Privacy & Cookie Policy

The protection of your personal data is Skeepers’ top priority.

The purpose of this Privacy and Cookie Policy (hereinafter the “Privacy Policy“) is to inform You (“Users” of our Services but also Internet Users) of the processing of your personal data carried out by Skeepers, and of your rights in this respect.

The Policy applies as soon as you arrive on the Skeepers website from the following URL address: https://skeepers.io/ (the “Site”) and governs the data processing carried out there. The Policy informs you of the use of Data made by Skeepers when you browse the Site and all the Services offered by Skeepers.

However, in order to obtain complete information on the processing of your Data that takes place within the framework of our Services (“Consumer Videos”, “Influencer Marketing”, “Rating & Reviews”), we kindly ask you to consult the relevant Privacy Policies:

“Influencer Marketing”: https://community.skeepers.io/privacy-policy/

“Consumer Videos”: https://legal.ugv.skeepers.io/PP/en/

Rating & Reviews: https://www.verified-reviews.com/en/

The Privacy Policy may be modified to take into account, in particular, changes in the processing of Data implemented and applicable legislation. You are therefore invited to read any new version made available by Skeepers.

This document was last updated in February 2024.

In the event of disagreement with the new wording of the “Privacy Policy”, you retain the right to request the deletion of all Personal Data concerning you by complying with the terms and conditions set out in section “10: Rights relating to Personal Data and their management”.

The Privacy Policy is divided as follows:

1: Definitions

2: General Information

3: Data Controllers and Data Subjects covered by this Privacy Policy

4: The processing of Personal Data by the Skeepers Group (origin of your data)

A) The processing of Personal Data carried out by Skeepers (Data Controller) on its website

1. The contact form
2. Request a demo
3. Subscribe to the Newsletter
4. Download the e-book
5. Register for our Webinars / Events
6. Access to the Replay of our Webinars
7. Management of applications and interviews (creation of a CV database)
8. Cookies

B) The processing of Personal Data carried out by Skeepers (Data Processor) as part of its Ratings & Reviews, FeedBack Management, Customer Data Activation and Live Shopping solutions

C) The processing of Personal Data carried out by Skeepers and its Clients (Separate Data Controllers) under its Influencer Marketing and Consumer Videos solutions

D) The processing of Personal Data by Skeepers (Data Controller) with respect to its Clients

5: “DO NOT USE MY SENSITIVE DATA” (CCPA/CPRA)

6: Social Media Data

7: Data Sharing / “DO NOT SHARE/SELL MY PERSONAL DATA” (CCPA/CPRA)

8: Data retention period

9: Data storage and security measures in place

10: Rights relating to Personal Data and their management

1: Definitions

Capitalized terms and phrases shall have the following meanings:

“Supervisory Authority ” means an independent public authority established by a Member State pursuant to Article 51 of the GDPR, and with which any data subject may lodge a complaint concerning the protection of his or her personal data, i.e. the Commission Nationale de l’Informatique et des Libertés (CNIL) in France;

“Campaign” means an operation shared with Creators to promote the products and/or services of one or more Clients (term specific to Consumer Videos and Influencer Marketing products).

“Customer” or ” Brand” means the legal entity, company, customer of Skeepers;

“Consent” of the data subject, means any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject agrees, by a statement or by a clear affirmative action, to the processing of personal data concerning him or her;

“Consumer” means a natural person who acts for purposes that do not fall within the scope of his or her commercial, industrial, craft or liberal activity;

“Content”: Refers to the texts, images, photographs, drawings, avatars, videos and more generally any visual, textual, sound and/or graphic publication of the Creator, representing the Brands’ Products;

“Creator”: Person previously registered and accessing the Skeepers platform for the purpose of generating Marketing and/or Consumer Video Influencer Content;

” Personal data” or “Personal Data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable natural person means a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

More simply, “personal data” is to be understood as any “personal data“, i.e. any information that is specific to you (surname, first name, age, address, email, telephone number, etc.);

“Skeepers Group or Skeepers” refers to the economic entity formed by the company Skeepers, SAS with a capital of €11,480,257, registered with the Marseille Trade and Companies Register under number 879 038 990, whose registered office is located at 18-20 Avenue Robert Schuman, CS 40494, 13002 Marseille, and all the Group’s Subsidiaries;

“Influencer”: Creator who has received a product for free so that they can post dedicated Content on their social network (e.g. Instagram, TikTok, YouTube, Pinterest, Blog, etc.);

“Internet users”: persons browsing the https://skeepers.io/ website ;

“Data Protection Regulation”: Includes REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, known as the General Data Protection Regulation (or GDPR), the Directive on Privacy and Electronic Communications 2002/58/EC (as amended by Directive 2009/136/EC, and as amended and replaced where necessary) and their transposition into national law, Law No. 78- 17 of 6 January 1978 relating to data processing, files and freedoms, known as the “Data Protection Act”; and any regulations, rules, derivative or related legislation implemented by the European Union, a Member State of the European Economic Area and any country outside the European Union and the European Economic Area concerning the processing and protection of Personal Data (as amended and replaced from time to time);

“Joint controllers” means two or more controllers who jointly determine the purposes and means of the processing(s) of personal data that they implement;

“Separate controllers” means two or more controllers who separately determine the purposes and means of the processing(s) of personal data that they implement;

‘Controller‘ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller may be designated or the specific criteria applicable to its appointment may be provided for by the law of the European Union. the Union or by the law of a Member State;

“Service(s)” / “Solutions” means the service(s) provided by the Skeepers Group – Ratings & Reviews, FeedBack Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos – that you use/subscribe to by the Client;

“Site” or “Platform” means the website from which the Skeepers Group offers its Ratings & Reviews, FeedBack Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos solutions, accessible from the following domain name: https://www.Skeepers.io/ ;

” Processor ” means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;

“Test”: Creator who has received a product free of charge in order to generate a video (Consumer Videos) or text (Influencer Marketing) review, which will be displayed on the Client’s and/or its partners’ e-commerce site.

“Processing your data” is a use of your Data, which can take any form (collection, recording, hosting, modification, transfer, etc.);

“User” means any person using any of the Skeepers Solutions.

” Personal data breach ” means a breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Any term specific to the protection of personal data (Data Controller, Data Subject, etc.) is defined in Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as the “General Data Protection Regulation“). or “GDPR“) which Skeepers undertakes to comply with.

2: General Information

By accessing and/or using the Site, and in general the Skeepers Services, you acknowledge that you have read the provisions of the Privacy Policy as a whole.

Access to the Site and use of the Services is prohibited to any minor under the age of sixteen. Therefore, by accessing and using the Site and Services, you represent and warrant that you are over 16 years of age if you are European, over 15 years of age if you are French, and over 13 years of age if you are American. If you are under the age requirement, you must not at any time or in any way access or use the Site and Services. If you are a parent or legal guardian of a minor and you believe that we hold Data about that minor, you may obtain deletion of the Data after proving your identity and legal authority over the minor by writing to privacy@skeepers.io .

3: Data Controllers and Data Subjects covered by this Privacy Policy

Skeepers, a simplified joint stock company with a capital of €11,480,257, registered with the Marseille Trade and Companies Register under number 879 038 990, and whose registered office is located at 18-20 Avenue Robert Schuman, CS 40494, 13002 Marseille, is the owner of the website https://www.skeepers.io/. It offers Ratings & Reviews, Feedback Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos.

Skeepers is particularly concerned about issues related to confidentiality, as well as the protection of the Personal Data of Users of its website and/or services, as well as those relating to its Customers. It takes this into account from the design of any new solution it offers to its customers.

It thus guarantees the highest level of protection of Personal Data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (known as the “General Data Protection Regulation”, hereinafter “GDPR”), French law (Data Protection Act of 1978, known as “LiL”) and, in general, with any regulations applicable to it in terms of the protection of such Personal Data ” Data Protection Regulation“.

This “Privacy & Cookie Policy” describes in detail the policy and practices of Skeepers (or the “Skeepers Group”) regarding the collection, use and disclosure of Personal Data that it processes on its behalf or on behalf of its Customers. The Data Subjects concerned by the processing of the Data are the Users of the Solutions, including in particular the Internet Users browsing the Site (“You“).

Skeepers is qualified as a Data Processor with respect to its Clients who have subscribed to the Rating&Reviews Solutions, FeedBack Management, Customer Data Activation and/or Live Shopping.

Skeepers is qualified as a separate Data Controller with respect to its Clients who have subscribed to the Consumer Videos and Influencer Marketing Solutions, to which it offers different types of Content, generated by Creators and/or Testers, sharing their experiences on the Brands’ Products received, with the aim of increasing their visibility, through the Influencers’ accounts on social networks and/or on the Brands’ websites and other Third-Party Platforms.

It is qualified as a joint Data Controller with the company Meta, the Instagram button inserted on the Site allowing access to the Instagram account of Skeepers. For more information on data processing and data protection at Meta: https://www.facebook.com/about/privacy . To have access to the Data Controller Agreement, which determines the respective responsibilities for compliance with the obligations arising from the GDPR with regard to the Joint Processing of registration/login to the Platform via the Facebook button: https://www.facebook.com/legal/controller_addendum .

It is qualified as a joint Data Controller with company X (ex-Twitter), the X button inserted on the Site allowing access to Skeepers’ X account. For more information on data processing and data protection at X (formerly Twitter): https://twitter.com/fr/privacy .

It is qualified as a joint Data Controller with Google, the Youtube button inserted on the Site allowing access to the Youtube account of Skeepers. For more information on data processing and data protection at Youtube: https://www.youtube.com/intl/ALL_fr/howyoutubeworks/user-settings/privacy/

4: The processing of Personal Data by the Keepers Group (origin of your data)

Skeepers receives, collects and processes your Personal Data from a variety of sources, which are set out below:

A) The processing of Personal Data carried out by Skeepers (Data Controller) on its website

1. The contact form

For any contact request made via the form available on the https://skeepers.io//contact/ page , the User gives his/her consent to Skeepers, via a checkbox, to process the following Personal Data:

Name and surname;
Email address;
Company

They must be filled in order to be able to contact you again to respond to your contact request, but also to offer you our other Services that may be of interest to you, taking into account your needs (Ratings & Reviews, FeedBack Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos). Otherwise, it will not be possible to send the contact form.

Skeepers will also be able to process any other personal data that the User has chosen to communicate to it in a deliberate manner, in the body of the message and during their exchanges.

Your information will be kept for three years, before deletion.

2. Request a demo

For any request for a demo made via the form available on the https://skeepers.io//demo/ page

, the User gives his/her consent to Skeepers, via a checkbox, to process the following Personal Data:

Name and surname;
Email address;
Company Name;
Level of position held;
Position held;

They must be filled in in order to be able to contact you again to respond to your request for a demo, but also to send you personalized communications and offer you our other Services that would be likely to be of interest to you, taking into account your needs (Ratings & Reviews, FeedBack Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos). Otherwise, it will not be possible to send the contact formula.

Skeepers will also be able to process any other personal data that the User has chosen to communicate to them in a deliberate manner, such as their telephone number, in the form, in the body of the message and during their exchanges.

Your information will be kept for three years from the last contact, before deletion.

3. Subscribe to the Newsletter

For any subscription to the Newsletter made via the “Subscribe to our newsletter” insert on the Website https://skeepers.io// the User gives his consent to Skeepers, by entering his email address, to send him his newsletter.

The User can unsubscribe at any time via the unsubscribe link at the bottom of each email. Your information will be kept until you exercise your rights of objection and/or deletion.

4. Download the e-book

For any download of e-books, white papers and guides present on the link https://skeepers.io//livres-blancs/ the User gives consent to Skeepers, via a checkbox, to process the following Personal Data:

Name and surname;
Professional email address;
Company

They must be filled in order to be able to download the e-book, to contact you to better understand your needs, but also to send you personalized communications and offer you our additional solutions (Rating&Reviews, Feedback Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos). Otherwise, the e-book will not be downloaded.

Skeepers will also be able to process any other personal data that the User has chosen to communicate to it in a deliberate manner, in the body of the message and during their exchanges.

Your information will be kept for three years from the last contact, before deletion.

5. Register for our Webinars / Events

For any registration for one of our Webinars on the https://skeepers.io//webinars/ page or for one of our events on the https://skeepers.io//evenements/ page, the User consents to the collection of his/her email address by the Skeepers partner, and shared with the latter.

The email address must be provided in order to be able to register for the Webinar / event, but also to send you personalized communications and offer you our additional solutions (Rating&Reviews, Feedback Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos). Otherwise, access to the Webinar / event will be impossible.

Skeepers will also be able to process any other personal data that the User has chosen to communicate to it in a deliberate manner in the body of the message and during their exchanges.

Your information will be kept for three years from the last contact, before deletion.

6. Access to the replay of our Webinars

For any request for access to the replay of our Webinars via the form available on the https://skeepers.io//webinars/ page , the User gives his/her consent to Skeepers, via a checkbox, to process the following Personal Data:

Name and surname;
Email address;
Company Name;
Level of position held;
Position

They must be filled in in order to be able to access the replays, contact you to find out your needs but also to send you personalized communications and offer you our additional solutions (Rating&Reviews, Feedback Management, Customer Data Activation, Influencer Marketing, Live Shopping and Consumer Videos). Otherwise, access to the replay of our Webinars will be impossible.

Skeepers will also be able to process any other personal data that the User has chosen to communicate to it in a deliberate manner in the body of the message and during their exchanges.

Your information will be kept for three years from the last contact, before deletion.

7. Management of applications and interviews (creation of a CV database)

Any application received, spontaneously or in response to one of our job offers within the Skeepers Group, will be treated with the greatest care and attention from our Human Resources.

If, unfortunately, your profile has not been retained, we will keep your information (CV and cover letter) for 2 years, before deleting it, unless you exercise your right to object or delete it before the end of the given period.

The processing of your data is justified by the legitimate interest of the Skeepers Group to recruit and build up a CV database. The legal basis is pre-contractual when the candidate’s profile has been selected to join the Skeepers Group.

You have various rights over your information, including those of access, updating, opposition and deletion, the terms of which are presented to you in section “10: Rights relating to Personal Data and their management”.

LinkedIn’s privacy policy can be found at the following link: https://fr.linkedin.com/legal/privacy-policy

8. Cookies

Access to and browsing on the Site https://www.Skeepers.io/ triggers the processing of data collected through cookies, pixels and other similar technologies, trackers (collectively referred to as “Cookies” in this “Privacy and Cookie Policy”) necessary for the Site to function, in order to make your visit to the Site as simple, reliable and useful as possible.

Non-essential cookies are subject to the User’s prior consent before they are deposited.

· What is a cookie?

Cookies are basic digital information (text files) about how Internet users use the Internet; They do not identify you personally, but they do identify the computer you are using, based on data from your hardware and software. This data may include: your IP address and browser settings (type of browser used, browser language, time zone, referring website, domain names of sites visited, and information about your online activity: dates and times of access and the addresses of the website from which you accessed the Site).

Thus, during your various visits to the Skeepers Site, Cookies make it possible to recognize your computer or mobile device and thus personalize and improve your navigation. Cookies and other Trackers contain information that the Site uses to make communication with your browser more efficient.

To learn more about cookies, including how to block them on Chrome, Firefox and Internet Explorer browsers: https://allaboutcookies.org/

However, you are advised not to disable so-called “essential” Cookies from your browser as you may no longer have access to the Site and will no longer be able to browse it.

Where applicable, Skeepers declines all responsibility for the consequences related to the degraded behavior of the Site resulting from the impossibility of using the Cookies necessary for its operation.

· Why does Skeepers use cookies?

1/ Skeepers uses so-called “essential” Cookies (“necessary” is the term used by specialized sites, in particular on that of the CNIL) whose function is to facilitate your access to the Site, while helping you to navigate and use all the features of the Site.

These cookies are also used to detect and prevent fraud.

These cookies do not require your consent as they are strictly necessary for the Site to function.

In order to find out more, you can consult them when you first visit the https://skeepers.io// website and at any time from the Cookies banner button, in the “Customize” section, then “Strictly necessary cookies”, and finally “Cookie details”.

2/ Skeepers also uses functionality and performance cookies that provide it with information about the use made of its Site, and allow it to better understand how it can improve its Site.

These Cookies are used by Skeepers:

for marketing purposes to generate different statistics such as demographic statistics;
in order to measure the performance and traffic of its Website;
in order to optimize the experience on its

[Data Sharing / “DO NOT SHARE/SELL MY PERSONAL DATA”]

In order to find out more, refuse or accept all or some of these functionality and performance Cookies, you can go to the “Customize” section, then “Functionality cookies”, “Performance cookies”, and finally “Cookie details” when you first visit the https://skeepers.io// website and at any time from the Cookies banner button. Thanks to the buttons at your disposal, you can accept all of them, reject them all, or accept some and reject others.

3/ By visiting the Skeepers https://skeepers.io// Site, “Third-Party Cookies” may be installed: these are Cookies placed on a User’s computer by the server of a domain separate from the Skeepers Site . Thus, a Third-Party Cookie “collected” on the Skeepers Site has not been placed by it but by its advertising partners, by social networks. They may be used by these companies to build a profile of your interests and provide you with relevant advertisements on other websites. They do not directly store personal data, but are based on the unique identification of your browser and internet device. If you do not allow these cookies, your advertising will be less targeted.

[Data Sharing / “DO NOT SHARE/SELL MY PERSONAL DATA”]

In order to find out more, refuse or accept all or some of these Third-Party Cookies (called “Social Network Cookies” and “Cookies for targeted advertising”), you can go to the “Customize” section when you first visit the https://skeepers.io/ website and at any time from the Cookies banner button, then “Social Network Cookies”, “Cookies for targeted advertising”, and finally “Cookie details”. Thanks to the buttons at your disposal, you can accept all of them, reject them all, or accept some and reject others.

B) The processing of Personal Data carried out by Skeepers (Data Processor) as part of its Ratings & Reviews, FeedBack Management, Customer Data Activation and Live Shopping solutions

Skeepers may have to process Personal Data in connection with its Ratings & Reviews, FeedBack Management, Customer Data Activation and Live Shopping solutions as a Data Processor on behalf of its Customers.

Its Customers, as Data Controllers, ensure compliance with the Principles relating to the processing of Personal Data (Article 5 of the GDPR), i.e. the lawfulness, fairness and transparency of the collection of Personal Data that they carry out from their consumers, end customers, prospects and more generally all “Data Subjects”, which they then pass on to the Skeepers Group. Skeepers, for its part, undertakes to comply with its obligations as a Data Processor under Article 28 of the GDPR and to apply the principle of Privacy by Design to all its Solutions.

Skeepers’ Clients must comply with the GDPR: to do so, they must inform their consumers, end customers, prospects and more generally all “Data Subjects” of the processing of their Personal Data by the SKEEPERS Group, prior to any collection of their data and in accordance with Articles 12 et seq. of the Regulation. They collect their prior consent where appropriate.

The Personal Data that is communicated to the Skeepers Group must be accurate, adequate, relevant and limited to what is necessary for explicit and legitimate purposes determined by the Data Controllers and which Skeepers respects. Skeepers, as part of its Ratings & Reviews, FeedBack Management, Customer Data Activation and Live Shopping solutions, stores them securely for no longer than is necessary for the purposes for which they are processed.

Customers of the Skeepers Group remain solely liable to Data Subjects for any lack of information, inaccuracies, errors or omissions relating to their Data.

The Skeepers Group therefore declines all responsibility in the event of violation of these fundamental principles by its Customers, and invites Data Subjects who believe that their rights have been violated, to contact them directly.

The table below details the data processing(s) implemented by SKEEPERS as part of the Rating & Reviews solution on behalf of its Clients

Nature of the operations carried out on personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Modification

■ Consultation/Access

■ Usage

■ Erasure / anonymization

■ Organization

■ Extraction

■ Communication

■ Dissemination

■ Provision

■ Destruction

Purposes of personal data processing operations carried out by SKEEPERS on behalf of the Client

Collection, management and dissemination of Consumer Reviews (on the Client’s websites, partner commercial sites, Third- Party Platforms, search engines, social networks)

Categories of personal data processed

· Consumer’s name;

· Consumer’s first name;

· Consumer’s email;

· Consumer’s phone number if sending an SMS;

· Order number / reference;

· Order date;

· Country Code;

· Product purchased;

· Image (if applicable);

· Place of In-Store Purchase (if applicable);

· IP address;

· Email opening tracker (date, time, email delivery status, IP address, type of device used);

· The ratings given by the consumer to their customer experience;

· Content of the Review (personal opinion about their customer experience);

· The date and time of publication of the Notice;

· The consumer’s response(s) to the Merchant Partner’s comment(s) in relation to a Review;

· Consumers’ answer(s) to questions asked by Internet users on the Client’s website.

No sensitive data will be accepted/processed.

Categories of data subjects (hereinafter referred to as “Data Subjects”)	■ Consumers ■ Leads ■ Client’s employees
Legal basis	Customer’s Legitimate Interest or Consumers’ Consent (at Customer’s choice)
Recipients	At the Client’s choice: – E-commerce connectors; – Third-party vendors; – Social media; – Third-party platforms; – Brands and distributors.
Retention period(s)	Personal data is retained for 3 months from the sending of the VERIFIED REVIEWS email, if no review is filed, or 18 months from the filing of the Review, when a consumer has filed a Review. The personal data attached to each Review is deleted by automated anonymization. The anonymized Reviews are kept for a period of 5 years, from the date of their publication, solely for statistical purposes. They are deleted from the database and backups at the end of the 5 years. The data deletion process takes place over a rolling one (1) month.

The table below details the data processing(s) implemented by SKEEPERS as part of the Feedback Management solution on behalf of its Clients

Nature of the operations carried out on personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Modification

■ Consultation/Access

■ Usage

■ Erasure / anonymization

■ Organization

■ Structuring

■ Adaptation

■ Extraction

■ Communication

■ Dissemination

■ Provision

■ Interconnection

■ Destruction

Purposes of personal data processing operations carried out by SKEEPERS on behalf of the Client

Collect and manage customer insights by sending questionnaires at all stages of the buying journey to optimize the experience and engagement of prospects and customers, continuously.

Categories of personal data processed;

Non-exhaustive list, according to the needs of the Data Controller:

o Name of the Respondent;

	o Respondent’s First Name; o Gender of the Respondent; o Respondent’s e-mail; o Client ID (assigned by the Client); o Country; o order number, purchase reference, etc. o Date of purchase/order/subscription o date of solicitation/sending of the email or SMS o Image (if applicable); o “Raw Insights”, i.e. the feedback from the Respondents previously defined by the CLIENT (level of satisfaction, comments, etc.); o The insights triggering the re- engagement actions determined by the CLIENT; o Cookies; o Etc. No sensitive data will be accepted/processed.
Categories of data subjects (hereinafter referred to as “Data Subjects”)	■ Respondents (determined according to the Client’s needs: employees, the Client’s customers, prospects, partners, etc.) ■ Users of the Solution
Legal basis	Customer’s legitimate interest or consumers’ consent (at Customer’s choice)
Recipients	At the Client’s choice: – E-commerce connectors; – Third-party vendors; – Third-Party Platforms.
Retention period(s)	Questionnaire responses and related personal data are active and available on the customer’s account for a period of 24 months. This retention period is justified in order to carry out statistical studies relevant to the Client. It is possible to configure a shorter period at the Customer’s request. At the end of the chosen retention period, the answers to the questionnaires and the personal data attached to them are kept for a further period of 12 months. They may not be consulted by the Client, their retention is only justified by the activation of the reversibility clause which may occur during this period and will allow their extraction. Beyond these additional 12 months, personal data will be anonymized.

The table below details the data processing(s) implemented by SKEEPERS as part of the Customer Data Activation solution on behalf of the Client

Nature of the operations carried out on personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Modification

■ Consultation/Access

■ Usage

■ Erasure

■ Organization

■ Structuring

■ Extraction

■ Communication

■ Dissemination

■ Provision

■ Reconciliation

■ Interconnection

■ Destruction

Purposes of the personal data processing operations carried out by SKEEPERS

· Measurement of site visitation;

· Monitoring of customer behavior for a reconciliation of the online and offline journey;

· Commercial prospecting operations.

Categories of personal data processed

Non-exhaustive list, according to the needs of the Data Controller:

· Personal data identifying individuals (surname, first name, date of birth);

· Personal data relating to personal life (postal address, e-mail address, telephone number, number of children);

· Personal data related to transactions of products and services purchased;

· Personal data related to browsing;

· Location-related personal data;

· Cookies / “email opening pixel”

Categories of data subjects (hereinafter referred to as “Data Subjects”)	■ Leads ■ Consumers
Legal basis	Customer’s legitimate interest or consumers’ consent (at Customer’s choice)
Recipients	At the Client’s choice: – E-commerce connectors; – Third-party vendors; – Third-Party Platforms.
Retention period(s)	Each customer determines the appropriate retention period for their data within the framework of its internal policy. Unless otherwise instructed by the Client, the data is stored by Skeepers for the duration of the contractual relationship.

The table below details the data processing(s) implemented by SKEEPERS under the Live Shopping solution on behalf of the Customer

Nature of the operations carried out on personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Consultation/Access

■ Usage

■ Erasure

■ Communication

■ Dissemination

■ Provision

■ Destruction

Purposes of personal data processing operations carried out by SKEEPERS on behalf of the Client

Main purpose: Connecting potential buyers on the Client’s online sales platform with the Client’s sellers and/or advisors, through the broadcasting of Live Shopping, with the aim of triggering purchases.

Specific processing for the “Contests” add-on:

Development and distribution of attractive content encouraging prospects to participate in competitions using a widget implemented on the Skeepers Customers’ shopping party player.

Categories of personal data processed

· “Customer ID” session ID: assigned to each user on each Live Shopping login, whether live or replayed;

· Video: image and voice of the Client’s employees;

· The telephone numbers OR email addresses of potential buyers who wish to be notified of the Customer’s Live Shopping via the Customer’s form;

· Link opening tracking implemented in the SMS notification of the start of Live shopping;

· Number of voters in the survey circulated by the Client.

For processing specific to the “Contests” add-on:

· Navigation

· number of registrations,

· number of options,

· Number of partner options

· Participant Identification:

Categories of data subjects (hereinafter referred to as “Data Subjects”)

· The Client’s salespeople and/or advisors (the Client’s employees);

· prospects;

· Participants in competitions (end customers or prospects)

Legal basis

Customer’s legitimate interest or consumers’ consent (at Customer’s choice)

Recipients

At the Client’s choice:

– E-commerce connectors;

– Third-party vendors;

– Social media;

– Third-Party Platforms.

Retention period(s)

· Session ID “Customer ID”: kept for the duration of the Session;

· Javascript tag: Duration of the Contract (used to display product videos (Shoppable content) and live shopping;

· Application logs: 6 months;

· Skeepers stores and preserves the videos in order to allow them to be replayed on the sites and pages identified by the Client for the entire Term of the Contract;

· The information collected to notify potential buyers of the Live Shopping for which they have registered is deleted 24 hours after the date and time of the Live Shopping.

For processing specific to the “Contests” service :

· 12 months by default, destruction on request

Personal data is processed at Skeepers only by the competent departments, which need to know the information for the proper performance of their duties. They are subject to a Confidentiality Agreement.

SKEEPERS TRACKER (Rating&Reviews, Live Shopping)

Name: Skeepers performance tracker Host: Client’s website

Cookie Type: Performance Cookie (1rst Party)

Legal basis: Consent collected by the Client’s Tag Manager

Purpose: to produce performance metrics to demonstrate the impact of the presence of review, video or live widgets on prospects’ purchasing behavior on customers’ e-commerce sites .

Shelf life: 13 months

C) The processing of Personal Data carried out by Skeepers and its Clients (Separate Data Controllers) under its Influencer Marketing and Consumer Videos solutions

Clients subscribing to Skeepers’ Influencer Marketing and/or Consumer Video Solutions acknowledge that they are acting with Skeepers as separate Data Controllers: they must comply with their legal obligations and maintain the confidentiality and security of the Data they share with Skeepers (“Shared Data”).

The Separate Data Controllers have formalized an Agreement on the specific conditions under which each of them will act as a separate Data Controller on the Shared Data. The outline of this agreement must be made available to data subjects within, for example, the privacy policies or any other appropriate document of the separate controllers, in order to comply with their duty to inform, which they undertake to do.

In this Privacy and Cookies Policy of Skeepers, it is stated that the Separate Data Controllers undertake in particular, to:

collect and process Personal Data in accordance with the regulations in force, in compliance with the Principles relating to the processing of Personal Data (Article 5 of the GDPR). The legal basis for the processing of data of data subjects by Skeepers under its Influencer Marketing and Consumer Videos solutions is the contractual basis (Article 6 §1 b) of the GDPR), with Users subscribing to its Services;
comply, prior to and throughout the duration of the processing, with the laws and regulations applicable to the protection of Personal Data, and in particular the GDPR;
implement organizational, technical, software and physical measures to protect the Data against alteration, destruction and unauthorized access;
ensure that the persons authorised to process the Data undertake to respect confidentiality or are subject to an obligation of confidentiality;
guarantee Users the effective exercise of all the rights they have under the GDPR;
not to use the Shared Data for purposes other than those expressly determined between them;
never transfer or make available the Shared Data and files to third parties for any purpose whatsoever and in particular for commercial prospecting purposes without the prior consent of the User;
retain Shared Data only for as long as is strictly

For a full list of Customers with whom the Skeepers Group is a separate Data Controller, please write to privacy@skeepers.io .

The table below details the data processing implemented by SKEEPERS under the Consumer Videos solution :

Nature of the operations carried out on personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Modification

■ Consultation/Access

■ Usage

■ Erasure

■ Extraction

■ Communication

■ Dissemination

■ Provision

■ Interconnection

■ Destruction

Purposes of the personal data processing operations carried out by Skeepers

Main purpose:

Creating, processing and distributing promotional videos on the Internet. .

Categories of Personal Data Processed (“Shared Data”)

· Name;

· Forename;

· Photo;

· Video;

· Date of birth;

· Email;

· Telephone number;

· Mailing address;

· Interests;

· Information published on social media;

· IP address;

· Tracers;

· Performance metrics;

· History and details of participation in Campaigns;

· Number and dates of Videos and Content published on the Platform;

· Reviews, votes, shares on Videos;

· Attachments attached to Internal Notes/Messaging that may contain Personal Data.

Categories of data subjects (hereinafter referred to as “Data Subjects”)

■ Users of the Consumer Videos platform;

■ Testers

■ End customers / consumers or prospects

of the Client;

■ Customer’s contacts and business partners;

■ Employees or external employees hired by

the Client.

Recipients

At the option of the Parties:

– E-commerce connectors;

– Social media;

– Third-party vendors;

– Third-party platforms;

– Brands and distributors.

Retention period(s)

The contact data, video data processed by the Platform are active and available on the customer’s account for 12 months.

After 12 months, the data related to the videos and videos are kept for the following purposes:

• The videos are kept for 20 years and can be made accessible when a new license is taken out by the Client;

• The video-related data (contact data / video data) is made accessible at the customer’s request for 12 months. At the end of this period, this data is anonymised and stored for statistical purposes. Anonymization is the process of substituting fake data for all personal data. Once anonymized, the data is no longer accessible to the Client.

The durations may be modulated by the Client (with the exception of the retention period of the Videos)

Users/Testers’ Data is kept for the duration of their activity on the Platform. They will be anonymized 6 months after the closure of their account;

Users/Testers’ Data is deleted within 2 years of their last activity on their account.

The table below details the data processing(s) implemented by SKEEPERS as part of the Influencer Marketing solution

Nature of the operations carried out on the personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Modification

■ Consultation/Access

■ Usage

■ Erasure

■ Organization

■ Extraction

■ Communication

■ Dissemination

■ Provision

■ Reconciliation

■ Interconnection

■ Destruction

Purposes of the processing of personal data carried out by SKEEPERS

Main purpose (Influencers):

· To put the Client in touch with influencers, users of the platform, in order for them to create content presenting the Client’s products on the Client’s social networks and/or websites, according to the campaigns chosen by the latter.

Main purpose (Testers):

· To connect the Client with consumers, users of the platform, in order for the latter to write written reviews about the Client’s products on the Client’s websites.

Categories of personal data processed

Mandatory for registration on the Platform:

o Email;

o Location (country);

o Date of birth.

Mandatory for Consumer Campaigns:

o Name and surname;

o Gender;

o Full mailing address;

o Telephone number.

Mandatory for Influencer Campaigns:

o Name and surname;

o Gender;

o Full mailing address;

o Telephone number;

o Public data accessible from the Influencer’s account on their social networks, retrieved via API

o Performance metrics.

Not Required by Influencers:

o Image (and voice if Video);

o Skin color;

o Relationship status;

o Parenting;

o Number of children;

o Animals;

o Purchasing habits;

o Skin type and concerns;

o Beauty habits;

o Hair color/type;

o Household income;

o Diet;

o Eyebrow color;

o Glasses;

o Sizes;

o Lifestyle;

o Skin problems;

o Favorite brands;

o Interests;

o Cookies.

Sensitive Data / “DO NOT USE MY SENSITIVE DATA”: for more information on the processing of your Sensitive Personal Data on the Influencer Marketing Platform, please visit the following link:

https://community.skeepers.io/

Not Required by consumers:

o Image

o Cookies

Categories of Data Subjects (hereinafter referred to as “Data Subjects”)

■ Influencers

■ Consumers

Recipients

At the option of the Parties:

– E-commerce connectors;

– Social media;

– Third-party vendors;

– Third-party platforms;

– Brands and distributors.

Retention period(s)

Creators’ personal data is kept for the duration of their activity on their Creator space. They will be anonymized 6 months after the closure of their account. Accounts are deleted 2 years from their last activity on their account.

SKEEPERS TRACKER

Name: Skeepers performance tracker Host: Client’s website

Cookie Type: Performance Cookie (1rst Party)

Legal basis: Consent collected by the Client’s Tag Manager

Purpose: to produce performance metrics to demonstrate the impact of the presence of review, video or live widgets on prospects’ purchasing behavior on customers’ e-commerce sites .

Shelf life: 13 months

D) The processing of Personal Data by Skeepers (Data Controller) with respect to its Clients

As part of the subscription to one or more of the Skeepers Group’s solutions, and then as part of this collaboration, Skeepers processes the Personal Data of its Customers.

The table below details the data processing carried out by the Skeepers Group in connection with its relations with its Clients:

Nature of the operations carried out on personal data

■ Reception

■ Collection

■ Registration

■ Retention

■ Modification

■ Consultation/Access

■ Usage

■ Erasure

■ Extraction

■ Communication

■ Dissemination

■ Provision

■ Interconnection

■ Destruction

Purposes of the personal data processing operations carried out by Skeepers in connection with its relations with its Clients

· Listening to and recording telephone and video conversations in the context of incoming and outgoing calls with prospects/customers in order to improve the quality of the service provided;

· Manage the contractual/commercial relationship;

· Create and manage the Client’s Back Office;

· Enable access to and use of the Platform and its services;

· Carry out all operations related to the Services,

· Communicate with the Client in the context of the performance of the Services or for information purposes in the event of changes to the General Terms and Conditions;

· Provide a support service (in particular by Chatbot);

· Sending commercial information in relation to the Subscribed or Similar Services (UGC);

· Carry out Customer Review surveys;

· Analyze data, audience types and usage trends;

· Perform marketing and statistical analyses;

· Carry out statistics in order to improve the functioning and optimize the Back Office;

· Compile statistics in order to improve the operation and optimize our Solutions;

· Maintain the Platform in its proper functioning and in a secure environment;

· Resolve any technical incidents encountered;

· Request payment for the Services subscribed to;

· Manage unpaid bills, litigation and disputes;

· Detection, prevention and fight against fraud and cybercrime;

· Keeping of general and auxiliary accounts;

· Responding to official requests from public or judicial authorities authorized for this purpose;

· Acquisition audit by potential buyers

Categories of personal data processed

· Last name;

· Forename;

· Professional email address;

· Business phone number;

· Image (if video interview);

· Voice (if video/audio interview);

· Identifier;

· Password;

· Connection logs;

· Cookies and other Trackers;

· Bank details.

Categories of data subjects (hereinafter referred to as “Data Subjects”)

· Employees, assimilated or external employees hired by the Client

Legal basis (depending on the purpose)

· Pre-Contractual / Contractual

· Skeepers’ legitimate interest

· Consent (prior to video/audio interview recording)

· Legal Obligation

Retention period(s)

Five (5) years from the end of the contractual relationship between the Skeepers Group and the Client (common law statute of limitations in civil and commercial matters).

Three (3) years from the last contact in the context of commercial prospecting.

Retention for a maximum period of 6 months from the date of recording of the audio or video interview. The data in the analysis documents (reports and analysis grids) are kept for one (1) year from their collection.

Retention for the duration of the litigation, deletion of the data once all appeals have been exhausted and the decision has become enforceable or the statute of limitations of the legal action.

In the event of an amicable settlement of the dispute, deletion as soon as the dispute is settled.

Retention for the current accounting year, increased by ten (10) years from closing.

Personal data is processed in the Skeepers Group only by the competent departments, which need to know the information for the proper performance of their tasks. They are subject to a Confidentiality Agreement.

5: “DO NOT USE MY SENSITIVE DATA” (CCPA/CPRA)

Sensitive data is a special category of personal data.

This is information that reveals the alleged racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Skeepers does not collect any sensitive data on https://skeepers.io/ (the “Site”).

Regarding the processing of sensitive data that takes place within the framework of our Solutions, we kindly ask you to consult the relevant Privacy Policies:

“Influencer Marketing”: https://community.skeepers.io/

6: Social Media Data

To find out which Social Media Data is processed by our Solutions, please consult the Privacy Policy of the Solution concerned:

“Influencer Marketing”: https://community.skeepers.io/

“Consumer Videos”: https://legal.ugv.skeepers.io/PP/en/

Rating & Reviews: https://www.verified-reviews.com/en/privacy-policy/

7: Data Sharing / “DO NOT SHARE/SELL MY PERSONAL DATA” (CCPA/CPRA)

To find out which Third Parties Skeepers shares your Data with, please consult the Privacy Policy of the relevant Solution:

“Influencer Marketing”: https://community.skeepers.io/

“Consumer Videos”: https://legal.ugv.skeepers.io/PP/en/

Rating & Reviews: https://www.verified-reviews.com/en/privacy-policy/

At Skeepers, your Personal Data has never been sold to third parties and never will be.

Skeepers undertakes to verify that all its subcontractors and partners necessary for the performance of the services scrupulously comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and to enter into contracts with them including a Data Processing Agreement and a Non-Disclosure Agreement.

In this context, all SKEEPERS subcontractors and partners are required to provide sufficient guarantees demonstrating that the applicable technical and organisational security measures for the protection of Personal Data have been taken (Article 32 of the GDPR).

In order to ensure the proper functioning of its Services, Skeepers uses IT and technical service providers (e.g. those in charge of maintaining the IS) such as IT service providers (e.g. the hosting provider), SaaS solutions that need to have access to Data to carry out the mission entrusted to them by Skeepers. Skeepers imposes strong obligations on these contracting parties in terms of processing, confidentiality and security of the Data to which these service providers have access.

Skeepers may also share your Data with its subcontractors in order to perform statistical analysis, editing, subtitling videos, manage video projects, send you an email, SMS, or mail, provide customer support, etc. These subcontractors may have limited access to some of your Personal Data in the strict context of the performance of their services. They have a contractual obligation to use it in accordance with the applicable provisions and regulations on the protection of Personal Data. They only use your Data to provide the services to which Skeepers has subscribed, and this is done with the guarantee of maintaining the strict confidentiality of the Data. For a complete list of subcontractors, please write to privacy@skeepers.io .

Skeepers may also be required to communicate your Data to third parties in certain specific cases:

If Skeepers is obliged to follow up on claims made against it and to respond to administrative and judicial proceedings (right to defence);
If Skeepers intends to divest a business or assets (including by divesting the business carrying on that business or owning those assets), your Data may be disclosed to the acquirer and potential acquirers as part of an audit, including their advice. If all or a portion of Skeepers’ assets are acquired by a third party, Data will be one of the transferred assets. The Data will be processed by the acquirer who will act as the new data controller and its Data protection policy will then govern the processing of the Data (merger, acquisition, sale of assets);
If Skeepers is compelled to disclose or provide access to the Data to comply with a legal obligation or court order, or to enforce or apply the performance agreement or any other accepted circumstances, or to protect the rights, property, or safety of Skeepers, its customers, or its employees (legal obligation).

You have the right to object, at any time, to the Sharing of your data with Third Parties. We will then no longer transmit your data to these Third Parties, unless (i) these Service Providers are essential for the proper performance of the Services offered (you will then have to unsubscribe from these Services) (ii) can justify to you that we have legitimate and compelling reasons for the Sharing/Processing of your data that prevail over your interests and your rights and freedoms (iii) for the establishment, exercising or defending our legal rights.

For the sharing of data with social networks and ways to object to it, please refer to point 6: Social media data.

For the deposit of cookies and how to object to them, please refer to sub-point 8. Cookies.

It is possible, through certain Skeepers Solutions (Influencer Marketing and Consumer Videos) to connect your account on our Platforms to other third-party accounts. By connecting your account to other third-party accounts, you acknowledge and agree to the ongoing sharing of information about you with other parties (in accordance with the privacy settings you have set on those third-party sites). If you do not want your Data to be shared in this way, do not use this feature.

You can disconnect your account from a third-party account at any time. You can learn how to disconnect your accounts from any third-party site by visiting your Account information page.

For more information on the processing of your Personal Data on the Consumer Videos Platform, the privacy policy can be found at the following link: https://legal.ugv.skeepers.io/PP/en/

For more information on the processing of your Personal Data on the Influencer Marketing Platform, the privacy policy can be found at the following link: https://community.skeepers.io/

For more information on the processing of your Personal Data on Rating & Reviews, the privacy policy can be found at the following link: https://www.verified- reviews.com/en/privacy-policy/

8. Duration of data retention

Your Data is only kept for the time strictly necessary for the purposes established in the previous articles of the Privacy Policy (article 4. The processing of Personal Data by the Keepers Group (origin of your data)), in accordance with the recommendations of the CNIL, and in compliance with legal obligations, in particular accounting and tax obligations.

Beyond the defined retention periods, the Data will be anonymized and only kept for statistical and archival purposes, after which it will be destroyed.

9. Data storage and security measures in place

Skeepers ensures the security of your Data and takes all necessary measures to ensure its confidentiality and prevent access, use, alteration, corruption, disclosure, and/or destruction by unauthorized persons.

To this end, Skeepers has implemented organizational, technical, software and physical measures in accordance with Article 32 of the GDPR listed in its Security Assurance Plan and Information Systems Security Policy. These include:

Data anonymization techniques upon request;
Regular backup of Personal Data with regularly validated restoration processes, in technically and physically separate backups;
Secure hosting (Amazon Web Services hosting company ISO 27001 certified for technical measures, ISO 27017 for cloud security, ISO 27018 for cloud privacy, SOC 1, SOC 2 and SOC 3, PCI DSS Level 1, BSI Common Cloud Computing Controls Catalogue (C5), ENS High.);
Protection in terms of access control (authentication and authorization control), processing, storage or exchange (encryption) to ensure confidentiality: access to your Data is limited and restricted only to the people/services that need to access it, who have signed a Confidentiality Agreement, this Data is stored on secure servers, Your Data is encrypted in transit and at rest (KMS encrypt). Access to your Data requires the use of a strong username and password.
Skeepers’ information system includes centralized and protected logging of the use of the services to detect any intrusion or fraudulent use, to try to identify the causes and origins, to avoid any contamination of other sites by bounce and finally to re-establish the system.
An in-depth security analysis to assess its It should be noted that if the required level is not reached, a new design phase is opened in order to reach the level required by the Skeepers Group;
Ongoing audits (Bug Bounty) carried out by accredited Third

Despite all these measures, your attention is drawn to the fact that the Internet is not a completely secure environment, so it is not possible to guarantee the security of the transmission and storage of your Data.

In accordance with Article 33 of the GDPR, Skeepers undertakes to notify the CNIL, as soon as possible, of any Data breach likely to cause a risk to the rights and freedoms of the Users of its Solutions (in cases where it is the Data Controller), and to inform them if the risk is high.

Skeepers is committed to ensuring that your data is hosted within the European Union and the European Economic Area. However, some specific services of Skeepers are operated outside the territory of the European Union and the European Economic Area, so a limited amount of your Personal Data will be shared with these service providers in countries outside the European Union.

Skeepers then ensures that Standard Contractual Clauses are signed in their latest version in force with the said third-country service providers, and that additional technical measures are implemented in order to be able to ensure a sufficient level of protection for the Sharing of your Data, according to the recommendations of the supervisory authorities, including the European Data Protection Board in its “Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data”.

10. Your rights

In the context of the Data processing carried out by Skeepers, you have the right to:

To obtain access to/copy of your Processed Data;
To obtain the rectification of your Data;
To obtain the deletion of all or part of your Data when the Data, (i) is no longer necessary for the purposes for which it was collected, (ii) is based exclusively on consent, (iii) is the subject of an objection request;
To object to the processing of your Data due to your particular situation;
To obtain the restriction of processing, temporarily, when the accuracy of the Data is contested, when you have objected to the processing, when your Data is no longer necessary for Skeepers but is still necessary for the establishment, exercise or defence of legal claims;
To unsubscribe or object to the receipt of commercial prospecting messages at any time by following the unsubscribe instructions indicated in the promotional emails you receive;
Withdraw your consent at any time in the case of consent-based processing;
To obtain the portability of your Data when the processing is based on consent and the processing is carried out using automated processes;
Provide guidance on the fate of your Post-Mortem

To exercise your right to delete your Data, your account, or to object, you can send your request to the following address: datadeletion@skeepers.io

To exercise any of your other rights or have any questions about this Privacy Policy, you may send a request to the following address: privacy@skeepers.io .

You can write to us at the address listed below:

SKEEPERS

Legal Department – Data Protection Officer 18-20 Avenue Robert Schuman

CS 40494

13002 Marseille

For any request to exercise your rights, you must, in your message:

Specify the address (email or postal) where you would like to receive a response from Skeepers. Otherwise, we will choose the same method you used to contact us;
Include a means by which you can be identified (order number, customer ID, if the means provided does not seem sufficient to prove your identity, a copy of your identity document may be required);
Specify, if possible:
- the context in which your data was collected,
- as well as the Relevant Solution

This information is valuable so that the Data Protection Officer can respond to you as quickly as possible.

Skeepers informs you that no requests will be processed over the phone.

A response will be sent to you as soon as possible, which may not exceed one (1) month from the date of receipt of your request.

A two (2) month extension is possible, in the event of a complex application, or if a large number of applications have been received.

Your request, as well as any data relevant to the processing of your request, will be kept for a period of five years from receipt of your request. If you have been asked for a supporting document, or if you have sent it spontaneously, it will be kept for a period of one year.

If, after contacting the Data Protection Officer, and a period of one month has elapsed, you believe that your GDPR rights are not respected, file a complaint with the CNIL.