Privacy Policy | ILMSKILL

1. Purpose of the privacy policy The purpose of this Privacy Policy is to inform Users of the ILMSKILL platform of the conditions under which their Personal Data may be collected, used, stored, transmitted, and protected when using the services offered through the platform. The ILMSKILL platform is operated by SASU Alpha Inova (hereinafter the “Publisher”). The Publisher attaches particular importance to the protection of Personal Data and undertakes to process such data in compliance with the applicable regulations, including: • Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”); • French Law No. 78-17 of 6 January 1978 as amended, known as “Informatique et Libertés”; • as well as any applicable regulation on personal data protection. This Privacy Policy supplements: • the General Terms of Use of the ILMSKILL platform; • any license agreements entered into with Clients; • and any contractual document applicable to services offered through the platform. Use of the ILMSKILL platform implies that the User has read this Privacy Policy. 2. Data controller The data controller for Personal Data collected and processed through the ILMSKILL platform is: SASU Alpha Inova Share capital: EUR 1,000 Rouen Trade and Companies Register (RCS): 914 975 735 Registered office: 72 rue de la République, 76140 Le Petit-Quevilly (France) Alpha Inova operates the ILMSKILL platform and determines the purposes and means of Personal Data processing carried out in connection with services offered through the platform. For any question relating to this Privacy Policy or the processing of Personal Data, Users may contact the Publisher at: Email: contact@ilmskill.com 3. Personal Data collected In connection with the use of the ILMSKILL platform and the services offered, the Publisher may collect and process different categories of Personal Data. The Personal Data that may be collected may in particular include: • identification and contact data: last name, first name, email address, role, company, professional information, or related contact details; • user account data: login credentials, authentication information, account settings, and access history; • technical and browsing data: IP addresses, session identifiers, timestamps, activity logs, and information relating to equipment, browsers, systems, or technical environments used; • data relating to electronic documents and operations: documents transmitted through the platform, electronic validations, electronic signatures, consents, supporting documents, and related traceability elements; • data relating to services and content used: downloads, content access, usage history, associated licenses, and interactions carried out through the platform; • data relating to support and communications: messages sent to customer support, assistance requests, technical or administrative exchanges, and related information. Certain Personal Data may be required for: • creating an account; • access to certain features; • provision of services offered; • electronic signature of documents; • validation of certain operations; • or compliance with applicable legal and contractual obligations. If certain required information is not provided, some services or features of the platform may be unavailable or limited. The Publisher does not intentionally collect Personal Data that is not necessary for the purposes pursued in operating the ILMSKILL platform. 4. Purposes of processing Personal Data collected through the ILMSKILL platform may be used for the following purposes: • creating, managing, and securing user accounts; • providing, operating, and administering services offered through the platform; • managing exploitation licenses and associated access; • transmitting, consulting, validating, and monitoring electronic documents; • carrying out and managing electronic signatures; • managing electronic consents and associated validations; • transmitting content, training packs, and digital resources; • managing downloads, access, and operations carried out through the platform; • retaining evidentiary elements and activity logs; • preventing fraud, abusive use, unauthorized access, or security breaches; • detecting, analyzing, and managing technical or security incidents; • technical support, customer service, and management of User requests; • improving, evolving, optimizing, and maintaining services offered; • complying with applicable legal, regulatory, and contractual obligations; • managing disputes, claims, audits, controls, or proceedings; • as well as defending the Publisher’s legitimate rights and interests. Processing operations are limited to the purposes necessary for the operation of the ILMSKILL platform and the provision of services offered. 5. Legal bases for processing Personal Data processing carried out through the ILMSKILL platform is based in particular on the following legal bases, in accordance with applicable personal data protection regulations: • performance of a contract or pre-contractual measures, in particular for: • creating and managing user accounts; • providing services offered through the platform; • license management; • transmission of digital content; • electronic signature of documents; • management of validations and operations carried out through the platform; • compliance with legal and regulatory obligations applicable to the Publisher, in particular concerning: • data retention; • security; • fraud prevention; • regulatory compliance; • or management of accounting, tax, or evidentiary obligations; • the Publisher’s legitimate interest, in particular to: • ensure the security and proper functioning of the platform; • prevent fraudulent or abusive use; • retain evidentiary elements; • improve services offered; • manage incidents, disputes, or claims; • protect the Publisher’s rights and interests; • or ensure continuity and evolution of services; • the User’s consent where required by applicable regulation, in particular for certain specific processing operations, certain electronic operations, or the use of certain non-essential cookies or trackers. Where processing is based on consent, the User may withdraw that consent at any time under the conditions provided by applicable regulation, without affecting the lawfulness of processing carried out before withdrawal. 6. Data recipients Personal Data collected through the ILMSKILL platform is intended for authorized persons, departments, and service providers within the framework of the pursued purposes and operation of services offered. Personal Data may in particular be accessible: • to the Publisher and its authorized administrative departments; • to authorized persons involved in the management, operation, maintenance, security, or support of the platform; • to technical providers, hosting providers, processors, or service suppliers involved in operation of the platform; • to providers involved in electronic signature, authentication, storage, security, or data transmission services; • to advisors, auditors, or authorized providers involved in the Publisher’s activities; • as well as to administrative, judicial, or regulatory authorities where required by law or where a legally valid request is made. Personal Data is transmitted only to recipients who need access in connection with their duties, contractual obligations, or pursued purposes. The Publisher may use technical providers or processors located inside or outside the European Union. Where Personal Data transfers may take place outside the European Economic Area, the Publisher endeavors to implement appropriate safeguards in accordance with applicable regulations. The Publisher does not sell Users’ Personal Data to third parties. 7. Hosting and transfers The ILMSKILL platform may rely on infrastructures, cloud services, technologies, and specialized technical providers required for its operation, hosting, provision of services offered, and security of processed data. Personal Data collected through the platform may be hosted, stored, processed, or transmitted by technical providers or processors acting in connection with services offered by the Publisher. Such processing may involve transfers of Personal Data within or outside the European Union or the European Economic Area, in particular where certain technical providers, cloud infrastructures, or digital services used by the Publisher are operated internationally. Where Personal Data may be transferred to countries that do not benefit from a European Commission adequacy decision, the Publisher endeavors to implement appropriate safeguards in accordance with applicable regulation, including: • appropriate contractual clauses; • suitable technical and organizational measures; • or any mechanism recognized by applicable regulation. The Publisher implements reasonable measures to select technical providers offering appropriate guarantees in terms of security and protection of Personal Data. Users acknowledge that the use of digital services, cloud infrastructures, and technologies operated at international scale may involve certain technical processing operations or data transfers necessary for the normal operation of the ILMSKILL platform. 8. Data security The Publisher implements reasonable technical, organizational, and security measures designed to ensure the confidentiality, integrity, availability, and protection of Personal Data processed through the ILMSKILL platform. These measures may in particular include: • authentication and access control mechanisms; • logging of operations and access; • protective measures against unauthorized access; • monitoring and detection mechanisms; • mechanisms to secure electronic exchanges; • backup, recovery, or restoration procedures; • measures to prevent abusive or fraudulent use; • as well as any security measure deemed appropriate by the Publisher. Access to Personal Data is limited to authorized persons only, within the scope of their roles, duties, or operational needs. The Publisher endeavors to select technical providers and processors offering appropriate guarantees in terms of security and protection of Personal Data. However, the User acknowledges that no IT system, network, cloud infrastructure, or electronic transmission can guarantee absolute security. Accordingly, despite the measures implemented, the Publisher cannot guarantee: • total absence of vulnerabilities; • total absence of fraudulent access; • total absence of malicious acts; • nor total absence of technical incidents beyond its reasonable control. The User remains responsible for: • confidentiality of their credentials; • security of their equipment and access systems; • access carried out from their account; • as well as information and documents transmitted through the platform. In the event of a security incident, suspected fraud, or security breach affecting systems, the Publisher may take any measure deemed necessary to protect: • Personal Data; • Users; • services offered; • technical infrastructures; • or the Publisher’s legitimate interests. Where required by applicable regulation, the Publisher may make required notifications to competent authorities or affected persons. 9. Data retention Personal Data, activity logs, evidentiary elements, and technical data processed through the ILMSKILL platform are retained for periods deemed necessary with regard to: • pursued purposes; • applicable legal and regulatory obligations; • security requirements; • contractual requirements; • evidentiary needs; • fraud prevention; • or defense of the Publisher’s rights. Retention periods may vary depending on: • the nature of the data concerned; • services used; • operations carried out; • applicable obligations; • or technical and operational constraints linked to operation of the platform. The Publisher may in particular retain: • data relating to user accounts; • documents transmitted through the platform; • electronic validations; • electronic signatures; • consents; • activity logs; • connection information; • exchanges with customer service; • as well as associated evidentiary elements. Certain data may be retained after: • deletion of an account; • end of a contractual relationship; • cessation of use of the platform; • or closure of a service, where such retention appears necessary: • to comply with a legal obligation; • for fraud prevention; • for system security; • for dispute management; • for retention of evidentiary elements; • or for defense of the Publisher’s rights. The Publisher may also adjust retention periods depending on: • legal or regulatory developments; • technical constraints; • security requirements; • operational needs; • or applicable evidentiary requirements. At the end of applicable retention periods, the data concerned may be deleted, anonymized, archived, or retained in a limited form where this remains necessary with regard to pursued purposes or applicable obligations. 10. Users’ rights In accordance with applicable personal data protection regulations, Users have, subject to the conditions and limits provided by those regulations, the following rights regarding their Personal Data: • right of access; • right to rectification; • right to erasure; • right to restriction of processing; • right to object; • right to data portability; • right to withdraw consent where processing is based on consent; • as well as the right to define directives regarding the fate of their Personal Data after death, where provided by applicable regulation. Users may exercise their rights by sending their request to the Publisher using the contact details made available in this Privacy Policy. In order to protect the confidentiality and security of Personal Data, the Publisher may request any supporting document or additional information necessary to verify the requester’s identity before processing a request. Certain requests may be refused, limited, or may not be fully satisfied where: • applicable regulation authorizes or requires it; • legal or contractual obligations prevent it; • retention of data remains necessary; • rights and freedoms of third parties must be protected; • or where the data concerned is necessary for the establishment, exercise, or defense of the Publisher’s rights. Users also have the right to lodge a complaint with the competent supervisory authority for personal data protection, in particular in France with the CNIL (Commission Nationale de l’Informatique et des Libertés). 11. Cookies and trackers The ILMSKILL platform may use cookies, trackers, or similar technologies necessary for operation, security, and use of the services offered. These technologies may in particular make it possible to: • maintain user sessions; • authenticate and secure access; • prevent fraud; • ensure proper technical functioning of the platform; • store certain preferences; • measure audience; • analyze use of services; • or improve offered features. Certain cookies or trackers are strictly necessary for operation of the platform and may be placed without prior consent where permitted by applicable regulation. Other cookies or trackers, in particular those relating to audience measurement, analytics, or non-strictly-necessary features, may require prior User consent in accordance with applicable regulation. The User may accept, refuse, or modify their preferences relating to cookies and trackers at any time via management tools made available on the platform. Refusal of certain cookies or trackers may limit access to certain features or affect the normal operation of certain services offered through the platform. Detailed information relating to cookies, trackers, retention periods, and preference management procedures is set out in the Cookie Policy available through the ILMSKILL platform. 12. Policy changes The Publisher reserves the right to modify, update, supplement, or adapt this Privacy Policy at any time, in particular to take account of: • legal, regulatory, or case-law developments; • technical developments of the platform; • developments in the services offered; • security requirements; • operational constraints; • or any development affecting Personal Data processing carried out through the ILMSKILL platform. The applicable version of the Privacy Policy is the one in force on the date the relevant services are used. The Publisher may inform Users of any modification to this Privacy Policy by any appropriate means, including: • display on the platform; • electronic notification; • email; • when logging into an account; • or by any other reasonably appropriate means. The Publisher may keep different versions of the Privacy Policy for purposes of: • traceability; • compliance; • evidence; • dispute management; • or compliance with applicable legal and regulatory obligations. Continued use of the platform after a new version of the Privacy Policy enters into force constitutes acknowledgment of that new version. 13. Contact For any question relating to this Privacy Policy, processing of Personal Data, or exercise of rights provided by applicable regulation, Users may contact the Publisher at: SASU Alpha Inova 72 rue de la République 76140 Le Petit-Quevilly (France) Email: contact@ilmskill.com The Publisher will endeavor to respond to requests within reasonable timeframes and in accordance with applicable personal data protection obligations. “This document is provided as a translation for convenience purposes. In the event of any discrepancy, inconsistency or interpretation issue between versions, the French version shall prevail.”