PRIVACY POLICY

1. DATA CONTROLLER

POGGI Avocats IT, whose registered office is located at 24 rue de Surène, 75008 Paris, registered in the SIRENE register under number 750 548 562, is responsible for the processing carried out via the website. www.poggiavocats.com and within the framework of the advisory or representation mission that you have entrusted to it.

POGGI Avocats IT processes your personal data in accordance with Law No. 78-18 of 6 January 1978 on Data Processing, Data Files and Individual Liberties, as amended, and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data.

2. RGPD REFERENT

The firm has appointed an RGPD referent whose contact details are as follows: Anne-Sophie POGGI, 24 rue de Surène, 75008 Paris, aspoggi@poggiavocats.com.

This RGPD representative is responsible for advising, informing and monitoring compliance with data protection regulations. He or she will be your main point of contact for exercising your rights (see below).

3. YOUR PERSONAL DATA

We collect the data needed to identify and communicate with you (title, surname, first name, address, telephone number, e-mail address, date of birth), to advise you or represent you (data concerning your business), your payment data, the data needed to carry out canvassing campaigns (surname, first name and e-mail address) and data relating to your

opposition.

4. PURPOSES AND LEGAL BASIS OF PROCESSING

Processing of personal data via the website www.poggiavocats.com are :

• answering questions asked via the contact form, on the basis of the individual's consent,
• management of reminders for people who have asked to be contacted by telephone, based on their consent,
• the drawing up of a quotation and the preparation of costed commercial proposals, based on the execution of pre-contractual measures,
• the performance of our fee agreement with regard to the management of the advisory services you have entrusted to us;
• the performance of a mission of public interest with regard to the management of the defence and/or representation mission that you have entrusted to us;
• complying with our legal obligations, in particular those relating to ethics, accounting, tax and social security, as regards monitoring invoicing and accounting;
• the subscription of prospective clients to the firm's newsletters, on the basis of consent given by means of a box to be ticked on the collection form. You may withdraw your consent at any time.
• customer subscriptions to the firm's newsletters, based on the data controller's legitimate interest in keeping its customers informed of its activities and the latest news concerning it.
• managing objections to receiving communications, on the basis of our legal obligations.

5. DATA RECIPIENT

Data is processed by the firm's strictly authorised staff.

This data will not be passed on to partners or third parties, nor will it be used for unintended purposes, unless otherwise specified and informed. No personal information other than that requested in this context is collected without the knowledge of the persons concerned.

The data collected is communicated only to the firm's hosting service provider:

Xelya - 174 Bureaux de la Colline, 1 Rue Royale, Bâtiment C, 11th floor, 92210 SAINT-CLOUD, FRANCE

Tel: 01 74 71 48 17, www.diapaz.fr

The site is hosted by OVH, OVH SAS, RCS LILLE METROPOLE 424 761 419 00045, VAT No: FR 22 424 761 419, registered office: 2 rue Kellermann - 59100 Roubaix France.

6. RETENTION PERIODS

Your data is stored :

• as part of the management of our advisory or representation role: for the entire duration of the relationship and until the limitation periods have expired;
• for billing and accounting management: for the entire duration of the relationship and for 10 years to meet our legal obligations;
• in the context of commercial prospecting: until you inform us that you no longer wish to receive communications from the firm and no later than 3 years from the last contact you may have made with the firm;
• to oppose commercial prospecting: 3 years from the date of opposition.

7. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The data collected via the processing of personal data on this site is not transferred outside the European Union.

8. DATA SECURITY

Data passing through the site is protected by appropriate security and confidentiality measures.

The PCs of the firm's lawyers and employees are equipped with Windows 365 and protected by Bitdefender passwords, antivirus and firewalls that are regularly updated by the outsourcing company Xelia (see point 5 above). We use Outlook mailboxes and, where appropriate, Microsoft TEAMS and OneDrive document sharing functions for our information and data communications.

with clients and prospects. The firm's client files are hosted by Xelia. Data flows with the Xelia server are protected by VPN encryption and a password. Xelia is ISO 20000, ISO27001, ISO 27018 and HDS (https://www.xelya.com/une-quadruple-certification-pour-xelya).

The website www.poggiavocats.com is accessible via HTTPS and equipped with security modules to prevent malicious intrusions and data leaks as far as possible. The site's administrator accounts can be accessed using strong passwords.

The firm's lawyers are bound by professional secrecy and subcontractors (IT, accountants) and employees by confidentiality agreements.

9. RIGHTS OF THE PERSONS CONCERNED

Subject to compliance with professional secrecy, the defence of the interests of the firm's clients and the rights of third parties (in particular the right to privacy, intellectual property rights and the confidentiality of correspondence), in accordance with the regulations in force, you may:

• to the data concerning you, rectify it, request its deletion or exercise your right to limit the processing of your data,
• if the legal basis is consent, you may withdraw your consent to the processing of your data at any time,
• if the legal basis is legitimate interest or the performance of a task in the public interest, for reasons relating to your particular situation, object to the processing of your data,
• if the legal basis is consent or the performance of the contract, exercise your right to the portability of your data, in particular in the context of a succession of lawyers in your case.

Individuals may exercise these rights by sending an e-mail to aspoggi@poggiavocats.com or by post addressed to POGGI Avocats IT, 24 rue de Surène, 75008 Paris.

10. COMPLAINTS

The user of this site or the lawyer's client may at any time contact the Commission Nationale Informatique et Libertés (CNIL), the French supervisory authority, and lodge a complaint by writing to CNIL - 3 place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07, or directly online at the address : www.cnil.fr/plaintes.

11. COOKIES

The website www.poggiavocats.com uses cookies. These are small computer files deposited on your terminal when you visit the site. Most of the cookies used on this website are necessary for navigation and the correct display of this site, while a few others collect anonymous visit statistics.

I/ TECHNICAL COOKIES NOT REQUIRING PRIOR CONSENT

The purpose of cookies is to enable :

• optimal browsing and page display on our site,
• improved security for our platform,
• management of site users' consent.

The use of these tracers does not require your consent in accordance with article 32 II of law no. 78-17 of 6 January 1978.

However, you can deactivate them at any time by going to your browser settings.

II/ THIRD-PARTY COOKIES REQUIRING YOUR PRIOR CONSENT

The purpose of cookies is to enable :

• analysis and measurement of site page traffic,
• integration of audiovisual content from online video sites.

These cookies are deactivated by default on this site. You can authorise them by clicking on "I accept".

You can change your mind at any time and give or withdraw your consent by clicking on the "main" icon at the bottom left of the screen.

12. ADDITIONAL PROVISIONS APPLICABLE TO RECRUITMENT (RECEIPT, ANALYSIS AND PROCESSING OF APPLICATIONS)

The data collected when your application is examined is processed by our firm in order to manage the recruitment process for its future employees.

The purpose of the processing carried out by the human resources department is to :

• manage the recruitment process, based on the execution of pre-contractual measures;
• to carry out compulsory formalities and complete the administrative file of successful candidates, on the basis of the performance of your employment or collaboration contract and our legal obligations;
• if you give your consent, the information you provide may be added to our CV library or used to respond to other job offers.

To meet these purposes, only personal information that is strictly necessary to assess your suitability for the job offered or to measure your professional skills will be requested during the selection phase. To this end, we will ask you for data relating to the qualifications you have obtained, your professional experience, and your professional skills and aptitudes in relation to the position offered. Failure to provide this information will make it impossible for you to take part in the recruitment process.

If your application is selected for the conclusion of a contract, we will ask you for the information and supporting documents required to complete the compulsory formalities (civil status, address, social security registration number, residency status, etc.).

Data is kept for as long as is necessary to complete the recruitment process.

Data concerning successful candidates will be included in their administrative file and will be kept for the applicable retention period (i.e. up to five years after the end of the employment relationship).

At the end of the recruitment process, data relating to unsuccessful candidates will be kept for three months so that they can obtain an explanation of the reasons that led to this decision, after which they will be destroyed.