Personal data protection policy

Introduction

Leandri Holding (SIREN 517 484 820, ZA de Tralavettu, 20110 Propriano, France) and its subsidiaries, CORSE PREFA (SIREN 435 281 829), ROCH LEANDRI BTP (450 635 503), LANFRANCHI ENVIRONNEMENT (500 608 708) and RL IMMOBILIER (499 187 045) (hereinafter "We" or the "Group") attach particular importance to the protection of your personal data.

The purpose of this personal data protection policy (hereinafter the "Policy") is to inform you of the manner in which the Group collects and processes your personal data, in particular when you consult the website of one of the Group's companies (the "Site"), when you contact one of them, or when you maintain a commercial relationship with one of its companies.

This Policy applies to any person using the Site, as well as to any person entering into a relationship with one of the Group's companies to whose attention it is brought.

Personal data processing by the Group is carried out in accordance with applicable regulations, in particular Regulation (EU) 2016/679 of 27 April 2016 (the "RGPD") and amended Law No. 78-17 of 6 January 1978.

Data controller

The data controller for your personal data is:

LEANDRI HOLDING, with a share capital of 3 924 880 €, whose registered office is located at ZA DE TRALAVETTU, 20110 PROPRIANO France, registered under number 517484820, represented by Roch LEANDRI, acting and empowered as President (the “Group”).

Personal data collected by the Group may be used and shared among the various Group companies when necessary for the purposes described in this Policy, particularly depending on the Group's organization, its operational needs and constraints, the nature of your request, or the products and services concerned.

In order to further outline our practices regarding the protection of personal data, we present in this Policy the different types of personal data that we may obtain directly from you or following your interaction with us, how we may use it, the persons with whom we may share it, how we protect it and ensure its security, as well as the rights you enjoy regarding your personal data.

What categories of data do we collect?

Within the framework of our activities and the use of the Site, we may collect and process the following categories of data:

• Your identity and contact details: such as name, address, phone number, or email address, for example when you submit a request via the Site's contact form;
• Published data: information that you share publicly, on our social networks or our Sites, for example to give your opinion on a product;
• Data relating to your requests: in particular information concerning your requests for information, via the Site's contact form or otherwise, regarding your project or worksite, as well as correspondence you may have with the Group's companies;
• Data relating to the contractual relationship: in particular information concerning quotes, orders, contracts, deliveries, invoices, claims, and commercial relationship history, as well as payment information: for example credit card numbers, bank account numbers, PayPal account details, or other payment information you must provide to pay for the products or services ordered from us. Your banking data is collected and stored directly by our payment service provider; we do not retain raw payment data on our servers;
• Data relating to your browsing on the Site: in particular information about your browser and browsing behavior, specifically your IP address, pages viewed, and more generally information likely to be collected via cookies or other trackers;
• Data relating to job applications: in particular your contact details, curriculum vitae, and information regarding your professional background, qualifications, and skills, as well as any information you choose to provide as part of your application.

Certain information is essential to process your request or execute a contract. If you do not wish to submit data concerning you when such data is necessary for the performance of a contract or service you request, or when required by law, the Group or the company concerned may not be able to respond to your request or provide the requested product or service.

For what purposes do we use your data?

Your personal data is used for the following purposes:

• For service improvement purposes: in order to better understand your interests and how you use our products and services, to improve our Sites, our services, and our products;
• For marketing and commercial prospecting purposes: to personalize your experience and adapt our marketing activities to your needs and preferences, to contact you, where applicable with your consent, regarding new products and special offers likely to interest you;
• For request management purposes: in order to process your requests, your applications, answer your questions, discuss your projects with you, manage any potential claims; provide the information you request, or communicate with you regarding our relationship (for example to gather your feedback, or inform you of changes to the Site or this Policy, or service updates);
• For contractual relationship execution purposes: to manage quotes and orders, provide products and services, ensure the operational, commercial, and administrative follow-up of the relationship, and manage invoicing and payments;
• For security purposes: we process your data to protect our company, our clients, our Sites, or our applications against risks of fraud, theft, or any wrongful act that could affect our activity, as it is in our legitimate interest to ensure the security of our operations;
• For analytical and statistical purposes: we perform analyses on the e-reputation of our company or our products, and measure the effectiveness of our online and offline campaigns or events, as it is in our legitimate interest to preserve our company's image and improve our marketing campaigns;
• For compliance with our legal and regulatory obligations: we process and retain your data as well as a history of transactions and other commercial documents to meet legal, tax, and administrative requirements, the needs of our insurers, or for audit purposes.

On what legal bases do we use your data?

We process your personal information based in particular on the following legal grounds:

• Contractual performance: we may process your personal information when the processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into such a contract.
• Legal obligation: we process your personal information to comply with legal obligations, such as meeting regulatory requirements, maintaining accurate records, and adhering to legal or contractual obligations.
• Legitimate interest: we may process your personal information on the basis of our legitimate interests, provided that these interests are balanced against your rights and freedoms.

When processing operations involve the use of cookies or other trackers subject to consent, they are carried out only after obtaining your consent.

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

In all cases, you may object at any time to the use of your data for commercial prospecting purposes.

How long do we retain your data?

We commit to retaining your information only for the duration necessary to achieve the objectives for which it was collected. Once the retention period has elapsed, we securely delete or anonymize the data.

If you request the deletion of your data, it will be removed from active systems, and any remaining copy in backups will be deleted in due course.

With whom do we share your data?

Your data is accessible only to individuals who need to know it as part of their duties and within the limits necessary to achieve the purposes described in this Policy.

We communicate or share your data in particular with the following:

• To the various departments of our company: only authorized personnel whose business activity justifies access to the information;
• To the various Group companies, when necessary depending on the nature of your request, the products or services concerned, the organization of the Group or its operational needs and constraints;
• To service providers acting on our behalf: for example, technical service providers involved in the hosting, maintenance or security of the Sites;
• To business partners: to suppliers, subcontractors and partners when this transmission is necessary for the performance of a service or the management of a project or site;
• With certain business partners, subject to your agreement: for example, we will share your data with third parties organizing an event jointly with us;
• To administrative or judicial authorities and other competent bodies: when we are legally required to do so or when it is necessary to do so to comply with applicable regulations: for example to respond to a court decision.

The Group does not sell your personal data.

Data transfers outside the European Economic Area

The Group prioritizes the processing of your data within the European Economic Area (“EEA”).

However, certain service providers or tools used by the Group may involve a transfer of data to a country located outside the EEA.

When such a transfer takes place, the Group ensures that it is carried out in accordance with applicable regulations and that the necessary safeguards are put in place, notably on the basis of an adequacy decision by the European Commission or appropriate safeguards such as standard contractual clauses adopted by the European Commission. Additional information regarding these transfers and the safeguards implemented can be obtained from the Group.

Security of your data

The Group implements appropriate technical and organizational measures to preserve the security, integrity and confidentiality of your personal data and to protect it in particular against unauthorized destruction, loss, alteration, disclosure or access.

Access to data is restricted to authorized personnel who need to know it as part of their duties.

What are your rights regarding your data?

You may have various rights regarding your personal data under applicable privacy protection laws. These rights are as follows:

• Right to erasure: you may request the erasure of your personal information when it is no longer necessary for the purposes for which it was collected, if you withdraw the consent on which the processing is based, or if the processing is unlawful. It remains isolated and accessible only for disaster recovery purposes or to fulfill legal obligations;
• Right to rectification: if you believe that your personal information is inaccurate or incomplete, you may request that it be corrected or completed;
• Right of access: you have the right to request access to the personal information we hold about you, including details on how it is processed and the purpose of such processing;
• Right to restriction of use and disclosure: you may ask us to restrict the use and disclosure of all or part of your personal information in certain circumstances. If you exercise this right, your personal information, with the exception of storage, may only be used or disclosed with your consent or within the limits permitted by applicable data protection laws;
• Right to data portability: you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another data controller;
• Right to object / right to opt out: you may object to or refuse the processing of your personal information on the grounds of legitimate interests or for direct marketing purposes. If you exercise this right, we will cease processing based on legitimate interests, unless we can demonstrate compelling legitimate grounds. If you object to or refuse processing for direct marketing purposes, we will cease processing or using your personal information for such purposes;
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time by contacting us as indicated below;
• Right to lodge a complaint: in the event of a disagreement with us regarding the processing of your personal data, you have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés), the competent supervisory authority in France (website: www.cnil.fr).

To exercise any of these rights, please submit your request to the following address: info@rochleandri.com.

We will respond to your request in accordance with applicable laws and regulations.