and services. Data is processed as it is necessary for pre-contract measures following your application and/or performance of the contract, such as:

• Subscribing to a product or service;
• Managing your claims;
• Managing after sale service;
• Managing your orders;

PCA pursues a number of legitimate interests, including:

• improving its knowledge of Clients;
• improving our products and services;
• preventing fraud.

This processing is performed taking your interests and basic rights into account.

As such, it is accompanied by measures and guarantees that ensure your interests and rights are protected, whilst maintaining a balance with the legitimate interests pursued by PCA.

Processing of your data may be justified by the nature of these legitimate interests, such as:

• Selecting and targeting our Clients;
• communication marketing;
• Client satisfaction surveys and measurements;
• Proposing customized and tailored services:
• in the context of developments in technology;
• by improving your Client experience;
• or to adapt to your requirements;

If legally required, PCA will subject specific data processing to obtaining your consent, such as:

• Sales canvassing if you are not a Client of PCA or if you are a Client of PCA, but in cases where the canvassing involves products that are not similar to those to which you have already subscribed;
• Transferring your data to third-party partners other than those mentioned below

To this effect, you will be specifically asked to consent to your data being collected and processed for explicit purposes.

Cookies or other trackers include tags, instruments and tracking tools that are placed on your device and read when consulting a website, reading an email or installing and using software or a mobile application. When you visit PCA website, cookies and trackers may be placed on your devices (such as computers, smart phones and computer tablets).

Our Cookies policy is available on each website involved.

What data do we collect?

You are informed on the document used to collect your data that your declarations are compulsory and the fact that, in certain cases, failure to respond to a request for information may affect the processing of your application.

When you use our products and services, we collect data about you, including data about your behavior, habits and preferences

Your personal data may also come from third-party service providers or suppliers, partners or subcontractors, if their personal data protection policies allow this or if you have authorized them to share this data. We may also need to collect public personal data about you.

In specific cases, we may have also collected personal data about you, even though we have not entered into direct relations. This may occur if your contact details have been communicated to us by one of our Clients, if, for example, you are one of their legal representatives, a family member, a co-borrower or personal guarantor, or a proxy (holding a power of attorney).

Who has access to your Data?

PCA takes all necessary measures to guarantee professional secrecy and ensure the security and confidentiality of your data, which includes ensuring that only authorized persons have access to the data.

Only persons accredited on account of their duties within the relevant departments of PCA, in charge of the corresponding processing, have access to your data, within the limit of their accreditations.

Similarly, our service providers or partners may have secured access to all or part of your data within the framework of performing their service or of our partnership.

As such, we share your data within:

• Debt recovery agencies;
• The service providers or subcontractors to which PCA assigns operational tasks, services, the performance of surveys or compiling of statistics;
• Legal and financial authorities, or other government bodies;
• certain regulated professions, such as lawyers, bailiffs, notaries or auditors.

For how long is your Data kept?

PCA only retains your data in accordance with the purpose of processing and in compliance with legal and regulatory obligations. The period for which your data is kept varies, depending on the purpose of the processing:

• Management of our products and services: 5 years maximum after the end of contractual relations and full payment of all amounts due or 10 years after the final settlement of disputes
• If no contract is signed: 6 months
• General accounting: 10 years from the end of the financial period
• Cookies: 13 months maximum

What rights do you have over your Data?

You have various rights over your data, subject to the limits and conditions authorized by the regulation, including the right to:

• obtain information about the processing of your data, together with a copy of your data;
• correct and update your Data if you believe your personal data to be inaccurate or incomplete, you are entitled to have your Data amended accordingly;
• ask for your personal data to be deleted;
• request that we limit the processing of your Data;
• request recovery of the data you have provided for us or ask us to send the data to a third party, if technically possible;
• withdraw your consent at any time for the processing of the data subject to your consent;
• on legitimate grounds relating to your specific situation, oppose the processing of your personal data, as well as, at any time, opposing the processing of your data for the purpose of canvassing, including profile processing related to said canvassing;ments de profilage liés à cette prospection ;
• File a complaint with a supervisory authority (in France, to the CNIL).

Furthermore, you have the option of sending us instructions regarding the retention, deletion and communication of your data after your death. These instructions may also be registered with a certified "digital trusted third party". These instructions, also known as a "digital will" can appoint an executor. If no such person is specified, your heirs will be the executors.

For electronic communications for canvassing purposes, an unsubscribe link (for emails) or number (for SMS/MMS) is also provided on all electronic communications from PCA.

How to exercise your rights

To exercise your rights, you can contact our Data Protection Officer by email ([email protected]) or by post (PCA - Data Protection Officer - 76, rue de la Pompe - 75116 Paris - FRANCE), specifying your last name, first name and contact details, and including a photocopy of your ID document.

How will you be kept informed of any changes made to this notification?

Changes may be made to this notification in order to increase protection of your personal data.

We will keep you informed of any major changes we make to this notification, via one of our standard communication channels, and we will invite you to acknowledge the changes on our website.