INFORMATION ON THE PROTECTION OF YOUR PERSONAL DATA

Shiftech constantly monitors compliance with regulations on the protection of personal data (hereinafter referred to as "personal data") and places it at the heart of its ethics, as described in its Personal Data Protection Policy.

Shiftech believes that the protection of personal data is essential to building a relationship of trust with its customers. As such, it intends to ensure the greatest possible transparency regarding the processing of personal data that it carries out on the personal data that its customers provide to it or that it collects through the various contacts that its customers may have with it.

the purpose of this information policy is to inform you in detail about the conditions under which Shiftech processes your personal data, as well as the rights and options you have to control your personal data and protect your privacy.

In this policy you will find information relating to :

1. WHO PROCESSES YOUR PERSONAL DATA?

Shiftech is an international franchise:
- Composed of different legal entities in France and abroad

- whose parent company is ST International 1 rue Guy Baillereau 37540 Saint cyr sur loire.

shiftech also relies on a network of franchisees to sell products and related services.

shiftech companies and its network of franchisees may collect and process personal data about you. Their responsibility for processing your personal data varies according to the franchisee company with which you share your personal data and according to their role in the various services or products provided. For the purposes of this document, "we", "us" or "Shiftech" refers to Shiftech SAS and its network of franchisees.

generally speaking, the following are jointly responsible for processing personal data within the meaning of the applicable regulations:

the parent company, ST International 1 rue Guy Baillereau 37540 Saint cyr sur loire and the members of its network whose list and contact details are available on the website.

in certain cases, ST International may also process your personal data as an independent data controller.

2. WHAT PERSONAL DATA DO WE PROCESS?

Personal data" refers to any information that enables you to be identified either directly (such as your name) or indirectly (for example, by means of a unique customer number).

in general, we undertake to collect only personal data that is relevant and appropriate to each of the purposes for which we process your personal data.

the personal data we collect depends on our interaction with you and may include information about:

Your identity and contact details (surname, first name, postal address, e-mail address, telephone number, etc.),

Data relating to your personal and/or professional situation (family situation, socio-professional category, etc.),

Your payment and transaction data, Data relating to our commercial relationship, in particular our interactions and contracts (order history, after-sales interventions, service contracts, competitions, interactions with our customer service, etc.),

Data identifying your vehicle (make, model, registration number, chassis number, etc.),

Data required to carry out loyalty-building, canvassing, research and surveys.

Data concerning your social networks (online accounts),

Data concerning the use of our websites and mobile applications, as well as our communications (number of visits, pages visited, messages opened, etc.).

we invite you to keep us regularly informed in writing of any changes concerning your personal data.

the products and services we offer are mainly aimed at people of legal age. We therefore do not carry out any specific processing on minors.

3. WHAT IS YOUR PERSONAL DATA USED FOR?

We provide you with an explanation of the context in which we collect your data, the purposes for which we process it and the length of time we keep it.

3.1. THE CONTEXT OF DATA COLLECTION

We collect your personal data in particular when:
- You visit one of our websites, which may use cookies or other tracers,
- You contact us by means of an online form, email, telephone, live chat, visit to a centre or any other means,
- You take part in a competition or event, or subscribe to one of our newsletters,
- You respond to one of our studies or satisfaction surveys,
- You create a user account to access our website from your computer or smartphone,
- You interact with us on social networks, in particular via the "Like", "Share" or "Twitter" buttons on Facebook, Instagram and Twitter on the Shiftech pages, which may result in the collection and exchange of personal data between the social networks and us.

3.2. PURPOSES OF PROCESSING PERSONAL DATA

• as part of our relationship, and depending on the context in which your personal data is collected, we may use your data to:
  A - Manage our initial interactions
  B - Manage our commercial relationship
  C - Manage the services provided
  D - Conduct research and analysis
  E - Manage our marketing operations

3.3. HOW LONG WE KEEP YOUR DATA

In accordance with regulations, we undertake to keep your personal data only for as long as is necessary to achieve the objective pursued, to meet your needs or to satisfy our legal obligations.

to determine this period, we take into account the following elements in particular:

The time required to process your request or complaint,

The length of time your user account has been open,

The need to keep a certain history of your interactions with us, for the proper management of our commercial relationship, this period varying in particular according to whether you have reprogrammed, received a service such as a repair, or simply interacted with us.

Our legal or regulatory obligations (this is particularly the case for our vehicles' technical data).

When we no longer need to use your personal data, it is deleted from our systems and records or made anonymous so that it can no longer be used to identify you. However, we may need to keep some of your personal data on file in order to be able to respond to any legal action, for the period of time prescribed by the applicable legislation.

4. WHO HAS ACCESS TO YOUR PERSONAL DATA?

Within Shiftech and its network members, we ensure that only those persons duly authorised to process your personal data by virtue of their functions and duties are permitted to do so.

We may share your personal data with other Shiftech companies.

in order to process all or part of your personal data, we use trusted third party service providers, acting as subcontractors under our instructions and on our behalf only, in particular for :
- Hosting, operating or maintaining our databases, websites and mobile applications,
- The provision of authentication services,
- Customer relationship management (call centres, provision of communication tools, etc.)
- The provision of services relating to our marketing, in particular the sending of commercial offers,
- The organisation of competitions and events,
- Carrying out studies and surveys.
For all these data sharing purposes, we take care to work only with trusted companies and to secure these relationships (contracts, audits, security guarantees and tests, etc.).

In certain cases, we may share some of your personal data with partners, who will use it for their own purposes. In such cases, these partners act as data controllers and their personal data processing policy applies to the shared data. We will ensure that we ask for your consent to such sharing where required by law, or at least allow you to object to such sharing.

we may also offer you the possibility of using your connection data to social networks. In this case, you share your profile information with us. The personal data shared depends on the configuration of the social network platform. Please note that these social networks apply their own privacy policies.

5. WHAT ARE YOUR RIGHTS?

You have a number of rights under the regulations on the protection of personal data:

a right to object to the processing of your personal data, subject to justifying reasons relating to your particular situation, and a right to request the limitation of the processing of your personal data, in certain cases provided for by the regulations.

a right to object to any commercial canvassing: you may at any time ask not to receive any further communications from us relating to our offers, news and events. This right can be exercised via the unsubscribe link included in each prospecting email. You may also object to being profiled.

a right to withdraw your consent at any time, for the purposes for which we have collected your consent.

a right to information: you have the right to obtain clear, transparent and comprehensible information on how we use your personal data and on your rights. This policy is an example.

a right of access to your personal data: you have the right to obtain information about the processing of your personal data (in particular the data that is used, for what purposes, etc.) and a copy of it.

a right of rectification: you have the right to have your data rectified if it is inaccurate or incomplete, despite our efforts to keep it up to date. This will enable us to comply with our obligation to keep your data up to date.

a right to the portability of your data, i.e., under certain conditions, the right to receive the personal data that you have provided to us, in a structured, commonly used computer format, and to have it transmitted to a third party if this is technically possible.

a right to erasure (or the right to be forgotten): you have the right to have your data erased or deleted. This right may be limited in the light of our contractual obligations (current contract) or legal obligations (prevention of legal action in particular).

a right to define either general or specific directives, with regard to certain processing operations, for the conservation, deletion and communication of your personal data in the event of your death. You can change or delete these instructions at any time. You can inform us of these special instructions by writing to the address below.

Finally, you have the right to lodge a complaint with the Commission Nationale Informatique et Libertés (CNIL) regarding the processing of your personal data. We encourage you to contact us before making any complaint, so that we can try to resolve your problem together.

to exercise any of your rights, you can send us your request at any time by email info-franchise@shiftech.fr by post to ST International Serivce à la protection des données, 1 rue Guy Baillereau 37540 Saint cyr sur loire.

You have the right to register free of charge on the Bloctel opposition list, managed by the company Opposetel, in order not to be subject to commercial solicitations by telephone. However, registration on this list does not prevent us from contacting you for canvassing purposes during the term of your contract with us, unless you have specifically exercised your right to opt out of receiving commercial offers from us.

6. HOW DO WE SECURE YOUR PERSONAL DATA?

Your personal data is stored on secure servers. We put in place, and require of our subcontractors and partners, appropriate data security and protection measures in line with the latest technologies.

When the processing of personal data involves its transfer, we ensure that this transfer takes place under appropriate conditions guaranteeing a sufficient level of protection, security and confidentiality.

When you create a digital account, you must enter a password that complies with our security standards and forms part of our confidentiality policy. It is your responsibility to keep this password.

As far as possible, your data is processed in the European Economic Area (EEA). However, as some of our service providers or their subcontractors are located in countries outside the EEA, your personal data is processed in those countries. Some of these countries may have regulations on personal data that differ from those of the European Union. In such cases, we take particular care to ensure that this transfer is carried out in compliance with the applicable regulations and put in place guarantees ensuring a level of protection of your private lifee and your fundamental rights equivalent to that offered by the European Union (in particular by using the European Commission's Standard Contractual Clauses).

7. MODIFICATION OF INFORMATION

We may occasionally amend this information. When this is necessary or required, we will inform you and/or seek your agreement. We therefore invite you to consult it each time you visit our site so that you are aware of the latest version.

version V1.