PRIVACY POLICY AND PERSONAL DATA PROTECTION

ADC ACTIVE DISTRIBUTION COMPANY

PREAMBLE

ADC ACTIVE DISTRIBUTION COMPANY places particular importance on the protection of privacy, the confidentiality of personal data and the security of information entrusted by its clients, prospects, suppliers and partners.

ADC is committed to processing personal data in compliance with:

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR);
• the amended French Data Protection Act (Loi Informatique et Libertés);
• the recommendations of the CNIL (French Data Protection Authority);
• the regulations applicable to electronic commerce.

The purpose of this policy is to inform data subjects about:

• the data collected;
• the purposes pursued;
• the legal bases for processing;
• the recipients;
• the retention periods;
• the rights available to them.

ARTICLE 1 – IDENTITY OF THE DATA CONTROLLER

The data controller is:

ADC ACTIVE DISTRIBUTION COMPANY (ADC SOLUTION)

Société par Actions Simplifiée

SIREN: 432 961 134

EU VAT number: FR64432961134

Registered office:

40 Impasse des Joncs 26780 MALATAVERNE France

Email: rgpd@adc-solution.com

Phone: +33 4 75 54 35 05

ADC determines the purposes and means of the processing carried out in the context of its commercial activity and the operation of its website.

ARTICLE 2 – DATA PROTECTION OFFICER

Any request relating to the protection of personal data may be addressed to:

ADC GDPR Department

Email: rgpd@adc-solution.com

Postal address:

ADC ACTIVE DISTRIBUTION COMPANY GDPR Department 40 Impasse des Joncs 26780 MALATAVERNE France

ADC reserves the right to appoint an external or internal DPO when necessary.

ARTICLE 3 – DATA SUBJECTS

The processing carried out by ADC may concern:

• professional clients;
• prospects;
• website visitors;
• registered account holders;
• legal representatives;
• employees of clients;
• suppliers;
• service providers;
• commercial partners;
• job applicants.

ARTICLE 4 – PROCESSING PRINCIPLES

ADC applies the following principles:

Lawfulness Data is collected on a valid legal basis.

Transparency Data subjects are clearly informed of the processing carried out.

Data minimisation Only data that is strictly necessary is collected.

Accuracy ADC endeavours to maintain accurate and up-to-date data.

Storage limitation Data is deleted or anonymised when its retention is no longer necessary.

Security ADC implements appropriate measures to ensure the confidentiality and integrity of data.

ARTICLE 5 – CATEGORIES OF DATA COLLECTED

5.1 Identification data

ADC may collect:

• last name;
• first name;
• title;
• job title;
• company name;
• SIREN number;
• EU VAT number;
• Kbis extract;
• professional supporting documents.

5.2 Contact details

ADC may collect:

• postal address;
• billing address;
• delivery address;
• email address;
• landline telephone number;
• mobile telephone number.

5.3 Customer account data

ADC may record:

• username;
• login history;
• order history;
• quote history;
• download history;
• commercial preferences.

Passwords are never stored in plain text.

5.4 Commercial data

ADC may retain:

• quotes;
• orders;
• invoices;
• commercial discounts;
• commercial exchanges;
• purchase history;
• complaints;
• after-sales service requests.

5.5 Technical data

ADC may collect:

• IP address;
• browser;
• operating system;
• language;
• device used;
• pages visited;
• browsing duration;
• connection logs.

5.6 Payment data

ADC may record:

• payment references;
• amounts;
• payment statuses;
• accounting information.

ADC never retains:

• full credit card numbers;
• card security codes (CVV/CVC);
• expiry dates.

5.7 Marketing data

ADC may record:

• newsletter subscriptions;
• email open rates;
• clicks;
• commercial preferences;
• areas of interest.

5.8 Regulatory compliance data

Given the nature of its activity, ADC may record:

• Safety Data Sheet (SDS) downloads;
• REACH document requests;
• certificate requests;
• CLP requests;
• batch histories;
• traceability requests.

ARTICLE 6 – ORIGIN OF DATA

Data may be collected:

Directly from data subjects:

• contact form;
• account creation;
• quote request;
• order placement;
• email;
• telephone.

Indirectly:

• professional directories;
• public databases;
• professional social networks;
• trade shows;
• commercial partners.

ARTICLE 7 – PURPOSES OF PROCESSING

ADC processes data in particular for:

Customer account management

• account creation;
• authentication;
• access management.

Commercial management

• quotes;
• orders;
• deliveries;
• invoicing.

Support and customer relations

• assistance;
• after-sales service;
• complaints;
• quality monitoring.

Regulatory compliance

• traceability;
• chemical safety;
• REACH obligations;
• CLP obligations.

IT security

• intrusion detection;
• fraud prevention;
• website security.

Commercial prospecting

• newsletters;
• marketing campaigns;
• invitations to professional events.

Administrative and accounting management

• tax obligations;
• accounting obligations;
• legal obligations.

ARTICLE 8 – LEGAL BASES FOR PROCESSING

ADC bases its processing on:

Performance of a contract For:

• orders;
• quotes;
• deliveries;
• invoicing.

Legal obligation For:

• accounting;
• taxation;
• regulatory obligations;
• traceability.

Legitimate interest For:

• security;
• fraud prevention;
• B2B prospecting;
• website improvement.

Consent For:

• newsletters;
• non-essential cookies;
• marketing communications where required.

ARTICLE 9 – FRAUD PREVENTION

ADC may implement specific processing intended to:

• prevent identity theft;
• detect fraudulent behaviour;
• verify VAT numbers;
• verify the professional status of clients;
• prevent payment defaults;
• protect information systems.

ADC may request any useful supporting document:

• Kbis extract;
• identity document;
• bank details;
• mandate.

An order may be put on hold pending the necessary verifications.

ARTICLE 10 – ABSENCE OF FULLY AUTOMATED DECISION-MAKING

ADC does not currently implement any decision producing significant legal effects based exclusively on automated processing within the meaning of Article 22 of the GDPR.

Any future development in this regard will be communicated specifically.

PART B – RECIPIENTS, PROCESSORS, TRANSFERS, RETENTION AND SECURITY

ARTICLE 11 – RECIPIENTS OF DATA

The personal data collected by ADC is accessible only to authorised persons in the context of their functions.

ADC applies a principle of access limitation based on operational needs.

11.1 ADC internal departments

The following may access certain data:

• general management;
• sales administration;
• commercial department;
• accounting department;
• logistics department;
• quality department;
• regulatory affairs department;
• IT department;
• marketing department;
• after-sales service.

Each employee only accesses data that is strictly necessary for carrying out their duties.

11.2 Service providers and processors

ADC may engage external service providers to carry out certain services.

These providers may intervene in particular for:

• website hosting;
• IT maintenance;
• cybersecurity;
• email sending;
• marketing campaigns;
• payment processing;
• delivery;
• backups;
• technical support.

ADC ensures that its processors provide sufficient guarantees regarding data protection.

Relations with these providers are governed by contracts compliant with Article 28 of the GDPR.

11.3 Carriers

The information necessary for shipping may be communicated to carriers:

• last name;
• first name;
• company name;
• address;
• telephone;
• email.

This information is limited to what is necessary for the proper execution of the delivery.

11.4 Payment service providers

Data strictly necessary for payment processing may be transmitted to the payment service providers selected by ADC.

ADC never retains:

• full credit card numbers;
• card security codes;
• banking authentication codes.

11.5 Legal advisors and authorities

ADC may be required to communicate certain information:

• to its legal advisors;
• to its chartered accountants;
• to its statutory auditors;
• to government agencies;
• to judicial authorities;
• to supervisory authorities.

Such communication takes place only when required by law or when necessary for the defence of ADC's rights.

ARTICLE 12 – NO SALE OF DATA

ADC does not sell personal data.

ADC does not rent personal data.

ADC does not transfer personal data to third parties for commercial purposes.

Any communication to commercial partners is based on an appropriate legal ground.

ARTICLE 13 – TRANSFERS OUTSIDE THE EUROPEAN UNION

ADC gives preference to hosting and processing data within the European Union.

However, certain technical providers may be located outside the European Union.

In such cases, ADC ensures that:

• the country benefits from an adequacy decision; or
• standard contractual clauses are implemented; or
• any other appropriate safeguard provided for by the GDPR is applied.

13.1 International tools

Certain tools may involve international data processing:

• cloud solutions;
• analytics tools;
• emailing platforms;
• CRM tools;
• support tools.

ADC selects recognised providers that implement appropriate protection mechanisms.

ARTICLE 14 – RETENTION PERIODS

ADC applies retention periods proportionate to the purposes pursued.

14.1 Customer accounts

Data relating to customer accounts is retained:

• throughout the commercial relationship;
• then for three years from the last active contact.

14.2 Commercial prospecting

Prospecting data is retained:

• three years after the last contact;
• or until consent is withdrawn where consent is required.

14.3 Orders and quotes

Data related to orders and quotes is retained:

• throughout the commercial relationship;
• then for the applicable statutory periods.

14.4 Invoices and accounting

Accounting documents are retained for:

• ten years.

14.5 Complaints and disputes

Data relating to disputes is retained:

• for the entire duration of the case;
• then until the statutory limitation periods have expired.

14.6 Security logs

Connection and security logs may be retained for:

• up to twelve months.

14.7 Regulatory data

Given ADC's activity, certain data relating to:

• batches;
• Safety Data Sheets;
• traceability;
• regulatory requests;

may be retained for ten years.

ARTICLE 15 – ARCHIVING

ADC may retain certain data in archived form where necessary:

• as proof of a contract;
• for the management of a dispute;
• to comply with legal obligations;
• to defend its rights.

Archives benefit from enhanced security measures.

ARTICLE 16 – DATA STORAGE LOCATION

ADC gives preference to infrastructure hosted:

• in France;
• or within the European Union.

Data may be stored on:

• secure servers;
• professional cloud solutions;
• redundant infrastructures.

ADC implements measures aimed at ensuring:

• availability;
• integrity;
• confidentiality of data.

ARTICLE 17 – DATA SECURITY

ADC implements appropriate technical and organisational measures.

17.1 Access security

ADC may in particular use:

• strong authentication;
• permission management;
• password policies;
• access control.

17.2 Exchange security

ADC secures exchanges in particular through:

• the HTTPS protocol;
• TLS encryption;
• integrity control mechanisms.

17.3 Infrastructure security

ADC may implement:

• firewalls;
• antivirus software;
• anti-malware;
• monitoring;
• logging;
• intrusion detection.

17.4 Backups

ADC carries out regular backups enabling:

• business continuity;
• data restoration;
• system resilience.

17.5 Awareness

ADC raises awareness among its employees regarding:

• confidentiality;
• cybersecurity;
• data protection best practices.

ARTICLE 18 – DATA BREACHES

ADC implements a security incident management procedure.

When a personal data breach is detected, ADC:

• identifies the incident;
• analyses the risks;
• documents the event;
• takes the necessary corrective measures.

18.1 Notification to the CNIL

When a breach presents a risk to the rights and freedoms of data subjects, ADC carries out the required notifications to the CNIL within the regulatory timeframes.

18.2 Notification to data subjects

When the breach is likely to result in a high risk, ADC informs the data subjects under the conditions provided for by the GDPR.

ARTICLE 19 – OBLIGATIONS OF PROCESSORS

ADC requires its processors to:

• comply with the GDPR;
• guarantee confidentiality;
• implement appropriate security measures;
• promptly notify any security incident.

ADC may carry out or request compliance checks where necessary.

ARTICLE 20 – EVOLUTION OF SECURITY MEASURES

ADC reserves the right to adapt its technical and organisational measures at any time in order to:

• take account of technological developments;
• respond to new threats;
• comply with regulatory changes;
• improve the protection of entrusted data.

PART C – RIGHTS OF DATA SUBJECTS AND LEGAL PROVISIONS

ARTICLE 21 – RIGHTS OF DATA SUBJECTS

In accordance with the General Data Protection Regulation (GDPR), every data subject has the following rights regarding their personal data.

These rights may be exercised at any time, subject to the limitations provided for by applicable regulations.

ARTICLE 22 – RIGHT OF ACCESS

Any data subject may obtain confirmation as to whether or not personal data concerning them is being processed by ADC.

Where processing is carried out, they may obtain in particular:

• confirmation of the processing;
• the categories of data concerned;
• the purposes pursued;
• the recipients of the data;
• the retention periods;
• the origin of data where it was not collected directly;
• the safeguards implemented in the event of transfer outside the European Union.

ADC may provide a copy of the data concerned under the conditions provided for by the GDPR.

ARTICLE 23 – RIGHT TO RECTIFICATION

Any data subject may request the correction of:

• inaccurate data;
• incomplete data;
• outdated data.

ADC will update the information as soon as possible where the request is well-founded.

ARTICLE 24 – RIGHT TO ERASURE

The data subject may request the deletion of their data in particular where:

• the data is no longer necessary;
• consent has been withdrawn;
• the processing is unlawful;
• a legal obligation requires it.

However, ADC may retain certain information where its retention is necessary:

• to comply with a legal obligation;
• for the performance of a contract;
• for the establishment, exercise or defence of legal claims;
• for accounting or tax retention purposes.

ARTICLE 25 – RIGHT TO RESTRICTION OF PROCESSING

The data subject may request a temporary restriction of processing in particular where:

• the accuracy of the data is contested;
• the processing is unlawful;
• the data is necessary for the defence of legal claims;
• an objection request is being examined.

During this period, data will be retained but its use will be limited in accordance with the regulations.

ARTICLE 26 – RIGHT TO OBJECT

Any data subject may object at any time to processing based on ADC's legitimate interest.

ADC may nevertheless continue the processing where there are:

• compelling legitimate grounds;
• legal obligations;
• necessities related to the defence of legal claims.

ARTICLE 27 – RIGHT TO DATA PORTABILITY

Where the conditions provided for by the GDPR are met, the data subject may request to receive the data they have provided:

• in a structured format;
• commonly used;
• machine-readable.

They may also request its transmission to another data controller where technically feasible.

ARTICLE 28 – WITHDRAWAL OF CONSENT

Where processing is based on consent, it may be withdrawn at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

ARTICLE 29 – POST-MORTEM DIRECTIVES

In accordance with French legislation, any person may define directives relating to the fate of their personal data after their death.

These directives may be:

• general;
• specific.

ADC will apply the instructions received within the limits provided for by applicable regulations.

ARTICLE 30 – EXERCISING RIGHTS

Requests relating to the rights described above may be addressed:

By post:

ADC ACTIVE DISTRIBUTION COMPANY GDPR Department 40 Impasse des Joncs 26780 MALATAVERNE France

By email: rgpd@adc-solution.com

Any request must sufficiently identify its author.

ARTICLE 31 – IDENTITY VERIFICATION

In order to protect personal data against unauthorised access, ADC may request additional elements to verify the identity of the applicant.

ADC reserves the right to:

• request a supporting document;
• request additional information;
• suspend the processing of the request in the event of reasonable doubt.

Supporting documents transmitted in this context will be deleted upon closure of the case.

ARTICLE 32 – RESPONSE TIMEFRAMES

ADC endeavours to respond to requests as soon as possible.

The response period is in principle one month from receipt of the request.

This period may be extended by a further two months where:

• the request is complex;
• the number of requests is high.

The data subject will be informed of this extension.

ARTICLE 33 – MANIFESTLY UNFOUNDED OR EXCESSIVE REQUESTS

In accordance with Article 12 of the GDPR, ADC may:

• refuse a request;
• charge a reasonable fee;

where it is manifestly unfounded, abusive or excessive.

ADC must be in a position to justify its decision.

ARTICLE 34 – MINORS

The ADC website is exclusively intended for a professional clientele.

ADC does not knowingly collect personal data relating to minors.

Any person who becomes aware of the presence of data relating to a minor is invited to contact ADC in order to enable its deletion where necessary.

ARTICLE 35 – COMPLAINT TO THE CNIL

Any data subject has the right to lodge a complaint with the competent supervisory authority.

In France:

Commission Nationale de l'Informatique et des Libertés (CNIL)

3 Place de Fontenoy TSA 80715 75334 PARIS CEDEX 07

www.cnil.fr

ADC nevertheless encourages data subjects to contact it beforehand in order to seek an amicable resolution.

ARTICLE 36 – UPDATES TO THIS POLICY

ADC reserves the right to modify this policy at any time in particular in order to:

• take account of legislative developments;
• take account of regulatory changes;
• integrate new services;
• improve the transparency of processing.

The applicable version is the one published on the website at the time of consultation.

ARTICLE 37 – VERSION ARCHIVING

ADC keeps a record of the main versions of this policy.

Previous versions may be retained for purposes of:

• proof;
• compliance;
• audit;
• dispute management.

ARTICLE 38 – SEVERABILITY

Should any provision of this policy be declared null or unenforceable, the remaining provisions shall remain in full force and effect.

ARTICLE 39 – APPLICABLE LAW

This policy is governed by French law.

Any difficulty relating to its interpretation or execution will be examined in accordance with the applicable legal provisions on personal data protection.

ARTICLE 40 – ACCEPTANCE

The use of the ADC website, the creation of a professional account, the request for a quote or the placement of an order implies acknowledgement of this privacy policy.

Where required by regulations, the necessary consents are obtained by ADC prior to carrying out the relevant processing.

COOKIE AND TRACKER POLICY

PART D – COOKIES, TRACKERS AND SIMILAR TECHNOLOGIES

ARTICLE 41 – DEFINITION OF COOKIES

A cookie is a text file placed on the user's device when browsing the ADC website.

Cookies enable in particular:

• the proper functioning of the website;
• the storage of browsing preferences;
• the security of access;
• audience measurement;
• the improvement of user experience;
• the personalisation of certain content.

The term "cookie" also covers similar technologies such as:

• localStorage;
• sessionStorage;
• pixels;
• tags;
• technical identifiers;
• audience measurement technologies.

ARTICLE 42 – PURPOSES OF COOKIES

The cookies used by ADC pursue in particular the following objectives:

• ensuring the technical functioning of the website;
• maintaining user sessions;
• securing forms;
• combating bots and automated attacks;
• storing consent choices;
• improving website performance;
• producing traffic statistics;
• facilitating navigation.

ARTICLE 43 – STRICTLY NECESSARY COOKIES

These cookies are essential to the functioning of the website.

They cannot be disabled via the consent manager as they are required to access the essential features of the website.

PHPSESSID

Purpose:

• maintenance of the user session;
• shopping cart retention;
• authentication;
• functioning of secure areas.

Duration: up to 1 year, 1 month and 4 days depending on the site configuration.

Nature: strictly necessary.

rc::a

Publisher: Google reCAPTCHA

Purpose:

• protection against bots;
• combating fraud attempts;
• securing forms.

Duration: persistent.

Nature: strictly necessary.

rc::c

Publisher: Google reCAPTCHA

Purpose:

• behavioural anti-bot verification.

Duration: session.

Nature: strictly necessary.

ARTICLE 44 – CONSENT MANAGEMENT COOKIES

ADC uses cookies designed to store the preferences expressed by the user regarding cookies.

cookiesplus

Purpose:

• storage of the consent choice;
• retention of user preferences.

Duration: 1 year.

Nature: functional.

ARTICLE 45 – FUNCTIONAL AND PREFERENCE COOKIES

These cookies improve the user experience and certain features of the website.

sib_cuid

Publisher: Brevo (formerly Sendinblue)

Purpose:

• technical management of campaigns;
• interaction tracking;
• improvement of the commercial relationship.

Duration: 6 months.

Nature: functional.

ARTICLE 46 – ANALYTICAL AND STATISTICAL COOKIES

ADC may use cookies enabling:

• analysis of website traffic;
• identification of pages visited;
• improvement of website performance;
• optimisation of user experience.

PrestaShop Cookies

Type: PrestaShop-*

Purpose:

• storage of certain preferences;
• technical browsing analysis;
• performance improvement.

Duration: approximately 20 days depending on the modules used.

Nature: analytical.

ARTICLE 47 – THIRD-PARTY COOKIES

Certain third-party services integrated into the website may place their own cookies.

These services may include in particular:

• Google reCAPTCHA;
• Brevo;
• PrestaShop Addons;
• statistics tools;
• maintenance tools;
• marketing tools.

ADC does not exercise control over the privacy policies of these third parties.

Users are invited to consult their respective policies directly.

ARTICLE 48 – CONSENT

On their first visit to the website, the user is presented with a banner enabling them to:

• accept all cookies;
• refuse all non-essential cookies;
• customise their choices.

No cookie subject to consent is placed before consent has been obtained.

ARTICLE 49 – WITHDRAWAL OF CONSENT

The user may at any time:

• modify their preferences;
• withdraw their consent;
• accept or refuse certain categories of cookies.

This modification can be made via the preference manager accessible on the website.

The withdrawal of consent does not affect the lawfulness of processing already carried out.

ARTICLE 50 – CONSENT RETENTION PERIOD

The choices expressed by the user are retained for a maximum period of thirteen months in accordance with the recommendations of the CNIL.

At the end of this period, renewed consent may be requested.

ARTICLE 51 – BROWSER SETTINGS

The user may also configure their browser in order to:

• accept or refuse cookies;
• delete cookies already stored;
• be notified before any cookie is placed.

The configuration options depend on the browser used.

Refusing certain cookies may affect certain features of the website.

ARTICLE 52 – LOCAL STORAGE AND SIMILAR TECHNOLOGIES

The ADC website may use:

• localStorage;
• sessionStorage;
• cache mechanisms;
• PrestaShop technical identifiers.

These technologies enable in particular:

• shopping cart retention;
• session maintenance;
• performance improvement;
• navigation security.

Where they are strictly necessary for the functioning of the service requested by the user, they are exempt from consent in accordance with the recommendations of the CNIL.

ARTICLE 53 – UPDATES TO THE COOKIE POLICY

ADC reserves the right to modify this policy at any time in order to take account of:

• regulatory changes;
• recommendations of the CNIL;
• new services integrated into the website;
• changes in the technologies used.

The version published on the website is authoritative.

ARTICLE 54 – CONTACT

For any question relating to cookies or personal data processing:

ADC ACTIVE DISTRIBUTION COMPANY

40 Impasse des Joncs 26780 MALATAVERNE France

Email: rgpd@adc-solution.com

or any other GDPR contact address indicated in the legal notices of the website.