Privacy Policy

When you use the website https://segmos.com (the "Site") and the Segmos platform (the "Platform"), and in the context of managing our contractual relationships with our clients, we may collect personal data relating to you.

This privacy policy is intended to inform you of the manner in which we process such data in compliance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), as well as French law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties (together, the "Applicable Law").

• "Client" means the legal entity that has subscribed to the Platform and to which a tenant is allocated.
• "Tenant" means the logically isolated environment allocated to a Client within the Platform, in which that Client's data is stored and processed.
• "User" means a natural person authorised to access the Platform on behalf of a Client.
• "Data Subjects" means the natural persons whose personal data are processed by Segmos.
• "Processor" means the company, individual or entity engaged by Segmos in connection with the processing of personal data as described below.

The terms "Personal Data", "Controller", "Processor" and "Processing" shall have the meanings given to them in Article 4 of the GDPR.

Segmos acts in two distinct capacities depending on the processing activity concerned.

We store personal data strictly for the periods necessary for the purposes described in this Policy, in our contracts or in accordance with the law and the recommendations of the CNIL. These retention periods vary according to their purpose and are reviewed regularly.

• Identification of the User — To identify and authenticate the User and to apply the role-based permissions governing access to the Platform. Legal basis: Performance of the contract.
• Use of the Platform — To enable the User to use the Platform, access its features and benefit from the services. Legal basis: Performance of the contract.
• Chain of custody and transaction records — To record allocations, transfers and ledger entries, and to maintain an auditable and verifiable traceability record. Legal basis: Performance of the contract, and our legitimate interest in the integrity and auditability of the records.
• Provision of raw data — To obtain information on products, suppliers and the Client necessary to establish carbon footprints and low-carbon offerings. Legal basis: Performance of the contract.
• Security and monitoring of the Platform — To detect and respond to abuse, fraud, security incidents and availability issues, and to maintain audit logs. Legal basis: Our legitimate interest in ensuring the security and availability of the Platform.
• Improvement of the Site, the Platform and the services — To continuously improve Segmos' tools, including through statistical analysis. Legal basis: Our legitimate interest in improving the Platform.
• Interactions with Users and Clients — To monitor and develop the contractual relationship, including onboarding and support. Legal basis: Performance of the contract.
• Handling of enquiries — To receive and respond to enquiries submitted through the contact form of the Site. Legal basis: Our legitimate interest in responding to persons who contact us.
• Accounting, invoicing and management of legal obligations — To issue and retain invoices and accounting records, and to respond to legal and regulatory obligations. Legal basis: Compliance with a legal obligation.

It is specified that Segmos does not, in any way, sell or otherwise commercially exploit the Personal Data of Data Subjects.

No Processing described in this policy involves a decision based solely on automated processing which produces legal effects concerning the Data Subject or similarly significantly affects them.

The Personal Data of Data Subjects are processed by Segmos as follows (depending on the specific processing activity):

• Data collection: Processings no. 1 to 9.
• Secure storage of data on authorised servers operated by Segmos or its providers (including hosting service providers), within logically isolated Tenants: Processings no. 1 to 9.
• Consultation and use by authorised staff, under the principle of least privilege and scoped to the Tenant concerned: Processings no. 1 to 9.

The Personal Data of Data Subjects are processed for the purposes set out above and are intended exclusively for Segmos' internal management teams and, where applicable, its Processors.

Access by Segmos staff is granted on the basis of the principle of least privilege. Staff who require access for information, training or marketing purposes are granted access to the staging environment only, and receive no access to production or Client data. Staff working on a Client project are granted access to that Client's Tenant only; Tenants are logically isolated from one another, so access to one Client's environment never implies access to any other. Access requests are reviewed and approved by the Chief Technology Officer, and access rights are reviewed on a quarterly basis.

The categories of Processors (legal entities) to whom Segmos may disclose Personal Data include the following:

• Daily operations: Processors providing digital tools that support Segmos' day-to-day operations, such as cloud infrastructure and data hosting solutions, identity and collaboration services, client relationship management tools, and audience measurement and analytics services;
• Maintenance operations: Processors with access to Segmos' technology in order to perform maintenance or address technical issues with the Platform in case of emergency;
• Public authorities: Public bodies to comply with legal obligations, as well as legal officers and judicial auxiliaries responsible for debt recovery.

These Processors are required to maintain strict confidentiality, ensure the security of the data to which they have access, use such data solely for the purposes of performing the tasks assigned to them, and comply with Applicable Law. Segmos assesses its critical Processors on an annual basis, including through the review of their independent security assessment reports.

A detailed list of the Processors engaged by Segmos is made available to Clients under their contractual documentation.

The Personal Data of Data Subjects are processed by Segmos from the moment of their direct or indirect collection. Such Personal Data are used throughout the contractual relationship and retained for the duration set out below, in accordance with applicable legal and regulatory provisions.

In particular:

• Identification and contact data (such as account details, identifiers, and information relating to communications about the evolution of the services and offers) are retained for the entire duration of the contractual relationship. Following the end of the contractual relationship, such data may be retained for a maximum period of three (3) years from the last interaction, unless the Data Subject has requested earlier deletion of their Personal Data by contacting Segmos at the address set out in Article 12.
• Data relating to the performance of the contract, including data necessary for account management, chain of custody and transaction records, invoicing and payments, are retained for a period of ten (10) years from the end of the accounting period concerned, in accordance with applicable accounting and commercial law obligations.
• Connection, usage and audit log data are retained for a period of twelve (12) months.
• Data collected through the contact form of the Site are retained for a period of three (3) years from the last exchange with the person concerned.
• Backups are retained for a rolling period of thirty (30) days, after which they are permanently deleted according to the defined retention schedule.

At the end of the applicable retention period, Personal Data are securely deleted so as to be no longer recoverable, or anonymised.

Segmos implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the GDPR. These measures include in particular:

• Encryption: data in transit is encrypted using Transport Layer Security (TLS) with certificates issued by an established certificate authority; data at rest is encrypted using AES 256-bit encryption.
• Network architecture: the Platform is hosted on Amazon Web Services infrastructure within a virtual private cloud protected by deny-by-default security groups and firewalls, with only specific authorised points of entry.
• Access control: role-based access control, authentication prior to any use of system resources, multi-factor authentication on critical systems, complex password requirements, quarterly access reviews and timely revocation of access upon departure.
• Tenant isolation: Client environments are logically isolated from one another.
• Change management: all changes to the Platform are subject to peer review by a reviewer other than the author, automated testing, and version control supporting rollback.
• Vulnerability management: systems are scanned at least monthly, and identified vulnerabilities are risk-ranked and remediated on a prioritised basis.
• Endpoint security: company devices enforce screen lock, operating system updates and encryption at rest.
• Backup and continuity: backups are performed at least daily, restoration is tested at least annually, and a business continuity and disaster recovery plan is maintained and periodically tested.
• Incident management: a documented incident management framework defines detection, escalation, severity rating and response, including notification to the competent authority and to Data Subjects where required by Applicable Law.
• Personnel: background checks are performed on new hires, confidentiality agreements are signed, and security awareness training is provided upon hire and annually thereafter.

Data Subjects benefit from the rights provided under Applicable Law, in particular the right to request from Segmos access to their Personal Data, the rectification or erasure of such data, the restriction of Processing concerning them, the right to object to the Processing, and the right to data portability. These rights may be exercised by writing to the address set out in Article 12.

Data Subjects have the following rights under the conditions set out by Applicable Law:

• Right to information: this privacy policy is intended to fulfil this right.
• Right of access: at any time, to all of their Personal Data.
• Right to rectification: of inaccurate, outdated or incomplete Personal Data.
• Right to restriction of Processing: in certain cases as set out in Article 18 of the GDPR.
• Right to erasure: of Personal Data, in particular where the data is no longer necessary for the purpose of the Processing, where the Data Subject has withdrawn their consent, or where the Processing is unlawful, subject to Segmos' legal retention obligations.
• Right to lodge a complaint with a supervisory authority: in France, the CNIL.
• Right to define post-mortem instructions: relating to the storage, erasure and disclosure of their Personal Data after death.
• Right to withdraw consent at any time: for Processing based on consent. Such withdrawal shall not affect the lawfulness of Processing carried out prior to withdrawal.
• Right to data portability: of Personal Data provided to the Controller, in a structured, commonly used and machine-readable format, and the right to have that data transmitted to a third party designated by the Data Subject.
• Right to object: to the Processing of their Personal Data. However, Segmos may continue such Processing where it has legitimate grounds to do so or where it is necessary for the establishment, exercise or defence of legal claims.

Data Subjects may exercise these rights at the address indicated in Article 12. Segmos may request additional information or documents to verify the identity of the Data Subject. Segmos responds within one (1) month of receipt of the request, a period which may be extended by two (2) months where the request is complex or numerous.

Where the request concerns data processed by Segmos as Processor on behalf of a Client, Segmos will forward the request to that Client without undue delay.

Any Data Subject may contact the CNIL if they believe that Segmos has not complied with Applicable Law (information on how to file a complaint with the CNIL is available directly on its website, www.cnil.fr).

The Platform and the Personal Data it contains are hosted on Amazon Web Services infrastructure located in the European Union, in the eu-west-1 region (Ireland).

Segmos limits, as far as possible, the selection of Processors that process Personal Data in countries outside the European Union.

However, in the context of fulfilling the purposes set out in this privacy policy and for data management purposes, Segmos may transfer Personal Data to countries outside the European Union that do not provide an adequate level of protection.

Where such transfers occur, they are governed by an adequacy decision of the European Commission or, in the absence of such a decision, by the Standard Contractual Clauses adopted by the European Commission, supplemented where necessary by additional safeguards. Segmos undertakes to implement all appropriate technical and organisational measures to ensure the security of the Personal Data of Data Subjects, and requires its Processors to comply with the obligations set out under Applicable Law.

Segmos' Data Protection Officer is Eric Askinazi.

Any question relating to this policy, and any request to exercise the rights set out in Article 10, may be addressed to the Data Protection Officer:

• By email: contact@segmos.com
• By post: Segmos — Data Protection Officer, 8 Rue de Marseille, 75010 Paris, France

Segmos uses only cookies that are strictly necessary for the operation of the Site and the Platform, in particular to maintain your session, to authenticate you and to preserve the security of the service. These cookies are exempt from the requirement to obtain prior consent under Applicable Law.

Segmos does not use advertising cookies, nor cookies that track your browsing across third-party websites.