01

WHO IS THE DATA CONTROLLER?

The data controller is T2S, a French private limited company, registered with the trade and company registry of Chambery under number 329 151 518, having its registered office located at ZAC du grand Verger, 89 rue Amiral Gérard, 73000 CHAMBERY.

02

WHICH PERSONNEL DATA DO WE PROCESS?

o

We collect and process the following of your personal data: - Identification data (e.g. last name, first name, email, postal address, phone number); - Connection and location data (e.g. IP address, connection logs, geolocation); - Commercial data (e.g. communications with the customer service, data required to provide the subscribed services or to manage the customer relationship, data required for to perform satisfaction poll, data required for statistical analysis); - Invoicing data (e.g. means and payments history, transaction data, invoices); - Behaviour data (e.g. subscribed or contemplated services, behaviour on websites and tools (viewed pages, connection time, number of views)); - Data relating to personal and/or professional life (e.g. registration to events, testimonies of employees) Only personal data strictly required to achieve the purposes mentioned below are collected.

03

WHAT ARE THE PURPOSES OF PERSONAL DATA PROCESSING?

Your personal data are processed for the following purposes: - The management of our relationship with you, and in particular the customer relationship management; - the provision or supply of ordered or subscribed services; - operations relating to event management or marketing campaign performance; - the improvement of your profil knowledge and the analysis of your behaviour; - the download of files; - the customisation of our services according to your profile and the enhancement of your experience; - invoicing management; - traffic measurement and analysis, statistical analysis; - the production of statistical data and anonymous information relating to road users’ behaviour and traffic data/situation; - satisfaction poll relating to our services; - improvement and optimisation of our services and website quality; - the management of people rights and enquiries; - Information on products you transport;

04

WHAT ARE THE LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA?

Your personal data are collected and processed pursuant to the following legal basis: - Your consent; - The performance of an agreement; - For the purposes of legitimate interests; - To comply with our legal and regulatory obligations.

05

WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA?

The recipients of your personal data are the followings, depending on the processing performed: - The internal departments of T2S and of our parent company, AXXES - Providers acting on behalf of AXXES for the purposes above-mentioned; - Toll Charger companies of road networks on which the services are provided or to which they pertain; - Commercial partners of T2S and AXXES for the purposes above-mentioned, provided that geolocation data transmitted are always anonymous. Personal data are not transferred outside of the European Union. Should personal data be transferred outside of European Union, we commit that such transfers shall comply with the applicable laws and regulations or to a law or regulation providing an equivalent or sufficient level of protection of your personal data.

06

WHAT IS THE STORING PERIOD OF YOUR PERSONAL DATA?

Your personal data are stored for the period strictly required to achieve the purposes for which they have been collected and processed. By default: - the customer account accessible through the customer space is stored three (3) years from the last connection; - your credit card data, when requested, are stored for the period required to perform the transaction; - connection data, web browsing, and website traffic data are stored for one (1) year. - Mobile Application connection data will not be retained beyond the time strictly necessary to achieve the purpose for which it was collected - The connection, geolocation and traffic data collected during the Use of a mobile Application are stored on the Terminal with which the User uses the Application, for a period of two (2) months. . Nevertheless, personal data is retained for a longer period of time in the form of archiving when legal and regulatory obligations require us to do so, or if this is necessary in view of the applicable statute of limitations, to assert our rights, when it is not possible to prove this by other means . Once your Personal Data is no longer required for the purposes or for archiving purposes to meet our legal obligations or for the purposes of the applicable prescription, we will ensure that it is completely destroyed or anonymized.

07

WHAT ARE YOUR RIGHTS IN RELATION WITH YOUR PERSONAL DATA?

o

Your rights in relation with your personal data are the followings: - right of access; you have the right to be informed in a concise, transparent, intelligible and easily accessible manner on how your Personal Data is processed. - right to enquire about your personal data; you also have the right to obtain confirmation that Personal Data concerning you is being processed and, if necessary, to access such Personal Data. - right to rectification; you have the right to obtain the rectification of inaccurate Personal Data concerning you. You also have the right to complete the incomplete Personal Data concerning you, by providing an additional declaration. - right to erasure – provided that such right shall not hinder the performance of the agreement or the compliance with our legal or regulatory obligations; - right to restrict one or several processing of your personal data; - right to change or withdraw, at any time, consents to the processing of your personal data when such processing are based only on your consent; - right to object to the processing of your personal data; - right to portability of your personal data. You also have the right to define general or specific directives regarding how your personal data shall be handled or your rights exercised in case of death. To ensure that all information we have concerning you are always accurate, we recommend you to regularly update your personal data. You can exercise your rights concerning your personal data by contacting us: - By email à data-privacy@t2s.com; or - By post mail at : T2S SAS, to the DPO, ZAC du grand Verger, 89 rue Amiral Gérard, 73000 CHAMBERY You can also register for free on the tele prospecting objection list named Bloctel and managed by Opposetel company according to a public service delegation. In case you are not satisfied in relation with your personal data, you have the right to register a complaint toward the competent authority: Commission Nationale de l’Informatique et des Libertés (CNIL) 3 Place de Fontenoy TSA 80715 75334 PARIS CEDEX 07 FRANCE Phone: +33 (0) 1 53 73 22 22

08

HOW TO CONTACT OUR DATA PROTECTION OFFICE (DPO)?

You may contact our DPO: - By email à data-privacy@t2s.com; or - By post mail at : T2S SAS, to the DPO, ZAC du grand Verger, 89 rue Amiral Gérard, 73000 CHAMBERY

09

WHAT ABOUT COOKIES?

Cookies and other tracking devices may be installed and/or read on your terminal/webbrowser when visiting our websites/application. In particular, the website: https://www.t2s.com/ uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). The cookies placed by T2S allow to personalize the content of the website/application, to analyze the traffic of the website/application, to make statistics of use, and to improve your experience on the website/application. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Some of this information will be shared with T2S partners. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your computer. Any deactivation means that the user refuses the deposit of the cookies in question. These cookies can be deleted at any time by the Internet user. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. (To learn more about cookies: http://www.cnil.fr/vos-libertes/vos-traces/les-cookies or https://www.fr/fr/site-web-cookies-et-autres-traceurs.) In accordance with the recommendations of the CNIL, the maximum retention period for cookies is a maximum of thirteen (13) months after their first deposit in the User's terminal, as is the duration of the validity of the User's consent to the use of these cookies. The lifetime of cookies is not extended with each visit. The User's consent must therefore be renewed at the end of this period.

10

WHAT ARE SECURITY MEASURES IMPLEMENTED?

As the data controller, we take all useful measures to maintain the security and confidentiality of data and in particular, to prevent any alteration or unauthorised access. For this purpose, we implement all technical and organisational measures to provide a security level adapted to risks. In addition, we make sure our subcontractors comply with all applicable rules concerning personal data protection.

11

ABOUT MODIFICATION TO THIS POLICY?

This policy is intended to evolve and may change. In case of minor modifications, the updated policy shall be uploaded online to a dedicated page. In case of major modifications (e.g. purposes, exercise of rights), you will be informed. Last update date : 19/02/2021

TOP