PRIVACY POLICY

Effective date: July 1, 2026

At SAPIOW, respecting your privacy and protecting your personal data is our priority.

This privacy policy (the "Privacy Policy") is intended to inform you about how your personal data is processed when you use the website https://sapiow.com/ (the "Website") and/or the Sapiow application (the "Application"), in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended (together, the "Applicable Regulations").

This Privacy Policy does not describe how your data is collected and processed via cookies and other trackers ("Cookies") on the Website and/or the Application. For more information, please refer to our Cookie Policy.

Who is the data controller?

When you browse and/or register on our Website and/or our Application, or more generally in the context of managing our contractual relationship with you, the data controller is SAPIOW, registered with the Rouen Trade and Companies Register under number 107 277 550, whose registered office is located at La Maison Bleue - 16 rue Alsace Lorraine 76000 Rouen ("We", "Us", "Our").

What data do we collect?

Personal data is any information that allows an individual to be identified directly or by cross-referencing with other data.

We collect personal data falling within the following categories:

Identification data (last name, first name, email address, phone number);
Professional life data (company name, CV, position/job title, LinkedIn URL);
Social network data (profiles or username);
Data relating to your purchases on the Website and/or the Application when you are connected with an Expert;
Connection data (connection logs, encrypted passwords);
Browsing data (IP address, pages viewed, date and time of connection, browser used, operating system, user ID, MAID);
Economic and financial data (data relating to your bank cards);
Any information you wish to send us as part of your contact request;
Technical data relating to video calls: only connection metadata (duration, network quality) is processed to ensure service maintenance, in compliance with the strictest security standards (SOC2, HIPAA).

To enable open conversations and ensure digital hygiene, SAPIOW guarantees the strict confidentiality of your exchanges through the secure infrastructure of its certified technical partner.

SAPIOW formally undertakes never to record the content of your video calls; no audio or video streams and no transcriptions are recorded.

Exchanges are encrypted in transit and are never stored on servers. There is no archive: once the video call has ended, the content permanently ceases to exist.

We have no interest in exploiting your data: it is never analyzed, never sold, nor used to train third-party technologies.

Mandatory data fields are indicated when you provide your data to us. They are marked by any appropriate means.

Details on the processing of your personal data

Purposes	Legal bases	Retention periods
Providing our services available on our Website and/or our Application through your account	Performance of the contract you have entered into with Us (i.e., our Terms of Use)	When you have created an account: your data is retained for the entire duration of your account. Your connection logs are retained for 6 months or 1 year. In the event of an inactive account for 2 years, your personal data will be deleted if you do not respond to our reactivation email. In addition, your data may be archived for evidentiary purposes for a period of 5 years.
Carrying out operations relating to the management of our customers concerning purchases and ensuring follow-up of the contractual relationship with our customers	Performance of the contract you have entered into with Us (i.e., our Terms of Use)	Personal data is retained for the entire duration of the contractual relationship. In addition, your data (with the exception of your bank details) is archived for evidentiary purposes for a period of 5 years. With regard to data relating to your bank card, it is retained by our payment service provider available on the Website and/or the Application in accordance with its own terms and conditions. Data relating to the card security code or CVV2 printed on your bank card is not stored.
Building a prospect database	Our legitimate interest in developing and promoting our business	Your data is retained for a period of 3 years from your last contact with us.
Complying with our legal obligations regarding the reporting of unlawful content on the Website and/or the Application	Compliance with our legal and regulatory obligations in the context of our Website and/or Application	Data relating to your identity is retained for 5 years from the end of the validity of the Terms of Use, the closure of your account, or the closure of the report. Other information provided by the user, in particular payment-related information, is retained for one year from the end of the validity of the Terms of Use, the closure of your account, or the closure of the report. Technical data enabling the source of the connection to be identified, or data relating to the terminal equipment used, is retained for a period of one year from the connection or use of the terminal equipment.
Sending newsletters, solicitations and promotional messages by email	For customers: our legitimate interest in retaining and informing our customers of our latest news For prospects or customers who have not booked a session with an Expert on the Website and/or the Application: your consent For professional Experts: our legitimate interest in retaining and informing our customers and prospects of our latest news	Data is retained for 3 years from your last contact with us or until you withdraw your consent.
Responding to your requests for information, contact and/or demonstration	Performance of pre-contractual measures taken at your request	Data is retained for a period of 3 years from your last contact.
Retaining administrative information and documents related to our business	Compliance with our legal and regulatory obligations	Invoices are archived for a period of 10 years. Data relating to your transactions (with the exception of banking data) is retained for 5 years.
Responding to requests to exercise rights by data subjects	Compliance with our legal and regulatory obligations	If we ask you for proof of identity: we retain it only for the time necessary to verify your identity. Once verification is complete, the proof of identity is deleted. If you exercise your right to object to receiving marketing communications: we retain this information for 3 years.

Who are the recipients of your data?

The following will have access to your personal data:

Our company's staff;
Our processors: hosting provider, website creation provider, communication sending provider (emails and phone), audience measurement and analytics provider, email messaging provider, instant messaging provider, secure payment provider, invoicing tool, cookie management tool;
Any legally authorized authority, in particular judicial, police or administrative authorities, if they so request.

Is your data likely to be transferred outside the European Union?

Your data is stored and kept for the entire duration of processing on the servers of Supabase, located within the European Union.

In the context of the tools we use (see the section on recipients regarding our processors), your data may be subject to transfers outside the European Union. The transfer of your data in this context is secured by means of the following tools:

either the data is transferred to a country that has been subject to an adequacy decision by the European Commission, in accordance with Article 45 of the GDPR: in this case, that country ensures a level of protection deemed sufficient and adequate to the provisions of the GDPR;
or the data is transferred to a country whose level of data protection has not been recognized as adequate under the GDPR: in this case, these transfers are based on appropriate safeguards indicated in Article 46 of the GDPR, adapted to each provider, including but not limited to the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules, or under an approved certification mechanism;
or the data is transferred on the basis of one of the appropriate safeguards described in Chapter V of the GDPR.

You may obtain a copy of the tools enabling the transfer of your data outside the European Union by contacting us at the details indicated in the section "What are your rights regarding your data?" below.

What are your rights regarding your data?

You have the following rights with regard to your personal data:

Right to information: this is precisely why we have drafted this Privacy Policy. This right is provided for in Articles 13 and 14 of the GDPR.
Right of access: you have the right to access all of your personal data at any time, pursuant to Article 15 of the GDPR.
Right to rectification: you have the right to rectify inaccurate, incomplete or outdated personal data at any time in accordance with Article 16 of the GDPR.
Right to restriction: you have the right to obtain restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR.
Right to erasure: you have the right to require that your personal data be erased, and to prohibit any future collection for the reasons set out in Article 17 of the GDPR.
Right to define directives relating to the retention, erasure and communication of your personal data after your death.
Right to withdraw your consent at any time: for purposes based on consent, Article 7 of the GDPR states that you may withdraw your consent at any time. This withdrawal will not affect the lawfulness of processing carried out before the withdrawal.
Right to data portability: subject to certain conditions specified in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a standard machine-readable format and to require its transfer to the recipient of your choice.
Right to object: pursuant to Article 21 of the GDPR, you have the right to object to the processing of your personal data. Please note, however, that we may continue processing despite this objection, for legitimate reasons or for the defense of legal claims.

You may exercise these rights by writing to us at the following address: privacy@sapiow.com.

We may ask you to provide additional information in the event of reasonable doubt, or any document likely to justify your identity if the doubt persists.

For any question or request that remains unsuccessful, you have the right to lodge a complaint with the competent supervisory authority, in France, the Commission Nationale de l'Informatique et des Libertés ("CNIL"), located at 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07.

Changes

We may modify this Privacy Policy at any time, in particular to comply with any regulatory, case law, editorial or technical developments. These changes will apply as of the effective date of the modified version. You are therefore invited to regularly consult the latest version of this policy. Nevertheless, we will inform you of any significant change to this privacy policy.

Consultation en Histoire de l’Art