Privacy Statement

What is the purpose of this privacy policy?

The purpose of this privacy policy (the “Policy”) is to inform visitors/users of the website and prospective customers (“You” or “Your”) about how the I-TRACING Group collects and processes your personal data in its capacity as data controller in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and local regulations relating to the protection of personal data (together the “Applicable Regulations”).

This Policy applies to all companies of the I-TRACING Group and explains how the I-TRACING Group’s entities collect, use, store and protect Your personal data, as well as your rights, in accordance with the Applicable Regulations. Each company within the I-TRACING Group is responsible for its own processing activities, subject to the specific terms set out in the following sections.

Who is the data controller?

When You visit our website at www.i-tracing.com (the “Website”), the data controller is I-TRACING, a simplified joint-stock company with its registered office at 25 quai du Président Paul Doumer, 92400 COURBEVOIE, registered within the Nanterre Trade and Companies Register under number 484 841 127 (“I-TRACING” or “We”).

This Policy does not apply to the processing of personal data where I-TRACING acts as a data processor. For the processing of personal data entrusted to us by our clients in connection with the use of our services, they act as data controllers and we act as a data processor within the meaning of the GDPR. It is therefore their responsibility to ensure compliance with the information and rights of data subjects and, more generally, with the Applicable Regulations.

The processing of personal data relating to I-TRACING’s clients and staff are not covered by this Policy. They are the subject of a separate notice.

What personal data do we collect, for what purposes, on what legal grounds, and for how long do we retain it?

“Personal data” refers to information relating to an identified natural person or a person who can be identified, directly or indirectly, from that data.

“Processing” refers to any operation or set of operations performed on personal data, regardless of the method used.

I-TRACING collects and processes only data that is relevant and necessary for the intended purpose, in accordance with the Applicable Regulations and on a valid legal basis – as detailed below.

When You visit the Website, we may collect and process personal data relating to You.

Depending on how You use the Website, the provision of certain information might be mandatory, which is indicated. In such cases, if You do not wish to provide Your data, You will not be able to make full use of the Website.

All personal data collected is retained for a limited period depending on the purpose of the processing and the time limits imposed by the legislation applicable to I-TRACING.

Data that may be collected directly from you
Processing and purposes	Categories of data processed	Legal basis	Retention period
Recruitment: to enable you to apply for vacancies within I-TRACING and its subsidiariesrecruitment and candidate assessment	Identification data: surname, first name, email and telephone contact details, date of birth Professional details: education, qualifications and certifications, professional experience	Performance of the contract and pre-contractual measures Our legitimate interest in retaining the CV if the candidate is not recruited	2 years after the last contact with the candidate
Prospects: to enable you to request information and/or receive offers regarding the services provided by I-TRACINGmanagement and follow-up of prospects	Identification details: surname, first name Professional details: work email address and telephone number, company name	Our legitimate interest in responding to your enquiries and in developing and promoting our business	3 years from your last contact
Communication and events management: Organisation of events and webinarsMonitoring the performance of communication campaigns	Identification data: surname, first name, email address, telephone number	Our legitimate interest in developing and promoting our business	3 years from your last contact

Data that may be collected indirectly
Processing and purposes	Categories of data processed	Legal basis	Retention period
Browsing experience: to enable the Website to function and ensure its security, and to improve the browsing experience	Technical data: information concerning the computer and the connection environment, namely the IP address, technical identifiers, error reports and performance data Browsing data: usage data, such as the functions you have used, the settings you have selected, the data you have clicked on, including the date and time and the pages viewed Location data	Our legitimate interest in ensuring the Website’s functioning and security and improving the browsing experience	13 months
Browsing experience: to provide you with relevant and personalised marketing content based on your interests		Consent	13 months

What cookies do we use?

The cookie management policy, which supplements the Policy, is available here.

Who are the recipients of your personal data?

Your personal data will never be sold, shared or disclosed to third parties by I-TRACING.

Your personal data may be disclosed to affiliates, subsidiaries or service providers for the sole purpose of carrying out the processing for which it was originally collected. In this context, these entities are primarily personal data processors, within the meaning of the Applicable Regulations, acting on our instructions and on our behalf. They are required to process the data in accordance with the Policy. They are not authorised to sell or disclose it to other third parties.

However, in certain cases, some recipients of the data may be separate data controllers.

The authorised recipients are:

I-TRACING’s internal departments

Authorised staff in the marketing, sales, administrative and IT departments;
The HR team

I-TRACING’s subcontractors:

HR management tool
audience measurement tool
LinkedIn account session retention
consent management platform
professional skills assessment
recruitment and application management

This list may change from time to time.

Furthermore, if you access the Website via a third-party application, your personal data may be shared with the publisher of that third-party application so that they can provide you with access to the Website under the terms of a license and a privacy policy specific to that publisher.

Finally, personal data may be disclosed if we are required to do so by law or by a regulatory provision, or if such disclosure is necessary in connection with a judicial or administrative request or litigation proceedings.

Is your personal data transferred outside the European Union?

The data collected may be processed outside the European Union by our data processors.

In such cases, we ensure an adequate level of protection for the transfer of data using the following measures:

either the data is transferred to a country that has been the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the GDPR: in this case, that country ensures a level of protection deemed sufficient and adequate under the provisions of the GDPR;

or the data is transferred to a country whose level of data protection has not been recognised as adequate under the GDPR: in this case, such transfers are based on appropriate safeguards set out in Article 46 of the GDPR, tailored to each service provider, including, but not limited to, the use of standard contractual clauses approved by the European Commission, the application of binding corporate rules, or pursuant to an approved certification mechanism;

or the data is transferred on the basis of one of the appropriate safeguards described in Chapter V of the GDPR.

You can obtain a copy of the tools enabling the transfer of your data outside the European Union by contacting us using the details provided in the section ‘What are the contact details of the Data Protection Officer (DPO)?’ below.

What security measures do we put in place to protect your data?

To ensure the security and confidentiality of the personal data we collect and process, we use technical measures (networks protected by standard devices such as firewalls, network segmentation, appropriate physical hosting, etc.) and organisational measures (strict, named access control, procedures, security policy, etc.).

When processing your personal data, we take all reasonable measures to protect it against loss, misuse, unauthorised access, disclosure, alteration or destruction.

Those with access to your personal data are bound by a duty of confidentiality and secrecy; they are liable to disciplinary action and/or other sanctions if they fail to comply with these obligations.

What are your rights regarding your data?

You have the following rights regarding your personal data:

Right to information: this is why we have drawn up this Policy. This right is provided for in Articles 13 and 14 of the GDPR.

Right of access: you have the right to access all your personal data at any time, pursuant to Article 15 of the GDPR.

Right to rectification: you have the right to rectify your inaccurate, incomplete or outdated personal data at any time, in accordance with Article 16 of the GDPR.

Right to restriction of processing: you have the right to obtain the restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.

Right to erasure: you have the right to request that your personal data be erased, and to prohibit any future collection of such data, on the grounds set out in Article 17 of the GDPR.

Right to lodge a complaint with the competent supervisory authority in the country where the I-TRACING Group company is located (in France, for processing carried out by I-TRACING SAS, the competent authority is the CNIL, www.cnil.fr), if you consider that the processing of your personal data constitutes a breach of applicable legislation, in accordance with Article 77 of the GDPR, or in the event of an unresolved issue relating to the use of your personal data.

Right to set out instructions regarding the retention, erasure and disclosure of your personal data after your death, for processing carried out in France by I-TRACING SAS.

Right to withdraw your consent at any time: for processing based on consent, Article 7 of the GDPR states that you may withdraw your consent at any time. Such withdrawal will not affect the lawfulness of processing carried out prior to the withdrawal.

Right to data portability: subject to certain conditions set out in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a standard, machine-readable format and to request that it be transferred to a recipient of your choice.

Right to object: under Article 21 of the GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue to process your data despite this objection, on legitimate grounds or to defend our legal rights.

You may exercise these rights by writing to us at the contact details below. We may ask you to provide additional information or documents, only to verify your identity.

What are the contact details of the Data Protection Officer (DPO)?

I-TRACING has appointed a Data Protection Officer (DPO) responsible for ensuring the protection of personal data and compliance with relevant legal and regulatory requirements.

For any further information or complaints regarding the application of this Policy, including processing activities involving all companies within the I-Tracing Group, you may contact the DPO using the details provided below:

I-TRACING – Data Protection Officer

25 quai du Président Paul Doumer – 92400 Courbevoie

dpo@i-tracing.com

Changes to the Policy

We may amend the Policy at any time, in particular to comply with any regulatory, case law, editorial or technical developments. These amendments will apply from the date the amended version comes into force. You are therefore invited to consult the latest version of this Policy regularly. Nevertheless, we will keep you informed of any significant changes to the Policy.

Effective date: 09/02/2026