eXo Platform SAS is a simplified joint stock company with capital of € 229,042.70 that is registered under company number 450 511 506 with Paris Register of Commerce and Companies. The company’s head office is at 4 rue d’Alleray 75015 Paris. Here, represented by its President, Mr Benjamin MESTRALLET (“eXo”) the company hereby commits to protecting the personal data of its Clients, visitors (“Users”) of its Websites, especially www.exoplatform.com (“Websites”)

By accessing and using the Websites, Users undertake to abide by and be bound by this Privacy Policy, which can be changed or updated at any time, without notice. Any modification or updates will be published online on the Website.

I. The nature of the personal data that is collected by eXo

eXo collects and processes the data that is provided voluntarily by Users in order to access or use the Websites, as well as data relating to Users’ preferences of users and traffic (such as IP addresses).

The purpose of this processing of data is to allow Users to access the Websites and use the services, improve services by placing cookies on Users’ devices, maintain our customer relationship and engage in dialogue via the Live Chat, to provide a service that is adapted to Users’ requirements and inform them about our products and service offerings, to perform tasks related to sales solicitation, in particular by sending newsletters, telephone calls, for the preparation of sales statistics, for the sale, lease or exchange of its soliciting files, the updating of its solicitation files, the management of rights of access requests, rectification and opposition, the management of people’s opinions of the products and services.

In some cases, Users could provide the following personal information as identification: name, email address, telephone number.

eXo shall never collect or process personal data directly or indirectly concerning: race, health, sexual orientation, political or philosophical convictions or religious beliefs.

II. Data other than that of a personal nature

2.1. Traffic

Traffic data is generated when Users’ devices connect to the Internet and, in isolation, is not sufficient to identify them. eXo may collect the following data: the origin of the connection, the type and the version of Internet browser that the User is using, the duration of the connection, etc. This data can be used for statistical purposes, to analyse traffic and improve websites. Traffic data is always processed anonymously.

2.2. Cookies

eXo places cookies on Users’ devices. Cookies are small files that contain, for example, traffic data and Users’ preferences.

The cookies placed by eXo have the following purpose: “User authentication”, recording Users’ visits and their origin and offering a LiveChat.

eXo uses the Google Analytics service (provided by Google Inc.) as a means of measuring audience reach, Mixpanel (provided by Mixpanel Inc.) and Smartlook (provided by Smartsupp.com, s.r.o) to collect the following data: the origin of connections (access providers), type and version of browser used, the language of the browser, duration of the connection, IP address, etc. and store cookies on Users’ devices in order to perform audience reach strategies. For further information, the Customer/Client or Users can consult the following sites: www.google.com/intl/fr/policies/privacy/ , Mixpanel.com/legal/dpa/ or smartlook.com/documents/dpa.pdf

Some partners of eXo can thus deposit cookies on the terminals of the Users: Google Analytics, Mixpanel and Smartlook for the purposes specified above as well as Marketo for the visits follow-up and the recording of the prospects, Intercom for the Live Chat, Pixel (Facebook) and Google Adwords for remarketing.

Cookies are required to navigate on the websites and must therefore be accepted by Users. Users can configure their browser to disable cookies or warn about them before accepting a cookie on the websites they visit. However, if Users disable cookies, they may not be able to use all the websites parts.

Cookies are valid for a period of thirteen (13) months. eXo will request a renewal of consent after this period

III. Processing of Users’ personal data

eXo collects and processes Users’ personal data in a fair and lawful manner that respects the rights of Users. eXo is the entity responsible for the processing of Users’ personal data.

IV. Storage of Users’ personal data

4. 1. Security

The personal data provided by Users is hosted by Salesforce, Google and Marketo, whose servers are located respectively in Dallas, South Carolina and San José in the United States

eXo endeavours to make its best efforts to avoid any interference with Users’ personal data, such as the loss, diversion, intrusion, unauthorised disclosure, alteration or destruction of personal data.

4. 2. Duration

The personal data processed by eXo will be deleted no later than three years from the date of the last contact arising from solicitation for prospect/user, following an unsubscription of the newsletter or in connection with the community (eXo tribe)

V. Transfer of Users’ personal data

eXo may transfer personal data to its subsidiary eXo MEA (which is located in Tunisia) for sales solicitation. eXo may transfer Users’ personal data if this so required by law or court order.

eXo may share Clients’/Customers’ or Users’ personal data with its trading partners, for the purpose of marketing, advertising or to offer products and services, including Marketo and Intercom. eXo may also share information in aggregated, anonymised form. Such information does not identify Users individually.

VI. Communications from eXo

eXo may send emails to Users at their email address for technical or administrative reasons, or to inform Users of the evolution of its services.

VII. Exercise of the rights of Users

The Users have rights concerning access, modification and rectification, and opposition to processing and portability. Users can request the deletion of personal data that has been collected or processed by eXo, and to lodge a complaint with a supervisory authority control and define the directives relating to your digital legacy.

Users are able to exercise these rights by writing to eXo at its postal address : 4 rue d’Alleray 75015 Paris or by visiting data-privacy@exoplatform.com.