PERSONAL DATA PROTECTION POLICY

The General Data Protection Regulation (GDPR) is a European regulation which harmonizes the legislation of each of the countries of the European Union regarding the protection of personal data which came into effecton May 25, 2018.

The Atalian Servest Group is fully committed to the bringing into compliance of the processing of personal data with the GDPR requirements.

The Atalian Servest Group is determined to build a strong and sustainable relationshipbased on trust and mutual interests with its customers, suppliers and partners.

This personal data protection policy (hereafter the”Policy“) describes the commitmentsimplemented by the companies of the Atalian Servest Group, acting as processing managers, to guarantee the observance of GDPR.

According to the processing implemented, the following parties are responsible for the processing:

• The LA FINANCIERE ATALIAN Company, partnership limited by shareswith capital of 114,624,776 euros registered with the Trade and Corporate Registry of Parisunder number 490 900 396 with its main office at 110 rue de l’Ourcq 75019 PARIS, represented by theFinagé Company, simplified joint stock company with capital of 1,000 euros, registered with the Trade and Corporate Registry of Parisunder number 837 758 515, with its main office at 110 rue de l’Ourcq 75019 PARIS, and represented by Mr.Matthieu de Baynast de Septfontainesas Chairman ofthe Finagé Company, itself theDirectorof the Company.

• or a subsidiary located within theEuropean Union.

In general, this Policy mentions the Atalian Servest Group which designates, depending on the case, the parent companyand/or the subsidiaries as the processing managers.

Through this Policy, the Atalian Servest Group also wishes to clearly inform the people involved of the way in which their personal data is collected and used.

1. The data processed and the people involved

2. Purposes and legal bases of the data processing

3. The recipients of the data

4. Data conservation period

5. Exercising of the rights of the person involved

6. Cookies and other tracers

7. Contacts

1.       The data processed and the people involved

The services of the Atalian Servest Group are intended for professionals andare not essentially intended for the processing of the personal data of its customers or on behalf of its customers.

Within the framework of its activities, the Atalian Servest Group thus simply processes the professional contact information of its contacts which include customers, suppliers, partners, and possibly prospects.

Within the framework of its activity, the Atalian Servest Group takes care to only collect data that is necessary for the purpose for which it is being processed.

2.       Purposes and legal bases of the data processing

The processing carried out by the Atalian Servest Group is for an explicitlegitimate and determined purpose, which is based on the fulfillment of a contract, the respecting of a legal or regulatory obligation, orlegitimate interestsfor commercial prospection.

Referencing andevaluation of suppliers

The Atalian Servest Group processes in particular the contact information of the contact people of its suppliers within the framework of the contracts which bind them, and also at their term, for the purposes of referencing and evaluation of their services. The Atalian Servest Group also has a legitimate interest in referencing potential suppliers identified by its teams.

Management of customers and prospects

The Atalian Servest Group processes the contact information of the contact persons of its customers as part of the fulfillment of the contracts concluded with its customers within the framework of the management of the commercial relationship and the providing of its services, quality control and reporting, the management of invoicing, accounting, and collections, if applicable.

The Atalian Servest Group also has a legitimate interest in processing thecontact information of its customers and prospects in order to send them commercial information and, if applicable, in order to invite them to take part in communications operations and events. This processing involves, depending on the cases, contact data collected directly from the people involved or transmitted by third parties.

Contacts via our website

The information and data collected by the Atalian Servest Group via on-line contact forms on its websites is processed by the company of the Atalian Servest Group that receives the message to orient the request to the department involved and to provide a response to the person who contacted the Atalian Servest Group. The Atalian Servest Group has a legitimate interest in processing this information.

Unsolicited job applications

The information and data collected by the Atalian Servest Group through unsolicited job application forms on its websites is processed by the company of the Atalian Servest Group to orient the request to the department involved and to provide a response to the person who sent their application to the Atalian Servest Group. The Atalian Servest Group has a legitimate interest in processing this information.

When the processing is done for purposes other than those identified in this Policy, the people involved will be distinctly informed of this.

3.       The recipients of the data

The Atalian Servest Group handles the data that it collects with the greatest care. Only data that is strictly necessary will be given to third parties for processing.

The Atalian Servest Group may thus be obliged to provide certain data to public authorities when they request it, and within the framework of its legal and regulatory obligations. In such cases, only information that is precisely requested will be communicated.

The Atalian Servest Group may also communicate information to itstechnical service providers, partners, insurers,auditorsor legal entities of its group whose intervention is strictly necessary to carry out one of the abovementioned purposes.

In its relations with its sub-contractors in the meaning of the GDPR, the Atalian Servest Group contractually guarantees that these sub-contractors will process the data in a way that ensures its integrity, confidentiality and security.

Data will not be transferred to third parties for purposes other than those described above unless there is an express authorization from the person involved, when this is required.

4.       Data conservation period

The personal data collected and processed by the

Atalian Servest Group is kept for a period of time that is strictly necessary for carrying out of the purpose for which it was collected.

All of the data collected by the Atalian Servest Group is deleted after carrying out of its purpose or kept in anonymized form.

Some data is archived to respond to complaints and litigation in progress and to respond to the legal and/or regulatory obligations and/or to respond to requests from government authorities.

The duration of the archiving is limited to the duration of thestatute of limits of the litigation or the legal / regulatory periods during which the Atalian Servest Group could be held responsible for complaints, government requests or future litigation.

5.       Exercising of the rights of the people involved

All people involved have rights of opposition, access, rectification, deletion, limitation and portability over their personal data within the conditions and limits provided for by the GDPR.

All people can assert these rights by contacting our Data Protection Representative whose contact information appears hereafter or, according to the cases, the reference person identified with the processing manager if it is for a subsidiary, proving their identity by showing an identity document.

All people can also lodge appeals with the control authority in the conditions provided for in the GDPR.

6.       Cookies and other tracers

A cookie is a piece of information stored on the computer or hardware of an internet user by the server of the site that he visits. Within a computer, cookies are managed by the web browser.

Browsing on the Atalian Servest Group website may lead to the installation of cookies on the User’s hardware.

The purpose of these cookies are to:

–              Measure the audience of the website;

–              Improve the functioning of the website;

The Atalian Servest Group uses a service to analyze the visits to its website.

Atalian Servest Group can read the information stored in such cookies during future visits by the user.

The data concerning the cookies of the user is kept for a period of 13 months as of its collection.

Some cookies are installed by third parties and allow for the collection of information on the Atalian Servest Group website.

Internet users can block the recording of cookies by configuring their web browsers. If these settings linked to the use of cookies are configured, certain functionalities of the site may no longer work properly, and the Atalian Servest Group cannot be held liable for this.

Users can also configure the cookies on the website by clicking on Privacy Preferences.

7.       Contacts

For processing involving the LA FINANCIERE ATALIAN Company, you can contact our Data Protection Representative by E-mail at: dpo@atalianworld.com and by post at the address 111-113, quai Jules Guesde – 94400 VITRY SUR SEINE – FRANCE

For processing involving another company of the group, you can contact the reference person identified on the company’s web site.