WWW.LAPSUS.TECH PRIVACY POLICY

The data controller for the data collected via the Website is:

Data protection contact:

• E-mail: privacy@lapsus.tech
• Mail: SAS Lapsus – 10 rue Louis Amiot, 01000 Bourg-en-Bresse, France

This "Privacy Policy" applies to the processing of personal data carried out by Lapsus in the context of:

• browsing the www.lapsus.tech Website;
• the possible use of contact or exchange forms with Lapsus;
• a page of company news;
• the consultation of image and video content owned by Lapsus;
• viewing recruitment advertisements and submitting applications via the Website;
• access to a Reserved Area subject to authentication for certain profiles (Shareholders, Employees, Candidates).

It does not cover processing carried out on any other Lapsus digital products or services that have their own policies or conditions.

When browsing the Website, Lapsus may collect technical and connection data such as the IP address, the date and time of the visit, the pages viewed, the characteristics of the browser and operating system, as well as information related to cookies and other trackers.

When the user contacts Lapsus via a contact form or an e-mail address mentioned on the Website (e.g. bonjour@lapsus.tech or legal@lapsus.tech), Lapsus may process identification and contact data such as surname, first name, e-mail address, possibly a telephone number, as well as any information contained in the message or attachments.

In the context of applications submitted via the Website, Lapsus may collect identification and contact information, elements relating to professional background and training (CV, experience, skills, qualifications, salary expectations, availability), as well as any other element that the candidate spontaneously communicates in their documents or in the free fields (cover letter, links to a portfolio or external profiles, for example).

For persons with access to the reserved area, Lapsus processes the login details communicated to them (username and password) as well as connection and log in data, in particular the dates and times of connection and the pages viewed in this area.

Personal data is processed for specified, explicit and legitimate purposes.

Certain data is processed to ensure the proper technical functioning and security of the Website, to measure its audience and to improve its content. This processing is based on Lapsus' legitimate interest in ensuring the security, maintenance and optimization of its Website.

The data collected in the context of contact requests or exchanges with Lapsus make it possible to respond to users' requests, to follow up on requests and, if necessary, to prepare or support a professional relationship. This processing is based on the execution of pre-contractual measures requested by the data subject and on Lapsus' legitimate interest in managing the requests addressed to it.

The data collected in the context of applications is used for the reception, analysis and selection of applications, the organization of interviews and, more broadly, the smooth running of recruitment processes, as well as, where applicable, the creation of a talent pool. This processing is based on the execution of pre-contractual measures at the request of the candidate and on Lapsus' legitimate interest in recruiting and organizing its human resources.

The data relating to access to the reserved area is used to manage access rights, secure the information that can be consulted there and ensure the traceability of access. This processing is based on the contractual or legal framework that binds Lapsus to the data subject (e.g. employment contract, mandate, recruitment process) as well as on Lapsus' legitimate interest in securing its internal spaces.

Finally, certain data may be processed to enable Lapsus to comply with its legal or regulatory obligations, respond to requests from administrative or judicial authorities, or defend its rights in the event of a dispute. This processing is based on compliance with legal obligations and on Lapsus' legitimate interest in defending itself.

Personal data is accessible only to persons who need it for the performance of their tasks. It may be communicated to Lapsus' internal teams, within the limits of their attributions.

It may also be communicated to technical service providers working on the Website, such as the host or maintenance or audience measurement providers, acting as subcontractors within the meaning of the regulations, on the basis of documented instructions from Lapsus and within the framework of contracts providing data protection commitments.

If necessary, the data may be passed on to Lapsus' advisors or partners, such as lawyers or experts, as well as to administrative or judicial authorities when required by a legal obligation or when this is necessary for the defense of Lapsus' rights.

Lapsus does not sell the personal data collected via the Website.

The Website is hosted by Vercel, Inc., whose address is 340 S Lemon Ave #4133, Walnut, CA 91789, USA. As a result, certain technical data related to browsing and hosting, such as logs and IP addresses, may be transferred to countries outside the European Union, in particular to the United States.

When such transfers take place, Lapsus ensures that they are subject to appropriate safeguards within the meaning of the General Data Protection Regulation, for example through standard contractual clauses adopted by the European Commission and additional security measures, in order to ensure an adequate level of protection.

Lapsus retains personal data for a period that does not exceed that necessary in relation to the purposes for which it is processed, while taking into account the applicable legal obligations and limitation periods.

Browsing data and technical logs are kept for a limited time period, usually from a few months to a year, in order to ensure the security and proper functioning of the Website.

The data collected in the context of contact requests is stored for the time necessary to process the request and may then be archived for a period of up to three years from the last contact with the data subject.

Application data is retained for the duration of the recruitment process. Unless the candidate objects, they may then be kept in a pool of applications for a maximum period of two years from the last contact.

Data relating to access to the reserved area is kept for the duration of the access, and then the connection logs may be kept for a limited time period, usually from a few months to a year, to the extent necessary for the security and traceability of access, subject to legal obligations imposing longer periods.

Beyond these periods, the data is deleted or anonymized.

In accordance with the applicable regulations on the protection of personal data, and in particular the General Data Protection Regulation (GDPR) and the "Informatique et Libertés" law, any person concerned has several rights over the data concerning them.

They have a right of access, which allows them to obtain confirmation as to whether or not data concerning them is being processed and, and if data is being processed, to receive a copy of it. They have a right of rectification, which allows to request the modification of inaccurate or incomplete data. They may, in certain cases provided for by law, request the deletion of their data or the limitation of its processing. They may also object, for reasons relating to their particular situation, to certain processing operations based on Lapsus' legitimate interest.

Where the conditions are met, the person may also exercise a right to portability, i.e. the right to receive the data they have provided in a structured, commonly used and machine-readable format, and to transmit it to another controller.

These rights can be exercised by contacting Lapsus by e-mail at privacy@lapsus.tech or by post at SAS Lapsus, 10 rue Louis Amiot, 01000 Bourg-en-Bresse, France. Lapsus may request proof of identity if there is reasonable doubt about the identity of the applicant.

Finally, the person has the right to lodge a complaint with the competent supervisory authority, and in particular with the Commission Nationale de l'Informatique et des Libertés (CNIL) in France, accessible via the www.cnil.fr website.

The Website may use cookies or other similar technologies placed on the user's terminal during browsing. These trackers can be used for the proper technical functioning of the Website, for audience measurement or to improve the user experience.

On their first visit to the Website, the user is informed of the use of cookies by an information banner. When required by regulation, some cookies are only placed with the prior consent of the user, who can accept, refuse or configure non-essential cookies.

The detailed terms and conditions relating to cookies, in particular the nature of the cookies used, their purposes, their storage periods and the means available to the user to manage them, may be specified in a separate "Cookie Policy" accessible from the Website when it is implemented.

Lapsus implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access. These measures include access control mechanisms, clearance management procedures and limiting access to only those who need the data in the course of their duties.

Despite these precautions, no system is completely secure. In the event of a security incident that may result in a high risk to the rights and freedoms of the data subjects, Lapsus will notify the relevant authorities and, where required, the data subjects, in accordance with legal requirements.

Lapsus reserves the right to modify this "Privacy Policy" at any time, in particular to take into account changes in its practices, services or the legal and regulatory obligations applicable to it.

In the event of a substantial change, appropriate information may be published on the Website. The applicable version is the one in force at the time of browsing the Website, with the date of the last update appearing at the top of the "Privacy Policy".