Personal Data Protection Charter

INTRINSEC SECURITE, a company with a capital of €3,062,570.00, registered with the Nanterre Trade and Companies Register under number 812 535 284, whose registered office is located at Tour Egée, 9-11 allée de l'Arche, 92400 Courbevoie (hereinafter "Intrinsec" or "we"), attaches great importance to the protection of the personal data of users of its website (hereinafter "you").

Some services offered on our website require the processing of your personal data. This policy aims to inform you about how Intrinsec, as data controller, collects and processes your data, including through the use of cookies and trackers. It does not cover processing related to job applicants (see the dedicated information on our Careers portal) or employees (available on our intranet).

This policy complies with applicable regulations, including Regulation (EU) 2016/679 of 27 April 2016 («GDPR») and French Law No. 78-17 of 6 January 1978, as amended («Data Protection Act»). It may be updated; the date of the last update is shown at the top of this page. We encourage you to review it regularly.

Summary

1. What personal data do we process?
2. How is your data collected?
3. Why do we process your data? (purposes and legal basis)
4. Marketing communications
5. Measuring email open and click rates (tracking pixels)
6. Cookies and other trackers
7. Who are the recipients of your data?
8. Transfers outside the European Union
9. How do we protect your data?
10. How long do we keep your data?
11. What are your rights?
12. Contact and complaints

1. What personal data do we process?

Depending on the circumstances, we can process the following categories of data:

• Identification data : civility, first name, last name, position, etc.
• Contact details : email address, phone number, etc.
• Technical data IP address, browser type and version, time zone and location, types and versions of add-ons, operating system and platform, and other technologies present on the devices you use to access our site.
• Profile data : areas of interest, preferences, feedback and responses to our surveys.
• Usage data : information about how you use our site and your interactions with our marketing content, including opening our emails and clicking on the links they contain (measured using tracking pixels, see section 5).
• Marketing and communication data : your preferences regarding the receipt of communications and your contact preferences.

2. How is your data collected?

We collect your data in two main ways.

Through direct interaction. You transmit your data to us when you use one of the site's features: contact form, subscription form for our marketing communications or events, content download form (reports, articles, white papers…), registration for an event organized or sponsored by Intrinsec, or participation in a competition or survey.

Through automated technologies. When you browse our website, we automatically collect certain technical data relating to your equipment and browsing habits, using cookies, server logs, and similar technologies. To learn more, please see our cookie policy.

3. Why do we process your data? (purposes and legal basis)

The table below presents, for each purpose, the corresponding legal basis and the categories of data concerned.

Purpose	Legal basis	Data categories
Responding to your inquiries	Your consent	Identification, contact
To give you access to our online content (white papers, reports, articles…)	Your consent	Identification, contact, marketing and communication
To organize our promotional activities and send you our marketing materials (products, services, events…)	Explicit consent (opt-in) if you are neither a customer nor a prospect; tacit opt-in (soft opt-in, with the right to object) if you are a B2B customer or prospect	Identification, contact, marketing and communication, usage, profile
Allowing you to subscribe to our newsletters	Your consent	Identification, contact
Measuring the open and click rates of our emails (tracking pixels)	Your consent (see section 5)	Contact, use
To place cookies and other trackers (excluding strictly necessary trackers)	Your consent	Techniques, usage
Analyze usage data to improve our website, our offers, our marketing, and customer relations.	Legitimate interest	Techniques, usage
Ensuring the security of our site	Legitimate interest	Techniques, usage
Register for an event or webinar	Your consent	Identification, contact, marketing and communication, profile, usage
Organize competitions or satisfaction surveys	Your consent (resulting from your participation)	Identification, contact, marketing and communication, profile
To respect our legal obligations and defend our rights in the event of a dispute	Legal obligation / legitimate interest, as the case may be	Depending on the case

4. Marketing Communications

Opt-in and tacit opt-in. If you are a customer or prospect (B2B), we do not require your prior consent to send you communications about our activities, products, or services: we rely on the implied opt-in (soft opt-in) provided for by applicable regulations, giving you the option to unsubscribe at any time. If you are neither a customer nor a prospect, we obtain your explicit consent (checkbox) or another affirmative action from you, such as completing a registration form. To learn about or modify your marketing preferences, contact us at dpo@intrinsec.com.

Sharing for marketing purposes. In some cases, we may share your data with other entities within the Intrinsec group for marketing purposes. We do not share your data for marketing purposes with companies outside the group without your consent.

Unsubscribe. You can ask us to stop sending you marketing communications at any time by clicking the unsubscribe link at the bottom of each of our emails or by writing to us at dpo@intrinsec.com. If you unsubscribe, we will retain this instruction and your email address for 18 months, solely to respect your choice, before deleting them.

5. Measuring email opens and clicks (tracking pixels)

When we send you communications by email (newsletters, event invitations, communications related to our services), some of these emails may contain tracking pixels. These are very small, usually invisible files that allow us to measure email opens, link clicks, and the date, time, and device type associated with these interactions when you open the message or click on a link.

We use this information to compile distribution statistics, evaluate the deliverability of our communications, and improve their content and relevance.

In accordance with Article 82 of the French Data Protection Act (Loi Informatique et Libertés) and the CNIL's recommendation of March 12, 2026 (published on April 14, 2026) concerning tracking pixels in emails, these trackers are implemented, for these measurement and optimization purposes, based on your consent. This consent is separate from your agreement to receive our communications: you can continue to receive our emails without their opening being individually tracked.

You can withdraw your consent or object to this tracking at any time, without affecting the receipt of our communications, by using the link provided for this purpose in our emails or by contacting us at dpo@intrinsec.com.

The only measure of deliverability (identification of inactive addresses in order to maintain the quality of our mailing list) may, where appropriate, be carried out without your consent, under strictly limited conditions, in accordance with the aforementioned recommendation.

6. Cookies and other trackers

Our website uses cookies and trackers, including trackers placed by third parties. With the exception of trackers strictly necessary for the website to function, these are only placed with your consent, which you can withdraw at any time. For details about these trackers, their purposes, and their retention periods, please consult our cookie policy.

7. Who are the recipients of your data?

Internal recipients. Depending on the purpose, your data may be processed by authorized Intrinsec personnel (including marketing and communications, sales, administration, human resources, and support functions). Access is limited to the needs of the relevant tasks and is subject to a confidentiality agreement.

External recipients. Your data may be processed by service providers acting on our behalf (for example, our hosting provider or our marketing and email service providers), who are required to ensure an appropriate level of security and to act only on our instructions. Your data may also be disclosed to other entities within the Intrinsec group, to a third party in connection with a capital transaction (merger, acquisition, asset sale, etc.), or to the competent authorities when required or permitted by law. Any disclosure is limited to what is strictly necessary.

8. Transfers outside the European Union

Given the international scope of the Intrinsec Group, your data may be transferred to recipients located outside the European Union and the European Economic Area, including countries that do not provide a level of protection equivalent to that of the Union. In such cases, we govern these transfers using the tools provided by regulations (for example, standard contractual clauses) and appropriate safeguards. You can obtain a copy by writing to us at dpo@intrinsec.com.

9. How do we protect your data?

We implement appropriate technical and organizational measures to prevent the loss, alteration, disclosure, or unauthorized access to your data, and we have procedures in place for managing data breaches. Access to your data is limited to those individuals who require it to perform their duties and are bound by a duty of confidentiality.

10. How long do we keep your data?

We retain your data for as long as necessary for the purposes for which it was collected and to comply with our legal obligations. For example:

• for a user account: as long as the account remains active; ;
• for our promotional activities: for the duration of the relationship and 3 years after your last interaction, unless you object; ;
• for trackers: according to the durations indicated in our cookie policy; ;
• For any other data: as long as the law requires.

We may retain certain data in restricted-access intermediate archiving for evidentiary purposes and for the duration of applicable statutes of limitations. Once these periods have expired, your data is deleted or anonymized.

11. What are your rights?

In accordance with applicable regulations, you have the following rights:

• Right of access : to obtain confirmation that your data is being processed, to obtain a copy of it and to be informed of the conditions of this processing.
• Right of rectification : to correct inaccurate data or complete incomplete data.
• Right to erasure You have the right to have your data deleted in the cases provided for by the regulations. This right is not absolute: certain legal obligations may require us to retain data, in which case you will be informed.
• Right to object : you have the right to object to processing based on our legitimate interest for reasons relating to your particular situation, and to object at any time to the processing of your data for direct marketing purposes.
• Right to limitation of the treatment in the cases provided for by the regulations.
• Right to portability : receive the data you have provided to us in a structured and commonly used format, or have it transmitted to another data controller, where the conditions are met.
• Right not to be subject to a fully automated decision (including profiling) producing legal effects or significantly affecting you, and the right to obtain human intervention.
• Right to withdraw your consent at any time, when the treatment is based on it, without this withdrawal calling into question the lawfulness of previous treatments.
• Right to define guidelines regarding the fate of your data after your death.

12. Contact and complaints

To exercise your rights or for any questions relating to the processing of your data, contact us at dpo@intrinsec.com.

If, after contacting us, you believe that your rights have not been respected, you can file a complaint with the National Commission for Information Technology and Civil Liberties (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.