Personal data protection policy

WeWard SAS, the data controller, (hereinafter referred to as "WeWard SAS") is a simplified joint stock company with a share capital of €1113.50, having its registered office at 111 Avenue Victor Hugo - 75016 - Paris, registered under the SIRET number 85361417000027 with the Paris Trade and Companies Registry. This privacy policy applies to the use of the WeWard Mobile Application (the "Mobile Application"), to the access to the Services we provide and is intended to inform you about the collection, use and more generally the processing of your personal data. All capitalized terms not defined herein shall have the meaning ascribed to them in the Terms of Use. Please note that you must be 15 years of age or older to use the Services.

1/ WeWardSAS collects and electronically processes personal information including, but not limited to, your name, cell phone number, e-mail address, IP address, unique device identifiers and other identifying information, photographs and/or payment information. The legal basis for the processing is the performance of the contract (Terms of Use to which you have agreed) between you and the Company.

More specifically:

As part of the Services, we may provide you with a feature that allows you to search for friends using their phone number, last name, first name, nickname, or by using your Facebook and/or Google credentials. If you choose, you will be asked to allow the Weward Application to access your address book or certain information associated with your Facebook and/or Google account, such as your name, profile picture, gender and list of friends. To the extent you consent, this information will be processed by us to identify your friends who use the Application or to allow you to invite friends to install the WeWard Application. WeWard SAS will never directly contact your friends, non-users of the platform.
‍
2/ With your consent (legal basis), we will collect information about your location, history of places visited, and your physical activity in order to (i) personalize the reward offers visible on the Application according to your profile and your location, (ii) propose you points of interest corresponding to your profile (places to visit). You can enable and disable location by using your mobile device's operating system settings. However, when you disable this feature, you will only have access to limited functionality of the Application and, in particular, it will be technically impossible for us to collect your physical activity and location information, which will prevent tracking and/or converting your movements into Wards. You will, however, be able to earn Wards by performing other actions (viewing advertisements, making purchases, participating in surveys etc.).

With your consent, we also process:

You may withdraw your consent at any time by contacting us at the email address listed at the end of this Policy or directly from the Mobile Application settings.

3/ As WeWard is a community of users, each person can view certain information related to other users (number of steps, number of Wards, their subscribers, CO2 saved, their contribution to the funding of the community's user rewards). To not share this data, you can choose to make your account "private" in the "settings" of the application so that it is only visible to your subscribers and not to all users. You can also remove subscribers from your account at any time.

WeWard may ask you to upload a photograph. The purpose of this processing is to provide social features that allow you to have a profile that can be identified by another user. The interest is only to make the App more "friendly".

As WeWard is present on social networks, the messages exchanged and the publications are also analyzed and taken into account for the proper functioning of the company.

The legal basis of these processing operations is the legitimate interest of WeWard being specified that the sending of the requested photo is not compulsory and that a refusal does not carry any consequence.

Other processing operations are based on the legitimate interest of WeWard:

*A cheating detection algorithm is used by WeWard whenever a user requests a transfer, a gift card, asks to exchange his Wards for certain gifts or makes a donation. The objective is to detect suspicious behavior (e.g. artificial simulation of steps, artificial simulation of geolocation points, inconsistent viewing of advertisements, sending of forged or non-owned receipts, forging of sponsorships). If the user uses such methods, his account will be suspended. He will be informed beforehand.
‍
4/ We work with third parties (convenience stores, advertising networks, analytics providers, affiliate platforms hereinafter "Partners") that may provide or receive information about you.

A complete list of these partners is available upon request to the email address listed at the end of this Policy.

Your personal data is processed by WeWard for the purposes described above and to this end, WeWard is likely to transmit your data to third parties belonging to the following categories:

On the one hand, to our subcontractors: WeWard may engage trusted partners acting as subcontractors and more specifically:

- as part of the provision of the Services by analyzing your data to tally your Wards as well as to allow us to provide you with the Wards you wish to convert into Reward;
- to our advertising partners, such as Ironsource https://developers.ironsrc.com/ironsource-mobile/air/ironsource-mobile-privacy-policy/. Ironsource shares data with the following advertising partners: https://developers.is.com/ironsource-mobile/general/ironsource-exchange-programmatic-partners/, who act as data controllers.
- more generally in connection with the use of the Application to provide support and respond to your requests, to send you an email, to assist you in using the Service, or to help us perform statistical analysis.

These third parties are contractually prohibited from using personal data submitted by WeWard except to provide the services they have been contracted to provide to us, and they are required to maintain the security and confidentiality of your information with equal or greater protection than that provided by WeWard. A contract in accordance with Article 28 of the GDPR is entered into with each of our subcontractors. You can obtain a list of these subcontractors upon request to the email address indicated at the end of this Policy.

On the other hand, to our Partners: WeWard ensures as much as possible that the Services are offered with transparency by the Partners with whom WeWard collaborates. For example, in this regard Partners may request WeWard to obtain information as confirmation of a visit in order to enable you to benefit from the Services offered (Rewards). In the event that your Wards are converted into Rewards with an e-merchant, we may transmit your data so that the latter can know the origin (email address, user name) of their customers. WeWard ensures that Partners with access to your personal data only process it for the purposes described at the time of converting Wards to Rewards.

You can obtain additional information about these Partners by sending an email to the address listed below.

In any event: in addition to the assumptions described above, WeWard will only disclose your personal data, without prior notice, if required by applicable regulations, or if such disclosure is necessary to comply with applicable law or regulation, a legal proceeding and/or an administrative or judicial order; to protect and defend the rights or property of the Company; and/or to act in urgent circumstances to protect the personal safety of the Application Users or third parties. WeWard will never transmit its list of Users to third parties without your prior consent. Subject to your express prior consent, WeWard's partners may contact you directly or through us to offer you commercial offers.

WeWard ensures that your data is processed in complete confidentiality and security by implementing the technical and organisational measures necessary to preserve its security, confidentiality and integrity under optimum conditions.

Only persons strictly authorised by WeWard will have access to your data. No unauthorised third party will have access to your data, except in the case of a legal or union obligation incumbent on the data controller.

WeWard retains your personal data for the period necessary to provide the Services. Thereafter, the data is kept in active base for a maximum of 7 days after the account is deleted, or after 24 months of inactivity
‍
Special features:

Mobile applications do not use cookies, as a website would. They use SDKs (software development kits).

Cookies and SDKs are primarily used to enable the site and application to function, or function more efficiently, but also to provide information to the owners of partner websites or to enhance your user experience and to display personalized content or ads to you.

‍On www.wewardapp.com, we only use a functional cookie (Datatog) to track malfunctions.
No cookies are set by third parties and WeWard does not use any advertising cookies on this site.

‍On www.business.weward.fr, we use :
- a functional cookie: Sentry, which allows us to identify "crashes" and malfunctions
- an audience measurement cookie: Amplitude

‍On the WeWard app, we use:
-Tracers necessary for the app to function properly and improve your experience: tracers (Facebook Sign In, Apple SignIn, Google Sign In, Firebase) in order to recognize you when you arrive on the app and an "IPbase" tracer to identify your country and offer you a version of the app corresponding to your country and language (tracers necessary for the provision of a service you request).
We also use tracers (Firebase Crashlytics, datadog) to detect malfunctions of the app.
‍
- The CodePush tracker in order to update the application and which does not collect any personal data.

-Trackers (Leanplum and Firebase) allow to manage the sending of notifications. You can disable notifications by going to the settings of your device.

- Trackers for audience measurement, not subject to consent (Amplitude and Firebase) and strictly necessary for the provision of the service (performance measurement, detection of navigation problems, optimization of the technical performance of the site or its ergonomics, estimation of the power of the servers required, analysis of the content consulted), and which meet the criteria for exemption from consent.

- Advertising trackers (Ironsource, Applovin, Adcolony, Unity, Fyber, Tapjoy, Facebook, SupersonicAds, Inbrain, TheoremReach, CPX, Pollfish, TapResearch, Adjoe) are used to collect data on the performance and exposure of advertising campaigns and to deliver advertising or surveys when you want them to in order to earn rewards.

- Attribution trackers (Adjust and Facebook Ads) are used to analyze and drive acquisition campaigns. You can review your Facebook ad settings and update your preferences at any time.

You may opt out of one or more of the trackers by sending your request to privacy@wewardapp.com.

You may contact WeWard at any time (contact@wewardapp.com for any topic, privacy@wewardapp.com to access the privacy policies for these trackers).

The information collected by the trackers is kept for a maximum of 6 months.

The processing of data from these cookies is carried out in accordance with our Privacy Policy which we invite you to consult.

Within the framework of the provision of the Services, WeWard may use analysis and notification service providers whose head office or servers are located in countries that are not members of the European Union and that have not been the subject of a decision of adequacy of protection by the European Commission. These countries (USA, Madagascar, UK) provide a lower level of protection than the existing framework in Europe. In these cases, WeWard ensures that this transfer is carried out under conditions that comply with the regulations in force by taking all appropriate measures and within a legal, technical and operational framework that ensures the confidentiality and security of this data. These third parties undertake to respect the European Commission's Standard Contractual Clauses.

You can obtain information on transfers by sending an email to the address indicated below.

You can delete your data at any time by going to the application, in the profile page, via the "delete my account" button or by sending an e-mail to contact@wewardapp.com.
This data will be deleted in its entirety within 7 days.

In accordance with the regulations in force, you have the right to access, oppose, rectify and delete your personal data, as well as the right to limit the processing carried out, to port your data and to define the fate of your data in the event of death. Finally, concerning profiling operations, you have the right to object to the use of such a process. You may also withdraw a prior consent granted. Nevertheless, the exercise of some of these rights (opposition to profiling, withdrawal of consent to geolocation) may make it impossible for WeWard to provide you with access to the Application or use all or part of the Services.
These rights can be exercised by contacting us at the following address privacy@wewardapp.com. In addition, you are reminded that you may exercise some of these rights directly through your account settings (deletion of documents, deletion of optionally requested information, and even general deletion of your account). You can remove the Facebook-Google/WeWard link from your Facebook/Google account. If you are not satisfied, you have the right to file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the supervisory authority in charge of compliance with obligations regarding personal data:

Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 Tel: 01 53 73 22 22https://www.cnil.fr/fr/vous-souhaitez-contacter-la-cnil