Personal Data Protection Charter

Who this charter is for

This charter explains how The Programmatic Company processes your personal data when you deal with us: as a client, prospect or business contact, as a visitor to our website ad-os.ai, or as a user of our advertising campaign management platform, available at platform.ad-os.ai (the "Platform").

It is issued in accordance with Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and French Law No. 78-17 of 6 January 1978, as amended ("Loi Informatique et Libertés").

Who we are

The Programmatic Company, a French société par actions simplifiée with share capital of EUR 177,948, registered with the Paris Trade and Companies Register under number 815 337 175, whose registered office is at 26 rue Damrémont, 75018 Paris, France ("we", "us").

We have appointed a data protection officer: METALAW, DPO TPC, 7 rue de Prony, 75017 Paris, France — dpo@ad-os.ai.

Our two roles, and whom to contact

Depending on the situation, we process your data on our own behalf, or on behalf of your employer where your employer is a client of the Platform. This distinction determines where to send your requests.

The data we process

• Identification and business contact details: last name, first name, job title, company, business email address and telephone number.
• Relationship data: correspondence, requests, contractual documents, invoicing data.
• Account data, for Platform users: login, application role, settings.
• Connection and activity data: IP address, date and time of connection, activity logs, technical information about your browser and device.
• The content of your support requests and of the requests you submit to the Platform’s agent.

We do not process any special categories of data within the meaning of Article 9 GDPR. The advertising campaign data processed by the Platform is business data and is not intended to include personal data.

Where your data comes from

• From you, when you contact us, fill in a form, correspond with us or use the Platform.
• From your employer, when it creates your account on the Platform or designates you as a contact person.
• From a partner or a company of your group, when it introduces us to you in connection with a business opportunity. It then provides us with your business contact details only.
• From publicly available professional sources, such as company websites and professional social networks.

Where your data is not collected from you, we inform you, and tell you its source, at our first exchange with you and, at the latest, within one month of obtaining it.

Why we process it, and on what basis

Where we act on our own behalf:

Where we act on behalf of your employer, we process your data solely to manage your access to the Platform, keep it secure and provide the support you request, in accordance with your employer’s instructions.

Artificial intelligence and automated decisions

The Platform includes artificial intelligence features, in particular an agent to which you can submit requests. These requests are processed by models supplied by providers acting as processors, within the European Union. Neither your requests nor the responses obtained are used to train models.

These features relate to advertising campaigns, not to individuals. Their proposals are subject to human validation. We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

Who has access to your data

• Members of our team who need it to perform their duties.
• Our technical processors, within the limits of their assignments: hosting and monitoring, supply of artificial intelligence models, support and messaging tools, data reporting tools. They are contractually bound by confidentiality and security obligations.
• Your employer, for data relating to your account on the Platform.
• Our data protection officer, our advisers and our statutory auditor.
• Public authorities and officers of the court, where required by law.

We do not sell, rent or exchange your data. We may share with third parties data that has been irreversibly anonymised and aggregated, which cannot be used to identify you in any way.

Where your data is processed

The Platform is hosted within the European Union, and artificial intelligence processing takes place there. Certain support and messaging tools process your business identification data and the content of your support requests outside the European Union. These transfers are governed by the standard contractual clauses adopted by the European Commission. You may obtain a copy from our data protection officer.

How long we keep it

At the end of these periods, your data is deleted. In our backups, deletion takes effect at the end of their rotation cycle, which does not exceed sixty (60) days.

Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure: access control and logging, encryption of data in transit and at rest, segregation of data between clients. If a breach of your data were likely to result in a high risk to your rights and freedoms, we would inform you without undue delay.

Cookies and trackers

At present, our website and the Platform only use trackers that are strictly necessary for their operation, which do not require your consent. Should other trackers, for audience measurement or advertising, be used in the future, they would only be placed with your prior consent, collected through a banner allowing you to accept or refuse just as easily, and this charter would be updated.

Your rights

You have the right to access, rectify and erase your data and to restrict its processing, the right to object, in particular to prospecting, at any time and without giving reasons, and the right to data portability where processing is based on a contract. You may also give instructions regarding the handling of your data after your death.

To exercise these rights, write to dpo@ad-os.ai or to METALAW, DPO TPC, 7 rue de Prony, 75017 Paris, France, taking into account the table “Our two roles”. We will respond within one (1) month, which may be extended as provided by the GDPR.

If you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr.

Changes to this charter

We may update this charter, in particular to reflect changes to our services or to the law. In the event of a material change, we will inform you in advance by appropriate means. The date of the last update and the version history are set out below.

Contacts

Version history

This charter is available in French and English. In the event of any discrepancy, the French version prevails.