Purpose of this policy

OKIMIA (trading name of Fygr SAS) is committed to an approach of security, confidentiality and continuous protection of the personal data (the "Data") of the users of its services, in accordance with the French and European regulations in force, in particular the amended French Data Protection Act of 6 January 1978 (LIL) and the General Data Protection Regulation of 27 April 2016 (GDPR).

The purpose of this policy is to inform you of the rules we apply regarding Data protection. It describes in particular how we collect and process your personal Data and how you can exercise your rights over this Data.

FYGR SAS, represented by François Menjaud as president, is the controller of the personal Data collected through the website and the OKIMIA Tool accessible from the website and from the application.

This means we determine the purpose and means of processing the personal Data collected.

We apply a strict policy to guarantee the protection of your Data.

Scope of the policy

This policy covers the use of:

• our website and the services accessible from this site;
• our services accessible on the Tool and from the application.

Status of FYGR and OKIMIA and of its clients

The corporate client undertakes to pass on this information to any natural person likely to be concerned by the Data processing carried out.

FYGR (through its OKIMIA Tool) undertakes to ensure compliance with the applicable provisions by all its partners or processors.

The data we collect

FYGR (through its OKIMIA Tool) may collect your Data in the following cases:

• We collect your Data through forms you complete on our website or to subscribe to our services or those of our partners;
• We also collect your Data when you correspond with us, in particular with our customer service, by email or phone. In this case, we keep a copy of this exchange;
• We may also collect your Data when you interact with us on social media;
• When you use our services, we receive information relating to the services you use and how you use them. This includes information about your company, your bank flows and your cash balance;
• We may also collect additional information from you when you register or otherwise use our services.

The categories of Data we process are as follows:

• Data identifying the natural person (surname, first name, professional email address, phone number);
• Data related to the operations and transactions carried out by the user account(s) in the course of their activity (receipt and issuance of payments, transfers);
• Banking data (IBAN, bank details, card number);
• Identification and authentication data related to the use of Okimia (username, password);
• Contact and interaction data with us: messages, emails, calls, interaction on our site and social media;
• Browsing data: cookies and IP address. We use cookies to allow you to access your reserved and personal areas. To find out more about the cookie policy, you can consult our Cookie Management Policy.

We do not carry out any processing operation of personal Data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or the processing of biometric or genetic data, under Article 9 of European Regulation 2016/679 of 27 April 2016 on data protection.

However, this prohibition may be set aside if legal or regulatory provisions require the processing of the aforementioned personal Data.

Use of the data collected

We collect and process your personal Data for specific, explicit and legitimate purposes. As such, we use your Data within the framework of the performance of the services contract you enter into with us. The purposes and legal bases pursued are as follows:

When collecting your personal data, we inform you whether certain data must be provided mandatorily or whether it is optional. Mandatory data is necessary for the functioning of the services. As for optional data, you are entirely free to provide it or not. We also indicate the possible consequences of a failure to respond.

Commercial prospecting

In accordance with the applicable legislation and with your consent where required, we may use the data you provide for commercial-prospecting purposes (for example to (i) send you our newsletters, (ii) send you invitations to our events or any other communication likely to interest you).

You may withdraw your consent at any time by (i) clicking on the unsubscribe link provided in each of our communications or (ii) contacting us at support@okimia.com.

Recipients of the data collected

Only the authorized and specified persons mentioned below may have access to certain of your Data:

• FYGR's authorized staff, who are bound by a confidentiality agreement relating to your Data;
• FYGR's processors, who act in the name and on behalf of FYGR;
• Powens, Bridge API, Fintecture, and EQUALS MONEY PLC, who act as joint controllers with FYGR regarding the bank-account aggregation, invoicing and payment-initiation services;
• Authorized third parties, such as the relevant courts, mediators, accountants, statutory auditors, lawyers, bailiffs, and debt-collection companies;
• Third parties likely to place cookies on your devices when you consent to it (for more details, consult our Cookie Management Policy).

Your Data is not communicated, exchanged, sold or rented to any person other than those mentioned above.

Data storage and transfer of data outside the EU

All our servers on which your data is kept, and those of the providers used to exchange and store this data, are located in Europe.

As such, the Data we collect is stored on the servers of our provider Amazon Web Services (AWS) in Europe, which guarantees a high level of security.

In the event that we use processors located outside the European Union, we undertake to ensure that our processors offer protective measures recognized as sufficient within the meaning of the GDPR. This may in particular involve processors located in any other country recognized by the European Union as ensuring an adequate level of protection of personal data ("Adequacy Decision"), subject to a data-transfer agreement compliant with the standard contractual clauses adopted by the European Commission, or any other protective measure recognized as sufficient by the European Commission.

Security

We inform you that we take all useful precautions and appropriate organizational and technical measures to preserve the security, integrity and confidentiality of your personal Data and, in particular, to prevent it from being distorted, damaged or accessed by unauthorized third parties. We also use secure payment systems compliant with the state of the art and the applicable regulations.

Data retention period

We keep your Data only for as long as necessary for the purposes pursued.

FYGR (through its OKIMIA Tool) keeps your Data as long as your account remains active, unless you request its deletion or that of your account.

The following categories of personal data may furthermore be kept for different periods:

• Financial data relating to the billing of our services (for example payments) is kept for the period required by the applicable tax and accounting laws;
• Data used for commercial-prospecting purposes may be kept for a period of three years from the deletion of your account, unless you have decided to exercise your right to object under the conditions set out below;
• Data used to establish proof of a right or a contract, or kept for compliance with a legal obligation, may be subject to an intermediate archiving policy in order to meet our legal, accounting and tax obligations. This includes in particular the ordinary 5-year limitation period provided for in Article 2224 of the French Civil Code.

Users' rights

In accordance with the applicable regulations, you have rights when your Data is processed:

• Right of access (Article 15 of the GDPR): you have the right to obtain from us confirmation as to whether or not Data concerning you is being processed, and to receive a copy of all the Data we hold about you;
• Right to rectification (Article 16 of the GDPR): you have the right to request the correction of the Data we hold about you if it is incomplete or inaccurate. In this case, we may contact you to verify the new Data provided;
• Right to erasure (Article 17 of the GDPR): you may ask us to erase your Data when we no longer have a legitimate interest in holding it; Right to restriction (Article 18 of the GDPR): you may in certain cases obtain from us the restriction of the processing of your Data;
• Right to portability (Article 20 of the GDPR): you may receive from us the Data concerning you in a structured, commonly used and machine-readable format, in particular for transmission to a third party. Where technically possible, you also have the right to obtain that the Data concerning you be transmitted directly to that third party;
• Right to object (Articles 21 and 22 of the GDPR): you may object at any time to the processing of your Data for reasons relating to your particular situation or when your Data is processed for prospecting purposes;
• Right to withdraw your consent (Article 13-2 c of the GDPR): you have the right to withdraw your consent to the processing of your Data at any time, which will not render unlawful the prior processing based on this consent;
• Right to define the fate of your Data after your death and to choose whether or not we communicate your data to a third party you have previously designated. In the event of death and in the absence of instructions from you, we undertake to destroy your data, unless its retention proves necessary for evidentiary purposes or to comply with a legal obligation.

Exercising your rights

You may exercise your rights by sending a request to our customer support at the addresses mentioned below.

Any request to exercise a right must be accompanied by a copy of an identity document. A response will be sent to you within one month of receipt of your request. To this end, we may ask you for additional information or documents.

Note that you do not need to pay a fee to access your personal data or exercise your rights.

However, we may charge a reasonable fee if your request is manifestly unfounded, repetitive or excessive.

For any question concerning the processing of your personal Data, or for any remark, request or complaint concerning its confidentiality, you can contact us:

• By email: support@okimia.com
• By post: FYGR SAS, 26 avenue Winston Churchill (La Filature, Building D), 27400 Louviers

Complaint to the French Data Protection Authority (CNIL)

In the event that the data subject's rights have not been respected, and after having contacted the Controller, the data subject may lodge a complaint with the CNIL:

• By post: Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, 75334 PARIS
• Lodge a complaint with the CNIL

Modification of the privacy policy

We reserve the right to modify this privacy policy at any time.

The most current version of this privacy policy governs our use of your information and will always be available on the OKIMIA website or upon request from FYGR.

If we were to make a substantial change to this privacy policy, we undertake to notify you via your email address.

Personal-data processor

Consult our Personal-Data Processor Addendum.