III – What are “Personal Data” and “Processing” of Personal Data?

What are “Personal Data”?

Personal Data means any information relating directly or indirectly to a natural person. For example, an identifier, a name, an identification number, an IP address, a photograph or a telephone number may be considered Personal Data.

What are “Sensitive Data”?

Personal Data includes Sensitive Data. This includes, in particular, racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health data or data concerning a person’s sex life.

As a general rule, Sensitive Data may only be collected and processed with the explicit consent of the individuals concerned, unless such processing is required by law or is necessary for the performance of a task carried out in the public interest.

What is “Processing” of Data?

Processing of Personal Data means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

In summary, Processing means any operation involving the use and/or consultation of your Personal Data.

IV – SOMMET DE L’ELEVAGE PROCESSES YOUR DATA AS DATA CONTROLLER

a) Identity of the Data Controller

The Data Controller responsible for the Processing of Personal Data is:

SOMMET DE L’ELEVAGE, a French simplified joint-stock company (Société par actions simplifiée) with share capital of €1,401,000, registered with the Clermont-Ferrand Trade and Companies Register under number RCS 930 089 321, whose registered office is located at 17 Allée Evariste Galois, 63170 Aubière, France.

• Telephone: +33 (0)4 73 28 95 10

• Email: rgpd@sommet-elevage.fr

• EU VAT No.: FR 22 930 089 321

Hereinafter referred to as “SOMMET DE L’ELEVAGE”.

b) Data Collected as Data Controller – Purposes and Legal Bases

As part of its relationship with SOMMET DE L’ELEVAGE, the Customer may be required to provide Personal Data concerning them. In this context, the Customer is requested to provide only the data that is necessary and/or requested and to delete and/or make illegible any other data appearing on documents, emails and/or other materials provided to SOMMET DE L’ELEVAGE as part of their relationship with the company.

SOMMET DE L’ELEVAGE is not specifically intended for minors. Where Personal Data concerning minors is collected, it is collected only where necessary for organisational purposes, access control, security or compliance with a legal obligation, and in strict accordance with the principles of data minimisation and proportionality. Where required by applicable regulations, rights shall be exercised by the person holding parental authority or by the minor’s legal representative.

Processing Activities, Purposes and Legal Bases

c) Collection of Browsing Data and Cookie Management

When You use Our Digital Tools, browsing data may be collected, in particular through cookies or similar technologies. Such data may include:

• the identifier and content of a cookie file stored on your device;

• the date and time your device connects to Our Digital Tools;

• your IP address and, where applicable, the address of the webpage from which You accessed Our Digital Tools;

• the type of operating system used by your device (Windows, macOS, Android, iOS, etc.);

• the type and version of the browser used (Chrome, Safari, Firefox, Edge, etc.);

• the browser language and certain technical or display preferences.

A cookie is a small file stored on your device (computer, tablet, smartphone, etc.) when You access Our Digital Tools. Cookies may be used, in particular, to ensure that services function properly, remember certain preferences, measure audience traffic or, where You have provided your consent, provide personalised content and communications.

Cookies may be placed directly by SOMMET DE L’ELEVAGE or by third-party service providers involved in providing certain functionalities. Where required by applicable regulations, the placement of such cookies is subject to your consent.

Types of Cookies Used

Technical and Functional Cookies

These cookies ensure the proper functioning, security and smooth operation of Our Digital Tools. In particular, they may be used to:

• implement security measures and prevent fraudulent use;

• remember your cookie choices and certain browsing preferences;

• retain information necessary for the operation of forms, the chatbot, car-sharing services or booking services;

• enable the secure operation of payment services;

• remember certain display, language or currency preferences.

List of domains placing technical and functional cookies:

• boutique.sommet-elevage.fr

• chat-assets.frontapp.com

• covoiturage-simple.com

• doubleclick.net

• linkedin.com

• m.stripe.com

• m.stripe.network

• platform.revolugo.com

• revolugo.com

• www.sommet-elevage.fr

Audience Measurement and Activity Tracking Cookies

These cookies enable Us, in particular, to measure traffic to and use of Our Digital Tools, compile statistics, identify the most frequently viewed content and detect potential browsing difficulties in order to improve Our services.

Domains concerned:

• assets.inwink.com

• platform.revolugo.com

• revolugo.com

• sommet-elevage.fr

Advertising, Marketing and Third-Party Content Cookies

These cookies may be used to measure the effectiveness of Our campaigns, track interactions with certain third-party content or services, personalise communications and enable the display of embedded content, including videos. Where consent is required, these cookies are placed only in accordance with your choices.

Domains concerned:

• capig.stape.at

• connect.facebook.net

• doubleclick.net

• google.com

• pardot.com

• sommet-elevage.fr

• www.googletagmanager.com

• www.sommet-elevage.fr

• www.youtube-nocookie.com

• youtube.com

Managing Your Preferences and Retention Periods

You may accept, refuse or modify your choices at any time regarding cookies requiring consent through the cookie management tool available on Our Digital Tools. You may also configure your browser to restrict or block certain cookies. However, refusing certain technical cookies may affect the operation of some features.

Retention periods vary depending on the nature and purpose of the cookie. Some cookies are deleted at the end of the session, while others are retained for a specified period. The applicable retention periods are detailed in the cookie management tool and are limited to what is necessary for their purposes and in accordance with applicable legal requirements.

d) Recipients of Customers’ Personal Data

SOMMET DE L’ELEVAGE undertakes to disclose and/or make Customers’ Personal Data accessible only to persons who need to know such data, including:

• persons responsible for administrative and commercial relations within SOMMET DE L’ELEVAGE, including, without limitation, the administrative, sales, technical, logistics, accounting and finance departments. Other departments within SOMMET DE L’ELEVAGE may also have access to such information exclusively where necessary for the contractual relationship;

• service providers and processors selected by SOMMET DE L’ELEVAGE to perform certain activities and/or assignments on its behalf and/or to fulfil commercial and contractual obligations, including sales representatives and accounting and invoicing service providers;

• IS/IT service providers (hosting providers, maintenance providers, etc.) and any other professionals who may be required to act on behalf of SOMMET DE L’ELEVAGE, including INWINK, a French simplified joint-stock company (Société par Actions Simplifiée) with share capital of €111,100, registered with the Paris Trade and Companies Register under number 521 915 637, whose registered office is located at 33 rue du Faubourg Saint-Antoine, 75011 Paris, France;

• accounting, legal, tax and/or financial advisers;

• banks and insurance companies;

• tax and social security authorities;

• any auditors involved in restructuring operations;

• public authorities, where required by law.

The list of processors is available upon request from the DPO.

As a general rule, Customers’ Personal Data cannot be viewed by other Customers unless You have given your consent through your profile settings.

Customers’ Personal Data will not be transferred or sold to third parties, except in connection with a restructuring operation (such as the sale of a business division, business assets or a change of control). In such cases, the consent of the Data Subjects will not be required; however, they will be informed when the Personal Data concerned is first used. In all circumstances, such exchanges, assignments and/or transfers shall be carried out in accordance with the Personal Data Protection Provisions.

With regard to the Personal Data of other individuals, You must respect their privacy and exercise particular care when providing Personal Data. We remind You that, as a Customer, You may process your own Personal Data, but not that of third parties. If You provide third-party Personal Data (for example, Personal Data relating to your employees), You must ensure that the transfer of such Personal Data to SOMMET DE L’ELEVAGE is lawful and You are responsible for providing the relevant information to those third parties.

V – SOMMET DE L’ELEVAGE PROCESSES CERTAIN PERSONAL DATA AS A DATA PROCESSOR

We provide Our Exhibitors with a service enabling them to purchase and send customisable e-invitations through their Exhibitor Area.

In this context, the Exhibitor acts as the Data Controller and We act as the Data Processor within the meaning of applicable Personal Data protection regulations. Accordingly, We process Guests’ Personal Data exclusively in accordance with the agreements entered into with the Exhibitor and in accordance with the Exhibitor’s instructions.

Each Exhibitor is therefore responsible for ensuring compliance with applicable Personal Data protection regulations when processing Guests’ Personal Data, in particular by providing Guests with all relevant information regarding the Processing of their Personal Data.

If You are a Guest, You should consult the Personal Data Protection Policy of the Exhibitor who invited You and/or contact their Data Protection representative.

The only Personal Data We require from You is your surname, first name and email address, solely for the purpose of enabling the Exhibitor to send You the e-invitation.

Tracking pixels are included in the invitation in order to enable the Exhibitor and Us to:

• analyse email open rates for deliverability purposes;

• analyse email open rates in order to measure and optimise campaign performance;

• detect and analyse suspected fraud.

You may object to the use of these tracking pixels through the settings and preference management options available on the Digital Tools.

SOMMET DE L’ELEVAGE, in its capacity as Data Processor, undertakes to:

• process Personal Data solely for the purposes of the aforementioned Service and in accordance with the Exhibitor’s written instructions, unless otherwise required by applicable regulations, in which case SOMMET DE L’ELEVAGE shall inform the Exhibitor in advance;

• ensure that persons authorised to access and process Personal Data have undertaken to respect its confidentiality;

• implement all necessary security measures to ensure that Personal Data is not altered, damaged, destroyed, lost or disclosed to unauthorised persons, whether accidentally or unlawfully;

• inform the Exhibitor of any Personal Data Breach as soon as possible after becoming aware of it and assist the Exhibitor in fulfilling its obligation to notify the competent authorities and affected Data Subjects of such breaches;

• maintain an accurate list of any sub-processors involved in carrying out the Processing and notify the Exhibitor of any intended changes, including the addition or replacement of a sub-processor, before such change takes place. The Exhibitor may object to the appointment of such new sub-processors, and the sub-processing operation may only take place if the Exhibitor has not objected within one (1) month following notification of the change by SOMMET DE L’ELEVAGE. The current list of sub-processors authorised to act as of the date of signature of the Contract is as follows: INWINK, for back-office services and the issuance of e-invitations (Tier 1), and Microsoft Corporation, for hosting services (Tier 2);

• assist the Exhibitor, insofar as possible, in fulfilling its obligation to respond to requests from Data Subjects seeking to exercise their rights;

• at the Exhibitor’s choice, delete all Personal Data or return it to the Exhibitor upon request or, at the latest, upon termination of the contract between the parties, and destroy all existing copies, unless otherwise required by law and except where retention is necessary for the applicable limitation period, exclusively for evidentiary purposes;

• allow and participate in audits relating to the Processing of Personal Data carried out by the Exhibitor or another auditor appointed by the Exhibitor, provided that such an audit may not take place more than once per year and shall be subject to one month’s prior notice and the execution of a confidentiality agreement;

• taking into account the information available to it, cooperate with the Exhibitor by: (i) providing all information necessary to carry out any Data Protection Impact Assessments in accordance with Article 35 of the GDPR; (ii) informing the Exhibitor whenever it considers that an instruction from the Exhibitor infringes applicable regulations; and (iii) providing the necessary information where the Exhibitor is required to demonstrate compliance with applicable Personal Data protection regulations.

The Exhibitor agrees that SOMMET DE L’ELEVAGE and/or any sub-processors authorised by the Exhibitor may transfer Personal Data outside the European Union (EU).

In such circumstances, SOMMET DE L’ELEVAGE undertakes to inform the Exhibitor and to implement all appropriate safeguards necessary to ensure the protection of the Personal Data of the Exhibitor and Guests in accordance with applicable regulations, including through the execution of binding agreements incorporating the European Commission’s Standard Contractual Clauses.

VI – Security and Confidentiality of Customers’ Personal Data

SOMMET DE L’ELEVAGE takes all appropriate precautions to preserve the security and confidentiality of Customers’ Personal Data and, in particular, to prevent such data from being altered, damaged or accessed by unauthorised third parties.

Accordingly, each SOMMET DE L’ELEVAGE employee is bound by a confidentiality clause.

Access rights management procedures have been implemented to ensure that each employee can access only the Personal Data that they need to know in order to perform their duties.

Access to IT systems is password-protected. These passwords are changed regularly.

Premises in which your Personal Data is stored are locked and accessible only to authorised persons with the appropriate access badge.

All Personal Data is hosted on secure servers.

Our service providers have entered into agreements containing security and confidentiality commitments and/or are currently in the process of entering into such commitments.

SOMMET DE L’ELEVAGE would like to remind You that the security of everyone’s Personal Data also depends on following good password management practices. For further information, the recommendations of the French Data Protection Authority (CNIL) are available through its guidance on basic password authentication security measures.

VII – Retention Period

Customers’ Personal Data is retained only for a reasonable period of time.

Where Personal Data is processed on the legal basis of a contract, it will be retained for the duration of the contractual relationship, plus an additional period of one year in active archives, and will subsequently be retained in intermediate archives for the applicable limitation period.

In all circumstances, the Personal Data of prospective Customers will be deleted by SOMMET DE L’ELEVAGE three years after the last contact. However, Personal Data may be placed in permanent archives and retained exclusively for statistical purposes.

If the Customer wishes to obtain further information regarding the retention period applicable to their Personal Data, they may contact the Data Protection Officer of SOMMET DE L’ELEVAGE using the contact details provided at the beginning of this Policy.

VIII – Transfer of Personal Data

As a general rule, Personal Data processed by SOMMET DE L’ELEVAGE is not transferred outside the European Union.

Where a technical service provider or processor processes Personal Data on behalf of SOMMET DE L’ELEVAGE, SOMMET DE L’ELEVAGE will ensure that:

• the service provider does not transfer any Personal Data outside the European Union; or

• the transfer is made to a country that has been the subject of an adequacy decision; or

• the transfer takes place after appropriate safeguards have been implemented, such as:

  • the implementation of Binding Corporate Rules (BCRs);

  • the implementation of Standard Contractual Clauses for the protection of Personal Data.

Third-party publishers are responsible for their own transfers of Personal Data.

IX – Customers’ Rights

In accordance with the Personal Data Protection Provisions, Customers have several rights in relation to their Personal Data:

• the right of access to their Personal Data;

• the right to rectification or erasure of their Personal Data;

• the right to restriction of Processing;

• the right to object to Processing;

• the right to Data Portability, under the conditions and within the limits provided for by the GDPR;

• the right to withdraw consent at any time, where Processing is based on consent. Such withdrawal shall only have effect for the future, from the time the lawfulness of the request has been received and validated by SOMMET DE L’ELEVAGE;

• the right to define general and specific instructions regarding how the Customer wishes their rights to be exercised after their death;

• the right to lodge a complaint with the CNIL, the French Data Protection Authority.

No automated decision-making based on Customer information, including profiling, is carried out.

Customers are reminded that where Personal Data is collected for the performance of a contract and/or pre-contractual measures, the provision of such Personal Data is mandatory. Failure to provide the required information may result in the Customer being unable to benefit from the right or service for which the Personal Data is processed.

To exercise these rights or obtain any further information, You may contact the Data Protection Officer using the contact details provided at the beginning of this Policy. SOMMET DE L’ELEVAGE undertakes to process all requests as promptly as possible and to keep the applicant informed of the steps taken.

Customers are reminded that SOMMET DE L’ELEVAGE can only respond directly to such requests in relation to Personal Data for which it acts as Data Controller. Where SOMMET DE L’ELEVAGE acts as a Data Processor, it undertakes to forward the request to the relevant Data Controller.

SOMMET DE L’ELEVAGE will use its best efforts to respond to You as promptly as possible. However, depending on the volume of Personal Data concerned, it may be entitled to an additional period of time in which to respond to your request.

If You are not satisfied with the outcome of these steps, and in all circumstances, You have the right to lodge a complaint with the CNIL.

X – Updates to the Personal Data Protection Policy

This document may be updated at any time, in particular in order to comply with any new applicable laws and/or regulations, recommendations issued by the CNIL and the European Data Protection Board (EDPB), as well as relevant decisions issued by courts and tribunals.

For this purpose, the new Personal Data Protection Policy will be made available to You by any written means prior to its entry into force.

Where the legal basis for Processing is consent, renewed consent will be requested.

In the event of an update, the wording “Updated on” will appear at the beginning of the Privacy Policy.

The revised version shall be the sole and only applicable version.