Confidentiality policy

Purse is a technology company that offers online merchants a software solution, accessible in Saas mode, that optimizes the management of their payments by being an intermediary between the merchant's site and the Payment Services Providers that the merchant has chosen to activate. Purse is what we call a “payment orchestration platform” that allows a dynamic and contextual display of the right payment methods on the merchant's payment page and secure access to the merchant to a back office, the Payment Manager, making it possible to manage the performance of payments processed by PSPs.

To provide this solution, Purse acts as a subcontractor, within the meaning of the RGPD, of merchants who choose to use this payment orchestration solution. As such, Purse implements all the technical and organizational security measures necessary to ensure the security and confidentiality of the data processed with its service. Purse solicits service providers, who act only on its instructions, to process the data in order to provide the service (Data hosting; database administration; computer developments...)

The data displayed in the Payment Manager is the data associated with a customer order from a merchant (Customer identity, address, basket detail, transaction amount, transaction status, shipping status, PSP used for payment). Upstream Pay does not store any credit card data. These are only processed by Payment Services Providers (PSPs) to process the payment. By default, and unless otherwise directed by a merchant, transaction data is retained by Purse for a period of 15 months from the date of the transaction.

Any customer of a merchant can, as a natural person, exercise their rights over the processing of their data. This is the right of access, rectification, portability, portability, deletion of data and the right to oppose and limit the processing of data. These rights must be exercised directly with the Merchant. You can also exercise them directly with Purse who will forward the request to the Merchant concerned.

PURSE is required to collect and process the personal data of its customers to carry out the following treatments: Processing purposes Management of customer contacts (collection of data on the website, in fairs, events...) Sending a newsletter and invitations to events; Conducting webinars; Conducting webinars Legal bases Legitimate interest of PURSE to promote its activity and to find customers interested in its solution.

Any natural person whose data has been collected has the right to exercise the following rights: - A right of access, rectification and portability of data - A right to oppose or limit processing - A right to formulate advance directives on the fate of their data after death These rights can be exercised with PURSE through [the form] (#dastra -customer-subject-form) available at the end of the page. You can also send your requests to the following postal address: PURSE, Building Eurocentre 179 Boulevard de Turin in Lille (59000) The request must indicate, the name, first name, postal address, email. An identity check may be carried out. PURSE sends a response within 1 month. In some cases, related to the complexity of the request or the number of requests, this period may be extended by 2 months. In certain cases provided for by the regulations, these rights may be subject to exceptions. The person concerned has the option of submitting a complaint to the CNIL (www.cnil.fr).

PURSE uses subcontractors for data hosting, email routing and IT development operations. Purse ensures that these subcontractors offer all sufficient guarantees in terms of data security and confidentiality.

For certain operations, personal data may be transmitted to companies located in countries outside the European Union. Prior to the transfer outside the European Union, and in accordance with the regulations in force, Purse ensures the security of these data transfers.

PURSE has determined precise rules concerning the duration of storage of Customers' personal data. In principle, data is kept for the time necessary to achieve the purposes for which they were collected. The retention periods selected are as follows: - The data of prospects (a person who has never subscribed to the service) is kept 3 years after the last contact from the prospect - Customer data is kept for 3 years from the end of the contract with the customer;

Information relating to navigation on the site may be recorded in “Cookies” files placed on your terminal, subject to the choices you have expressed concerning Cookies and that you can modify at any time. 1. **Use of cookies on the Site** The Cookies used by Purse on its site are used to: - establish statistics and volumes of visits and use of the various elements of the Site. As such, we use audience measurement cookies. - adapt the presentation of our Site according to the terminal used; - allow you to access reserved and personal areas of our Site, such as your account, using identifiers; - to implement security measures, for example when you are asked to log in to your account again after a certain period of time; 2. **Setting cookies on the Site** You can make the choice at any time to express and modify your wishes in terms of cookies, by the means described below. - **Setting cookies with the consent manager** To access the list of cookies placed and configure their deposit, click on the link below: - **Configuring your browser software** You can configure your browser software so that cookies are saved in your terminal or, on the contrary, that they are rejected, or systematically, or according to their sender. The configuration of cookies is different depending on the browser used: - For Edge: http://windows.microsoft.com/fr-FR/windows-vista/Block-or-allow-cookies - For Edge: - For Safari: https://support.apple.com/fr-fr/HT201265 - For Chrome: http://support.google.com/chrome/bin/answer.py?hl=fr&hlrm=en&answer=95647 - For Firefox: http://support.mozilla.org/fr/kb/Activer%20et%20d%C3%A9sactiver%20les%20cookies - For Opera: http://help.opera.com/Windows/10.20/fr/cookies.html **Opposition list to manage the deposit of cookies** You also have the possibility to oppose the deposit of cookies by accessing the website **Link from third party editors** Purse uses the Google Analytics audience measurement cookie that can be set at the following address: https://tools.google.com/dlpage/gaoptout?hl=fr.

The data is processed for the following operations: - Writing and distributing ads on third-party platforms and jobboards; - Receiving responses from candidates; - Managing the recruitment process (conducting interviews; review of interviews; possible evaluation tests); The data is processed on the basis of Purse's legitimate interest in collecting data in order to assess the suitability of the individual for the job concerned and, if necessary, to recruit.

To provide this solution, Purse acts as a subcontractor, within the meaning of the RGPD, of merchants who choose to use this payment orchestration solution. As such, Purse implements all the technical and organizational security measures necessary to ensure the security and confidentiality of the data processed with its service. Purse solicits service providers, who act only on its instructions, to process the data in order to provide the service (Data hosting; database administration; computer developments...)

The candidate whose data was collected has the right to exercise the following rights: - A right of access, rectification and portability of data - A right to oppose or limit processing, - A right to formulate advance directives on the fate of his data after death These rights can be exercised with Purse as follows: The candidate can also send his requests to the following postal address: Purse, Next Now, 67 rue du Luxembourg 59777 Lille The request must indicate, the name, surname, postal address, email. An identity check may be carried out. Purse sends a response within 1 month. In some cases, related to the complexity of the request or the number of requests, this period may be extended by 2 months. In certain cases provided for by the regulations, these rights may be subject to exceptions. The person concerned has the option of submitting a complaint to the CNIL (www.cnil.fr).

The data is transmitted to the managers concerned by the application as well as to the HR department.

Purse keeps application data for a period of 24 months from when the application is submitted. This period is renewed with each new interaction with the candidate.

Purse has appointed a data protection officer at the CNIL. He can be reached at the following address: mesdroits@purse.eu