Privacy and Personal Data Management Policy

Version 1.0 29-11-2018

Applewood provides its professional customers and their beneficiary users with services accessible through various secure websites. The different services offered allow for the management and automation of the incentive and challenge implementation process by professional customers, as well as the provision of rewards to their beneficiaries.

To deliver its products and services, Applewood needs to collect and process personal data. Applewood places great importance on the use of personal data and the respect for privacy. The company is committed to doing everything possible to ensure the confidentiality and security of information.

The Privacy Policy explains how Applewood collects, stores, and uses the Personal Data of the Customers and Users of the products and services it provides. The Privacy Policy allows concerned individuals to learn more about the origin and use of the information collected and processed by Applewood and informs them of their rights.

By accessing the Services offered, the User acknowledges having read and accepted the terms of this Policy for Privacy and Management of Personal Data as collected and processed by Applewood.

The User will be notified of any significant changes to this Policy. In the event of modifications, these will only apply to Customers and Users of the products and services after such changes. At any time, they are free to discontinue using the Solution and its Services.

GLOSSARY

For complete understanding, Applewood provides users with a glossary. The terms used in this document have the following meanings:

“Solution” refers to a website through which Applewood offers its products and services to its professional customers and their designated beneficiaries.

“Personal Data” or “Data” refers to any information relating to an identified or identifiable natural person, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

“Partners” refers to the various service providers and suppliers of Applewood for the delivery of services and provision of products via the Solution.

“Personal Data Regulation” refers collectively to the General Data Protection Regulation No. 2016/679 (hereinafter GDPR), French Law No. 79-17 of January 6, 1978, concerning information technology, files, and freedoms as amended, the French Digital Republic Act No. 2016-1321 of October 7, 2016, and any new laws or decrees issued for their application.

“Services” refers to the services and products provided by Applewood, including associated support services.

“Site” refers to the websites published by Applewood through which the User accesses the Services provided.

“User” refers to any internet user (professional customers, their representatives as natural persons, and their beneficiary employees) who has entered personal data in the account creation and registration form for the Solution and, after receiving a confirmation email, has definitively confirmed their account.

DATA CONTROLLER – DATA PROTECTION OFFICER

The Data Controller is Applewood, a company with a share capital of €200,000, registered with the Évreux Trade and Companies Register under the number 390 049 054, with its headquarters located at 34 Grande Rue, 27430 Saint-Pierre-du-Vauvray, France.

The contact details of the Data Protection Officer appointed by Applewood are as follows: Laurent Lanon

Email: dpo@applewood.fr

Postal address: 677 Allée de la Fosse Moret – ZAC ECOPARC 2, 27400 HEUDEBOUVILLE, France.

LEGAL BASIS FOR PROCESSING:

The data collected by Applewood is used for the following purposes:

To perform a contract with the user or in response to a request prior to the conclusion of a contract.
To provide services to users.
To comply with legal obligations imposed on the company.
To carry out a task in the public interest.
To protect the security of its systems, detect, and prevent fraud.

In any case, Applewood ensures that it does not infringe upon the interests or fundamental rights and freedoms of users by allowing them to oppose, at any time, all or part of the processing described in this Privacy and Personal Data Management Policy.

WHAT PERSONAL DATA IS COLLECTED?

Various types of information are collected about and from the user.

The data collected includes:

Data voluntarily provided by the Customer during order placement (signed quote/contract) or account creation in the case of a free trial of services provided by Applewood: company/customer name, registration number, name and first name of the company/customer representative, administrator designated by the legal representative or natural person designated as the beneficiary by the customer, phone number, email address.
Data voluntarily provided by the User when creating their account through a request for access to services provided by Applewood. For example: title, name, first name, address, phone number, email address, company name, etc.
Technical data: IP address, the type of browser you use (Internet Explorer, Firefox, etc.), the operating system you use (Microsoft Windows, Linux, Apple Mac OS, etc.), the domain name of your Internet service provider (Orange, SFR, etc.);
Behavioral data: This data relates to the behavioral analysis of the actions and choices you make while browsing the site. This includes data such as the searches you perform on the site, data resulting from the analysis of your profile, data from your use of our websites, such as specific web pages you visit and the duration of your visits.

MINORS

The Solution is accessible only to adult natural persons. Applewood does not knowingly collect, and will not knowingly collect, information about a minor without supervision. If the user is under 18 years old, they are not authorized to access or use the services provided by Applewood.

USE OF PERSONAL DATA

The Personal Data collected and processed is intended for the provision, use, improvement, and maintenance of a secure environment for the services.

The processing carried out by Applewood is based on the fulfillment of the contractual relationship, the legitimate interest of Applewood, or the collection of user consent, if applicable.

The uses are as follows:

Initiating a contractual relationship between Applewood and the customer who wishes to benefit from the products and services offered by Applewood.
Access to and use of the services provided by Applewood by the user for a free trial or within the framework of a contract.
Management and optimization of service operations.
Organization of the terms of use of the services.
Verification and identification of data provided by the user.
Communication and sharing with other users of the solutions.
Implementation of support services.
Operations related to prospecting, information, and statistics.
Management of unpaid invoices and disputes.
Implementation of security measures, prevention of IT fraud, and management of security incidents.
Personalization of communication and commercial solicitation directed towards users, particularly by email.

RECIPIENTS

The personal data collected by Applewood may be shared with its partners, suppliers, and subcontractors solely for the purposes of managing and operating the services offered, including websites, solutions, support services, maintenance, hosting, and administrative, executive, and commercial management. Data may also be shared with public bodies and law enforcement authorities upon request, according to Applewood’s instructions and in compliance with its privacy and personal data management policy. The involvement of each external service provider is strictly limited to the specific task they perform on behalf of Applewood.

Applewood ensures that its subcontractors provide sufficient guarantees to implement the necessary security and confidentiality measures for the Data they access in the course of their work, as defined by the applicable regulations.

The recipients of your personal data include:

The technical and administrative services of Applewood.
The technical service providers of Applewood, responsible for hosting the websites and solutions published by Applewood.
External service providers (e.g., accountants) and subcontractors.
Public authorities, if required by law, to respond to claims made against Applewood and comply with administrative and judicial procedures, or to fulfill a legal obligation.

No personal data collected and processed by Applewood is transmitted to third parties for commercial purposes. If Applewood ever intends to do so, the user will be explicitly informed, and their consent will be obtained beforehand.

HOSTING OF PERSONAL DATA

All processing of your personal data is carried out within the territory of the European Union (EU). No data is transferred outside the EU. Applewood ensures that it makes its best efforts to implement necessary precautions and security measures to ensure data security.

In any event, if Applewood needs to transfer data outside the European Union, it commits to guaranteeing the protection of personal data in accordance with the strictest regulations, particularly through the signing of contractual clauses based on the European Commission’s model or any other mechanism compliant with the applicable regulations.

SECURITY

Applewood is committed to implementing the necessary technical and organizational measures to ensure the security of personal data against theft, loss, unauthorized disclosure, or modification, depending on the sensitivity of the data.

Applewood also commits to considering the protection of your personal data and privacy from the design phase of new products or services offered to you.

However, Applewood draws the users’ attention to the fact that the internet is not a completely secure environment. Applewood cannot be held liable for any interruption in access to the website due to force majeure or circumstances beyond its control.

MALICIOUS USE AND USER ACCOUNT PASSWORD MANAGEMENT

The user of the Solution must manage their account password and not share it with anyone.

Applewood recommends that Users take the following security measures to enhance online safety:

Maintain password confidentiality.
When creating a password, use 8 characters, preferably mixing letters and numbers. Avoid using dictionary words, your name, email address, or other easily obtainable personal data. Applewood also recommends frequently changing your password. To do this, go to the “My Account” section and click on “Password.”
Avoid using the same password across multiple online accounts.

The password and login links to the Solution are strictly for the User’s use and are confidential. Applewood will never ask the User for their login credentials or password. Users should never share their account information with third parties.

Applewood’s infrastructures are protected against malware, viruses, and other threats. Applewood makes every effort to provide users with a safe and secure environment. However, it is the user’s responsibility to ensure the security of their device (PC, mobile device, tablet, etc.) and their network, which remain entirely under their control.

In the event of account impersonation or suspicious activity, users are advised to contact Applewood without delay at: sécurité@applewood.fr.

DATA RETENTION

Applewood retains personal data only for the duration strictly necessary to provide the Services or for other essential purposes, such as fulfilling legal obligations.

If a request for deletion or the exercise of rights to request data erasure is made, the User is informed that Personal Data may be retained in Applewood’s archives for the period necessary to meet legal, accounting, financial, and tax obligations, to resolve disputes, and to prevent potential illegal activities.

COOKIES

A “cookie” is a small text file that can be stored, subject to your choices, in a dedicated space on your device’s hard drive during your use of the Solution. A cookie file allows its issuer to identify the device in which it is stored during the validity or storage period of the cookie and must therefore be considered as Personal Data.

When using the Solution, information related to the device used (such as type, operating system, internet service provider, browser, IP address, language preferences, geolocation data) may be stored in cookies installed on your device, subject to the choices you make regarding cookies, which you can modify at any time.

The storage of a Cookie on a device is primarily subject to the user’s consent, which can be expressed and modified at any time and free of charge through the options provided by the web browser.

Applewood warns the User that refusing to store cookies or deleting stored cookies may prevent or degrade access to certain features of the Solution. In such cases, Applewood disclaims any liability.

MANAGEMENT OF USER RIGHTS

Under the conditions specified by the Data Protection Regulation, individuals have the right to access, rectify, update, inquire, limit, transfer, and erase their data.

According to the data protection regulations, the User has the following rights:

Right to object to the processing of their data for legitimate reasons.
Right of access and communication, the right to rectify, update, erase, and delete data concerning them, subject to legitimate reasons.
Right to data portability: Individuals are informed that they can request a copy of their personal data, subject to reimbursement for the costs of reproduction and delivery.
Right to restrict processing of their data.

However, Applewood may refuse requests that are manifestly abusive, particularly due to their number, repetitive nature, or systematic nature.

To exercise your rights, simply send a postal letter to the following address, indicating your full name, email address, postal address, and company name, and include a copy of a valid identity document:

By email: dpo@applewood.fr
By postal mail: Applewood, Attn: DPO, 34 Grande rue, 27430 Saint-Pierre-du-Vauvray, France.

You will receive a reply within one (1) month of the date your request is received.

The User has the right to file a complaint for data protection violations with the supervisory authority.

Questions and requests for information regarding this policy should be sent to: dpo@applewood.fr.