Personal Data Privacy Policy ARMIS

1. Preamble

ARMIS has developed a technological platform based on artificial intelligence that transforms retailers and brands sales operations (hereinafter the “Advertisers”), initially broadcasted in paper format or other medium, into multilocal advertisements on the internet, and broadcasted optimally around each of the brand’s stores.

ARMIS helps Advertisers to broadcast, through platforms such as Google, Facebook, third party websites or Mobile Applications via Demand-Side Platform type tools (hereinafter the “Third Party Platforms”), relevant advertising for the users of these third-party platforms (hereinafter the “Users” or the “Data subjects”).

ARMIS does not directly process the personal data of the Data subjects during the advertising campaign operation and the broadcasting of multilocal advertisements. Only third-party Platforms collect and process directly the personal data of their Users. ARMIS automatically setups the advertising campaigns on third-party platforms according to predefined criteria (e.g. duration of the campaign, places of distribution, types of products).

Advertising campaigns and associated multilocal advertising are only displayed to Data Subjects who have previously expressed their consent to the collection and processing of their personal data from third-party Platforms. These third-party platforms are responsible for their own processing of personal data and for their compliance with the applicable legislation in this area.

When the User clicks on an advertisement, he is redirected to the websites of the Advertisers or to the websites created by ARMIS on behalf of the Advertisers.

ARMIS subsequently processes the personal data of Users who have previously expressed their consent for this purpose, in order to establish anonymous and aggregated analyzes of the results of advertising campaigns sent to Advertisers.

This information is also used to improve the artificial intelligence solution that ARMIS has developed.

As part of its service:

either ARMIS does not have access to the personal data of Data Subjects which are collected and processed directly and only by third-party Platforms (see paragraph 2.2.1),

or ARMIS only processes personal data that is indirectly identifying and which does not allow profiling of the Persons concerned or their exact identity to be known (see paragraphs 2.2.2 and 2.2.3).

In addition, the data is kept for the maximum period indicated in Article 2.7 hereof.

This personal data privacy Policy (hereinafter the “Policy”) and the cookies policy are made in accordance with the Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the individuals protection with regard to the processing of personal data “General Data Protection Regulation” or “GDPR“) and Act n°78-17 of 6 January 1978 related to computing, files and individual liberties, as amended by Act No. 2018-493 of 20 June 2018 (hereinafter “Loi Informatique et Libertés“).

All concepts used by ARMIS, in this Policy, and which are defined by the GDPR and/or the Loi Informatique et Libertés have the meaning given to them by these legal texts.

2. Data Processing

2.1. Data Subjects

The persons concerned by the processing described in Article 2 are the Users who browse on third-party Platforms and who have consented to the broadcasting of multilocal advertising under the conditions described in Article 2.2.

2.2. Purposes and legal basis of your data processing

2.2.1. Multilocal advertising

The personal data of the Data Subjects is processed in order to provide a multilocal advertising service.

More precisely, ARMIS communicates to Data Subjects information related to products, promotions or events proposed by the Advertisers, in adequacy with the preferences and the proximity of the persons concerned within the shopping areas of the Advertisers, in order to be as close as possible to their tastes.

2.2.2. Analysis of advertising campaigns and statistics

ARMIS also processes indirectly identifying personal data of the Data Subject to establish, only in anonymized and aggregated form, statistics, geomarketing studies and results of advertising campaigns. The results of advertising campaigns are communicated to Advertisers by ARMIS in order to report on the relevance of the products, promotions and events carried out on their behalf to the Persons concerned.

This processing is based on:

– the consent of the Data Subject, as well as

– the legitimate interest of ARMIS and the Advertisers, since it is necessary for them to understand the relevance of advertising campaigns and to identify the means and methods to be implemented to improve it, if necessary.

2.2.3. Improvement of Artificial Intelligence

ARMIS also processes indirectly identifying personal data of Data Subjects, in anonymized and aggregated form, to improve the performance of its artificial intelligence tool. It is by training and improving its artificial intelligence tool that ARMIS is able to deliver relevant adverting to Data Subjects.

This processing has for legal basis the legitimate interest of ARMIS, since it is necessary for the improvement of its software used in its multilocal advertising service.

2.3. Data controllers

Multilocal advertising (§.2.2.1) and analysis of advertising campaigns and statistics (§2.2.2) are carried out by ARMIS and the Advertisers as joint data controllers. The improvement of Artificial intelligence (§2.2.3) is carried out by ARMIS as data controller.

2.4. Contact – Délégué à la protection des données personnelles

For any information concerning the processing of personal data carried out by ARMIS, the Data Subject may address their requests to the attention of the ARMIS Personal Data Protection Officer by e-mail to the address privacy@armis.tech or by post to the following address:

ARMIS

Data protection officer

21 rue de Cléry, 75002 Paris, France

The Data Subject may establish contact with Advertisers or Third Party Platforms via the contact details they provide in their own personal data privacy policies.

2.5. Categories of data concerned

Personal data processed by ARMIS for Analysis of advertising campaigns and statistics (§2.2.2) and Improvement of Artificial Intelligence (§2.2.3) are:

– IP address information

– Geolocation information (latitude and longitude)

– Cookies

– Information about the unique device identifier or IMEI

2.6. Recipients of the data

As part of the processing described in paragraphs 2.2.2 and 2.2.3, ARMIS is required to entrust the hosting and storage of data to subcontractors specializing in data hosting services.

2.7. Data Retention

For the processing of multilocal advertising (§2.2.1)), no retention period specific to ARMIS is implemented, since ARMIS does not have direct access to this data. To find out the retention periods defined by the Third-Party Platforms, the data subject is invited to read the data protection policies of the Third-Party Platforms.

For the processing described in paragraphs 2.2.2 and 2.2.3, the personal data stored by ARMIS is kept for the following periods:

Lat/Long	Anonymization and deletion of raw data 15 days after collection
IP adress
device ID	6 months
Cookies	6 months

3. Common provisions

3.1. Data subjects’ rights

Each individual has a right of access, rectification, deletion, limitation, opposition, portability of his/her data, or withdrawal of his/her consent under the conditions and limits provided by the GDPR and the loi Informatique et Libertés.

The data subject may exercise his/her rights at any time by contacting the person whose data appear in Article 2.4.

In the event that the Data Subject exercises his/her rights with ARMIS, given ARMIS’s choice to set up a very short anonymization period for the data from their collection and the fact that in one case ( cf. §2.2.1) ARMIS does not have access to the data, ARMIS will not be able to respond favorably to requests that may be made to it, except in the event that it is able to identify the Data Subject in the context of the processing. implemented.

For the sake of confidentiality and the protection of personal data, ARMIS will ask the Data Subject to identify themselves in order to respond to their request. For this, he/she may be asked to attach to his/her application, a copy of an official identity document, such as a valid identity card or passport.

All requests will be processed in a timely manner and in compliance with applicable regulations.

In case of dispute regarding the data use, the individual has the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés

3.2. Data transfer outside the European Union

Some personal data may be transferred outside of the European Union. These transfers are based on adequacy decisions within the meaning of article 45 of the GDPR, framed by appropriate guarantees within the meaning of article 46 of the GDPR such as standard contractual clauses or ad hoc protection adopted by the European Commission, or by binding corporate rules (or BCR for Binding Corporate Rules) within the meaning of article 47 of the GDPR.

3.3. Updates

ARMIS may modify this Policy periodically.

The data subject will be informed of the modification by any means such as: email, notification on the ARMIS website, or on one of the sites published by ARMIS for Advertisers when the Data subject is redirected to one of them. The current version of the Policy is always accessible on request to the ARMIS Data Protection Officer at the contact details provided in Article 2.4.