Pursuant to the amended law n°78-17 of January 6, 1978 relating to data processing, data files and liberties, the European regulation 2016/679 relating to the protection of individuals with regard to the processing of personal data and the free movement of such data, the Company informs any person over 15 years old accessing the services offered on the Website (hereinafter, the "User") of its commitment to respect the confidentiality, integrity and security of the data that the User will be led to communicate to it through the website www.specifyapp.com (hereinafter, the "Website"), or the use of the chatbot provided by the company Intercom (hereinafter, the "Chatbot").

Any personal data identifying the User directly (including his name, first name, phone numbers, email addresses, postal addresses) or indirectly are considered confidential data and are processed as such, subject to changes in the legal framework on the qualification of personal data (hereinafter, the "Personal Data").

1. Identification of the data controller

The data controller who collects and manages the data of the Users on the Website and the Chatbot is SPECIFY, a simplified joint stock company with a capital of 13,423.07 euros registered with the Trade and Companies Registry under the number 838 002 996 whose registered office is located at 15, rue des Halles 75001 PARIS, whose legal representative is Mr. Valentin CHRETIEN.

2. Personal data and cookies that may be collected

When browsing the Website and using the Chatbot or the various services offered by the Company, the User consents to the Company's collection of the following categories of data:

• Personal identification data: e-mail address;

• Connection data: IP address, information relating to the configuration (type of machine, browser, etc.) and browsing (date, time, pages viewed, occurrence of errors, etc.) of the User.

• Chatbot usage data: chatbot usage ID, date of creation of the conversation, date of last connection of the User; conversational data relating to the conversation between the Chatbot and the User and search criteria.

By linking the Chatbot to Google Tag Manager, Specify collects the connection information of the Users to be able to adapt to the language used by his/her browser. This information does not make him/her identifiable.

During exchanges via the Chatbot, the User is sometimes invited, with his/her consent, to leave his/her contact information (Name, email and phone number).

The User agrees to provide current and valid personal identification Data as part of the information required on the Website or when using the Chatbot, and warrants that he/she will not make any false statements or provide any inaccurate information.

3. Method of collection of Personal Data

The User consents to the collection of his/her Personal Data by the Company when he/she fills in the following documents:

• Request form for access to the Specify platform,

• Use of the Chatbot.

  
  

4. Legal basis for the collection and processing of Personal Data

Users' Personal Data are collected on the basis of the following legal grounds:

• The specific, free and informed consent of the User (in particular for the request for access to the User's Specify platform, the use of the Chatbot and the subscription to the newsletter and any other content);

• The execution of a legal obligation incumbent on the Company;

• The execution of a contract concluded between the Company and the User (in particular for the execution of the general terms and conditions of use/sale);

• The legitimate interest of the Company (in particular to ensure the security of transactions).

  
  

5. Purpose of the processing of Personal Data

Mandatory Personal Data are the data strictly necessary for the processing or requests made by the User. In the absence of communication of said data, the User is informed that certain services offered by the Company cannot be provided. The mandatory nature of the information requested is notified to the User at the time of collection.

The optional Personal Data collected by the Company are intended to better know the User and improve the User's browsing experience on the Website and his/her use of the Chatbot.

Personal Data are collected and processed for the following purposes:

• Access to the Specify platform;

• Use of the Chatbot;

• Processing requests;

• Improvement of the browsing on the Website;

• Subscription to the Company's newsletter, and receipt of any other content;

• Contact and support;

• Management of the commercial relationship;

• Commercial prospecting;

• Management of requests to exercise the rights of the persons concerned as listed in Article 9 below.

Users are informed that, subject to their prior, specific and positive consent, the Personal Data transmitted may be transferred to the Company's business partners and/or companies belonging to the same group as the Company, so that the latter can inform Users about their offers and services.

6. Storage period of Personal Data

Personal Data, including that collected by the Chatbot, are deleted or archived after three (3) years from the User's last use of the Website.

Such Personal Data may also be stored for a period of ten (10) years thereafter in the archive database, under restricted access, in order to (i) comply with the Company's legal and regulatory obligations, and/or (ii) to enable it to assert a legal claim, before being permanently deleted.

7. Recipient of Personal Data

The User's Personal Data are intended for the persons duly authorized to process them within the Company, in particular, and depending on the nature of the processing and the type of data, the persons in charge of the sales department, the customer service department, the marketing department, the administrative department, the logistics department and the IT department.

The Company relies on subcontractors in the conduct of its activities and the providing of its service.

The subcontractors:

• process the User's Personal Data on its behalf and on its instructions;

• present sufficient guarantees as to the implementation of appropriate technical and organizational measures to ensure the security and confidentiality of the User's data.

In cases where the Company uses subcontractors located in countries offering levels of protection that are not equivalent to the level of protection of personal data in the European Union, the Company undertakes to ensure that such transfer is governed by the signature of standard contractual clauses established by the European Commission or by the implementation of binding corporate rules ("BCR").

8. Measures implemented by the Company to ensure the security and confidentiality of Personal Data

The Company undertakes the processing of Personal Data in a way that is:

• lawful;

• fair;

• transparent;

• proportionate;

• relevant;

• within the strict framework of the purposes pursued and announced;

• for the duration necessary for the set-up processing of Personal Data;

• in a secure manner;

The Company implements and updates the appropriate technical and organizational measures to ensure the security and confidentiality of Personal Data, preventing them from being altered, damaged or communicated to unauthorized third parties.

9. Users' Rights to Personal Data

It is possible for the User, by simple written request, to access the Personal Data concerning him/her, to request their modification or correction, or to demand that they no longer appear in the Company's database.

In virtue of his/her Access Right, the User is authorized, in accordance with article 15 of the GDPR, to request that the Company (i) provides him/her the Personal Data concerning him/her in an accessible format, (ii) confirms that his/her Personal Data are or are not being processed, (iii) communicates him/her the purposes of the processing, the categories of Personal Data processed and the recipients to whom his/her Personal Data are communicated and (iv) informs him/her of the duration of the storage of his/her Personal Data or the criteria used to determine this duration.

In accordance with article 16 of the GDPR, the right of rectification confers on the User the right to require the Company to rectify, complete or update his/her Personal Data when they are inaccurate, incomplete, equivocal or out of date.

Under the conditions set forth in Article 17 of the GDPR, the User is entitled to the deletion of his/her Personal Data, allowing him/her to ask the Company to delete his/her Personal Data as soon as possible, in particular when they are no longer necessary with regard to the purposes for which they were collected.

The User also has the right to limit the processing of his/her Personal Data in the cases listed in article 18 of the GDPR. He/She may thus request that his/her personal data be kept solely for the purposes of:

• verifying the accuracy of the Personal Data that he/she contests;

• ascertaining, exercising or defending his/her rights in court, even though the Company no longer has any use for it;

• verifying whether the legitimate reasons pursued by the Company prevail over his or her own in the event that he or she would oppose data processing conducted in virtue of the legitimate interest of the Company;

• satisfy his/her request for limitation of the use of his/her data - rather than deletion - in the event that the processing of his/her data is unlawful.

In the circumstances provided for in article 20 of the GDPR, the User has a right to the portability of his/her Personal Data, allowing him/her to recover from the Company the Personal Data he/she has provided, in a structured, commonly used and machine-readable format, for the purpose of forwarding them to another data controller.

In accordance with article 21 of the GDPR, the User has the right to oppose, at any time, the processing of his Personal Data for commercial prospecting purposes.

Finally, Users benefit from the right to decide of the fate of their data after their death (Article 40-1 of Law No. 78-17 of January 6, 1978 relating to data processing, data files and liberties).

To exercise his or her rights of access, rectification, deletion, limitation, portability and opposition mentioned above, the User shall send his or her request by e-mail to the following address: hello@specifyapp.com

The Company will provide the person exercising any of these rights with information on the measures taken, as soon as possible and in any event within one (1) month after receipt of the request. This period may be extended by two (2) months, depending on the complexity and number of requests.

If the Company does not comply with the request, it will inform the person, as soon as possible, and in any event within one (1) month after receipt of the request, of the reasons for its inaction and of the possibility of lodging a complaint with a supervisory authority and of lodging a judicial appeal.

The exercise of these rights is free of charge. However, in the event of a clearly unfounded or excessive request, the Company reserves the right (i) to require the payment of a fee taking into account administrative costs, or (ii) to refuse to comply with such requests.

10. Recourse in case of Personal Data breach

In the event of a Personal Data breach that may create a risk to its rights and freedoms, the Company shall notify the National Commission for Data Protection and Liberties (Commission Nationale de l'Informatique et des Libertés - CNIL-France) of the violation as soon as possible, and, if possible, seventy-two (72) hours at the latest after becoming aware of it. The Company will also inform the User as soon as possible in accordance with the provisions of Article 34 of the GDPR.

Without prejudice to any other administrative or jurisdictional recourse, the User who considers that the processing of his Personal Data constitutes a violation of the provisions of the legislation in force may file a complaint with a competent supervisory authority such as the National Commission for Data Protection and Liberties (Commission Nationale de l'Informatique et des Libertés - CNIL-France).

11. Information request

For any questions regarding the processing of their personal data and the exercise of their rights, Users may contact the dedicated service at the following address: hello@specifyapp.com.

12. Cookies

The connection data may be stored, through the browser software, in short text files (cookies), subject to the Users' choices, in a dedicated space on the Company's disk. The Company treats this technical data in a completely anonymous manner, not linking it to any information that could identify the User and does not transmit it to third parties.

Each cookie is assigned an anonymous identifier. The cookie file allows its issuer to identify the device in which it is stored during the period of validity or registration of the cookie concerned.

Purpose of cookies

Cookies, depending on their category, are used for the following purposes:

(i) Technical cookies

A first category of cookies are those that are strictly necessary for the use of the Website or the Application. They are indispensable for browsing the Website while taking advantage of all its functionalities (support of the Internet user's operating system, display, etc.).

They enable certain functionalities and the display of the Website to be adapted to the browser and equipment of the Users. They are essentially technical cookies that do not identify the User as an individual.

(ii) Traffic measurement cookies

Another category of cookies are those that are necessary to analyze performance. These cookies make it possible to generate statistics regarding traffic and use of the various services of the Website. Their purpose is to enable the Company to improve User Experience. These cookies do not identify the User as an individual.

Some traffic measurement cookies allow the Company to count visits on certain pages dedicated to its partners and to analyze these visits, namely:

_ga

• Source: Google Analytics

• Purpose: Google web analytics tool. The cookies used make it possible to collect information and generate statistical reports on the use of the Website in an anonymous manner.

• Duration of Data retention: 2 years

ajs_user_id

• Source: Platform

• Purpose: Targeted advertising

• Duration of Data retention: 1 year

ajs_anonymous_id

• Source: Platform

• Purpose: Traffic analysis tool

• Duration of Data retention: 1 year

intercom_id

• Source: Platform

• Purpose: Allows the Website to recognize the visitor in order to optimize the functionality of the dialog box.

• Duration of Data retention: 9 months

intercom_session

• Source: Platform

• Purpose: Allows the Website to recognize the visitor in order to optimize the functionality of the dialog box.

• Duration of Data retention: 1 week

amplitude_id

• Source: Platform

• Purpose: Allows to view the path taken by the Users.

• Duration of Data retention: 10 years

nuxt_color_mode

• Source: Platform

• Purpose: Allows to save the theme preferences of the user's app.

• Duration of Data retention: 1 year

privacy-policy-accepted

• Source: Platform

• Purpose: Allows to register the acceptance of the user's privacy policy.

• Duration of Data retention: 1 year

authenticated

• Source: Platform

• Purpose: Allows to keep the session open after a first connection.

• Duration of Data retention: 1 year

These first two categories of cookies are only used for the purposes of establishing usage statistics, preventing errors, preventing infringement and counterfeiting of the Website or improving the conditions of access to or use of the Website.

(iii) Functional cookies

A third category of cookies concerns Website features. They allow to simplify the User's Browsing. Indeed, they allow to record some of the User's choices (language, User name, country, information relating to a previously entered form, ...).

(iv) Cookies from social networks

Another category of cookies comes from social networks: these cookies, issued by third parties, allow the user to share the content of the Website or the Application with other people. This is the case, for example, of the "Share" or "Like" application buttons from sites such as "Facebook", "Twitter", "Medium", "Slack" or "Spectrum".

The Company draws the Users' attention to the fact that such items make their identification possible. Indeed, the social network that provides this type of application component is likely to identify the User thanks to this button, even if the User has not clicked on it when browsing the Website or the Application. Indeed, certain cookies allow the concerned social network to track the User's Browsing on the Website or the Application, as long as the User's account for this social network is activated on his/her device during his/her Browsing on the Website or the Application.

The Company has no control over the process used by the social networks to collect information relating to the User's Browsing on the Website or the Application and associated with the Personal Data they have at their disposal. The User is invited to consult the privacy policies of these social networks in order to be aware of the purposes of use, including advertising, of the Browsing Information they may collect through these application buttons.

These privacy policies must in particular allow the User to exercise his/her choices with these social networks, in particular by setting up his/her user accounts for each of these networks.

(v) Targeted advertising cookies

Finally, a last category of cookies concerns advertising. These are targeted advertising cookies.

These cookies make it possible to offer the User advertising content that is targeted with regard to his or her centers of interest. These cookies are deposited by the Company's partners.

The Company does not manage its partners' cookies and has no control over them.

The User's choices regarding Cookies

The User may, at any time, set his/her browser to modify his/her choices regarding cookies. The setting of the web browser is an efficient and free means of determining, beforehand, the management of such cookies.

Consent on cookies

The storage of a Cookie on a Device is essentially subject to the will of the User of said Device, which the User may express and modify at any time and free of charge through the choices offered by his or her browsing software. If the User has accepted Cookies on his or her Device in his or her browser, the Cookies incorporated in the pages and content that he or she has consulted may be stored temporarily in a dedicated area of the Device in question. They will only be readable there, and only by their emitter.

Refusal of cookies

If the User refuses to accept Cookies on his or her Device, or if the User deletes those saved there, he or she will no longer be able to benefit from a certain number of features that are nevertheless necessary to navigate in certain areas of the Website or the Application. This would also be the case if the Company or its service providers could not recognize, for technical compatibility purposes, the type of browser used on the User's Device, its language and display settings, or the country from which the Device in question appears to be connected to the Internet.

Where applicable, the Company declines all responsibility for the consequences related to the degraded operation of its services resulting from the impossibility for it to record or consult the Cookies necessary for their operation and that the User will have refused or deleted.

The period of validity of the consent to the deposit of Cookies is thirteen (13) months. At the end of this period, the User's consent is collected again.

How to exercise the choices according to the Browser used by the User?

The settings for cookie management depend on the User's browser.

As an indication, the User may refuse Cookies by configuring his browser as follows:

For Internet Explorer:

• Go to Tools > Internet Options.

• Click on the Privacy tab.

• and under Settings, select Advanced, select "Ignore automatic cookie management".

• For more information: http://windows.microsoft.com/fr-FR/windows7/Block-enable-or-allow-cookies

For Firefox:

• At the top of the Firefox window, click on the Firefox button (Tools menu in Windows XP) and select Options.

• Select the Privacy tab.

• Set Rules: to "use custom settings for browsing history".

• Unselect Accept Cookies.

• For more information: http://support.mozilla.org/fr/kb/activer-desactiver-cookies?redirectlocale=fr&redirectslug=Activer+et+d%C3%A9sactiver+les+cookies

For Chrome:

• Click on the wrench icon located in the browser toolbar.

• Select Settings.

• Click Show Advanced Settings.

• In the "Privacy" section, click the Content Settings button.

• In the "Cookies" section, you can block cookies and data from third party sites

• For more information: http://support.google.com/chrome/bin/answer.py?hl=fr&hlrm=en&answer=95647

For Safari:

• Go to Settings > Preferences

• Click on the Privacy tab

• In the box "Block Cookies", check the box "always".

• For more information: http://support.apple.com/kb/HT1677?viewlocale=fr_FR

For Opera:

• Go to Settings > Preferences

• Click on the advanced tab

• In the box "cookies", check the box "Never accept cookies"

• For more information: http://help.opera.com/Windows/10.20/fr/cookies.html

  
  

13. Changes to the Privacy Policy

The Company reserves the right to modify this Privacy Policy in order to comply with obligations under privacy legislation or to adapt it to its practices.

14. Contact

If you have any questions about this Privacy Policy or if you have any requests relating to your personal data, you may contact us by sending an email to: hello@specifyapp.com.