PROTECTION CHARTER
OF USERS' PERSONAL DATA

Definition and nature of personal data

When you use the www.lafaaac.com website and the LAFAAAC application (hereinafter together referred to as the "Platform"), we may ask you to provide us with personal data about yourself, in order to use the services offered by LAFAAAC. In the context of the present charter, the term "personal data" refers to all data that makes it possible to identify an individual, which corresponds in particular to your surname, first names, e-mail address, telephone numbers, place of residence, details of your purchases and subscriptions, credit card numbers, as well as any other information that you choose to communicate to us about yourself.

Purpose of this charter

The purpose of this charter is to inform you of the means we use to collect your personal data, in strict compliance with your rights. In this regard, we inform you that we comply, in the collection and management of your personal data, with French law no. 78-17 of January 6, 1978 relating to information technology, files and freedoms, in its current version (hereinafter: the "Loi Informatique et Libertés"), as well as Regulation (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: the "RGPD").

Identity of the data controller

The company responsible for collecting your personal data is L'Académie Franco-Anglophone des Arts Audiovisuels et du Cinéma ("LAFAAAC"), a SAS with share capital of 10,000 euros, registered with the Paris Trade and Companies Registry under no. 832 737 464, whose registered office is located at 17 rue Saint-Fiacre 75002 Paris (hereinafter referred to as "We").

Personal data collection

The legal basis for our collection of your personal data is as follows: (i) Legitimate interest when you voluntarily provide us with personal data during your visit to our Platform, the data then being collected to enable us to better respond to your requests for information about our services. (ii) Your consent in the case of social network cookies, advertising cookies and Google Analytics cookies referred to in article 11. (iii) This collection is necessary in order to perform the contract concluded when you use our services on our Platform. (iv) The processing of your data is necessary to comply with a legal obligation to which we are subject. Your personal data is collected for one or more of the following purposes: (i) to manage your access to and use of certain services accessible on the Platform, (ii) to carry out operations relating to the management of users concerning contracts, orders, invoices, follow-up of relations with users, (iii) to compile a file of registered members and users, (iv) to send newsletters, requests and promotional messages. If you do not wish us to do so, we give you the option of expressing your refusal in this respect at the time your data is collected, (v) to compile commercial statistics and statistics on the number of visitors to our services, (vi) to organize competitions and lotteries and all promotional operations, with the exception of online gambling subject to approval by the Autorité de Régulation des Jeux en Ligne, (vii) to manage the opinions of individuals on products, services or content, (viii) to manage outstanding payments and any disputes arising from the use of our products and services, (ix) to personalize responses to your requests for information, (x) to meet our legal and regulatory obligations. When we collect your personal data, we inform you whether certain information is mandatory or optional. Mandatory data is required for the operation of our services. For optional data, you are entirely free to choose whether or not to provide it. We will also inform you of the possible consequences of failing to do so.

Recipients of collected data

Access to your personal data will be granted to our company's staff, auditors and subcontractors. Your personal data may also be disclosed to public bodies, exclusively in order to meet our legal obligations, to legal auxiliaries, judicial officers and debt collection agencies.

Transfer of personal data

Your personal data will not be sold, rented or exchanged to third parties
benefit of third parties.

Retention period for personal data

(i) Concerning user management data: Your personal data is kept for the time strictly necessary to manage our commercial relationship with you. Your data may be kept for a period of 3 (three) years from the end of the commercial relationship in the case of any canvassing operations aimed at you. Data enabling us to establish proof of a right or a contract, which must be kept in order to comply with a legal obligation, will be kept for the period stipulated by the law in force. Personal data relating to non-user prospects may be kept for a period of 3 (three) years from the date of collection or last contact with the prospect. At the end of this 3 (three) year period, we may contact you again to find out whether you wish to continue receiving commercial solicitations (ii) Concerning credit card data: Financial transactions relating to the payment of purchases and fees via the Platform are entrusted to a payment service provider, which ensures their proper processing and security. For the purposes of these services, this payment service provider may receive personal data relating to your credit card numbers, which it collects and stores in our name and on our behalf. We do not have access to this data. To enable you to make regular purchases or pay related fees on the Platform, your credit card details are kept for the duration of your registration on the Platform and at least until the time of your last transaction. By checking the appropriate box on the Platform, you give us your express consent to store this data. Data relating to the visual cryptogram or CVV2 on your bank card is not stored. If you do not wish your personal data relating to your credit card numbers to be stored under the conditions specified above, we will not store this data beyond the time required to complete the transaction. In any case, for the purposes of proof in the event of any dispute concerning the transaction, the related data may be kept in intermediate archives for the period stipulated in article L 133-24 of the French Monetary and Financial Code, i.e. 13 (thirteen) days.

Security

We inform you that we take all necessary precautions and appropriate organizational and technical measures to preserve the security, integrity and confidentiality of your personal data, and in particular to prevent it from being distorted, damaged or accessed by unauthorized third parties. We also use secure payment systems that comply with the state of the art and applicable regulations.

Hosting - Data transfer outside the European Union

We inform you that your data is kept and stored for the duration of its retention on the servers of Amazon Web Services, located in the European Union. Your data may be transferred outside the European Union, in particular to the Ivory Coast, where our community manager is located. The transfer of your data in this context is secure. We have signed a specific contract with our community manager governing the transfer of your data outside the European Union, based on the standard contractual clauses between a data controller and a data processor approved by the European Commission.

Cookies

Cookies are text files, often encrypted, stored in your browser. They are created when a user's browser loads a given website: the site sends information to the browser, which then creates a text file. Each time the user returns to the same site, the browser retrieves this file and sends it to the website's server. Different types of cookies are used for different purposes:
Technical cookies are used throughout your browsing experience, to facilitate navigation and execute certain functions. For example, a technical cookie may be used to memorize the answers entered in a form, or the user's preferences regarding the language or layout of a website, where such options are available. - 5 - We use technical cookies.
Social network cookies may be created by social platforms to enable web designers to share their site's content on these platforms. In particular, these cookies may be used by social platforms to track users' browsing habits on the website concerned, whether or not they use these cookies. We use cookies from social networks. We invite you to consult the privacy protection policies of the social platforms that set these cookies, to find out how they use the browsing information they may collect thanks to these cookies, and how you can exercise your rights with these platforms.
Advertising cookies may be created not only by the website on which the user is browsing, but also by other websites displaying ads, widgets or other elements on the page displayed. In particular, these cookies may be used for targeted advertising, i.e. advertising based on the user's browsing habits. We also use advertising cookies.
We use Google Analytics, a statistical audience analysis tool that generates a cookie to measure the number of visits to the Platform, the number of pages viewed and visitor activity. Your IP address is also collected to determine the city from which you are connecting. We remind you that you may refuse to accept cookies by configuring your browser. However, such a refusal could prevent the Platform from functioning properly.

Access to your personal data

In accordance with the French Data Protection Act No. 78-17 of January 6, 1978, and the RGPD, you have the right to obtain communication and, where appropriate, rectification or deletion of data concerning you by contacting: - e-mail address: contact@lafaaac.com - postal address: 24 rue de l'Est, c/o La Ruche - 75020 Paris Persons whose data is collected on the basis of our legitimate interest, as mentioned in Article 5, are reminded that they may at any time object to the processing of data concerning them. We may, however, continue to process data if there are legitimate grounds for the processing which override your rights and freedoms, or if the processing is necessary to establish, exercise or defend our legal rights.

The right to specify how your data will be handled after your death

You have the right to define directives concerning the conservation, deletion and communication of your personal data after your death. These directives can be general, i.e. they cover all your personal data. In this case, they must be registered with a trusted digital third party certified by the CNIL. Instructions can also be specific to data processed by our company. In this case, please send them to the following address: - e-mail address: contact@lafaaac.com - postal address: 24 rue de l'Est, c/o La Ruche - 75020 ParisBy sending us such instructions, you expressly give your consent for these instructions to be stored, transmitted and executed in the manner provided herein. In your instructions, you may designate a person to be responsible for their execution. This person will then be entitled, when you die, to take cognizance of the said directives and ask us to implement them. If you do not designate a person, your heirs will be entitled to take cognizance of your instructions on your death and ask us to implement them. You may modify or revoke your instructions at any time by writing to us at the above address.

Portability of your personal data

You have a right to the portability of the personal data you have provided to us, understood as the data you have actively and consciously declared in the course of accessing and using the services, as well as the data generated by your activity in the course of using the services. We remind you that this right does not apply to data collected and processed on a legal basis other than consent or the performance of the contract binding us. This right may be exercised free of charge, at any time, and in particular when you close your account on the Platform, in order to recover and retain your personal data. To this end, we will send you your personal data, by any means deemed useful, in a standard open format that is commonly used and machine-readable, in accordance with the state of the art.

Making a complaint to a supervisory authority

You are also informed that you have the right to lodge a complaint with a competent supervisory authority, (the Commission Nationale Informatique et Libertés for France), in the Member State in which your habitual residence is located, your place of work or the place where the violation of your rights would have been committed, if you consider that the processing of your personal data subject to the present charter constitutes a violation of the applicable texts. This recourse may be exercised without prejudice to any other recourse before an administrative or judicial court. You also have the right to an effective administrative or judicial remedy if you consider that the processing of your personal data as described in this charter constitutes a violation of the applicable laws.

Treatment limitation

You have the right to limit the processing of your personal data in the following cases: - During the period of verification that we implement, when you dispute the accuracy of your personal data, - When the processing of such data is unlawful, and you wish to limit such processing rather than delete your data, - When we no longer need your personal data, but you wish to retain them to exercise your rights, - During the period of verification of legitimate grounds, when you have objected to the processing of your personal data.

Modifications

We reserve the right, at our sole discretion, to modify this charter, in whole or in part, at any time. These modifications will come into effect as of the publication of the new charter. Your use of the Platform following the entry into force of these modifications will constitute recognition and acceptance of the new charter. If you do not agree with the new charter, you should no longer access the Platform.

Effective date

This charter came into force on March 1, 2020.