PERSONAL DATA PROTECTION POLICY

This personal data protection policy, applicable on 29/10/2024, sets out the manner in which the personal data (hereinafter referred to as "Personal Data") of prospects and business customers as well as customers acting in a personal capacity (hereinafter referred to together as "Users") are collected and processed by Welcome Account :

• for the supply of Welcome Account products and services under contracts entered into with them;

• when they visit the website https://welcomeaccount.com/ (hereinafter referred to as "the Site") and

• when they connect to the Welcome Account Application (hereinafter referred to as "the Application").

The Personal Data collected are processed in accordance with the European Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (referred to as the "RGPD"), to the Law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms (known as the "Informatique et Libertés"), and this Personal Data Protection Policy (hereinafter referred to as the "PPD").-

1. Data controller and purposes

Personal Data, collected through various communication channels (the Site, the Application, by telephone or by e-mail), are collected by Welcome Account in its capacity as data controller within the meaning of the RGPD.

The nature of the operations carried out on Personal Data is the collection, recording, consultation, reconciliation, consolidation, storage and communication by transmission in order to ensure compliance with the legal and regulatory obligations applicable to Welcome Account, as a payment services agent.

1. Personal data processed

The Personal Data collected and processed by Welcome Account are :

1. Personal data retention and storage

Personal Data retention periods are necessarily extended for the legal period of foreclosure or prescription as evidence in the event of litigation. In the latter case, the retention period for Personal Data is extended for the duration of the dispute.

After the deadlines set out above, Personal Data is either deleted or kept after being anonymized, notably for statistical purposes. Please note that deletion or anonymization are irreversible operations and that Welcome Account is no longer able to restore them.

1. Storage and transfer of Personal Data outside the EU

Welcome Account stores Personal Data on the servers of Microsoft Ireland Operations Limited located in Ireland.

Users' Personal Data (excluding data collected in compliance with legal and regulatory obligations, in particular for the purposes of combating money laundering and the financing of terrorism) may be transferred outside the European Economic Area to third countries. If this is the case, Welcome Account implements a precise and demanding framework that complies with applicable European regulations, in particular by relying on an adequacy decision from the European Commission or by signing dedicated contractual clauses (European Commission Standard Contractual Clauses) and security commitments offering the level of guarantee required by the RGPD.

Data may be transferred to the following countries:

• United States.

You may obtain a copy of these guarantees at any time by contacting Welcome Account at the address and in the manner specified in article 11 of this PPD.

1. Recipient of Personal Data

The recipients are the natural or legal persons who receive communication of Personal Data (hereinafter referred to as the "Recipients").

Welcome Account ensures that Personal Data is only accessible to authorized internal and external Recipients, including in particular :

• Welcome Account personnel authorized to manage the relationship with customers and prospects; in this context, Welcome Account decides which Recipients may have access to which Personal Data according to an appropriate authorization policy and ensures that they are subject to an obligation of confidentiality;

• Welcome Account's service providers who process Personal Data on behalf of Welcome Account and according to its instructions, without being able to use this data for purposes other than carrying out the subcontracted operations;

• Welcome Account's partners, who process Personal Data on behalf of joint customers and according to the terms of the contracts directly concluded with them;

• national or regional subsidiaries of the Crédit Agricole Group, in particular Okali, in its capacity as an electronic money institution, Welcome Account's principal;

• authorities legally authorized to have access to it; in this context, Welcome Account is not responsible for the conditions under which the personnel of these authorities have access to and use the Data. Such transmissions are carried out in compliance with - among other things - the "Compendium of procedures - authorized third parties" published by the Commission Nationale de l'Informatique et des Libertés (CNIL);

• In the context of carrying out all types of capital transactions with this third party (including, in particular, acquisitions, disposals, mergers, demergers, contributions, partial contributions of assets, transfers of all assets and liabilities, restructurings or any other transactions involving the transfer of company shares), whether partial or total, at Welcome Account level.

1. profiling and fully automated decisions

In cases where Welcome Account implements data processing involving fully automated decision-making (including profiling) and producing legal effects concerning or significantly affecting Users, such processing is then based on Users' explicit consent, the performance of a contract or specific legal provisions. Such processing is carried out in accordance with the applicable regulations and is backed by appropriate guarantees.

Should this profiling have legal consequences for Users, they may request the intervention of a human being, in particular in order to obtain a re-examination of their situation, to express their own point of view, to obtain an explanation or to contest the decision taken.

1. remote identity verification

The purpose of the remote identity verification service is to validate that the identity documents presented by Users are authentic, and that Users are the legitimate holders of these documents. The verdict is determined on the basis of personal identification data, acquired and verified by Share ID as a remote identity verification service provider, certified by the Agence Nationale de la Sécurité des Systèmes d'Informations (the "ANSSI"). The verdict, as well as the identity attributes and credentials, are then communicated to Welcome Account.

The following identity attributes are deemed to characterize the uniqueness of an individual's identity and are therefore collected by Share ID and transmitted to Welcome Account: birth name, customary name (if present), first name(s), date of birth, place of birth, nationality, gender. Welcome Account invites Users wishing to verify identity to the identity verification service web page. Users are then invited to video-capture their identity document and face; Users are guided through this phase. Once the identification data has been captured, Welcome Account's compliance department and/or its agents (notably Okali) asynchronously verify the data.

Nota Bene : A specific technical processing of biometric data, captured during the facial video, is carried out by the above-mentioned service provider for the purpose of verifying the identity of Users. This specific technical processing of facial images makes it possible to confirm the unique identification of an individual based on his or her physical, physiological or behavioral characteristics. It also detects the "living" character of the individual's face, to check that it has not been physically or digitally altered. This biometric data is considered sensitive within the meaning of the RGPD. In order to use this processing in compliance with the RGPD, Welcome Account justifies a specific need to identify Users to enable access to its products and services, under the supervision of the CNIL.

Alternative to remote identity verification: Users who do not wish or are unable to use the identity verification service under the proposed conditions may request an alternative method of identity verification from the compliance department of Welcome Account and/or its agents, without any additional constraints, incentives or special consideration. To take advantage of this service, Users are invited to contact Welcome Account's customer service department at the following e-mail address: [email protected] .

Share ID certification by ANSSI and its remote identity verification policy can be consulted at any time at the following addresses:

https://www.shareid.ai/privacy
https://www.ssi.gouv.fr/entreprise/produits-certifies/prestataires-de-verification-didentite-a-distance-pvid/. https://www.ssi.gouv.fr/entreprise/produits-certifies/prestataires-de-verification-didentite-a-distance-pvid/.

1. Security of Personal Data

Welcome Account reaffirms its commitment to ensuring that the security of Users' Personal Data is at the heart of all its actions. The solutions used by Welcome Account to store or process its Users' Personal Data are subject to our rigorous validation and certification procedures.

1. Failure to provide Personal Data

Users are not obliged to answer all the questions asked of them in the various collection media and contact forms offered by Welcome Account: fields marked with an asterisk are mandatory, others are optional.

However, failure to provide such Data may result in Welcome Account being unable to process the User's request, or prevent the User from benefiting from certain Welcome Account products and services.

1. rights to Personal Data

Users have rights to their Personal Data collected and processed by Welcome Account in connection with the provision and promotion of its products and services.

Their rights are as follows:

• a right of access, rectification and deletion of Personal Data (inaccurate, incomplete, equivocal or outdated):

• Welcome Account guarantees Users access to their Personal Data collected or processed as part of the commercial relationship;

• a right to object to the processing of Personal Data at any time in the context of commercial prospecting:

• Welcome Account allows Users to oppose commercial prospecting without justification.

• a right to limit the processing of Personal Data in accordance with applicable regulations:

• if Users no longer wish certain of their Personal Data to be processed, they have the option of limiting its use in accordance with applicable regulations.

• a right to portability of Personal Data:

• Welcome Account will return Users' Personal Data at their request, in a commonly used electronic format, so that they can, if necessary, transmit it to the organization of their choice.

• the right to withdraw consent at any time:

• Users may accept or refuse Welcome Account's processing of some of their Personal Data at any time. However, this may result in the termination of the registration process or access to the Site.

• the right to lodge a complaint with a supervisory authority:

• Users have the right to lodge a complaint at any time with the CNIL, the French data protection supervisory authority.

• a right to communicate to Welcome Account as data controller their instructions concerning their Personal Data in the event of death:

• Users can communicate their instructions on what to do with their data after their death.

Users may exercise their rights with the Welcome Account DPO by writing to the e-mail address [email protected] by post to the postal address: DPO Welcome Place - Station F

44 rue Eugène Freyssinet

75013 Paris

France

.

Welcome Account undertakes to respond to all requests within one month of receipt. This period may be extended by two (2) months if the request is particularly complex.

In this case, Users will be informed of any such extension and the reasons for it within a maximum period of one (1) month from receipt of the request.

In the event of a dispute, Users may lodge a complaint with the CNIL, whose Website can be accessed at the following address https://www.cnil.fr and its head office is located at 3 Place de Fontenoy, 75007 Paris.

1. Modification of ppd

The PPD may be modified or amended at any time in the event of changes in legislation, case law, decisions and recommendations of the CNIL (French Data Protection Authority), practices or changes in the processing of Personal Data by Welcome Account.

Any new version of the PPD will be brought to the attention of Users by any means that Welcome Account deems appropriate and relevant, including electronic means and publication on the Site.