Effective 1st of April 2023

When written with an initial capital letter, the following terms and expressions will be considered as having the meanings attributed to them in the Master Service Agreement for the Upflow Services.

During your use of the website www.upflow.io (hereafter referred to as the “Website”), we may require you to provide us with personal data concerning you, in order to be able to use the Services offered by Upflow.

The term “personal data” refers to all data making it possible to identify an individual, which includes among other things your last name, first name, postal address and e-mail address, telephone number, data concerning your use of the Website, details of your subscriptions, bank details and any other information you choose to provide about you.

The purpose of this charter is to inform you of the means used by us to collect your personal data, in strict compliance with your rights.

During the collection and management of your personal data we comply with law number 78-17, dated 6 January 1978 concerning information technology, data files, and civil liberties in its current version, the so-called “Informatique et Libertés” law and (EU) regulation number 2016/679 of 27 April 2016, from the moment it takes effect (hereafter referred to as the: “GDPR”).

The data controller responsible for the collection of your personal data is the company UPFLOW SAS, a simplified joint stock company registered in the trade & company register of Creteil, France under the number 838 718 328, having its registered office at 5 avenue du Général de Gaulle, 94160 Saint Mandé, FRANCE, represented by Alexandre Louisy, in his capacity of President, and supplying the Services (hereafter referred to in this document as: “Us” or “We”). Upflow SAS is a wholly owned subsidiary of UPFLOW, Inc., a company registered 251 Little Falls Drive, Wilmington, County of New Castle, DE 19808, Delaware, USA under EIN 35-267994. .

The legal basis for the collection of your personal data is as follows:

Your personal data is therefore collected to meet one or several of the following end purposes:

During the collection of your personal data, we will inform you if certain data must obligatorily be entered or if it is optional. The compulsory data is required for the operation of the Services. Regarding the optional data, you are completely free to supply this or not. We also inform you of the possible consequences of any failure to reply.

The following will have access to your personal data:

Your personal data will not be transferred, rented, leased or exchanged to/with third parties.

Your personal data will not be stored any longer than the time strictly necessary to the management of our business relationship with you. However, personal data making it possible to establish proof of a right or a contract, or data that must be stored to ensure compliance with a legal obligation will be stored for the period stated in the applicable law.

Regarding any possible prospection operations targeting Clients, their data may be stored for a period of three years from the end of the business relationship.

Personal data concerning a prospect who is not a client may be stored for a period of three years from the time it is collected or from the last contact initiated by the prospect.

At the end of this three-year period, we may contact you again to find out if you wish to continue receiving sales proposals.

In the event that an individual chooses to exercise their right to access or rectify data, the data concerning ID documents will be retained for the period mentioned in article 9 of the code of criminal procedure, i.e. one year. In the event that an individual chooses to exercise their right to oppose the use of data, this data may be archived for the limitation period mentioned in article 8 of the code of criminal procedure, i.e. three years.

When you subscribe to specific Services offered by Upflow, the banking information concerns all financial data related to your Payment Account or your use of the Services when you have subscribed to the Services proposed by Upflow.

This banking information may be retained for the purpose of providing proof in the event of any disputes concerning a transaction, in intermediate archives, for a period of 13 (thirteen) months from the moment the transaction is recorded in the Payment Account.

Information making it possible to take account of your right of opposition will be stored for a minimum of three years from the moment you exercise your right of opposition.

The retention period for the cookies mentioned in article 10 is 13 months.

We hereby inform you that we take all appropriate organizational and technical measures to protect the security, integrity and privacy of your personal data, which includes preventing it from being deformed, damaged or accessed by unauthorized third parties.

We hereby inform you that your data is retained and stored for its whole retention period on the servers of the company Google Cloud Services, located in Ireland, in the European Union.

Your data will not be transferred outside the European Union during the use of the services we offer.

Cookies are text files, often encrypted, stored in your browser. They are created when the user’s browser loads a given website: the website sends information to the browser which then creates a text file. Whenever the user returns to the same website, the browser recovers this file and sends it to the website’s server.

There are several types of cookies, not all of which serve the same end purpose:

We use technical cookies.

We use social networking cookies. These cookies are only placed in your browser if you grant your consent.

We invite you to consult the privacy policies of the social networking platforms initiating these cookies, to familiarise yourself with the end purposes of the use of the browsing data they may gather via these cookies and the various means of exercising your rights vis-a-vis these social networks.

We use advertising cookies. These cookies are only placed in your browser if you grant your consent.

For all useful purposes, we should remind you that you can oppose the recording of cookies by configuring your browser to refuse them. Such a refusal may however prevent the Website from functioning properly.

Pursuant to law number 78-17 of 6 January 1978 concerning information technology, data files and civil liberties, and the General Data Protection Regulation, you have a right to access and where applicable to rectify or delete the data concerning you, via online access to your file when you subscribe to the Services proposed by Upflow.

In any case, you can contact:

• Postal address: Upflow SAS, 5 avenue du Général de Gaulle 94160 Saint Mandé, France

• E-mail address: [email protected]

You are reminded that the data is collected on the basis of our legitimate interests, as mentioned in article 4, and that at any time they may oppose the processing of the data concerning them. However, we may nevertheless continue the processing operations if legitimate grounds exist for this processing which take precedence over your rights and liberties or if the processing is necessary to establish, exercise or defend our rights before the courts.

You have the right to specify instructions concerning the storage, deletion and communication of your personal data after your death.

These instructions may be general, i.e. they cover all personal data concerning you. In this case they must be recorded with a digital trusted third-party certified by the CNIL (French data protection authority).

The instructions may also be specific, concerning the data processed by our company. In this case, you should send them to us using the above-mentioned contact details.

When you send us such instructions, you expressly grant your consent for these instructions to be stored, transmitted and implemented in accordance with the terms mentioned in this document.

In your instructions, you may appoint a person with responsibility for their implementation. When you are deceased, this person will then be authorized to familiarise him/herself with the said instructions and to request that we implement them. Unless you have designated someone, your heirs will be authorized to familiarise themselves with these instructions and to request that we implement them.

You may modify or revoke your instructions at any time by contacting us using the above-mentioned contact details

You have rights concerning the portability of the personal data you have supplied to us, with this term being understood as referring to the data you have actively and consciously declared when accessing and using the Services, and the data generated by your activities during the use of the Services. We would like to remind you that this right does not concern data collected and processed on another legal basis other than consent or the performance of the contract existing between us.

This right may be exercised free of charge, at any time, including at the time you close your account via the Client Interface, in order to recover and store your personal data.

In implementing this right, we will send you your personal data by any means considered appropriate, in a structured, commonly used and machine-readable format pursuant to the state-of-the-art at the time.

You are also hereby informed that you have the right to submit a complaint to the relevant supervisory authority, (the Commission Nationale Informatique et Libertés for France), in the member state in which you have your normal place of residence, your place of work or the place in which the violation of your rights occurred, if you consider that the processing of your personal data covered by this Charter constitutes a violation of the applicable laws and regulations.

This referral to the supervisory authority may be performed without prejudice to any other referral to an administrative or judicial authority. You also have a right to refer the matter to the administrative or judicial authorities if you consider that the processing of your personal data covered by this Charter constitutes a violation of the applicable laws and regulations.

You have the right to restrict the processing of your personal data in the following cases:

- During the verification period we apply, if you discover that your personal data is inaccurate,

- When the processing of this data is illicit and you wish to limit this processing rather than delete your data,

- When we no longer require your personal data but you would like it to be retained in order to be able to exercise your rights,

- During the verification period concerning legitimate grounds when you have opposed the processing of personal data.

We reserve the right to totally or partially modify this charter at any time at our sole discretion. These modifications will take effect when the new charter is published. Your use of the Website following the application of these modifications constitutes acknowledgment and acceptance of the new charter. Failing this, and if you disagree with his new charter, you must no longer access the Website.

This charter takes effect on the 1st of March 2023.