PERSONAL DATA PROTECTION POLICY

This Personal Data Protection Policy details all the information which will enable you to understand how your personal data is processed within the Automatic Cashback Service.  If you would like to read the general data protection policy for all services provided by Macadam, which complements this specific policy, click here.

The processing of your personal data by PayLead and Macadam results from your willingness to participate in the Automatic Cashback Service. In the interests of transparency, when you register for the Automatic Cashback Service we will provide you with as much information as possible about how we use your personal data and the extent of your rights (including the right to object to processing which is not strictly necessary for the provision of the Automatic Cashback Service).

The protection of personal data is a priority for Macadam and PayLead. We are committed to respecting the rules arising from the General Data Protection Regulation (GDPR).

1. WHO IS LIABLE FOR PROCESSING YOUR PERSONAL DATA ?

To provide the Automatic Cashback Service, the following two entities act as Joint Controllers:

• MACADAM TECHNOLOGIES, S.L., a company with its registered office at Av Diagonal Num.472 P.6 Pta.4 08006 – Barcelone (Spain), registered in the Trade and Companies Register of Barcelone under Volume 48762, Folio 113, Sheet B 595293, with Tax Identification Number (N.I.F.) B44845337;

• PAYLEAD, a simplified joint stock company (SAS) with its registered office at 9, rue de Condé 33064 Bordeaux (France), registered in the Bordeaux Trade and Companies Register under number B 821 725 579.

PayLead and Macadam have jointly determined how the Automatic Cashback Service functions and how your personal data is used to provide this service.

PayLead also acts as an independent data controller for the further processing operations described in Section II.

2. FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

The table below details the purposes for which we use your personal data and the corresponding legal basis retained. The transactions carried out on the basis of the execution of the contract are essential for the provision of the Automatic Cashback Service.

The Automatic Cashback Service is based on the analysis of your banking transactions: on the basis of the displayed offers catalogue, PayLead identifies the transactions eligible for Automatic Cashback. We then generate your Automatic Cashback automatically, without any specific action on your part.

PayLead also analyses your banking transaction data to provide you with personalised offers based on your transaction history and spending habits. The eligibility criteria for the offers are defined by our partner merchants and Macadam.

The essence of the Automatic Cashback Service is to allow you to enhance you banking transactions to benefit from personalised and relevant offers from our partner merchants.

Further processing (as defined in Article 13.3 of the GDPR)

PayLead uses your personal data for the further processing described below. This processing is performed by PayLead independently and under its sole responsibility.

As required by the applicable regulations, we have verified that the pursuit of our legitimate interests does not infringe the rights and freedoms of users:

• A user can reasonably anticipate that PayLead will be required to issue invoices towards partners merchants and provide reports to them on the performance and follow-up of campaigns.

• PayLead's analysis do not focus on any individual person, but on a set of aggregated, nonnominal data.

• PayLead conducts its studies on the basis of pseudonymised data.

3. WHAT PERSONAL DATA DO WE USE?

The following personal data is provided to PayLead by Macadam:

• IBAN

• Name of your bank

• Bank account type

• Banking transactions: transaction name, date, place, amount, merchant, truncated PAN number (last 4 digits)

• Unique user identifier (token)

Please note that Macadam does not transfer your name, surname, email address, date of birth or nationality to PayLead. This information remains in the sole possession of Macadam.

PayLead identifies you only through a unique user ID, called a "token," consisting of a series of numbers and letters. This is called pseudonymisation.

By analysing your banking data, PayLead also processes your consumption habits (your favourite brands, your favourite shops, the geographical areas where you usually shop, your average basket), your average salary, your exceptional income or life events which can be deducted from your purchases (such as weddings, births, etc.).

As part of the support process, we process additional personal data of any kind which you may provide to us. In doing so, we ask that you limit the information shared to what is necessary, in particular what is required by us to respond to your request.

4. HOW LONG WILL YOUR PERSONAL DATA BE KEPT?

Your personal data is used for a specific period of time, strictly limited to the purposes for which it is collected:

• Your banking transaction data is deleted after 2 years (from the date of the transaction) if it has not generated an Automatic Cashback payment.

• Your transaction data is deleted after 5 years (from the date of the transaction) if it has generated an Automatic Cashback payment.

When you decide to unsubscribe from the Automatic Cashback Service:

PayLead will delete all of your personal data, except for data relating to the payment of Automatic Cashback, which will be retained for the aforementioned 5-year period.

Macadam will delete all of your personal data related to the Automatic Cashback, except for data relating to the payment of Automatic Cashback, which will be blocked and retained for a 6-year period. After this period such data will be physically deleted, or, if applicable, anonymized securely by Macadam (anonymized/non-personal data).

5. TO WHOM IS YOUR PERSONAL DATA COMMUNICATED?

Your personal data is only accessible to PayLead or Macadam staff who need to know it in order to carry out their duties and provide the Automatic Cashback Service.

Some limited third parties may have access to your pseudonymised (or anonymised where appropriate) personal data:

• Any subcontractors and service providers of PayLead acting for technical and logistical reasons related to the proper execution of the Automatic Cashback Service (such as data storage providers, ticketing tool editor, etc);

• The partner merchants to whom PayLead communicates a statement of transactions which have generated a Cashback (amount, time stamp, truncated PAN).

6. WHERE IS YOUR PERSONAL DATA STORED?

Your personal data is hosted and processed by PAYLEAD exclusively in the European Union.

However, PayLead reserves the right to use certain service providers outside the European Economic Area (EEA). PayLead will inform you of such transfers outside the EU and ensure that your personal data is properly protected in accordance with the requirements of the GDPR. Upon request, PayLead will provide you with a copy of the applicable safeguards.

7. HOW IS YOUR PERSONAL DATA PROTECTED?

PayLead uses technical and organisational measures which comply with legal and regulatory requirements to keep your personal data secure and confidential, including:

• pseudonymisation of data: PayLead does not know your identity directly

• implementation of a policy for managing access rights to our tools and databases

• implementation of a logs policy

• data encryption

• anti-virus

• carrying out penetration tests

• anonymisation of data where possible

• training of PayLead employees in data security and privacy

Under written agreements, PayLead requires its service providers and subcontractors to implement strong security measures to protect the personal data they process on behalf of PayLead.

8. HOW CAN YOU EXERCISE YOUR RIGHTS?

The regulations in force allow you to keep control of your personal data. As such, you have the following rights:

• Right of access: you have the right to obtain a copy of any personal data we hold concerning you.

• Right of rectification: you can request that your personal data be updated if it is incorrect.

• Right to object: in certain cases, you have the right to object to the use of your personal data. Only processing operations based on the legal basis of "legitimate interests" may be opposed by you. You must justify the legitimate reasons as why you wish to object to the use of your personal data by PayLead.

• Right to withdraw your consent: if you have given your consent to a specific processing operation, you may withdraw that consent at any time, without justification. Withdrawal of consent is only valid for the future.

• Right to restrict processing: in certain cases, you have the right to request that all or part of the processing of your personal data be suspended or restricted.

• Right to be forgotten: in certain cases, you can request the deletion of all of your personal data.

• Right to portability: you may ask to obtain all of your personal data in an understandable and readable format.

• Right to object to profiling and automated individual decision-making: you have the right to object at any time to the profiling of your personal data for direct marketing purposes.

Please note that exercising certain rights may result in your unsubscribing from the Automatic Cashback Service, since some processing is necessary for the provision of the service.

In order to respond to your request, we may ask you to provide us with proof of your identity and/or additional supporting information.

We will do our best to respond to your request as soon as possible.

You can exercise your rights by contacting Macadam and/or PayLead at the following addresses:

PAYLEAD

To the attention of DPO

58 bis rue de la Chaussée d'Antin

75009 PARIS

dpo@paylead.fr

MACADAM TECHNOLOGIES, S.L.

Av Diagonal Num.472 P.6 Pta.4  08006 – Barcelone (Spain)

contact@macadam.app

You can contact either Macadam and/or PayLead, who will jointly respond to your request. However, please note that PayLead does not have direct knowledge of your identity, so it is recommended that you address your initial request to Macadam.

Finally, you can file a complaint with

• the CNIL, the French Data Protection Authority (Commission Nationale Informatique et Libertés, located at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 (more information at www.cnil.fr) or

• the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD), located at C/Jorge Juan, 6, 28001 Madrid (more information at www.aepd.es)

This policy may be updated, in particular if new personal data processing are operated. You will be informed of these changes by any written means.