Privacy Policy

PROMODEV (hereafter "we", "us" or "PROMO.DEV") is committed to protecting your privacy. This policy describes how we collect, use, store and protect personal data collected through the promo.dev website. This policy applies exclusively to the promo.dev institutional website. Personal data processed on the PROMO.DEV SaaS platform on behalf of our enterprise clients is governed by dedicated Data Processing Agreements (DPA) signed with each client, in which PROMODEV acts as a data processor. By using the promo.dev website, you acknowledge having read and understood this policy.

The data controller for personal data collected through the promo.dev website is: PROMODEV SAS with a share capital of €321,000 Registered office: 276 avenue du Douard, ZI les Paluds, 13400 Aubagne Cedex, France SIRET: 89055988300016 Contact: dpo@promo.dev

We collect the following categories of personal data: • Data you provide voluntarily via the contact form or demo requests: last name, first name, professional email, company, position, phone number (optional), the content of your message. • Data collected automatically for the technical operation and security of the website: IP address, browser type and version, operating system, pages visited, connection date and time, referrer URL. • Data stored by strictly necessary technical cookies: language preference, session security tokens. We do not collect any sensitive data within the meaning of Article 9 of the GDPR (health, religious opinions, sexual orientation, etc.).

We process your personal data for the following purposes: • Respond to your inquiries submitted through the contact form or the demo request form. • Schedule and conduct product demonstrations at your request. • Send you commercial communications about our services, only if you have expressly consented or if you are already a business client (soft opt-in). • Ensure the technical security of the website, prevent fraud and unauthorized access. • Produce anonymous aggregated statistics on the use of the website to improve its content and performance. • Comply with our legal, accounting and tax obligations.

Each processing operation carried out relies on one of the following legal bases, in accordance with Article 6 of the GDPR: • Consent: for commercial communications and for any non-essential cookie. • Performance of pre-contractual measures at your request: for demo requests and contact concerning our services. • Legitimate interest: for the technical security of the website, fraud prevention and the improvement of our services (this interest is balanced against your rights and freedoms). • Legal obligation: for the retention of certain data required by French law (accounting, tax, invoicing for clients).

We retain your personal data only for as long as necessary for the purposes for which they were collected: • Contact requests and demo requests: 3 years from the last contact initiated by you, unless a business relationship is established. • Prospect data: 3 years after the last active contact, then anonymized or deleted. • Client data (contract, invoicing, accounting documents): 10 years from the end of the accounting year, in accordance with the French Commercial Code. • Technical logs (IP addresses, connections): 12 months maximum. • Strictly necessary cookies: session duration or up to 13 months maximum. At the end of these periods, data is either deleted or anonymized so that it can no longer identify you.

Your personal data is accessible only to the internal PROMODEV teams who need it to carry out their duties (sales, marketing, technical support, management). We use the following categories of subprocessors, each bound by a data processing agreement compliant with Article 28 of the GDPR: • Hosting provider: Cloudflare, Inc. (United States) — hosting of the promo.dev website and edge security. • Email provider: for the sending and receipt of professional emails. • Customer relationship management (CRM) tool: to track inquiries and business relationships. • Analytics and monitoring providers: for anonymous aggregated audience measurement and technical availability of the website. We never sell or rent your personal data to third parties for commercial purposes.

Some of our subprocessors are established outside the European Union, notably in the United States (in particular Cloudflare, Inc.). Any transfer of personal data outside the European Union is governed by appropriate safeguards within the meaning of Chapter V of the GDPR, including: • Standard Contractual Clauses (SCC) adopted by the European Commission. • Additional technical and organizational measures (encryption in transit and at rest, strict access controls, audit logging). A copy of these safeguards can be obtained by writing to dpo@promo.dev.

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your personal data: • Right of access: obtain confirmation that data concerning you is being processed and access this data. • Right to rectification: request correction of inaccurate or incomplete data. • Right to erasure ("right to be forgotten"): request deletion of data under certain conditions. • Right to restriction of processing. • Right to data portability: receive the data you have provided in a structured, commonly used format. • Right to object to processing, in particular for direct marketing purposes. • Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand. • Right to define directives on the fate of your data after your death. To exercise these rights, please write to dpo@promo.dev. We will respond within one month of receipt of the request. Proof of identity may be requested in case of reasonable doubt. You also have the right to lodge a complaint with the French Data Protection Authority (CNIL — cnil.fr) if you consider that the processing of your data infringes the applicable regulations.

We implement appropriate technical and organizational measures to protect your personal data against loss, unauthorized access, disclosure, alteration or destruction: • Encryption of communications in transit (TLS 1.3) and at rest for sensitive data. • Strict access management based on the principle of least privilege. • Continuous security monitoring and incident detection. • Regular backup of data. • Awareness training for our teams on data protection. • Security incident response and notification procedures. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with Article 34 of the GDPR.

The promo.dev website uses only technical cookies strictly necessary for its operation: • Language preference cookie: to remember your language choice (EN or FR). • Session security cookies: to protect against attacks (CSRF, etc.). These cookies do not require your consent as they are essential to providing the service you request. No third-party analytics, advertising or behavioral tracking cookies are placed without your explicit consent. You can configure your browser to refuse cookies at any time or to be notified when a cookie is set. Note that disabling technical cookies may affect the proper functioning of the website.

This privacy policy may be updated at any time to reflect changes in our practices, technical developments or regulatory changes. The date at the top of the page indicates the last update. In case of substantial modification, we will inform you by any appropriate means (banner on the website, direct email if you have already contacted us). We recommend that you consult this page regularly.

For any question relating to this policy or the processing of your personal data, or to exercise your rights, you can contact us: By email: dpo@promo.dev By mail: PROMODEV — Personal Data — 276 avenue du Douard, ZI les Paluds, 13400 Aubagne Cedex, France If you consider, after having contacted us, that your data protection rights are not respected, you can lodge a complaint with the French Data Protection Authority (CNIL): CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr