This privacy policy (hereinafter referred to as the “Privacy Policy” ) defines the legal framework for the collection, use and processing by Lunii SAS (hereinafter referred to as the “Company” ) of the personal data of users browsing and/or using the services offered via the website developed by the Company (hereinafter referred to as the “Users” ), accessible at the address https://www.lunii.com , the Lunii mobile application, the computer application designed and operated by the Company (hereinafter referred to as the “Platforms” ). The provision of personal data collected under this Privacy Policy is mandatory. This information is necessary for the processing and provision of the services offered by the Company via the Platforms (hereinafter referred to as the “Services” ). Failure to provide information prevents the proper functioning of the Services offered online. The Company undertakes to comply with the applicable regulations regarding the protection of personal data (hereinafter referred to as “Personal Data” ), and in particular the obligations arising from European Regulation No. 2016/679 on the protection of personal data (GDPR). The Company collects personal data only in accordance with the terms of this Privacy Policy and any legal and reasonable instructions given by the User at any time. When the Company notes a violation of rights in the context of the processing of personal data, this violation will be notified to the CNIL within a period not exceeding seventy-two (72) hours after becoming aware of it. Any violation relating to the processing of the User's personal data will be notified to the User concerned by e-mail, within one (1) month.

1.1 Throughout the duration of use of the Platform and the Services, the Company may collect any information, directly or indirectly identifying the User, necessary for the creation of an account on the Platform and necessary for the proper functioning of the Platform (hereinafter referred to as “Personal Data” ). When logging in for the first time, the User expressly consents to the processing of their Personal Data within the limits of processing strictly necessary for the proper functioning of the Platform. Providing the personal information collected is mandatory. This information is necessary for processing and providing the Services. Failure to provide information prevents the proper functioning of the Services offered online. This particularly concerns:
▪ Personal Data relating to the identity of the User and in particular their title, surname, first name, email address, telephone number, postal address and postal code;
▪ Personal Data relating to browsing, collected automatically by the Company and in particular the anonymized IP address, the browser used, the browsing time, the operating system used, the language and the pages viewed;
▪ Data relating to statistics of visits to the Platform by Users and in particular traffic data and other data or communication resources used by the User when accessing the Platform;

1.2 Personal Data may be collected directly when the User communicates it to the Company using the forms for creating a User account, requesting contact, subscribing to the newsletter available on the Platform and reporting illegal content. The Company reserves the right to review, browse or analyze communications exchanged between the Company and Users via the Platform for the purposes of fraud prevention, risk assessment, regulatory compliance, investigation, product development, research and User support. The provision of Personal Data collected for these purposes is mandatory and strictly necessary for the proper functioning of the Platform. Otherwise, the Services cannot be provided

2.1 Purpose of data processing The use of our Platforms for informational purposes is designed to minimize the collection of personal data. Generally, it is possible to use these Platforms without providing personal information. However, certain data may be required when placing an order, creating an account, for customer service inquiries, subscribing to the newsletter, or when using the contact form to obtain information about our products and services. We collect personal data voluntarily to the extent possible to provide our services. When this is not justified by a specific legal basis, we ask for your prior consent. This consent can be withdrawn at any time. Personal data is not shared with third parties, except for our service providers who need it to process orders (delivery, payments, after-sales service, etc.). In these cases, only the data strictly necessary for the service is transmitted, and the service providers undertake to comply with the GDPR and treat the data confidentially. In the event of a merger, acquisition, or reorganization, your personal information may be transferred in accordance with applicable laws. We may also disclose this information if required to do so by law or to protect our rights or those of others, and to respond to requests from authorities. We regularly update our data protection policy in line with legislative changes and developments in our internal processes, and will inform you accordingly.

2.2 Legal basis for processing The processing of your personal data complies with the provisions of the General Data Protection Regulation (GDPR). The data provided via the contact form is processed with your consent (Art. 6(1)(a) GDPR). In the case of communication by e-mail, the legal basis is Art. 6(1)(f), or if it is aimed at concluding a contract, Art. 6(1)(b). We primarily process your data for the provision of contractual services (Art. 6(1)(b) GDPR). We use subcontractors for these services, with whom we have concluded agreements in accordance with Art. 28 GDPR. If these subcontractors are located outside the EU or EEA, we ensure compliance with EU standard contractual clauses. If you have consented to certain purposes, such as receiving our newsletter, this processing is based on your consent (Art. 6, para. 1, point a) of the GDPR), which you can withdraw at any time, without affecting the processing already carried out. When processing is necessary to comply with a legal obligation, such as tax obligations, the legal basis is Art. 6(1)(c) GDPR. In addition, we may also process your data on the basis of a legitimate interest (Art. 6(1)(f)), for example to inform you about our similar products or to check your creditworthiness.

Your rights regarding your personal data Depending on the legislation of your country of residence, you have the following rights:
● Right of access,
● Right of rectification,
● Right to erasure,
● Right to restriction of processing,
● Right of opposition,
● Right to data portability. To exercise these rights, you can use our contact form, modify your profile directly or contact us at mesdonnees@lunii.com .

3.1 The Company may disclose Users' Personal Data to courts, governmental or law enforcement authorities or authorized third parties, if required or permitted by law, or if such disclosure is reasonably deemed necessary: (i) to comply with the Company's legal obligations, (ii) to comply with legal process and to pursue claims asserted against the Company, (iii) to respond to verified requests in connection with a legal investigation or alleged or suspected illegal activity or any other activity that may expose the Company or the User to legal liability. 3.2 The Company has the right to subcontract all or part of the execution of the Services in compliance with the legal provisions in force. The Company may also subcontract the hosting services of Personal Data on the condition that the Personal Data is processed by a hosting platform located exclusively in the territory of the European Union. The subcontractor will be authorized to process on behalf of the Company the Personal Data necessary to provide the Services. 3.3 Personal Data may be transmitted to technical service providers, for the sole purpose of the proper execution of the Services, or to its various suppliers such as payment solution providers.

4.1 The Company makes every effort to ensure the security, integrity, and confidentiality of the information you provide to us. To this end, technological security measures have been deployed to protect your personal data. In addition, the Company complies with the requirements of applicable data protection regulations. When using our Platforms and during the ordering process, your personal data is protected by SSL encryption. The Company has also implemented technical and organizational measures to prevent the loss, destruction, unauthorized access, alteration, or dissemination of your information by unauthorized third parties. Access to your Lunii account is secured by a personal password, which you must keep confidential. The same applies to access to the mobile and desktop applications. To further protect your information, we recommend that you always log out and close the browser window after each session, especially if you share your device (computer, tablet, or smartphone) with other users.

4.2 The Personal Data communicated by the User will be destroyed no later than six (6) months after the end of the User's use of the Services. The Company reserves the right to retain certain data in order to justify, where applicable, the perfect execution of its contractual or legal obligations. The data thus retained will be limited to what is strictly necessary.

4.3 In all cases, Users have the right to access, rectify, modify, oppose, transfer and delete Personal Data concerning them by writing to the following address: mesdonnees@lunii.com, indicating your first name, last name, email address and address. In accordance with current regulations, all requests must be signed and accompanied by a photocopy of an identity document bearing the User's signature. The User may retrieve his/her Personal Data in an open and readable format. The right to portability is limited to the data provided by the User concerned. It applies on the basis of the User's prior consent. The Company undertakes to transfer, upon request, within one (1) month, any document collecting Personal Data to the User in order to be able to implement the right to portability. The costs related to data recovery are the responsibility of the User making the request.

In accordance with CNIL deliberation no. 2013-378 of December 5, 2013, the Company also informs that cookies record certain information that is stored in the User's hard drive memory. This information is used to generate audience statistics. An alert message, in the form of a banner, asks the User, in advance, if he wishes to accept cookies. Users accessing the home page or another page of the Platform directly from a search engine will be informed:
▪ the specific purposes of the cookies used;
▪ the possibility of opposing these cookies and changing the settings by clicking on a link in the banner;
▪ and the fact that continuing to browse implies consent to the storage of cookies on your device. To ensure the free, informed and unequivocal consent of Users on the Platform, the banner will not disappear until they have continued browsing. Unless prior consent is given, cookies will not be stored or read.

Depending on the choices made by the User, he may be a recipient of the newsletter. By checking the box provided for this purpose or by expressly giving his consent to this end, the User accepts that the Company may send him a newsletter (information letter) which may contain information relating to new activities offered by the Company's Partners. Users will have the option to unsubscribe from the newsletter by clicking on the link provided for this purpose, present in each of the newsletters.