Confidentiality policy

These terms were updated on October 20, 2023.
SECTION 1. PREAMBLE

YUZU, a simplified joint stock company, with a capital of 35,000 euros, whose head office is located at 5 Rue Jacques Villermeaux - 54000 NANCY, registered in the NANCY Trade and Companies Register under number 917 762 536 (hereinafter “” We ” or” YUZU ”), acting as data controller, ensures the protection of personal data (the” Personal data ”) collected from natural persons, users of the Platform — Customers and Participants — accessible via app.yuzu.hr (Customer) and game.yuzu.hr (Participants) (hereinafter and hereafter the” Platform ”) within the meaning of the CGU which are respectively applicable to them (hereinafter” You ”). Your Personal Data is processed in accordance with the applicable regulations, namely, Regulation (EU) no. 2016/679 of 27 April 2016 known as” RGPD ”, which came into force on May 25, 2018 and the Data Protection Act, which was amended several times, as well as any other applicable laws concerning the protection of personal data from which you could benefit (the” regulating ”).

The Platform is intended for carrying out Evaluations of Job Participants via the “Serious Game” method.

SECTION 2. PURPOSE OF THE POLICY

We are committed to ensuring the respect of your privacy and the protection of your Personal Data.

This privacy and personal data protection policy (hereinafter the “Privacy Policy”) informs you about the use of your Personal Data in connection with the use of the Platform.

This Privacy Policy allows you to know the origin and use of the information collected, as well as the rights and options you have under the Regulations.

The Privacy Policy is therefore important for you and we invite you to read it carefully.

To find out how We use cookies on our Platform, we invite you to consult article 10 of this Privacy Policy.

This Privacy Policy is an integral part of the CGV/CGU of the Platform, as well as any other contractual conditions agreed between You and YUZU. All terms written with a capital letter as the first letter, not defined in this Policy, have the meaning given to them in the CGV/CGU of the Platform and/or in any other contractual conditions agreed between You and YUZU.

SECTION 3. MODIFICATION OF THE PRIVACY POLICY

We may change the Privacy Policy according to the legal and regulatory context, as well as to keep you informed of changes in our personal data and cookie processing practices.

We therefore advise you to always read the most recent version of the Privacy Policy as soon as you interact with Us by consulting this section or by clicking on the “Privacy Policy” link in the lower banner of our Platform.

SECTION 4. OUR ROLE AND RESPONSIBILITY

Unless otherwise indicated in separate information notes/notices relating to certain specific Personal Data processing, the Personal Data processing described in this Policy is implemented by our company, referred to above, publishing the Platform; thus having the status of “Data Controller” within the meaning of article 4 of the RGPD.

SECTION 5. DATA PROTECTION OFFICER — CONTACT

We have appointed a person responsible for ensuring compliance with this Privacy Policy and, more generally, compliance with the Regulations.

In case of questions and/or difficulties about the Privacy Policy and our personal data protection practices, do not hesitate to contact us on the Platform, using one of the following means:

- By email: support-entreprise@yuzu.hr
- By post: Yuzu, 5, rue Jacques Villermeaux — 54000 NANCY

In the event of a dispute concerning the way in which We collect and process your Personal Data, you can file a complaint with the CNIL via the following link: https://www.cnil.fr/fr/plaintes/ or by post to the following address: 3 Place de Fontenoy -TSA 80715 - 75334 PARIS CEDEX 07 — www.cnil.fr or, if you live in another country, with the supervisory authority in your usual place of residence.

SECTION 6. CATEGORIES OF PERSONAL DATA THAT WE PROCESS AND THEIR PURPOSES

The purpose of this section is to provide you with more information about the Personal Data we collect, the purposes for which we process this Personal Data, and the legal basis on which each specific processing is based. We only process Personal Data that we collect about you if there is a reason for doing so and we have a relevant legal basis.

It is specified that for all purposes based on our legitimate interest, we make sure in this case to take into account any potential impact that this processing may have on you. If we believe that your interests or fundamental rights and freedoms override our legitimate interest, then we will not use your Personal Data on this legal basis and may ask for your specific consent.

6.1. Customer Data

● Account creation : We collect and process Personal Data to allow you to create and access your Account on the Platform. In order to manage your Account from its creation to its deletion, you must provide us with certain information about you (in particular your name, first name, telephone number, professional email address, legal name of the Customer, company name of the Customer, VAT number, VAT number, SIREN number, head office).

The legal basis for this treatment is contractual. We need this data in order to create and maintain your Account, to apply the Terms and Conditions as well as any other applicable additional contractual conditions that you accepted when creating your Account.

● Provision of Platform Services : We collect and process your Personal Data in order to allow you to access and use the various Services on our Platform, including to facilitate the acquisition of Credits.

- Acquisition of Credits: civil status, your postal address, your postal address, your bank details (IBAN number, name of the account holder), postal address, date of acquisition, details of the acquisition, details of the acquisition, amount of the acquisition.
- The legal basis for these treatments is contractual. We need this data in order to apply the Terms and Conditions as well as any other applicable additional contractual conditions that you accepted when creating your Account.

● Management of complaints and exercise of the rights provided for in this Policy : We collect and process Personal Data such as your username, contact details and the content of your message (insofar as it may contain Personal Data about you or a third party), your identity document (for the exercise of the rights provided in this Policy) when managing and following up on questions and/or requests that you may submit to us.

The legal basis for these treatments is contractual. We need this data in order to apply the Terms and Conditions as well as any other applicable additional contractual conditions that you accepted when creating your Account.

● Commercial prospecting actions : We collect Personal Data such as your username and email address in order to send you commercial requests.

- The legal basis is our legitimate interest in requests relating to services similar to those from which you already benefit.
- The legal basis is your consent for all other solicitations.

Management of the Platform, analysis of the use of the Platform and the purposes provided for in the article “Cookies Policy” : In this respect, we process and collect information relating to your connection terminal and your browser, in particular your IP address (from which information on your country/state of location can be derived), your browser, the type of device used and navigation information. More information can be found in section 10 of this Policy.

Some Personal Data that is essential for us to fulfill the purposes described above may be indicated on the various pages of our Platform, generally by an asterisk. If you do not fill in these mandatory fields, We may not be able to respond (or partially respond) to your requests. Other information is optional and allows us to get to know you better and to improve our services for you.

Apart from any interaction with the Platform, some Personal Data is essential to fulfill the purposes described above and we reserve the right not to respond to your requests if they are not provided to us.

During the events we organize, we may process additional Personal Data under the conditions and for uses that are specially notified to you on this occasion.

6.2. Participant Data

● Account creation : We collect and process Personal Data to allow you to create and access your Account on the Platform. In order to manage your Account from its creation to its deletion, you must provide us with certain information about you (in particular your Name, First Name, email address and telephone number).

The legal basis for this treatment is contractual. We need this data in order to create and maintain your Account, to apply the Terms and Conditions as well as any other applicable additional contractual conditions that you accepted when creating your Account.

Provision of Platform Services : We collect and process your Personal Data in order to allow you to access and use the various Services of our Platform, including the conduct of Evaluations.

Carrying out the Assessment: Name, First name, Telephone number, behavioral data; The legal basis for these treatments is contractual. We need this data in order to apply the Terms and Conditions as well as any other applicable additional contractual conditions that you accepted when creating your Account.

Management of complaints and exercise of the rights provided for in this Policy : We collect and process Personal Data such as your first and last name, your contact details and the content of your message (insofar as it may contain Personal Data concerning you or a third party), your identity document (for the exercise of the rights provided for in this Policy) when managing and following up on questions and/or requests that you may submit to us.

The legal basis for these treatments is contractual. We need this data in order to apply the Terms and Conditions as well as any other applicable additional contractual conditions that you accepted when creating your Account.

Commercial prospecting actions : We collect Personal Data such as your username and email address in order to send you commercial requests.

- The legal basis is our legitimate interest in requests relating to services similar to those from which you already benefit.
- The legal basis is your consent for all other solicitations.

Management of the Platform, analysis of the use of the Platform and the purposes provided for in the article “Cookies Policy” : In this respect, we process and collect information relating to your connection terminal and your browser, in particular your IP address (from which information on your country/state of location can be derived), your browser, the type of device used and navigation information. More information can be found in section 10 of this Policy.

Some Personal Data that is essential for us to fulfill the purposes described above may be indicated on the various pages of our Platform, generally by an asterisk. If you do not fill in these mandatory fields, We may not be able to respond (or partially respond) to your requests. Other information is optional and allows us to get to know you better and to improve our services for you.

Apart from any interaction with the Platform, some Personal Data is essential to fulfill the purposes described above and we reserve the right not to respond to your requests if they are not provided to us.

During the events we organize, we may process additional Personal Data under the conditions and for uses that are specially notified to you on this occasion.

SECTION 7. STORAGE OF YOUR PERSONAL DATA
7.1.Retention period of Customers' Personal Data
7.2.Retention period of Participants' Personal Data
7.3. Retention period of Personal Data of all users of the Platform
SECTION 8. RECIPIENTS OF YOUR PERSONAL DATA

Your Personal Data is only shared with third party service providers and partners only when necessary for the purposes set out in this Privacy Policy.

We use trusted third party service providers and partners and provide them with the only information they need and We require them not to use this information for other purposes. We make every effort to ensure that all of these third party partners maintain the confidentiality and security of your personal data.

The purpose of sharing your Personal Data with third party partners is:

8.1. Platform Management and Related Third-Party Services

Personal Data will not be transferred or made accessible to any third party subject to:

● From our subcontractors and service providers, for exclusively technical reasons (for example, providers of hosting and maintaining the Platform, provider of payment services);
● and any restructuring of the legal organization, including total or partial sale of assets, mergers, acquisitions, demergers and more generally any reorganization operation in order to ensure the continuity of the Services.

Whether or not they are integrated directly into the Platform, these third party providers and partners collect and process your Personal Data independently in accordance with their relevant privacy policies and under their sole responsibility.

8.2. Complaint Management/Exercising your rights under this Policy

Your Personal Data is accessible to authorized persons working on our behalf with whom you are in contact, as well as to our customer relationship teams.

8.3. Protection and defense of Our rights

We may be required to communicate your Personal Data to third parties when such communication is required by law, a regulatory provision or a judicial decision, or if this communication is necessary to ensure the protection and defense of our rights (for example to our agents and external advisers in case of debt collection).

8.4. Outgoing links to third party websites

The Platform may contain outgoing links to third party websites. We have no control over the content, privacy policies, or actions of these websites.

The use of information that you may provide to third parties on other sites or that these third parties may collect on other websites is not governed by this Privacy Policy.

You should carefully review the privacy and personal data protection policies of third party websites and contact the editors of these sites if you have any questions about how they use information about you.

We cannot be held responsible for any third party who does not use information about you in accordance with that third party's privacy policy or in accordance with any contractual or legal obligations to which that third party is subject.

SECTION 9. TRANSFER OF YOUR PERSONAL DATA OUTSIDE THE EUROPEAN UNION

The Personal Data that we collect about you is transferred to and stored on servers located in the European Union.

However, if your Personal Data were likely to be transferred outside the European Union to service providers and partners, we would take the necessary measures with them to ensure an adequate level of data protection, in accordance with the regulations in force (Chapter V of the RGPD).

As such, we will ensure that your data benefits from a level of protection similar to that applicable within the meaning of the European Union, by implementing at least one of the following two protection measures:

1. Your Personal Data would be transferred to countries that have been considered to ensure an adequate level of protection of personal data by the European Commission;
2. We would use the Standard Contractual Clauses approved by the European Commission.

If the subcontractor, the service provider and/or the partner no longer meets these conditions or does not meet these conditions, We undertake not to transfer your Personal Data to them.

SECTION 10. COOKIE POLICY

Our Platform uses cookies and/or other tracking technologies under the conditions specified below.

10.1. Definition of cookies and other tracking technologies

The term “cookies” refers to a small file stored by a server in your terminal (computer, telephone, tablet...) and associated with a web domain (i.e. in the majority of cases to all the pages of the same Web Platform). This file is automatically returned upon subsequent contacts with the same domain.

For example, it could be:

● HTTP cookies
● “flash” cookies

Other tracking technologies are also likely to be used. These include:

● the result of calculating a unique fingerprint for your terminal in the case of” Fingerprinting ” (calculation of a unique identifier of the terminal based on elements of its configuration for tracking purposes)
● invisible pixels or “web bugs”,
● access to terminal information from APIs (localStorage, IndexedDB, advertising identifiers such as IDFA or Android ID, access to GPS... ),
● any other identifier generated by a software or an operating system (serial number, MAC address, unique terminal identifier (IDFV), or any set of data that is used to calculate a unique fingerprint of the terminal (for example via a “fingerprinting” method).

For the purposes of this Privacy Policy, we will use the term” Cookies ” to refer indifferently to cookies and any other tracking technology deposited and/or read, when consulting our Platform, regardless of the type of terminal you use: computer, smartphone, digital tablet connected to the Internet.

These Cookies have multiple uses such as:

- track your browsing for statistical or advertising purposes;
- allow the customization of the user interface (choice of display language or presentation of the service);
- allow authentication with a service, including those aimed at ensuring the security of the authentication mechanism, for example by limiting robotic or unexpected access attempts.

10.2. Prior consent

For the use of certain Cookies, your prior consent is required.

When you visit our Platform for the first time, and we are considering placing a Cookie on your terminal:

(1) You are notified by means of an information banner at the bottom of the page that is displayed; and
(2) You are invited to either accept, or refuse, or to configure your choices regarding the use of these Cookies

Insofar as your consent must result from an unequivocal act, any action other than the one that explicitly allows you to accept is considered a refusal (for example, closing the consent banner).

Some of these Cookies are exempt from consent when they meet the criteria provided for by guidelines for cookies and other trackers.

However, we want to inform you of their use and remind you that the settings of the browser used may allow you to block them, with potentially negative effects for the functioning of our Platform.

10.3. The type of Cookies used and their purposes

We may use the following Cookies:

Functional cookies : they are necessary for the proper functioning of the Platform. They are essential to access our various services (login data, etc.)

Audience measurement cookies : Assign a unique identifier to each user, in order to generate statistics, which we use to assess the performance of the Platform. In this way, the following data can be collected:

- the number of unique visits;
- the frequency with which users visit our Platform;
- what pages visitors are viewing;
- how long users view a particular page;
- the page from which visitors leave our Platform.

Tracking cookies : they make it possible to analyze your browsing, your consultation or consumption habits on our Platform, in order to offer you targeted advertising or personalized services. The profile that is established based on this data is not linked to your name, address, email address, etc., but only serves to match the advertisements to your profile, so that they are as relevant as possible for you. (no personal information is collected)

We collect your consent for these Cookies. They will not be installed without your consent.


− Third-party cookies: they allow you to track the pages you visit on the Internet in order to create your personal profile. This profile is not linked to your name, address, email address etc. as mentioned above, but is only used to identify you as a unique visitor and to adapt the ads to your profile so that they are as relevant as possible for you.

We collect your consent for these Cookies. These Cookies will not be installed without your consent.

− Cookies related to social networks: they allow social networks to save the articles and pages that you share via their sharing buttons. They may also contain tracking Cookies that track your browsing behavior on the Internet.

We collect your consent for these Cookies. These Cookies will not be installed without your consent.

Platform improvement cookies : they allow you to test different versions of a web page in order to know which page is best used.

Session trackers allowing you to store information about the current session.

10.4. List of Cookies used
10.5. Your rights with respect to Personal Data collected by Cookies

You have the right to access, rectify, limit and delete your Personal Data in accordance with this Privacy Policy. In addition, you have the right to oppose the processing of Personal Data and the right to the portability of your data.

In order to prevent abuse, we may ask you to identify yourself when exercising your rights.

When it comes to accessing Personal Data linked to a Cookie, we may ask you to send us a copy of the Cookie in question, according to instructions that will be communicated to you by our technical teams.

SECTION 11. SAFETY

We have implemented appropriate technical, organizational, software, and physical measures to ensure the confidentiality and security of your Personal Data against loss, destruction, alteration, unauthorized access or disclosure. In particular:

● Our computer systems are subject to physical and software protection in accordance with the state of the art. Procedures for the physical and electronic backup of data collected on the Platform are implemented, in accordance with French legislation and European regulations in force relating to the protection of personal data;
● Our employees who, because of their function, would have access to your Personal Data are subject to confidentiality obligations;
● Our service providers and subcontractors are required by written commitments to implement sufficient security measures to ensure the protection of your Personal Data in accordance with applicable legislation;

We remind you that the Internet is not a completely secure environment and that as such, we cannot guarantee the security of the transmission or storage of information on the Internet.

SECTION 12. YOUR RIGHTS

In accordance with the Regulations, you have the following rights:

12.1. Access and correction

You have the right to access your Personal Data, as well as the right to request the correction or deletion of data that is inaccurate.

12.2. Erasure

You can also request the deletion of Personal Data concerning you as soon as their conservation is no longer necessary.

12.3. Opposition

You can also oppose the processing of your Personal Data or request its limitation, except when the processing is necessary for the performance of the services.

12.4. Withdrawal of consent

Where the processing of your data is based on your consent (and is the only legal basis for the processing), you can withdraw that consent at any time.

12.5. Portability

When authorized by law, you have the right to ask us to return your Personal Data to you (in a structured, computer-readable form) or, where technically possible, to transfer it to a third party.

12.6. Post-mortem guidelines

You can also send us your instructions concerning the storage, deletion and communication of your Personal Data after your death, by sending us on any durable medium the name of one or more persons authorized to do so. You can change these guidelines at any time.

SECTION 13. EXERCISE OF YOUR RIGHTS AND COMPLAINT

The rights provided for in article 12 of this Privacy Policy may be exercised directly with Us in accordance with the procedures referred to in article 5 of this Privacy Policy.

In order to allow us to respond to you quickly, it is recommended that you indicate your name, first name and email address.

Some requests to exercise rights (right of access) must be accompanied by a photocopy of an identity document bearing the signature of the person concerned in order to verify their identity and specify the address to which the response should be sent. A response will then be sent to him within one (1) month following receipt of the request.

It is specified that the data relating to identity documents necessary to exercise the right of access, modification or correction will be kept for a period of one (1) year in accordance with article 9 of the Code of Criminal Procedure.

However, we reserve the right not to respond to requests that are clearly unfounded or excessive.

649eefb3f91981851084d9a6