Privacy policy of FretBay S.A.S

This privacy policy applies to users of FretBay applications, websites, features or other services.
This privacy policy explains how FretBay S.A.S and its affiliates collect and use personal data. It applies to all users of our applications, websites, or other services, unless they are covered by a separate privacy policy, such as MyBoxMan. This statement applies specifically to the following users.

• Shipper: persons who order transport services for goods, including those who receive transport services ordered by a third party
• Carrier: a person who provides goods transport services to Shippers individually or through partner transport companies

This privacy policy also governs other collections of personal data made by FretBay S.A.S in the course of its services.

All persons subject to this declaration are hereafter referred to as "users".

Interpretation

Words whose initial letter is capitalized have meanings defined in the following conditions. The following definitions have the same meaning whether they appear in the singular or plural.

Definitions

For the purposes of this Privacy Policy :

• "Site(s)" means the electronic communication platform Fretbay.com, provided by the Company and accessible directly via the web.
• "Application(s)" means software programs provided by the Company that can be downloaded to any compatible mobile electronic device to which users are connected online.
• "Account" means a unique account created for you to access our service or parts of our service.
• "User(s)" refers to the Internet user or mobile user using our Site(s) or Applications.
• "Service(s)" : services for connecting Shippers identifying themselves as seeking goods transportation services with Carriers identifying themselves as offering goods transportation services on our platforms.
• "Affiliate(s)" means an entity that controls, is controlled by, or is under common control with a party, where the "control" means ownership of 50% or more of the shares, capital interest or other securities giving the right to vote for the election of directors or other management powers.
• "Company" is interpreted as the legal entity, responsible for the edition and content of our Sites and Applications, FretBay S.A.S, whose postal address is : 31 rue de Reuilly 75012 Paris.
• "Device"means any device used to access the Service, such as a computer, mobile phone or digital tablet.
• "Personal data" is any information that relates to an identified or identifiable person.
• "Usage data" means data collected automatically, either generated by the use of the Service or from the infrastructure of the Service itself (e.g. the duration of a page visit).
• "Service provider" means any natural or legal person who processes data on behalf of the Company. This includes third party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analysing how the Service is used.
• "Third party social media service" means any website or social networking site through which a User may log in or create an account to use the Service.
• "You" shall be construed as the person accessing or using the Service, or the Company or other legal entity on whose behalf that person accesses or uses the Service, as applicable.

Types of data collected

Personal data

When using our Service, we may ask you to provide us with certain Personally Identifiable Information that may be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• E-mail address
• Pseudonym
• Name and surname
• Landline telephone number
• Mobile phone number
• Social networks
• IP address
• Location data
• Financial transaction data
• Usage data

Usage data

Usage Data is collected automatically when you use the Service. Usage Data may include information such as the Internet Protocol address (e.g., IP address) of your device, browser type, browser version, the pages of our Service you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

When you access the Service by or through a mobile device, we may automatically collect certain information, including, but not limited to, the type of mobile device you are using, the unique identifier of your mobile device, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you are using, unique device identifiers and other diagnostic data. We may also collect information that your browser sends when you visit our Service or when you access the Service by or through a mobile device.

Location data

Carrier Location Data - we collect accurate or approximate location data from Carriers, in particular to facilitate the provision of the Service, as well as the use of tracking and security features within the Service, prevent and detect fraud, and meet legal requirements. The collection of this data takes place when the Application is open and appears on the screen or in the background on their Devices.

Shipper Location Data - we collect accurate or approximate location data from Shippers in order to facilitate the provision of the Service, and in particular to improve pick-ups by Carrier partners. As this information may be published on our Sites and Applications, Shippers are informed of this fact at the time of collection of this information so that they can exercise caution in the transmission of the information and to further protect their privacy.

Financial transaction data

We collect financial transaction data associated with the use of the Service, including the type of service ordered or provided, order details, payment transaction information such as detailed transaction amount, transport data, time and date of service performance, amount charged, distance travelled and means of payment.

When using the Site or the Application, in order to provide certain features, we may collect, with your prior permission, images and other information from your device's camera and photo library.
We use this information to provide features of our Service, to improve and personalise our Service. The information may be uploaded to the Company's servers and/or a service provider's server or it may simply be stored on your device.

You can enable or disable access to this information at any time via your device settings.

At FretBay, protecting your privacy is as important as the quality of our service. To preserve your privacy, we first pseudonymize your identity.

By using our Service you declare that you give your consent to the Company to use the Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor and improve the use of our Service.
• To manage your Account: to manage your registration as a User of the Service. The Personal Data you provide may give you access to various features of the Service that are available to you as a registered user.
• Contacting You: Contacting You by email, telephone calls, SMS or other equivalent forms of electronic communication, such as mobile application push notifications regarding updates or informational communications related to contracted features, products or services, including security updates, where necessary or reasonable for their implementation.
  • To provide you with news, special offers and general information about other goods, services and events we offer that are similar to those you have already purchased or enquired about, unless you have chosen not to receive such information.
• Manage your requests: To assist and manage the requests you make to us.
• For business transfers: We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of all or a portion of Our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which Personal Data we hold about Users of our Services is one of the transferred assets.
• Other purposes: We may use your information for other purposes, such as analyzing data, identifying usage patterns, determining the effectiveness of our promotional campaigns and marketing activities.

You declare that you give your consent to the Company to share your Personal Data in the following situations:

• With Service Providers: We may share your Personal Information with service providers in order to monitor and analyze the use of our Service and to contact you.
• For Business Transfers: We may share or transfer your Personal Data as part of or during negotiations for a merger, sale of Company assets, financing or acquisition of all or part of our business by another company.
  • With Affiliates: We may share your Personal Information with our Affiliates, in which case we will require those Affiliates to comply with this Privacy Policy. Affiliates include our parent company and any other subsidiary, joint venture partner or other company that we control or that is under common control with us.
• With business partners: We may share your Personal Information with our business partners to offer you certain products, services or promotions.
• With Carrier Partners: In order to perform the Service, we pass on your Personal Data to carrier partners who may be performing a transport service for you, or where you share Personal Data.
• With your consent: We may use your personal information for any other purpose in accordance with your rights and the regulations on personal data protection.

The Company will only retain your Personal Data for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes and enforce our legal agreements and policies. To this end, we have an in-house data retention policy for active, intermediate and archival storage in accordance with the European Data Protection Regulation.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, unless such data is used to enhance the security or improve the functionality of our Service, or we are legally required to retain such data for longer periods.

Your information, including Personal Data, is hosted on servers located in the European Union. The Data is processed at the Company's operating offices and at any other location where the parties involved in the processing are located. We guarantee that this information will always be processed and in particular transferred within the framework of the General Data Protection Regulation (GDPR), which provides, among other things, an adequate level of protection for your Personal Data. In the event of a transfer outside the European Union, we guarantee that the processing of your Personal Data will remain subject to the General Data Protection Regulation.
Your consent to this privacy policy, followed by your submission of such Data, represents your agreement to this transfer.
The Company will take all reasonable steps to ensure that your Personal Data is treated securely and in accordance with this Privacy Policy. No transfer of your Personal Data will take place to a private or public organisation outside of Europe unless it has adequate controls in place, including the security of your Data and other personal information.

As a result of collaborations such as those with IT Service Providers, particularly in relation to services that involve emailing, maintaining, repairing or securing IT systems, your Personal Data may become known to employees of a Service Provider in a country outside the European Union. If there is not a level of data protection in that country comparable to that of the European Union and therefore there is no "suitability decision"of the European Commission in respect of that country, we will protect your interests under data privacy legislation by entering into European Union standard data privacy clauses, which have been published by the European Commission and agreed with the recipient, or by other appropriate means. You may request a copy of the EU standard data privacy clauses (or other safeguards, as appropriate).

Commercial transactions

If the Company is involved in a merger, acquisition or sale of assets, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and is subject to a different Privacy Policy.

Application of the law

In certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests from public authorities (for example, a court or government agency).

Other legal requirements

The Company may disclose your personal data in the good faith belief that such action is necessary to :

• Comply with a legal obligation ;
• To protect and defend the rights or property of the Company;
• Prevent or investigate possible wrongdoing in relation to the Service;
• To protect the personal safety of Users of the Service or the public;
• Protecting against legal liability.

As a data subject, you have the following rights in accordance with the General Data Protection Regulation (GDPR) which came into force on 25 May 2018, provided the respective legal requirements are met:

• Right of access (Art. 15 GDPR) : You have the right to obtain information about your personal data processed by us.
• Right of rectification (Art. 16 GDPR) : You may obtain the rectification of inaccurate personal data concerning you. In addition, you can have incomplete personal data completed.
• Right to erasure (Art. 17 GDPR) : In specific cases, you can obtain the deletion of your personal data.
• Right to restrict processing (Art. 18 du GDPR) : In specific cases, you can have the processing of your personal data restricted.
• Right to data portability (Art. 20 du GDPR) : If you have provided us with data on the basis of a contract or your consent, you may request to receive the data provided in a structured, commonly used and machine-readable format or that we transfer the data directly to another controller.
• Right to withdraw consent : If you have given your consent to the processing of your personal data, you may withdraw your consent at any time with future effect. The lawfulness of the processing of your personal data until your withdrawal will not be affected.
• Right of appeal : You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is in breach of the regulations (Art. 77 GDPR). The address of our competent supervisory authority is as follows Commission National de l'Informatique et des Libertés (CNIL), 3 place Fontenoy, 75007 Paris.
• Right to object (Art. 21 du GDPR) :
  Individual right of objection : You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6 (1) (e) ou (f) GDPR, including profiling based on these provisions. We will then no longer process personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims.
  Right to object to processing for direct marketing purposes: In some cases, we process your data for direct marketing purposes. You have the right to object at any time to the processing of your personal data for these purposes. This applies to profiling to the extent that it is associated with such direct marketing. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
• Enforcement of your rights : To exercise the above rights, please contact us at support@fretbay.com or contact our Data Protection Officer directly at legal@fretbay.com In this case, please ensure that you can unambiguously identify yourself.

The security of your Personal Data is important to us, but please remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. However, we do implement appropriate IT security measures as recommended by the General Data Protection Regulation (GDPR).

Our Service is not directed to persons under the age of 18. We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you know that your child has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from a person under the age of 18 without verification of parental consent, we will take steps to delete that information from our servers.

If we need to rely on consent as the legal basis for processing your information and your country requires parental consent, we may require your parent's consent before we collect and use that information.

On our website, we use cookies to provide a wide range of features, make use more comfortable and optimise our Site and Application. Cookies are small text files generated by a web server and stored on your device while using our Site or Application or while visiting it online through your web browser.

We use "session cookies" which are automatically deleted at the end of your browsing session. In addition, we use "persistent cookies" which are primarily used to provide you with permanent recurring settings as an application user or website visitor. This allows us to modify our application individually according to your preferences. Persistent cookies also allow us to analyse the usage behaviour of our visitors, but only within the scope of their validity. In addition, other cookies may be used in the context of the integration of specific services by the providers of these services (called "cookies tiers").

Below is a detailed list of the cookies we use on our website. We classify cookies into the following categories:

• Necessary cookies
• Analytical cookies
• Cookies Marketing

Necessary cookies are classified as cookies that must be present for the Site or Application to provide its basic functions. These cookies are used exclusively by us and are therefore first party cookies. This means that all information stored in the cookies is sent back to our Site or Application. The use of necessary cookies on our Site or Application is possible without your consent. For this reason, necessary cookies cannot be deactivated or activated individually. However, you have the possibility to deactivate cookies generally in your browser at any time. The use of necessary cookies is based on Art. 6 (1) (b) GDPR (pre-) contractual measures. Furthermore, our use of the necessary cookies is based on a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. We have a legitimate interest in providing you with our application

Analytical cookies allow us to count visits and track access sources to measure and improve the performance of our application. They help us determine which pages are most popular, least used and how visitors navigate the website. These cookies may be first party cookies or third party cookies. The use of analytical cookies is based on your consent Art. 6 (1) (a) GDPR.

Marketing Cookies; These cookies allow us to determine the number of visits and sources of traffic, in order to measure and improve the performance of our website. They also help us to identify which pages are visited more or less frequently and to assess how visitors navigate the website. All information collected by these cookies is aggregated and therefore anonymised. If you do not accept these cookies, we will not be informed of your visit to our site. The use of marketing cookies is based on your consent Art. 6 (1) (a) GDPR

If you have given your consent to the processing of your Personal Data, you may withdraw your consent at any time with future effect. The lawfulness of the processing of your Personal Data until your withdrawal will not be affected.

Google Analytics

Our Sites and Applications use Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies. The information generated by the cookie about your use of the Site or Application (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google LLC is a certified EU-US Privacy Shield (which can be viewed at https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). An adequate level of data protection is therefore guaranteed, if your Personal Data is processed in the United States. We have concluded a contract with Google LLC for the processing of Personal Data and have activated the "IP anonymisation" on this site. This means that Google LLC will truncate your IP address within the Member States of the European Union or in other Contracting States of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to Google LLC's servers in the USA and truncated there. Google LLC uses this information on our behalf to analyse your use of our Sites and Applications, to compile reports on the activity of our Sites and Applications and to provide other services related to application activity and internet usage. Google LLC may also transfer this information to third parties where required to do so by law, or where such third parties process the data on Google LLC's behalf. Google LLC will not associate your IP address with any other data held by Google LLC.

We use Google Analytics to analyse and constantly improve the use of our application. Due to the acquired statistics, we are able to improve our offer and make it more interesting for you as a User. The legal basis for the processing of your personal data is your consent Article 6 (1) (a) GDPR. If you have given your consent to the processing of your personal data, you may withdraw your consent at any time with future effect. The lawfulness of the processing of your personal data until your withdrawal will not be affected. You can also prevent the storage of cookies whenever you wish after your consent by changing the relevant browser settings. Please note that if you do so, some functions of our application may no longer be available or function properly. In addition, you can prevent the collection of data generated by the cookie about your use of the Application (including your IP) and its processing by Google LLC by downloading and installing its application available at https://tools.google.com/dlpage/gaoptout?hl=en. You can prevent the collection of your data by Google Analytics by clicking on the following link. This sets an opt-out cookie that will prevent future collection of your data when you visit this website. Please note that if you delete your cookies, you will need to re-enable the opt-out cookie.
Browser add-on module "opt-out"of Google Analytics. https://tools.google.com/dlpage/gaoptout?hl=de

For further information, please refer to : Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, fax +353 (1) 436 1001; terms of use: http://www.google.com/analytics/terms/de.html ; privacy overview : http://www.google.com/intl/de/analytics/learn/privacy.html ; privacy statement : https://www.google.com/intl/en-GB/policies/privacy/.

Our Service may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We urge you to review the privacy policy of each site you visit.

We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third party site or service.

We may update our privacy policy from time to time as legislation changes or our business develops. We will notify you of any changes by posting the new privacy policy on this page.

We will notify you by email and/or by a prominent notice on our Service, before the change takes effect and we will update the date of "last update" at the top of this privacy policy.

You should check this privacy policy regularly for any changes. Changes to this privacy policy are effective when posted on this page.

FRETBAY SAS domiciled at 31 rue de Reuilly 75012 Paris, France , acting both on its own behalf and through its subsidiaries, is the "controller" of your personal information. This regulation came into force on 05/01/2022.